@bongos/core 1.19.728 → 1.19.730

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.728",
-  "core_contract": "1.19.728",
-  "source_commit": "06378fe68686262687d6c0a9220a171349fd08c8",
+  "core_version": "1.19.730",
+  "core_contract": "1.19.730",
+  "source_commit": "3f93cfa0217ede14fe7949d98ed1e298cfc0bf17",
   "source_ref": "HEAD",
-  "built_at": "2026-09-13T15:07:36.492Z",
+  "built_at": "2026-09-13T15:24:59.913Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 477,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2602,
-  "tree_sha256": "92181bc6b8bf6edd84603371fa1dff3a7634795709dca0232d22f40c2d105589",
+  "tree_sha256": "262b2dd98348643b71dddab54d3637811bfcc13b336b0e48a2e2e516c16152c3",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -272,7 +272,7 @@
     {
       "path": ".claude/skills/worktree-clean/SKILL.md",
       "mode": "0000644",
-      "sha256": "a51d79d257e7d502dc9becbd2f45e05af881b840ee287ce0e450ebb64a93dec4"
+      "sha256": "4819fe448f4e35c3c7c3f4784718d51a7a4469f3c644d1b6c57b693b79da129e"
     },
     {
       "path": ".devcontainer/Dockerfile",
@@ -1237,7 +1237,7 @@
     {
       "path": "docs/adr/0151-governance-permissions-as-atom-ranks-as-roles.md",
       "mode": "0000644",
-      "sha256": "fe05aa8c4719600b299a638a85ce39b4b6d75b7fc78d58151e9c92cb91825a2e"
+      "sha256": "0ad167bf535aab268bfedece8339cfcf315d85d264028d403ca2c889b6044fe2"
     },
     {
       "path": "docs/adr/0152-landing-gate-served-by-the-core-app.md",
@@ -2482,7 +2482,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "aae40418a50dbacd171155a580656c0ff09acdd3ee5a32ff5056dd810f928d92"
+      "sha256": "73560b927b992fc1fdebf584b70d7ead444303708c64d76f38acb34f9cd01212"
     },
     {
       "path": "docs/modules-contract.md",
@@ -2747,7 +2747,7 @@
     {
       "path": "docs/recipes/windows-builders.md",
       "mode": "0000644",
-      "sha256": "6760a34d404aa68c61896983c8aa621bd26244e5c98ed056045b3467359c4b53"
+      "sha256": "eef830271b0e77a161c61759970346b63730d3e6049b4944d24586abadb843de"
     },
     {
       "path": "docs/recipes/work-on-a-task-from-your-dev-box.md",
@@ -4362,7 +4362,7 @@
     {
       "path": "modules/government/protected-surfaces.json",
       "mode": "0000644",
-      "sha256": "2a6c392d4499498f0e0fb80c80002ba9d82a3f5e66e48cce9802c21c276af2a0"
+      "sha256": "ec125c2bfba680c7645dda0b65dd6ece183dd57ceecdb5616ea2b8b34b776e56"
     },
     {
       "path": "modules/government/ranks.js",
@@ -7512,12 +7512,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "98647626d77d3752e83cb85506424f53b3bc829592fad02cabd79d7890d62cea"
+      "sha256": "9ae46f748e2463accb302101f1ee604ba32234081a73959da3d0d2e144e86390"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "d184aeeeed9d18bf8d0d0ea577bdce3c578ed9b2c483413f93ee96341de5f9d7"
+      "sha256": "7210ef7cb81f359b560b4b1a0bacb86fd42ee0d48d51150e53af53e7b7fb4d7b"
     },
     {
       "path": "public-docs/index.html",
@@ -8822,7 +8822,7 @@
     {
       "path": "scripts/gds/stale-worktrees.js",
       "mode": "0000644",
-      "sha256": "40c5ef66ef5efc3754da367e64604af765d2e595986fc7af1af10f793d1a57e0"
+      "sha256": "b615f8cdf4b1e74d997fff9e8eaa7f5c77276eefaa02f1a0c0becd80f8697620"
     },
     {
       "path": "scripts/gds/start.js",
@@ -8907,7 +8907,7 @@
     {
       "path": "scripts/gds/worktree.js",
       "mode": "0000644",
-      "sha256": "af95d7ae434d587dae654e24640163c44ac293edb11d2c0deb979b855701ac85"
+      "sha256": "69f167d079c1900568f740d8d4a1a2288f5ff47146634209f8a1a9350a3aa5e2"
     },
     {
       "path": "scripts/hall-preview/README.md",
@@ -9317,7 +9317,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "12f533b8bd9218fb6820687062fc5e6e417ec51dc2dce5bcda46f4d6c55e4454"
+      "sha256": "e16770f57d46b5ef94d4b98477943b7bff414b7a499081a338fd49709ccf6241"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10807,7 +10807,7 @@
     {
       "path": "tests/government_protected_surfaces.mjs",
       "mode": "0000644",
-      "sha256": "dfde7ca6e223324317a0d56960db7adc9b30bdfc35f718269e9d6978344545ac"
+      "sha256": "25d8b1851872230a189dcaf04a82a769c1bc8b285540bce3eaed6159790edf4c"
     },
     {
       "path": "tests/government_rank_sync.mjs",
@@ -12647,7 +12647,7 @@
     {
       "path": "tests/stale_worktrees.mjs",
       "mode": "0000644",
-      "sha256": "e003d6391d14212198c0e55494190e702adc0a27c2820362afe3d676c67a4963"
+      "sha256": "97ca351bc03b3d56b99239739818c11fea384691ee597b54a0c4bef60be196f6"
     },
     {
       "path": "tests/start_env_guard.mjs",
@@ -13017,7 +13017,7 @@
     {
       "path": "tests/worktree_helper.mjs",
       "mode": "0000644",
-      "sha256": "9d511e7cf21cea05cc565e9e5022c7c86cd3cf0d67053125ec27aeae3348e30a"
+      "sha256": "cac88e36d1e2ef2cbe2799275186f0787431b5b636fc52d1325b5dbbfcd56368"
     },
     {
       "path": "tests/world_tokens.mjs",

package/.claude/skills/worktree-clean/SKILL.md

@@ -1,27 +1,29 @@
 ---
 name: worktree-clean
 description: >-
-  Remove per-claim worktrees whose work already landed, via the junction-safe worktree.js remove — never raw git worktree remove, which follows the node_modules junction. Triggers: "/worktree-clean", "prune stale worktrees", or the SessionStart line "Stale worktrees: N".
+  Remove per-claim worktrees whose work landed, and sweep the husks a locked remove leaves, via junction-safe worktree.js — never raw git worktree remove, which follows the node_modules junction. Triggers: "/worktree-clean", "prune stale worktrees", "worktree husks".
 ---
 
 **Script skill (authoritative).** Two scripts do the work; this skill only sequences them and shows the list before anything is removed.
 
 ## What this skill does
 
-1. `node scripts/gds/stale-worktrees.js` — the list. A worktree is **stale** when its branch is an ancestor of `origin/main` (the land happened) or the branch is gone (the ship deleted it). Detached worktrees and unmerged branches are **live** and never touched. Run `git fetch origin` first so "merged into main" reflects today's main, not the last fetch.
+1. `node scripts/gds/stale-worktrees.js` — the list. A worktree is **stale** when its branch is an ancestor of `origin/main` (the land happened) or the branch is gone (the ship deleted it). Detached worktrees and unmerged branches are **live** and never touched. Run `git fetch origin` first so "merged into main" reflects today's main, not the last fetch. The same call also names **husks** — directories under `.claude/worktrees/` that git does not list as worktrees at all (step 6).
 2. Show the stale list to the builder (names + why). The worktree holding the **current claim** is never stale by construction (its branch is unmerged), but say so if the builder asks.
 3. For each stale name: `node scripts/gds/worktree.js remove <name>`. That helper unlinks any node_modules junction BEFORE `git worktree remove`, which is the whole reason raw git is off-limits here (learning in `scripts/gds/CLAUDE.md` → "Gotchas / invariants"; the `git-guard.js` PreToolUse hook blocks the raw form).
    - A worktree with untracked leftovers (`.playwright-mcp/`, a stray screenshot) refuses without `--force`. Show the `git -C <path> status --porcelain` output; if it is only untracked junk, re-run with `--force`. If it shows **modified tracked files**, skip it and report — someone's uncommitted work is not this skill's to delete.
 4. `git worktree prune` — clears any registrations whose directory is already gone.
 5. Print the tally: removed / skipped (with why) / still live. Stale branches stay — a merged branch is harmless and `git branch -d` is the ship's business, not a cleanup chore.
+6. `node scripts/gds/worktree.js prune-husks` — the **husks**: directories still under `.claude/worktrees/` that git no longer lists. They are the residue of an OneDrive-locked `git worktree remove`, which deregisters the worktree but cannot delete the directory (task 1002594). Nothing else can see them: a deregistered husk is absent from `git worktree list`, which is all step 1's stale scan reads. The sweep deletes only an **empty** husk that this session is not standing in and that has not been touched in 24h — the harness parks live session directories in the same folder and a fresh one looks exactly like residue. It prints the reason for every skip; `--force` waives only the 24h rule.
 
 ## Safety
 
 - Read-only until step 3; the list is shown first.
 - Never `--force` over modified tracked files.
 - Never deletes branches, never touches the primary checkout, never calls `git worktree remove` directly.
+- The husk sweep uses `rmdir`, never a recursive delete: a husk that gained files between the check and the call is refused by the filesystem, not emptied.
 - No claim is needed: worktrees are local machine state, not project state — nothing here is committed.
 
 ## Calls
 
-`node scripts/gds/stale-worktrees.js [--json]` · `node scripts/gds/worktree.js remove <name> [--force]` · `git worktree prune`.
+`node scripts/gds/stale-worktrees.js [--json]` · `node scripts/gds/worktree.js remove <name> [--force]` · `node scripts/gds/worktree.js prune-husks [--force]` · `git worktree prune`.

package/docs/adr/0151-governance-permissions-as-atom-ranks-as-roles.md

@@ -79,6 +79,8 @@ This is the pillar that keeps configurability from becoming a foot-gun, and it h
 
 **The protected-surface registry.** Today's rank→surface map — `PROTECTED_GLOBS` + the per-tier `EXPECTED_RANKS` — is baked into code (`src/bongos/permission-path-check.js`). Governance takes ownership of it **as data**: which paths are protected, and at what floor, becomes a governance-owned registry. The **out-of-band substrate stays the enforcer** — the pre-push hook, the grader pre-pass, `main-audit.js`, `gate-review.js`, and the goal-scope check *read the registry* instead of a hardcoded list, but enforcement never moves into the app. The Metic floor and the `system`-permission mapping *flow from* the registry. The registry (R101) is also the moment to **close the [ADR 0087](0087-compete-on-governance-not-tooling-cursor.md) §3 path-matching gap** the sweep confirmed: `permission-path-check.js`'s `normalize()` does backslash→slash + strip-`./` only — **no case-folding and no Unicode normalization** — so a case-varied or homoglyph path evades the protected-glob match (Linux-deployed, so latent today, but it is the Cursor-class `.cursorignore`/case-bypass CVE shape). The registry matcher should normalize (case-fold + Unicode NFC) and gate file **creation** as strictly as edits.
 
+**Amendment, 2026-09-13 (task 1002891).** The registry now protects the files that *hold* the DigitalOcean and Cloudflare credentials, not only the files that decide who may spend them — and it does so from a **computed** set: `tests/government_protected_surfaces.mjs` recomputes every `process.env` credential read from the tracked tree and reds the build if one is unregistered. The task that asked for this named a single file as "the sole holder" of both tokens; by the time it was claimed that file read neither, and the readers had spread to five. A registry entry transcribed from prose would have recorded the gap as closed while leaving every live reader unprotected — the same drift the MIT1 execution-root tripwire exists to catch, which is why this one is built the same way.
+
 The invariant this buys, stated as a testable promise (R112, R114): **the tab can re-map which surfaces are protected and at what floor (policy), but it cannot move enforcement into the request path (substrate).** An Archon can create a custom role and grant it every `system: false` permission in the catalog, assign it to a `xenos`, and that builder gains exactly those operational powers — **while a `system` permission the role "has" stays enforced by the substrate**: the deploy / protected-path / SSH attempt is still blocked, because [ADR 0043](0043-git-ssh-trust-boundary-and-rank-floor-on-permission-paths.md)'s layer-3 audit reads the real git history and the real registry, independent of anything the app grants. Config owns policy; the substrate owns enforcement; a forced grant cannot cross that line. (Note: `main` on this repo still has **no** GitHub branch protection — re-verified 2026-07-24, [ADR 0043](0043-git-ssh-trust-boundary-and-rank-floor-on-permission-paths.md) §"Branch-protection status" — so `main-audit.js` remains the *authoritative* substrate layer, not a redundant net. The registry does not change that; it only makes the protected list data instead of a constant.)
 
 ### 5. Capability in core, settings per project (C4)

package/docs/module-api-changelog.md

@@ -1930,5 +1930,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.726 with no explicit bump. run 34763937238. (task 1002620)
   1.19.728 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.727 with no explicit bump. run 34764630913. (task 1002620)
+  1.19.729 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.728 with no explicit bump. run 34765179905. (task 1002620)
+  1.19.730 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.729 with no explicit bump. run 34765502139. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/recipes/windows-builders.md

@@ -79,7 +79,23 @@ checkout's `node_modules` (by walk-up inside the repo, by junction outside); a s
 `git worktree remove` on an in-repo worktree often errors `Permission denied` / `Device or
 resource busy` because OneDrive briefly locks the directory. The failed attempt usually still
 **deregisters** the worktree (`git worktree list` to confirm — the helper's `remove` does this
-check for you); the empty husk directory deletes on its own later. Don't fight it with retries.
+check for you). Don't fight it with retries.
+
+The empty husk directory does **not** delete on its own — this page and the helper both used to
+say it did, and nothing ever swept one (task 1002594; 20 directories under `.claude/worktrees/`
+for 13 registered worktrees when it was finally measured). Worse, a husk is invisible to
+`stale-worktrees.js`, which reads `git worktree list` — precisely the list a deregistered
+directory has left. Sweep them when the lock has cleared:
+
+```bash
+node scripts/gds/worktree.js prune-husks
+```
+
+It deletes only an **empty** husk that the current process is not standing in and that has not
+been touched in 24 hours, and prints the reason for every skip. Those rules are not paranoia: the
+Claude Code harness creates its own session directory under `.claude/worktrees/` — not a git
+worktree at all, and live while that session runs — so a fresh one is indistinguishable from
+residue. `--force` waives the 24-hour rule and nothing else.
 
 ## Local unit tests: baseline first, CI is truth
 

package/modules/government/protected-surfaces.json

@@ -38,6 +38,12 @@
     { "glob": "modules/dev-box/boxes.js", "group": "box-access", "why": "boxScopeForRank / provision floor — decides who gets a full source clone" },
     { "glob": "modules/dev-box/box-access.js", "group": "box-access", "why": "decideSourceAccess (rank → starter|full source)" },
     { "glob": "modules/dev-box/box-credential.js", "group": "box-access", "why": "mints the box source credential" },
+    { "glob": "scripts/gds/provision-config.js", "group": "box-access", "why": "task 1002891. CREDENTIAL READER: reads process.env.DO_API_TOKEN. The group already protects who DECIDES box access (boxes.js, box-access.js, box-credential.js) but protected nothing that HOLDS the infrastructure credentials those decisions spend — an asymmetry idea 1000692 raised and this entry closes. The set is computed, not listed: the tripwire in tests/government_protected_surfaces.mjs recomputes every process.env credential read from the tracked tree and reds if one is unregistered." },
+    { "glob": "scripts/gds/provision-net.js", "group": "box-access", "why": "task 1002891. CREDENTIAL READER: reads process.env.CLOUDFLARE_API_TOKEN in checkDnsTokenScope. The filing task asserted this code lived in scripts/gds/provision.js; it had moved, and provision.js reads no credential at all. Registering the named file rather than the computed one would have recorded the gap as closed while closing nothing." },
+    { "glob": "scripts/gds/box-infra.js", "group": "box-access", "why": "task 1002891. CREDENTIAL READER: reads process.env.CLOUDFLARE_API_TOKEN and process.env.CLOUDFLARE_ACCOUNT_ID into the CF config the box plane provisions against." },
+    { "glob": "scripts/gds/cf-tunnel.js", "group": "box-access", "why": "task 1002891. CREDENTIAL READER: defaults its token parameter to process.env.CLOUDFLARE_API_TOKEN, so it reads the credential whenever a caller omits one. Not named by the recorded decision — the recomputation found it, which is the whole argument for computing the set instead of transcribing it." },
+    { "glob": "scripts/gds/box.js", "group": "box-access", "why": "task 1002891. CREDENTIAL READER: reads process.env.DO_API_TOKEN — the DigitalOcean control plane for the box fleet. Also not named by the recorded decision. Registering it does NOT widen any module wall: the dev-box module key already lists this file and already derives protected:true from the modules/dev-box/ entries above, so the derived protected-module set is unchanged (verified before and after against src/bongos/module-scope-map.js)." },
+    { "glob": "scripts/gds/do-api.js", "group": "box-access", "why": "task 1002891. The DigitalOcean API client the token is handed TO. Unlike the five above it reads no process.env value — it takes the token as a parameter and throws when a live call has none — so the drift tripwire does not demand it and its absence from that computed set is expected, not a bug. It is registered because the recorded decision named it and because it is the code that puts the credential on the wire." },
     { "glob": "modules/grading/grader.js", "group": "pipeline", "why": "BV1.R73: grading carved to modules/grading/ — the glob follows the file" },
     { "glob": "modules/grading/grader-workers/", "group": "pipeline", "why": "the adversarial panel (Narc/Hacker/Quality/Efficiency) — blunting these blunts the gate" },
     { "glob": "modules/grading/grader-rubric.json", "group": "pipeline", "why": "the grader's scoring rubric (ADR 0058)" },

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.728",
+  "version": "1.19.730",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.728",
+      "version": "1.19.730",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.728",
+  "version": "1.19.730",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/stale-worktrees.js

@@ -13,20 +13,35 @@
 // deleted it). Both are pure git facts, so this runs in well under a second at
 // SessionStart. The primary checkout is never listed.
 //
+// THE SECOND LEAK — HUSKS (task 1002594). Under OneDrive, `git worktree remove`
+// often errors 'Permission denied' / 'Device or resource busy' but still
+// DEREGISTERS the worktree, so `worktree.js remove` treats deregistration as
+// success and tells the builder the locked directory "deletes on its own later".
+// Nothing ever deleted it. That residue is invisible to the scan above BY
+// CONSTRUCTION: a deregistered husk is, by definition, absent from
+// `git worktree list`, which is the only thing classifyWorktrees reads. Measured
+// on 2026-09-13 in this checkout: 20 directories under .claude/worktrees/, 13
+// registered — 7 husks that no probe had ever named. So the husk scan reads the
+// DISK and subtracts what git knows: the mirror image of the stale scan.
+//
 // Usage:
 //   node scripts/gds/stale-worktrees.js --line   # ONE line, or nothing; always exit 0
-//   node scripts/gds/stale-worktrees.js --json   # { stale: [{name, path, branch, why}], live: [...] }
-//   node scripts/gds/stale-worktrees.js          # human report; exit 0 clean, 1 stale found
+//   node scripts/gds/stale-worktrees.js --json   # { stale: [...], live: [...], husks: [...] }
+//   node scripts/gds/stale-worktrees.js          # human report; exit 0 clean, 1 stale/husks found
 //
-// Removal is deliberately NOT here — `/worktree-clean` walks this list through
-// `node scripts/gds/worktree.js remove <name>`, the junction-safe path.
+// Removal is deliberately NOT here — `/worktree-clean` walks these lists through
+// `node scripts/gds/worktree.js remove <name>` and `worktree.js prune-husks`,
+// the junction-safe paths.
 
 'use strict';
 
 const { execFileSync } = require('child_process');
+const fs = require('fs');
 const path = require('path');
 
 const MAIN_REF = 'origin/main';
+// Where worktree.js add puts a worktree by default; the only place husks collect.
+const WORKTREES_SUBDIR = path.join('.claude', 'worktrees');
 
 function git(args, cwd) {
   return execFileSync('git', args, { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] });
@@ -64,6 +79,20 @@ function classifyWorktrees(worktrees, { isMerged, branchExists }) {
   return { stale, live };
 }
 
+// Directories sitting in .claude/worktrees/ that git does not list as a worktree —
+// the deregister-then-never-delete residue. Pure (the directory listing and the
+// registered paths are both injected) so the set arithmetic is testable without
+// creating directories. Case- and separator-insensitive on both sides, because the
+// porcelain and fs.readdirSync disagree about drive-letter case on Windows.
+function classifyHusks({ dirNames, worktreePaths, worktreesRoot }) {
+  const norm = (p) => path.resolve(p).replace(/\\/g, '/').toLowerCase();
+  const registered = new Set(worktreePaths.map(norm));
+  return dirNames
+    .filter((name) => !registered.has(norm(path.join(worktreesRoot, name))))
+    .sort()
+    .map((name) => ({ name, path: path.join(worktreesRoot, name) }));
+}
+
 // Three git calls total, whatever the worktree count: the list, every local branch,
 // every branch already merged into origin/main. Per-worktree subprocesses would be
 // N+1 over exactly the number this probe exists to shrink.
@@ -77,18 +106,40 @@ function scan(cwd) {
   let merged;
   try { merged = refNames(git(['branch', '--merged', MAIN_REF, '--format=%(refname:short)'], cwd)); }
   catch { merged = new Set(); } // no origin/main yet (fresh clone, no fetch) → nothing is provably stale
-  return classifyWorktrees(worktrees, {
+  const r = classifyWorktrees(worktrees, {
     branchExists: (b) => existing.has(b),
     isMerged: (b) => merged.has(b),
   });
+  // The main checkout is always the first porcelain entry, so the husk directory is
+  // derivable without a second git call.
+  const mainRoot = worktrees.length ? worktrees[0].path : cwd;
+  const worktreesRoot = path.join(mainRoot, WORKTREES_SUBDIR);
+  let dirNames = [];
+  try {
+    dirNames = fs.readdirSync(worktreesRoot, { withFileTypes: true })
+      .filter((d) => d.isDirectory()).map((d) => d.name);
+  } catch { dirNames = []; } // no worktrees dir yet → no husks, not an error
+  r.husks = classifyHusks({ dirNames, worktreePaths: worktrees.map((w) => w.path), worktreesRoot });
+  return r;
+}
+
+function namesOf(list) {
+  const names = list.slice(0, 6).map((s) => s.name).join(', ');
+  return names + (list.length > 6 ? ` +${list.length - 6} more` : '');
 }
 
 function lineFor(r) {
-  if (!r.stale.length) return '';
-  const names = r.stale.slice(0, 6).map((s) => s.name).join(', ');
-  const more = r.stale.length > 6 ? ` +${r.stale.length - 6} more` : '';
-  return `Stale worktrees: ${r.stale.length} whose work already landed (${names}${more}). `
-    + 'Run /worktree-clean — never `git worktree remove` (it follows the node_modules junction).';
+  const husks = r.husks || [];
+  const parts = [];
+  if (r.stale.length) {
+    parts.push(`Stale worktrees: ${r.stale.length} whose work already landed (${namesOf(r.stale)}). `
+      + 'Run /worktree-clean — never `git worktree remove` (it follows the node_modules junction).');
+  }
+  if (husks.length) {
+    parts.push(`Worktree husks: ${husks.length} deregistered dir(s) still on disk (${namesOf(husks)}). `
+      + 'Run node scripts/gds/worktree.js prune-husks.');
+  }
+  return parts.join(' ');
 }
 
 function main() {
@@ -102,12 +153,16 @@ function main() {
   }
   if (argv.includes('--json')) { console.log(JSON.stringify(r, null, 2)); return; }
   if (argv.includes('--line')) { const l = lineFor(r); if (l) console.log(l); return; }
-  console.log(`  Worktrees: ${r.live.length} live, ${r.stale.length} stale`);
+  const husks = r.husks || [];
+  console.log(`  Worktrees: ${r.live.length} live, ${r.stale.length} stale, ${husks.length} husks`);
   for (const s of r.stale) console.log(`    stale  ${s.name}  (${s.why})`);
+  for (const h of husks) console.log(`    husk   ${h.name}  (on disk, not registered)`);
   for (const l of r.live) console.log(`    live   ${l.name}  [${l.branch || 'detached'}]`);
-  if (r.stale.length) { console.log('  Remove with: node scripts/gds/worktree.js remove <name>   (or /worktree-clean)'); process.exit(1); }
+  if (r.stale.length) console.log('  Remove with: node scripts/gds/worktree.js remove <name>   (or /worktree-clean)');
+  if (husks.length) console.log('  Sweep husks with: node scripts/gds/worktree.js prune-husks');
+  if (r.stale.length || husks.length) process.exit(1);
 }
 
 if (require.main === module) main();
 
-module.exports = { parseWorktreeList, classifyWorktrees, lineFor };
+module.exports = { parseWorktreeList, classifyWorktrees, classifyHusks, lineFor };

package/scripts/gds/worktree.js

@@ -22,9 +22,22 @@
 // which claim.js surfaces at claim time. Deliberately short here: two full
 // copies of the same prose would drift apart.
 //
+// THE RESIDUE `remove` LEAVES — HUSKS (task 1002594). Under OneDrive, the
+// `git worktree remove` below often errors 'Permission denied' / 'Device or
+// resource busy' while still DEREGISTERING the worktree, so this tool has always
+// accepted deregistration as success. What it then TOLD the builder was wrong:
+// the locked directory does not "delete on its own later", and no probe could
+// even see it, because stale-worktrees.js reads `git worktree list` and a
+// deregistered husk is by definition absent from it. Measured 2026-09-13: 20
+// directories under .claude/worktrees/, 13 registered. `prune-husks` is the
+// deferred half of deregister-then-delete-later, and it is deliberately manual —
+// the harness parks LIVE session directories in the same folder, so see
+// huskDisposition for the three rules that keep a sweep from deleting one.
+//
 // Usage:
 //   node scripts/gds/worktree.js add <task-id|name> [--path <dir> | --outside] [--base <ref>]
 //   node scripts/gds/worktree.js remove <name|path> [--force]
+//   node scripts/gds/worktree.js prune-husks [--force]
 //   node scripts/gds/worktree.js list
 
 const fs = require('node:fs');
@@ -110,6 +123,31 @@ function removalPlan({ nodeModulesState }) {
     : ['git-worktree-remove'];
 }
 
+// A husk younger than this may still be a LIVE session's directory rather than
+// abandoned residue, so the default sweep leaves it for tomorrow.
+const HUSK_QUIET_MS = 24 * 60 * 60 * 1000;
+
+// Should this deregistered husk be deleted? Pure, so the safety rules can be proved
+// without creating directories.
+//
+// WHY EACH RULE (task 1002594). The husks that collect under .claude/worktrees/ are
+// not all the same animal: most are the OneDrive-lock residue cmdRemove below leaves
+// behind, but the harness also creates a session directory there that is not a git
+// worktree at all and is LIVE while its session runs. Deleting one of those pulls the
+// floor out from under another agent's cwd. So: never a directory this process is
+// standing in, never one holding files (residue is empty by construction — anything
+// else is somebody's leftovers to inspect by hand), and by default never one touched
+// today, because "recently created and empty" is exactly what a fresh session dir
+// looks like. `force` waives only the age rule; in-use and non-empty are absolute.
+function huskDisposition({ isCwdOrAncestor, isEmpty, ageMs, force }) {
+  if (isCwdOrAncestor) return { action: 'skip', why: 'in use — this session is inside it' };
+  if (!isEmpty) return { action: 'skip', why: 'not empty — inspect by hand' };
+  if (!force && ageMs < HUSK_QUIET_MS) {
+    return { action: 'skip', why: 'touched in the last 24h — may be a live session dir (--force sweeps it)' };
+  }
+  return { action: 'delete', why: 'empty, deregistered' };
+}
+
 // -- CLI ----------------------------------------------------------------------
 
 function git(args, opts = {}) {
@@ -272,7 +310,11 @@ function cmdRemove(root, argv) {
         const still = listWorktrees(root).some((w) => path.resolve(w).toLowerCase() === path.resolve(wtPath).toLowerCase());
         if (!still) {
           console.log(`worktree deregistered: ${wtPath}`);
-          console.log('  (the directory husk is briefly locked — OneDrive — and deletes on its own later)');
+          // This used to claim the husk "deletes on its own later". It does not:
+          // nothing deleted it and nothing could see it either, since a deregistered
+          // directory is absent from `git worktree list` (task 1002594).
+          console.log('  (the directory husk is still locked — OneDrive — and stays on disk.');
+          console.log('   Sweep it once the lock clears: node scripts/gds/worktree.js prune-husks)');
         } else {
           console.error(`worktree remove failed — ${e.message}`);
           // The worktree is still live but its junction is already unlinked —
@@ -301,6 +343,56 @@ function cmdRemove(root, argv) {
   console.log(`  (branch "${path.basename(wtPath)}" left in place — the land/ship pipeline owns branch cleanup)`);
 }
 
+// The other half of the OneDrive story (task 1002594): cmdRemove above accepts a
+// failed `git worktree remove` as long as the worktree got DEREGISTERED, and tells
+// the builder the locked directory "deletes on its own later". Nothing did — and
+// nothing could even SEE the residue, because stale-worktrees.js reads
+// `git worktree list` and a deregistered husk is by definition absent from it. This
+// is the sweep that makes that promise true.
+function cmdPruneHusks(root, argv) {
+  const force = hasFlag('--force', argv);
+  const worktreesRoot = path.join(root, '.claude', 'worktrees');
+  const registered = new Set(listWorktrees(root).map((p) => path.resolve(p).replace(/\\/g, '/').toLowerCase()));
+  let entries;
+  try { entries = fs.readdirSync(worktreesRoot, { withFileTypes: true }); }
+  catch { console.log('no .claude/worktrees directory — nothing to sweep.'); return; }
+
+  const cwd = path.resolve(process.cwd());
+  const now = Date.now();
+  let deleted = 0;
+  let skipped = 0;
+  for (const ent of entries) {
+    if (!ent.isDirectory()) continue;
+    const huskPath = path.join(worktreesRoot, ent.name);
+    if (registered.has(path.resolve(huskPath).replace(/\\/g, '/').toLowerCase())) continue; // a real worktree: `remove` owns it
+    let isEmpty;
+    let ageMs;
+    try {
+      isEmpty = fs.readdirSync(huskPath).length === 0;
+      ageMs = now - fs.statSync(huskPath).mtimeMs;
+    } catch (e) {
+      console.log(`  skip    ${ent.name}  (unreadable — ${e.message})`);
+      skipped += 1;
+      continue;
+    }
+    // path.relative is '' for the cwd itself and has no leading '..' for an ancestor.
+    const rel = path.relative(path.resolve(huskPath), cwd);
+    const isCwdOrAncestor = rel === '' || !rel.startsWith('..');
+    const { action, why } = huskDisposition({ isCwdOrAncestor, isEmpty, ageMs, force });
+    if (action === 'skip') { console.log(`  skip    ${ent.name}  (${why})`); skipped += 1; continue; }
+    try {
+      fs.rmdirSync(huskPath); // rmdir, never rm -r: it refuses a directory that gained files since the check
+      console.log(`  removed ${ent.name}`);
+      deleted += 1;
+    } catch (e) {
+      // Still locked (OneDrive) — say so plainly; the next sweep gets it.
+      console.log(`  skip    ${ent.name}  (still locked — ${e.code || e.message}; it will sweep next run)`);
+      skipped += 1;
+    }
+  }
+  console.log(`husks: ${deleted} removed, ${skipped} skipped.`);
+}
+
 function cmdList(root) {
   const all = listWorktrees(root);
   for (const w of all) {
@@ -322,13 +414,17 @@ function main() {
   }
   if (cmd === 'add') return cmdAdd(root, argv);
   if (cmd === 'remove') return cmdRemove(root, argv);
+  if (cmd === 'prune-husks') return cmdPruneHusks(root, argv);
   if (cmd === 'list') return cmdList(root);
   console.error('usage: node scripts/gds/worktree.js add <task-id|name> [--path <dir> | --outside] [--base <ref>]');
   console.error('       node scripts/gds/worktree.js remove <name|path> [--force]');
+  console.error('       node scripts/gds/worktree.js prune-husks [--force]');
   console.error('       node scripts/gds/worktree.js list');
   process.exit(2);
 }
 
 if (require.main === module) main();
 
-module.exports = { worktreeNameFor, needsJunction, removalPlan, nodeModulesState, shadowingNodeModules };
+module.exports = {
+  worktreeNameFor, needsJunction, removalPlan, nodeModulesState, shadowingNodeModules, huskDisposition,
+};

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.728'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.730'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/government_protected_surfaces.mjs

@@ -174,6 +174,58 @@ const ADDED_SINCE_R101 = [
        + 'otb-regen driver, so editing it changes how much of the tree that driver '
        + 'rewrites during a merge. executed-closure.js carries it as TRUSTED_NON_CODE.',
   },
+  // task 1002891 (from idea 1000692, raised by the grader's hacker worker). Group
+  // 'box-access' protected who DECIDES box access but nothing that HOLDS the
+  // infrastructure credentials those decisions spend. The five readers below are the
+  // COMPUTED set — the credential-reader tripwire further down recomputes it from the
+  // tracked tree on every run — plus do-api.js, which the credential is handed to.
+  {
+    after: 'modules/dev-box/box-credential.js',
+    glob: 'scripts/gds/provision-config.js',
+    why: 'reads process.env.DO_API_TOKEN. The DigitalOcean credential for instance '
+       + 'provisioning, previously unprotected at any rank while the files deciding WHO '
+       + 'may provision were protected at Metic.',
+  },
+  {
+    after: 'scripts/gds/provision-config.js',
+    glob: 'scripts/gds/provision-net.js',
+    why: 'reads process.env.CLOUDFLARE_API_TOKEN in checkDnsTokenScope. The filing task '
+       + 'placed this code in scripts/gds/provision.js, which by the time of the claim '
+       + 'read no credential at all — registering the file the prose named would have '
+       + 'recorded the gap as closed while closing nothing.',
+  },
+  {
+    after: 'scripts/gds/provision-net.js',
+    glob: 'scripts/gds/box-infra.js',
+    why: 'reads process.env.CLOUDFLARE_API_TOKEN and process.env.CLOUDFLARE_ACCOUNT_ID '
+       + 'into the Cloudflare config the box plane provisions tunnels and DNS against.',
+  },
+  {
+    after: 'scripts/gds/box-infra.js',
+    glob: 'scripts/gds/cf-tunnel.js',
+    why: 'defaults its token parameter to process.env.CLOUDFLARE_API_TOKEN, so it reads '
+       + 'the credential whenever a caller omits one. The recorded decision did not name '
+       + 'this file; the recomputation found it, which is the case for computing the set '
+       + 'rather than transcribing a list.',
+  },
+  {
+    after: 'scripts/gds/cf-tunnel.js',
+    glob: 'scripts/gds/box.js',
+    why: 'reads process.env.DO_API_TOKEN — the DigitalOcean control plane for the box '
+       + 'fleet, and also not named by the recorded decision. Adding it widens no module '
+       + 'wall: the dev-box key already lists this path and already derives protected '
+       + 'from the modules/dev-box/ entries, so the derived protected-module set is '
+       + 'unchanged (asserted below).',
+  },
+  {
+    after: 'scripts/gds/box.js',
+    glob: 'scripts/gds/do-api.js',
+    why: 'the DigitalOcean API client the token is handed TO. It reads no process.env '
+       + 'value — the token arrives as a parameter and the constructor throws when a live '
+       + 'call has none — so the tripwire below does not demand it and its absence from '
+       + 'that computed set is expected. Registered because it is the code that puts the '
+       + 'credential on the wire.',
+  },
 ];
 
 // Surfaces RENAMED since R101 — still protected, under a new path. Distinct from
@@ -303,6 +355,158 @@ test('every execution root in the closure is a protected surface (MIT1 drift tri
   }
 });
 
+// ---------- the credential tripwire: every credential READER is a protected surface ----------
+//
+// task 1002891, from idea 1000692 (the grader's hacker worker, on the 1002690 re-grade).
+// Group 'box-access' protected the files that decide WHO may provision a box, but nothing
+// that HOLDS the DigitalOcean / Cloudflare credentials those decisions spend.
+//
+// WHY THIS IS COMPUTED AND NOT LISTED. The task offered two options, both resting on a
+// named file: "scripts/gds/provision.js is the sole holder of the DO and CF tokens". By
+// the time it was claimed that sentence was false in both halves — provision.js reads
+// NEITHER token (the code moved), and the readers are spread across five files. Taking the
+// prose at its word would have registered a file holding no credential and recorded the
+// gap as closed. That is the failure shape of task 1003366, where an audit named four
+// execution roots and the code had eight, and the four missed the earliest vector.
+//
+// So the registry is pinned to what the tree actually does, and this test is the pin: add
+// a process.env read of a credential anywhere in tracked JS and the build reds until the
+// registry grows to match.
+//
+// FAIL CLOSED, DELIBERATELY. The scan is textual, so a `process.env.DO_API_TOKEN` written
+// inside a comment counts as a read. That over-reports rather than under-reports, which is
+// the right direction for a security tripwire: the fix is to register the file or reword
+// the comment, and neither leaves a live credential unprotected.
+const CREDENTIAL_ENV = ['DO_API_TOKEN', 'CLOUDFLARE_API_TOKEN', 'CLOUDFLARE_ACCOUNT_ID'];
+
+// Which CREDENTIAL_ENV names this source reads off process.env. Four spellings, because a
+// tripwire that only knows the idiom in use today goes quiet the first time someone writes
+// the same read differently: `process.env.NAME`, `process.env['NAME']`,
+// `process['env']['NAME']`, and destructuring — `const { NAME } = process.env`, rename and
+// multi-line included.
+//
+// KNOWN LIMIT, stated rather than papered over: a read through an intermediate binding
+// (`const env = process.env; env.DO_API_TOKEN`) or a name assembled at runtime is not
+// textually detectable and is not caught. Closing that needs an AST pass over the tree,
+// which is a different piece of work; nothing in the tree reads a credential that way
+// today, and the registry entries do not depend on the scan to stay correct — the scan is
+// what catches DRIFT.
+//
+// Returns a sorted array; [] means "reads none", which is indistinguishable from "the
+// scanner broke", so every caller also asserts the whole scan is non-vacuous. A scanner
+// that quietly finds nothing looks exactly like a passing test.
+function credentialReadsIn(source) {
+  const found = new Set();
+  for (const name of CREDENTIAL_ENV) {
+    const forms = [
+      new RegExp(`process\\.env\\.${name}\\b`),
+      new RegExp(`process\\.env\\[\\s*['"\`]${name}['"\`]\\s*\\]`),
+      new RegExp(`process\\s*\\[\\s*['"\`]env['"\`]\\s*\\]\\s*\\[\\s*['"\`]${name}['"\`]\\s*\\]`),
+      // Destructuring. [^}]* spans newlines inside a character class, so a multi-line
+      // destructure matches; the \\b keeps NAME_SUFFIX from counting as NAME.
+      new RegExp(`\\{[^}]*\\b${name}\\b[^}]*\\}\\s*=\\s*process\\.env\\b`),
+    ];
+    if (forms.some((re) => re.test(source))) found.add(name);
+  }
+  return [...found].sort();
+}
+
+// tests/ is out of scope, and the exclusion is load-bearing rather than convenient: the
+// unit tests directly below hold `process.env.DO_API_TOKEN` as fixture text, so without it
+// this scanner reports ITSELF as an unregistered credential holder (it did, on the first
+// run — which is also the evidence that it detects rather than quietly finding nothing).
+// A test fixture is not a credential holder: tests/ is not the provisioning path, holds no
+// live token, and is never what a droplet executes. Every path that DOES reach DigitalOcean
+// or Cloudflare lives under scripts/ or modules/ and stays in scope.
+const SCAN_EXCLUDED = /^tests\//;
+
+// The tracked JS tree, scanned for credential reads. git ls-files (not a directory walk)
+// so an untracked scratch file can never add or remove a protected surface.
+function credentialReaders() {
+  const tracked = execFileSync('git', ['ls-files', '*.js', '*.mjs', '*.cjs'],
+    { cwd: ROOT, encoding: 'utf8' })
+    .split('\n').map((s) => s.trim()).filter(Boolean);
+  return tracked
+    .filter((rel) => !SCAN_EXCLUDED.test(rel))
+    .filter((rel) => credentialReadsIn(fs.readFileSync(path.join(ROOT, rel), 'utf8')).length > 0)
+    .sort();
+}
+
+test('credentialReadsIn detects a read in every form it must', () => {
+  assert.deepEqual(credentialReadsIn('const t = process.env.DO_API_TOKEN || null;'),
+    ['DO_API_TOKEN']);
+  assert.deepEqual(credentialReadsIn("process.env['CLOUDFLARE_API_TOKEN']"),
+    ['CLOUDFLARE_API_TOKEN']);
+  assert.deepEqual(credentialReadsIn('process.env["CLOUDFLARE_ACCOUNT_ID"]'),
+    ['CLOUDFLARE_ACCOUNT_ID']);
+  assert.deepEqual(credentialReadsIn('process.env[ `DO_API_TOKEN` ]'), ['DO_API_TOKEN']);
+  assert.deepEqual(credentialReadsIn("process['env']['DO_API_TOKEN']"), ['DO_API_TOKEN']);
+  assert.deepEqual(credentialReadsIn('const { DO_API_TOKEN } = process.env;'),
+    ['DO_API_TOKEN']);
+  assert.deepEqual(credentialReadsIn('const { DO_API_TOKEN: tok } = process.env;'),
+    ['DO_API_TOKEN'], 'a renamed destructure is still a read');
+  assert.deepEqual(
+    credentialReadsIn('const {\n  PORT,\n  CLOUDFLARE_API_TOKEN,\n} = process.env;'),
+    ['CLOUDFLARE_API_TOKEN'], 'a multi-line destructure is still a read');
+  assert.deepEqual(
+    credentialReadsIn('process.env.DO_API_TOKEN; process.env.CLOUDFLARE_API_TOKEN;'),
+    ['CLOUDFLARE_API_TOKEN', 'DO_API_TOKEN']);
+});
+
+test('credentialReadsIn does not fire on a near-miss', () => {
+  // The guard that matters: a scanner matching too loosely reds honest files until
+  // someone loosens it, and a loosened scanner protects nothing.
+  assert.deepEqual(credentialReadsIn(''), []);
+  assert.deepEqual(credentialReadsIn('export DO_API_TOKEN or run without --apply'), []);
+  assert.deepEqual(credentialReadsIn('opts.token || cfg.DO_API_TOKEN'), []);
+  assert.deepEqual(credentialReadsIn('process.env.DO_API_TOKEN_FILE'), [],
+    'a longer env name that merely starts with a credential name is a different variable');
+  assert.deepEqual(credentialReadsIn('process.env.SOME_OTHER_TOKEN'), []);
+  assert.deepEqual(credentialReadsIn('const { DO_API_TOKEN_FILE } = process.env;'), [],
+    'the destructure form must respect the word boundary too');
+  assert.deepEqual(credentialReadsIn('const { DO_API_TOKEN } = someOtherObject;'), [],
+    'destructuring a credential-shaped name off something else is not an env read');
+});
+
+test('every credential reader in the tree is a protected surface (1002891 tripwire)', () => {
+  const readers = credentialReaders();
+  assert.ok(readers.length >= 5,
+    'fixture sanity: the scan found '
+    + `${readers.length} credential reader(s), and the tree has had at least five since `
+    + 'task 1002891. A scan that finds nothing passes every assertion below without '
+    + 'checking anything — treat this as the scanner being broken, not as good news.');
+  for (const rel of readers) {
+    const surface = ppc.surfaceFor(rel);
+    assert.ok(surface,
+      `${rel} READS an infrastructure credential off process.env `
+      + `(${credentialReadsIn(fs.readFileSync(path.join(ROOT, rel), 'utf8')).join(', ')}) `
+      + 'but no protected surface covers it. Add it to '
+      + 'modules/government/protected-surfaces.json (group "box-access") and declare it '
+      + 'in ADDED_SINCE_R101 above.');
+    assert.ok(ppc.RANK_TIER[surface.floor] >= ppc.RANK_TIER.metic,
+      `${rel} holds an infrastructure credential but is floored at '${surface.floor}' — `
+      + 'below Metic it stays writable by the ranks ADR 0043 keeps out of the trust core.');
+  }
+});
+
+test('registering the credential readers widened no module wall', () => {
+  // The second-order effect task 1002891 was explicitly warned about, asserted rather
+  // than reasoned about. src/bongos/module-scope-map.js DERIVES a module's `protected`
+  // flag from overlap with this registry, and a protected module makes its goals
+  // Archon-mediated-join. The six surfaces added for 1002891 are file-level for exactly
+  // this reason: the modules/provisioning/ subtree (the task's option (b)) would have
+  // flipped `provisioning` and walled goals 1000032, 1000046 and 1000059.
+  const map = require(path.join(ROOT, 'src', 'bongos', 'module-scope-map.js'));
+  const protectedNow = map.protectedModules();
+  assert.ok(!protectedNow.includes('provisioning'),
+    'the provisioning module derived protected:true — a credential-reader entry reached '
+    + 'modules/provisioning/ or scripts/gds/provision.js, which walls goals 1000032, '
+    + '1000046 and 1000059 behind an Archon join. Keep the entries file-level.');
+  assert.ok(protectedNow.includes('dev-box'),
+    'dev-box was already protected via its modules/dev-box/ globs before 1002891; if it '
+    + 'is not, the premise of the box.js entry has changed.');
+});
+
 // Metic is a FLOOR, not a fixed value (task 1003191). Pinning every surface to
 // exactly 'metic' made the registry's own contract untestable and, worse,
 // illegal: governance owns this data and raising one surface to 'archon' is a

package/tests/stale_worktrees.mjs

@@ -2,7 +2,7 @@
 // facts (task 1003365): no repo, no API, just the porcelain text + two predicates.
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
-import { parseWorktreeList, classifyWorktrees, lineFor } from '../scripts/gds/stale-worktrees.js';
+import { parseWorktreeList, classifyWorktrees, classifyHusks, lineFor } from '../scripts/gds/stale-worktrees.js';
 
 const PORCELAIN = [
   'worktree C:/repo',
@@ -64,3 +64,59 @@ test('--line caps the named list at six', () => {
   assert.match(line, /\+2 more/);
   assert.doesNotMatch(line, /task-7/);
 });
+
+// ---- husks (task 1002594) ----
+//
+// The stale scan above reads `git worktree list`, so it is blind BY CONSTRUCTION to
+// the residue of an OneDrive-locked remove: that directory was deregistered, which is
+// precisely what makes it absent from the porcelain. The husk scan is the mirror —
+// disk minus git.
+
+const WT_ROOT = 'C:/repo/.claude/worktrees';
+
+test('a directory on disk that git does not list is a husk', () => {
+  const husks = classifyHusks({
+    dirNames: ['task-1', 'task-2', 'leftover'],
+    worktreePaths: ['C:/repo', 'C:/repo/.claude/worktrees/task-1', 'C:/repo/.claude/worktrees/task-2'],
+    worktreesRoot: WT_ROOT,
+  });
+  assert.deepEqual(husks.map((h) => h.name), ['leftover']);
+});
+
+test('a registered worktree is never a husk, whatever the drive-letter case or separator', () => {
+  const husks = classifyHusks({
+    dirNames: ['task-1'],
+    worktreePaths: ['C:/repo', 'c:\\repo\\.claude\\worktrees\\task-1'],
+    worktreesRoot: WT_ROOT,
+  });
+  assert.deepEqual(husks, []);
+});
+
+test('every directory is a husk when git lists no worktrees but the main checkout', () => {
+  const husks = classifyHusks({
+    dirNames: ['b', 'a'],
+    worktreePaths: ['C:/repo'],
+    worktreesRoot: WT_ROOT,
+  });
+  assert.deepEqual(husks.map((h) => h.name), ['a', 'b']); // sorted, so the report is stable
+});
+
+test('--line names husks even when nothing is stale, and stays empty when neither exists', () => {
+  assert.equal(lineFor({ stale: [], live: [], husks: [] }), '');
+  assert.equal(lineFor({ stale: [], live: [] }), ''); // husks absent entirely (older caller)
+  const line = lineFor({ stale: [], live: [], husks: [{ name: 'task-9' }] });
+  assert.match(line, /Worktree husks: 1 /);
+  assert.match(line, /task-9/);
+  assert.match(line, /prune-husks/);
+  assert.doesNotMatch(line, /Stale worktrees/);
+});
+
+test('--line reports both leaks in one line when both exist', () => {
+  const line = lineFor({
+    stale: [{ name: 'task-1', why: 'merged into main' }],
+    live: [],
+    husks: [{ name: 'task-2' }],
+  });
+  assert.match(line, /Stale worktrees: 1 /);
+  assert.match(line, /Worktree husks: 1 /);
+});

package/tests/worktree_helper.mjs

@@ -27,7 +27,9 @@ import os from 'node:os';
 import path from 'node:path';
 
 const require = createRequire(import.meta.url);
-const { worktreeNameFor, needsJunction, removalPlan, nodeModulesState, shadowingNodeModules } = require('../scripts/gds/worktree.js');
+const { worktreeNameFor, needsJunction, removalPlan, nodeModulesState, shadowingNodeModules, huskDisposition } = require('../scripts/gds/worktree.js');
+
+const HOUR = 60 * 60 * 1000;
 
 let passed = 0;
 let failed = 0;
@@ -189,6 +191,41 @@ test('the nearest stray wins, matching node\'s own resolution order', () => {
     'node stops at the first node_modules it meets walking up');
 });
 
+// ---- 5. huskDisposition (task 1002594) ----
+//
+// A husk is a directory under .claude/worktrees/ that git does not list as a
+// worktree — the residue of an OneDrive-locked `git worktree remove` that
+// deregistered but could not delete. Three of the four inputs are SAFETY rules, and
+// each one has a real directory behind it: the harness puts live session dirs in the
+// same folder, and they look exactly like fresh residue.
+
+test('an old, empty, unused husk is swept', () => {
+  eq(huskDisposition({ isCwdOrAncestor: false, isEmpty: true, ageMs: 48 * HOUR, force: false }).action, 'delete');
+});
+
+test('the directory this session is standing in is never swept — not even with --force', () => {
+  eq(huskDisposition({ isCwdOrAncestor: true, isEmpty: true, ageMs: 48 * HOUR, force: true }).action, 'skip');
+});
+
+test('a husk holding files is never swept — not even with --force', () => {
+  eq(huskDisposition({ isCwdOrAncestor: false, isEmpty: false, ageMs: 48 * HOUR, force: true }).action, 'skip');
+});
+
+test('a husk touched in the last 24h is held back — a live session dir looks just like this', () => {
+  const d = huskDisposition({ isCwdOrAncestor: false, isEmpty: true, ageMs: 2 * HOUR, force: false });
+  eq(d.action, 'skip');
+  eq(/24h/.test(d.why), true, 'the skip reason names the age rule');
+});
+
+test('--force waives the age rule, and only the age rule', () => {
+  eq(huskDisposition({ isCwdOrAncestor: false, isEmpty: true, ageMs: 2 * HOUR, force: true }).action, 'delete');
+});
+
+test('in-use outranks every other rule', () => {
+  eq(huskDisposition({ isCwdOrAncestor: true, isEmpty: false, ageMs: 0, force: true }).why,
+    'in use — this session is inside it');
+});
+
 console.log('');
 console.log(`worktree_helper: ${passed} passed, ${failed} failed`);
 process.exit(failed > 0 ? 1 : 0);