Remote Orca Server removal can orphan descendants and discard retry state

[ruigomeseu]

Summary

Removing a running worktree through a paired Remote Orca Server can partially tear down the terminal, fail filesystem deletion with Directory not empty, and still remove Orca's workspace metadata. Child processes, generated files, and external routes can remain, but the worktree can no longer be targeted for a retry because Orca returns selector_not_found.

This is a Remote Orca Server project whose repository is local to the Linux server, not an SSH-backed repository. It appears distinct from #2656.

Environment

• macOS Orca client 1.4.137
• Paired headless Orca runtime on Linux
• Long-running Vite development server launched through Turbo and Portless
• Portless exposing the application through Tailscale Serve

Steps to reproduce

1. Pair the desktop client with a Linux Remote Orca Server.

2. Register a repository that is local to that server.

3. Create an Orca worktree and start a long-running development command in an Orca terminal. The command should include a child that writes cache files inside the worktree while running; Vite writing .vite reproduced this reliably.

4. Confirm the application is serving.

5. Remove the worktree normally while the development terminal is still running. The CLI equivalent used for the reproduction was:

   orca worktree rm --environment <remote> --worktree <selector> --force --json

Actual behavior

The removal returned:

Failed to force delete worktree at /path/to/worktree. error: failed to delete '/path/to/worktree': Directory not empty

Afterward:

• The Portless parent process was gone, but Turbo, Vite, and esbuild descendants were still running.
• Vite recreated a .vite directory after deletion had begun, leaving the worktree directory behind.
• The Tailscale Serve route remained registered even though its listener was gone.
• The worktree branch remained.
• Orca had already removed its workspace metadata. A second removal attempt returned selector_not_found, so cleanup could not be retried through Orca.

Expected behavior

• Orca should stop the full process tree and wait for descendants to exit before deleting the filesystem path.
• If filesystem or Git removal fails, Orca should preserve enough workspace metadata to retry or surface a cleanup action.
• A failed removal should not leave background processes or external routes behind.

Workaround

A committed orca.yaml archive hook that sends an interrupt to the development terminal and waits for its shell to regain control prevents the race. With the hook explicitly enabled (--run-hooks in the CLI), the same remote test removed all processes, the listener, Tailscale Serve configuration, directory, and branch successfully.