feat(desktop,host-service): tombstone workspace deletes + kanban board view for the workspaces page - #6296

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In
`@apps/desktop/src/renderer/hooks/host-workspaces/useHostWorkspaces/useHostWorkspaces.ts`:
- Around line 275-283: Update the archived data mapping in useHostWorkspaces so
hostReachable reflects the corresponding archivedQueries[index] error state
instead of always being true. Reuse the same reachability derivation used by the
live-query path, while preserving the existing archived row filtering and
mapping behavior.
- Around line 173-196: Update the isReady calculation in useHostWorkspaces to
include settlement of every enabled query in archivedQueries when
includeArchived is true. Treat disabled archived queries as already settled,
preserve rendering of any live or archived data already available, and keep the
existing readiness behavior when archived data is not requested.

In
`@apps/desktop/src/renderer/routes/_authenticated/_dashboard/components/DashboardSidebar/hooks/useDashboardSidebarShortcuts/useDashboardSidebarShortcuts.ts`:
- Around line 61-69: Update useDashboardSidebarShortcuts and its callers to
receive the in-flight deletion workspace IDs, then filter those IDs out of
flattenedWorkspaces before generating shortcut targets. Ensure
JUMP_TO_WORKSPACE_*, PREV_WORKSPACE, and NEXT_WORKSPACE cannot navigate to
workspaces pending deletion.

In
`@apps/desktop/src/renderer/routes/_authenticated/_dashboard/v2-workspaces/page.tsx`:
- Around line 95-143: Update the synchronization around hydratedRef and the
useEffect in the v2 workspaces route so changes to Route.useSearch() reapply all
URL filter values to useV2WorkspacesFilterStore before the store-to-URL
navigation can overwrite them, while preserving initial hydration behavior. Add
a route test covering same-route navigation between /v2-workspaces URLs with
different filters and verify the store and resulting URL remain synchronized.

In `@packages/host-service/src/runtime/archived-workspace-reconcile.ts`:
- Around line 35-44: Update the stranded-workspace teardown flow around
selectStranded and destroyWorkspace to revalidate ownership of each
row.worktreePath in the same serialized critical section as teardown. Prevent
force deletion when a live workspace claims the path between the initial
livePaths snapshot and cleanup, preferably by using an atomic path claim or a
cleanup guard inside destroyWorkspace; abort cleanup for paths owned by another
live row.

In `@packages/host-service/src/runtime/pull-requests/pull-requests.ts`:
- Around line 484-486: Update syncWorkspaceRow so its workspace update predicate
requires archivedAt IS NULL, preventing writes to archived tombstones even when
archival races with readWorkspaceRefs. Only refresh the project after the
conditional update reports success, and add a race test that archives the
workspace while readWorkspaceRefs is blocked.

In `@packages/host-service/src/trpc/router/project/project.ts`:
- Around line 842-853: Update the local workspace cleanup query in the project
deletion flow to include archived rows so their existing worktrees are removed
before the project cascade; remove the isNull(workspaces.archivedAt) filter
while preserving the projectId restriction. Add a test covering an archived
workspace with a still-existing worktree and verify it is cleaned up before
deletion.

In
`@packages/host-service/src/trpc/router/workspace-cleanup/workspace-cleanup.ts`:
- Around line 462-469: Update the phase label in the comment above the local
commit remainder logic near deleteLocalWorkspace to reference step 1.5 instead
of step 0.5, matching the archive phase documentation elsewhere.
- Around line 313-323: Update the rollback condition around marked,
archiveLocalWorkspace, and unarchiveLocalWorkspace so rollback occurs only when
the workspace row was live before this attempt. Capture whether local.archivedAt
was unset before archiving, use that state to gate the catch-block unarchive,
and preserve existing behavior for newly archived rows while never clearing a
pre-existing tombstone.

In `@packages/host-service/test/archived-workspace-reconcile.test.ts`:
- Around line 1-2: Move the unit test from the archived workspace reconciliation
test location to sit beside the source file containing selectStranded. Preserve
the existing test coverage and imports, adjusting only relative paths as needed
so the co-located test directly exercises selectStranded.

---

Nitpick comments:
In
`@apps/desktop/src/renderer/routes/_authenticated/_dashboard/v2-workspaces/components/V2WorkspacesBoard/components/V2WorkspacesBoardCard/V2WorkspacesBoardCard.tsx`:
- Around line 6-12: Move the ChecksDot component out of
V2WorkspacesBoardCard.tsx into components/ChecksDot/ChecksDot.tsx, add the
corresponding index.ts barrel export, and import ChecksDot from that barrel in
V2WorkspacesBoardCard.tsx while preserving its current behavior and props.

In
`@apps/desktop/src/renderer/routes/_authenticated/_dashboard/v2-workspaces/components/V2WorkspacesList/components/V2WorkspaceRow/V2WorkspaceRow.tsx`:
- Around line 69-71: Update the V2WorkspaceRow delete-dialog lifecycle so
deleteDialogMounted is cleared when onOpenChange receives a normal false close,
releasing the dialog and its live-query subscription after cancellation.
Preserve the latch only while teardown is in progress and may need to reopen the
dialog, including the existing force-delete recovery path.

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="packages/host-service/src/trpc/router/workspace-creation/shared/adopt-existing-worktree.ts">

<violation number="1" location="packages/host-service/src/trpc/router/workspace-creation/shared/adopt-existing-worktree.ts:123">
P1: Recreating a branch after deletion can return its archived workspace as an existing workspace, skipping adoption/creation. Filter tombstones from `findExistingWorkspaceByBranch` so this new live-only lookup behavior remains consistent through the earlier idempotency checks.</violation>
</file>

<file name="apps/desktop/src/renderer/routes/_authenticated/_dashboard/v2-workspaces/components/V2WorkspacesList/components/V2WorkspaceRow/V2WorkspaceRow.tsx">

<violation number="1" location="apps/desktop/src/renderer/routes/_authenticated/_dashboard/v2-workspaces/components/V2WorkspacesList/components/V2WorkspaceRow/V2WorkspaceRow.tsx:378">
P3: Cancelling a delete permanently mounts this row’s delete-dialog hook tree; opening and cancelling dialogs across a large workspace list accumulates hidden components that rerender with shared host/preference context. Preserve the latch only while a destroy is in flight or a teardown failure must be recoverable, then clear it on an ordinary close.</violation>
</file>

<file name="apps/desktop/src/renderer/routes/_authenticated/_dashboard/v2-workspaces/components/V2WorkspacesHeader/V2WorkspacesHeader.tsx">

<violation number="1" location="apps/desktop/src/renderer/routes/_authenticated/_dashboard/v2-workspaces/components/V2WorkspacesHeader/V2WorkspacesHeader.tsx:199">
P3: An active project filter loses its visible label when the search query excludes that project's options, so the trigger incorrectly says “All projects” although filtering remains active. Preserve selected projects from `projectsById` in the options/trigger label independent of search results.</violation>
</file>

<file name="packages/host-service/src/app.ts">

<violation number="1" location="packages/host-service/src/app.ts:258">
P0: A workspace recreated after the reconcile path snapshot can have its worktree deleted: the reconciler selects an archived row, creation registers a live row at that path, then the queued destroy removes that shared path. Revalidate live-path ownership atomically/immediately before each destroy (or serialize creation and reconciliation by path).</violation>
</file>

<file name="packages/host-service/src/runtime/pull-requests/pull-requests.ts">

<violation number="1" location="packages/host-service/src/runtime/pull-requests/pull-requests.ts:432">
P2: The periodic sweeps materialize every permanent tombstone before filtering, so refresh cost grows with deletion history. Filter `archived_at IS NULL` in SQL and update the test fakes to support the predicate.</violation>
</file>

<file name="packages/host-service/src/runtime/archived-workspace-reconcile.ts">

<violation number="1" location="packages/host-service/src/runtime/archived-workspace-reconcile.ts:26">
P1: A live workspace using a symlink-equivalent path can be treated as stranded and deleted at startup because `livePaths` compares raw strings while cleanup canonicalizes paths. Normalize both archived and live paths before ownership comparison.</violation>

<violation number="2" location="packages/host-service/src/runtime/archived-workspace-reconcile.ts:35">
P1: A user-created worktree reusing a permanent tombstone's path is deleted on the next host restart before it can be imported, since DB ownership is the only safety check. Reconcile only a checkout provably belonging to the interrupted delete, using a durable deletion marker/identity rather than path existence alone.</violation>
</file>

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@packages/host-service/test/workspace-cleanup.test.ts`:
- Line 708: Move the unit tests from workspace-cleanup.test.ts beside the
workspace-cleanup router implementation, preserving their contents and test
behavior. Keep only cross-cutting integration tests under the host-service
test/integration directory.

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="packages/host-service/src/trpc/router/workspace-cleanup/workspace-cleanup.ts">

<violation number="1" location="packages/host-service/src/trpc/router/workspace-cleanup/workspace-cleanup.ts:315">
P2: A corrupt session path outside the managed root now reports deletion success while leaving its folder and an archived, name-claiming tombstone; treat the skipped folder removal as a cleanup failure so the outer handler unarchives it for retry.</violation>
</file>

<file name="plans/done/20260809-1015-workspace-tombstones-kanban-board.md">

<violation number="1" location="plans/done/20260809-1015-workspace-tombstones-kanban-board.md:87">
P3: The new decision-log entry reverses the session exemption (sessions now tombstone on delete), but the rest of this plan still documents the opposite: Big Picture ("Sessions... are exempt and keep today's hard delete"), Milestone 2 steps 1/3 ("for non-session workspaces only" / "for sessions keep deleteLocalWorkspace (hard delete, unchanged)"), the Tests and Validation checklists ("session destroy still hard-deletes the row"), and Outcomes ("sessions still hard-delete"). A reader reconciling the reversed decision against the plan's operational steps will get conflicting instructions about the destroy pipeline. Please propagate the reversal to the affected sections so the plan is internally consistent.</violation>
</file>

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In
`@apps/desktop/src/renderer/routes/_authenticated/_dashboard/v2-workspaces/components/V2WorkspacesBoard/components/V2WorkspacesBoardCard/V2WorkspacesBoardCard.tsx`:
- Around line 123-136: Update ChecksDot so every status has an accessible name:
render a visually hidden “No checks” label for “none”, and add visually hidden
labels identifying pending, successful, and failed checks alongside their icons.
Preserve the existing icon and styling for each non-none status.

---

Nitpick comments:
In
`@apps/desktop/src/renderer/routes/_authenticated/_dashboard/v2-workspaces/components/V2WorkspacesBoard/components/V2WorkspacesBoardCard/V2WorkspacesBoardCard.tsx`:
- Around line 41-50: Split V2WorkspacesBoardCard, BoardCardBody, and ChecksDot
into separate ComponentName/ComponentName.tsx files, preserving their existing
behavior and imports; add an index.ts barrel export for each component and
update consumers/imports accordingly. Run bun run lint:fix, then confirm bun run
lint succeeds.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@packages/host-service/src/trpc/router/project/project.ts`:
- Around line 843-853: Prevent duplicate workspace deletion telemetry during
project removal: in the cleanup loop handling localWorkspaces, ensure archived
rows with surviving worktrees are purged without invoking the telemetry-emitting
deleteLocalWorkspace path, or suppress telemetry when archivedAt is non-null
while preserving normal cleanup for live rows. Add a regression test covering
removal of a project containing an archived workspace whose worktree still
exists.

---

Outside diff comments:
In
`@apps/desktop/src/renderer/routes/_authenticated/_dashboard/v2-workspaces/page.tsx`:
- Around line 184-191: Update the isEmptyDashboard condition in the dashboard
page to use all.length === 0 instead of liveWorkspaces.length === 0, so
archived-only boards continue rendering their Deleted or Merged columns while
genuinely empty dashboards still show the create screen.

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/desktop/src/renderer/routes/_authenticated/_dashboard/stores/deletingWorkspacesStore/deletingWorkspacesStore.ts">

<violation number="1" location="apps/desktop/src/renderer/routes/_authenticated/_dashboard/stores/deletingWorkspacesStore/deletingWorkspacesStore.ts:12">
P2: Overlapping delete flows can clear the shared ID before teardown finishes, re-enabling shortcuts/navigation to a workspace still being destroyed. Track an in-flight count per ID (or ownership tokens) and remove it only when the final flow settles.</violation>
</file>

<file name="apps/desktop/src/renderer/routes/_authenticated/_dashboard/components/DashboardSidebar/hooks/useDashboardSidebarShortcuts/useDashboardSidebarShortcuts.ts">

<violation number="1" location="apps/desktop/src/renderer/routes/_authenticated/_dashboard/components/DashboardSidebar/hooks/useDashboardSidebarShortcuts/useDashboardSidebarShortcuts.ts:73">
P1: Prev/next shortcuts can still navigate into a workspace mid-destroy because the workspace page's concurrent handlers bypass this filtered list. Have those handlers consult `deletingIds` (or consolidate the bindings) so every shortcut target excludes in-flight deletes.</violation>
</file>

<file name="packages/host-service/src/trpc/router/workspace-cleanup/workspace-cleanup.ts">

<violation number="1" location="packages/host-service/src/trpc/router/workspace-cleanup/workspace-cleanup.ts:329">
P2: A repeated destroy of an already archived workspace emits `workspace_deleted` again, contradicting the once-per-delete telemetry contract. Gate tracking on `local.archivedAt === null` from the pre-archive row so completed retries do not double-count.</violation>
</file>

<file name="packages/host-service/src/trpc/router/project/project.ts">

<violation number="1" location="packages/host-service/src/trpc/router/project/project.ts:853">
P2: Deleting a project leaves archived cards whose worktree is already gone visible on an open board for up to 30 seconds, because these rows are cascade-deleted without a `workspace:changed` event. Keep all project rows for the per-row `deleteLocalWorkspace` loop, while using a separate filtered set only for Git worktree cleanup.</violation>
</file>

<file name="apps/desktop/src/renderer/routes/_authenticated/_dashboard/v2-workspaces/page.tsx">

<violation number="1" location="apps/desktop/src/renderer/routes/_authenticated/_dashboard/v2-workspaces/page.tsx:126">
P1: Copied URLs that omit default filters do not reproduce the sender's view when the receiver has prior non-default store state; e.g. `?view=board` retains `archived=all` instead of the sender's default week. Encode defaults in shareable URLs or add an explicit navigation signal that resets omitted fields for deep links while preserving bare sidebar navigation.</violation>
</file>