# Dependency-Aware Cleanup

Cleanup is plan-first and dry-run by default. A `LifecycleCleanupPlan` records the exact object,
dependency graph, digest, reclaimable bytes, retention state, blockers and proposed action.

Artifact-set checks cover active locations, derived artifacts, candidates, profiles, execution and
production approvals, capability deployments/routes, project bindings, evaluation runs, embedding
spaces/migrations, lifecycle evidence and retention. Location checks distinguish one node-local copy
from remaining copies. Database foreign keys use `RESTRICT`; there are no hidden destructive
cascades.

Execution requires an operator credential and explicit confirmation, re-resolves the graph and
compares its digest. Changed dependencies make the plan `STALE`; active dependencies or retention
return typed 409 conflicts. ModelForge records a location removal only after the typed storage action
confirms physical completion. Retrying after a crash reconciles the same plan; removal records retain
prior status, digest, size, actor and time. Model, revision, hashes, evaluation, deployments and audit
are never erased by binary-location cleanup.

M13 dependency discovery also reports `MIGRATION_PLAN_SOURCE` and `MIGRATION_PLAN_TARGET` when an
artifact set appears in an active plan identity or a retained rollback snapshot. The execution-time
digest recheck prevents cleanup racing a newly planned migration.

## Node lifecycle extension

Node decommission applies the same fail-closed principle to compute infrastructure. Its preview
enumerates blockers, current truth to remove and provenance to retain; execute repeats that graph
under transaction locks and has no force override. See `NODE_DECOMMISSION.md`.