[asto18089]

Summary

Deleting an automation dropped its terminal run history. delete_automation now refuses while any run is queued or running — an in-flight occurrence has already crossed the admission boundary, so its definition and run binding must stay intact for recovery to settle it. This deliberately reverses the previous behavior of retaining queued/running receipts through deletion; the old contract's guarantee (recovery can neither lose nor repeat the occurrence) is preserved in strictly stronger form, because the definition itself now survives until the receipt settles.

Once settled, completed/failed/canceled runs move under <root>/archive/<automation_id>/ before the live paths are removed (atomic writes, crash-safe: a half-completed delete loses nothing and a retry is idempotent), bounded to the newest 50 per automation by ended_at (falling back to created_at). The archive tree sits beside automations/, runs/, and triggers/, invisible to listings, pending-run recovery, and scheduler scans; list_archived_runs serves it via a new archived query flag on the existing runs endpoint (absent flag = unchanged behavior, #[serde(default)]).

Two existing tests were rewritten for the new contract: deletes_definition_and_settled_runs_but_retains_unfinished_receipts (now delete_refuses_active_receipts_then_archives_settled_runs) and reconciliation_reaches_old_runs_and_runs_of_deleted_definitions (the deleted-definition recovery leg is unreachable by design now; the get-runs-past-window coverage is preserved). The orphan-receipt path (finish_scheduled_run_persists_run_when_automation_deleted_mid_enqueue) is unchanged and still passes.

Disclosures: the refusal check and archive writes run inside the same exclusive transaction/lock as the delete (claim-vs-delete is serialized — no check-then-enqueue window), so a very large run history extends the lock hold; bounded today at 50 archived runs per automation. The include-suppressed half of the active-run scan is defensive: a suppressed active run is not reachable today (suppression is only persisted with a terminal status). Known follow-up: the TUI delete receipt still says "recorded runs deleted: {run_count}", which reads oddly once runs are archived instead of dropped — wording follow-up.

Testing

• cargo test -p codewhale-tui --lib automation_manager — refuse-while-active (visible queued runs at all three dispatch sites), archive contents and ordering, the 50-run retention bound with exact dropped-set assertions, scheduler-scan isolation after delete, and the reconciliation/settle-then-delete flow
• cargo clippy -p codewhale-tui --all-targets --all-features --locked
• cargo fmt --all -- --check

Adapted from the Pinvou fork's automation run-archiving work (Pinvou/CodeWhale branch upstream/u8-run-archive, commit 6e1bc9324), re-derived onto the current automation manager (upstream's ensure_safe_storage_id / atomic-write / delete-refusal idioms).

Checklist

• Updated docs or comments as needed
• Added or updated tests where relevant
• No CHANGELOG.md changes

No-Issue: Retain completed automation history when its definition is deleted.