[Eli Pinkerton (wallstop)]

Summary

• run cleanup classification for every acquire outcome eligible for release
• normalize missing/partial proof to schema-valid unknown evidence
• preserve inherited runner quarantine across pre-build head rejection
• require the exact confirmed cleanup tuple before the Windows canary can pass
• pin the complete lifecycle contract in RC014 with data-driven failure/cancellation cases

This follows up on the late Cursor Bugbot finding in #10: #10 (comment)

Validation

• actionlint (workflow parse; optional external linters unavailable locally)
• RC001–RC019, including Git Bash opt-in
• Windows resource-proof/classifier and activation retry suite
• workflow-policy tests (10/10)
• Vitest (365 passed, 2 skipped)
• TypeScript typecheck
• changed-file formatting and git diff --check
• lint (17 existing warnings, 0 errors)

---

Note

Medium Risk
Changes affect organization Unity lock release and runner quarantine semantics; incorrect classification could block CI or mis-report license seat safety, but scope is CI scripts and workflow only.

Overview
Tightens Windows Unity lock lifecycle so release always carries schema-valid cleanup evidence and the canary cannot pass on partial proof.

Cleanup classification now runs whenever acquire is release-eligible (success, failure, or cancelled—not only success). The classifier takes quarantine-recovered from lock acquire: pre-build head rejection counts as cleanup-confirmed only when no same-runner quarantine was inherited; quarantine recovery or missing recovery evidence yields cleanup-evidence-unknown instead of falsely confirming safety.

Lock release maps classifier output to typed schema-5 fields: resource-cleanup-status is confirmed only for the (resource-safe=true, resource-reason=cleanup-confirmed) tuple; resource-reason is normalized to cleanup-confirmed, return-missing-positive-evidence, or cleanup-evidence-unknown. The post-release verify step requires both CLEANUP_RESOURCE_SAFE and CLEANUP_RESOURCE_REASON=cleanup-confirmed.

Tests/contracts: test-windows-resource-proof.ps1 adds quarantine/cancelled-head cases; RC014 in verify-resource-cleanup-contract.mjs pins the new workflow env, release expressions, and verify script checks.

^{Reviewed by Cursor Bugbot for commit baaf8d3. Bugbot is set up for automated code reviews on this repo. Configure here.}

[Eli Pinkerton (wallstop)]

Cursor (@cursor) review
@copilot review

Please review the exact head ea5704787d29abecd1d27361dcc26f23cf02af4b, including acquire failure/cancellation, inherited quarantine, partial classifier outputs, and the final proof tuple.

[Eli Pinkerton (wallstop)]

Exact head ea5704787d29abecd1d27361dcc26f23cf02af4b is now ready and all CI checks are green.

Cursor (@cursor) review
@copilot review

Please provide final review of the ready PR.

[Eli Pinkerton (wallstop)]

Cursor (@cursor) review
@copilot review

Please review exact head baaf8d3; the latest commit parenthesizes every cleanup mapping branch explicitly and RC014 pins the unambiguous expressions.

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit baaf8d3. Configure here.}