@north-light/crouter 0.3.197 → 0.3.199

package/dist/core/worktree.js

@@ -1,4 +1,4 @@
-import { existsSync, mkdirSync, readFileSync, realpathSync, rmSync, rmdirSync, writeFileSync } from 'node:fs';
+import { existsSync, mkdirSync, readFileSync, realpathSync, rmSync, writeFileSync } from 'node:fs';
 import { createHash } from 'node:crypto';
 import { dirname, join, resolve } from 'node:path';
 import { gitSync } from './git.js';
@@ -76,7 +76,6 @@ function checkoutPathForBranchInList(porcelain, branch) {
     return null;
 }
 const WORKTREE_LOCK_WAIT_MS = 30_000;
-const WORKTREE_CLEANUP_TIMEOUT_MS = 5_000;
 function commonGitDir(repoRoot) {
     const commonDir = runGit(repoRoot, ['rev-parse', '--git-common-dir'], 'git_common_dir_failed', 'Inspect the repository git metadata, then retry.');
     return realpathSync(resolve(repoRoot, commonDir));
@@ -240,18 +239,23 @@ export function isRebaseInProgress(cwd) {
 /** The ONE authoritative closed-worktree state transition, shared by both
  *  closing paths (explicit `closeManagedWorktreeLocked` land, and the clean
  *  `autoDropCleanManagedWorktreeLocked` push-final drop): persist
- *  `managed_worktree.state: 'closed'` AND repoint the node's launch `cwd` to
- *  the durable base checkout, atomically, in the same `updateNode` write.
- *  The worktree dir is torn down by cleanup around this call (at best left
- *  as an empty tombstone so an in-flight `push final` can still run) and
- *  must never remain the node's recorded launch directory — an existing
- *  tombstone directory still passes a naive `existsSync(cwd)` revive
- *  preflight, so a caller that forgets this repoint lets a later park/revive
- *  launch into a directory that no longer holds a real checkout. Both
- *  closing paths MUST go through this helper instead of hand-rolling the
- *  `updateNode` call, so neither can drift out of sync with the other. */
-function persistClosedWorktreeState(nodeId, wt) {
-    updateNode(nodeId, { cwd: wt.repo_root, managed_worktree: { ...wt, state: 'closed', closed: new Date().toISOString() } });
+ *  `managed_worktree.state: 'closed'`, name its cleanup state, and repoint the
+ *  node's launch `cwd` to the durable base checkout atomically in the same
+ *  `updateNode` write. A live node keeps its checkout intact for explicit
+ *  post-exit cleanup: `git worktree remove` recursively deletes the caller's
+ *  cwd and cannot safely run against it. Both closing paths MUST go through this helper instead of
+ *  hand-rolling the `updateNode` call, so neither can drift out of sync. */
+function persistClosedWorktreeState(nodeId, wt, cleanup = 'pending') {
+    updateNode(nodeId, { cwd: wt.repo_root, managed_worktree: { ...wt, state: 'closed', cleanup, closed: new Date().toISOString() } });
+}
+function deferredCleanupResult(wt) {
+    const remove = `git -C ${shellQuote(wt.repo_root)} worktree remove ${shellQuote(wt.path)}`;
+    return {
+        worktree_removed: false,
+        worktree_remove_error: `cleanup pending: the caller checkout at ${wt.path} remains intact. After its node exits, run \`${remove}\` after confirming it is safe to delete.`,
+        branch_deleted: false,
+        branch_delete_error: `cleanup pending: local branch ${wt.branch} remains checked out at ${wt.path}; delete it only after that checkout is removed and its landed commit is still contained in ${wt.base_ref}.`,
+    };
 }
 function closeManagedWorktreeLocked(nodeId) {
     const node = getNode(nodeId);
@@ -289,18 +293,18 @@ function closeManagedWorktreeLocked(nodeId) {
     }
     const dirty = statusPorcelain(wt.path);
     if (dirty !== '') {
-        throw new WorktreeError('dirty_worktree', 'managed worktree has uncommitted changes', `Commit the work in ${wt.path} (or ask the human with \`crtr human ask\` if you do not know whether to keep it), then rerun \`crtr node worktree close\`.`);
+        throw new WorktreeError('dirty_worktree', 'managed worktree has uncommitted changes', `Commit the work in ${wt.path} (or ask the user with \`crtr human send\` if you do not know whether to keep it), then rerun \`crtr node worktree close\`.`);
     }
     const branch = currentBranch(wt.path);
     if (branch !== wt.branch) {
         const found = branch === 'HEAD' ? 'detached HEAD' : branch;
-        throw new WorktreeError('wrong_branch', `managed worktree is not on its recorded branch (expected ${wt.branch}, found ${found})`, `Check out ${wt.branch} in ${wt.path} before closing, or ask the human with \`crtr human ask\` if you are unsure why it changed, then rerun \`crtr node worktree close\`.`);
+        throw new WorktreeError('wrong_branch', `managed worktree is not on its recorded branch (expected ${wt.branch}, found ${found})`, `Check out ${wt.branch} in ${wt.path} before closing, or ask the user with \`crtr human send\` if you are unsure why it changed, then rerun \`crtr node worktree close\`.`);
     }
     const baseSha = resolveLandableBase(wt.repo_root, wt.base_ref);
     const rebase = gitSync(['rebase', baseSha], wt.path);
     if (rebase.status !== 0) {
         const detail = (rebase.stderr.trim() || rebase.stdout.trim()).trim();
-        throw new WorktreeError('rebase_failed', `rebase onto local base branch '${wt.base_ref}' did not complete`, `Resolve conflicts in ${wt.path}, run \`git rebase --continue\` there, then rerun \`crtr node worktree close\`. If the blocker is not mechanical, ask the human with \`crtr human ask\`.`, detail);
+        throw new WorktreeError('rebase_failed', `rebase onto local base branch '${wt.base_ref}' did not complete`, `Resolve conflicts in ${wt.path}, run \`git rebase --continue\` there, then rerun \`crtr node worktree close\`. If the blocker is not mechanical, ask the user with \`crtr human send\`.`, detail);
     }
     const landedSha = runGit(wt.path, ['rev-parse', 'HEAD'], 'landed_sha_failed', 'Inspect the worktree checkout manually, then rerun `crtr node worktree close`.');
     // Fast-forward the local base branch to the worktree tip rebased onto the
@@ -309,7 +313,7 @@ function closeManagedWorktreeLocked(nodeId) {
     // captured tip, so neither can overwrite a concurrent base change.
     const fastForward = gitSync(['merge-base', '--is-ancestor', baseSha, landedSha], wt.repo_root);
     if (fastForward.status !== 0) {
-        throw new WorktreeError('land_base_failed', `rebased worktree is not a fast-forward of local base branch '${wt.base_ref}'`, 'Ask the human with `crtr human ask` how to land this managed worktree.', (fastForward.stderr.trim() || fastForward.stdout.trim()).trim());
+        throw new WorktreeError('land_base_failed', `rebased worktree is not a fast-forward of local base branch '${wt.base_ref}'`, 'Ask the user with `crtr human send` how to land this managed worktree.', (fastForward.stderr.trim() || fastForward.stdout.trim()).trim());
     }
     const baseCheckout = checkoutPathForBranch(wt.repo_root, wt.base_ref);
     if (baseCheckout !== null) {
@@ -319,7 +323,7 @@ function closeManagedWorktreeLocked(nodeId) {
             const detail = checkoutHead.status !== 0
                 ? (checkoutHead.stderr.trim() || actualHead).trim()
                 : `expected ${baseSha}, found ${actualHead}`;
-            throw new WorktreeError('land_base_failed', `local base branch '${wt.base_ref}' changed while this worktree was closing`, `Reconcile the base checkout at ${baseCheckout}, then rerun \`crtr node worktree close\`. If you are unsure, ask the human with \`crtr human ask\`.`, detail);
+            throw new WorktreeError('land_base_failed', `local base branch '${wt.base_ref}' changed while this worktree was closing`, `Reconcile the base checkout at ${baseCheckout}, then rerun \`crtr node worktree close\`. If you are unsure, ask the user with \`crtr human send\`.`, detail);
         }
     }
     const land = baseCheckout !== null
@@ -328,46 +332,21 @@ function closeManagedWorktreeLocked(nodeId) {
     if (land.status !== 0) {
         const detail = (land.stderr.trim() || land.stdout.trim()).trim();
         throw new WorktreeError('land_base_failed', `could not fast-forward local base branch '${wt.base_ref}' to this worktree`, baseCheckout !== null
-            ? `Local base branch '${wt.base_ref}' is checked out at ${baseCheckout} in a state that blocks a fast-forward (uncommitted changes, or it has diverged). Reconcile it there, then rerun \`crtr node worktree close\`. If you are unsure, ask the human with \`crtr human ask\`.`
-            : 'Ask the human with `crtr human ask` how to land this managed worktree.', detail);
-    }
-    // Landing on the local base branch IS the point of no return: persist `state: 'closed'`
-    // IMMEDIATELY, before attempting any cleanup below. Worktree removal and
-    // branch deletion are best-effort from here on — their failure is cosmetic
-    // (a stray checkout / local ref) and must never re-strand `state: 'open'`
-    // behind a dead end that permanently blocks push-final. See
-    // `persistClosedWorktreeState` for why `cwd` is repointed in the same write.
-    persistClosedWorktreeState(nodeId, wt);
-    const { worktreeRemoved, worktreeRemoveError } = bestEffortRemoveWorktreeCheckout(wt, { timeoutMs: WORKTREE_CLEANUP_TIMEOUT_MS });
-    // Delete via the atomic base+branch transaction, keyed on `landedSha` for
-    // BOTH refs: the fast-forward above just moved `refs/heads/<wt.base_ref>`
-    // to `landedSha`, and `wt.branch`'s tip (as of `landedSha`) is provably
-    // contained in it. Binding both refs into one transaction closes the
-    // window a branch-only check leaves open: if a concurrent commit lands a
-    // new tip on this branch, or a concurrent force-reset moves the base off
-    // `landedSha`, before this call runs, the transaction fails closed and
-    // preserves the branch — it cannot ever delete the last ref to work that
-    // is no longer contained in the base. A refusal here is cosmetic and
-    // non-fatal exactly as before: the land already happened (state is closed
-    // above), only cleanup of the source branch is best-effort. Skip the
-    // attempt entirely when the checkout itself could not be removed — this
-    // branch is still checked out somewhere, so deleting its ref underneath
-    // that checkout must never be attempted.
-    const { branchDeleted, branchDeleteError } = worktreeRemoved
-        ? bestEffortDeleteBranchWithBaseProof(wt, landedSha, landedSha)
-        : {
-            branchDeleted: false,
-            branchDeleteError: `local branch ${wt.branch} was left in place because its checkout at ${wt.path} could not be removed automatically; resolve the checkout, then run \`git -C ${shellQuote(wt.repo_root)} branch -D ${shellQuote(wt.branch)}\` after confirming it is merged.`,
-        };
+            ? `Local base branch '${wt.base_ref}' is checked out at ${baseCheckout} in a state that blocks a fast-forward (uncommitted changes, or it has diverged). Reconcile it there, then rerun \`crtr node worktree close\`. If you are unsure, ask the user with \`crtr human send\`.`
+            : 'Ask the user with `crtr human send` how to land this managed worktree.', detail);
+    }
+    // The caller broker still runs from wt.path after this API response. Do not
+    // invoke `git worktree remove`: it recursively deletes the caller's cwd and
+    // a timeout can kill Git between individual unlink operations. Keep the
+    // checkout and its checked-out branch intact in the named pending-cleanup
+    // state; the successful land is still the point of no return for this node.
+    persistClosedWorktreeState(nodeId, wt, 'pending');
     return {
         node_id: nodeId,
         branch: wt.branch,
         worktree_path: wt.path,
         landed_sha: landedSha,
-        worktree_removed: worktreeRemoved,
-        ...(worktreeRemoveError !== undefined ? { worktree_remove_error: worktreeRemoveError } : {}),
-        branch_deleted: branchDeleted,
-        ...(branchDeleteError !== undefined ? { branch_delete_error: branchDeleteError } : {}),
+        ...deferredCleanupResult(wt),
     };
 }
 export function closeManagedWorktree(nodeId) {
@@ -378,114 +357,9 @@ export function closeManagedWorktree(nodeId) {
         return closeManagedWorktreeLocked(nodeId);
     return withRepositoryWorktreeLock(wt.repo_root, () => closeManagedWorktreeLocked(nodeId));
 }
-const defaultWorktreeCleanupRunner = (args, cwd, options) => gitSync(args, cwd, undefined, options);
-let worktreeCleanupRunner = defaultWorktreeCleanupRunner;
-/** Test seam for the bounded post-land cleanup regression. */
-export function setWorktreeCleanupRunnerForTest(runner) {
-    worktreeCleanupRunner = runner ?? defaultWorktreeCleanupRunner;
-}
-function isValidRegisteredCheckout(output, wt) {
-    let path = null;
-    let prunable = false;
-    const samePath = (candidate) => {
-        try {
-            return realpathSync(candidate) === realpathSync(wt.path);
-        }
-        catch {
-            return resolve(candidate) === resolve(wt.path);
-        }
-    };
-    const matches = () => path !== null
-        && samePath(path)
-        && existsSync(path)
-        && existsSync(join(path, '.git'))
-        && !prunable;
-    for (const line of output.split('\n')) {
-        if (line.startsWith('worktree ')) {
-            if (matches())
-                return true;
-            path = line.slice('worktree '.length).trim();
-            prunable = false;
-        }
-        else if (path !== null && line.startsWith('prunable')) {
-            prunable = true;
-        }
-    }
-    return matches();
-}
-function timeoutRecoveryGuidance(wt, options) {
-    const force = `git -C ${shellQuote(wt.repo_root)} worktree remove --force ${shellQuote(wt.path)}`;
-    const prune = `git -C ${shellQuote(wt.repo_root)} worktree prune`;
-    const removeResidual = `rm -rf ${shellQuote(wt.path)}`;
-    try {
-        const inspection = worktreeCleanupRunner(['worktree', 'list', '--porcelain'], wt.repo_root, options);
-        if (inspection.status === 0) {
-            return isValidRegisteredCheckout(inspection.stdout, wt)
-                ? `run \`${force}\` after confirming it is safe to delete.`
-                : `run \`${prune}\`, then run \`${removeResidual}\` after confirming the leftover directory is safe to delete.`;
-        }
-    }
-    catch {
-        // Inspection is advisory only. Emit both recovery shapes when Git could
-        // not tell us which residual state remains.
-    }
-    return `if ${shellQuote(wt.path)} is a valid non-prunable checkout (its .git exists and its worktree-list record is not prunable), run \`${force}\`; otherwise run \`${prune}\` and then \`${removeResidual}\` after confirming it is safe to delete.`;
-}
-/** Best-effort `git worktree remove` shared by a real land (close) and an
- *  auto-drop (nothing was ever landed). Either way `wt.path` IS the calling
- *  node's own pi-process cwd — a process can never chdir itself out of a
- *  directory that vanishes out from under it, so once removal deletes it,
- *  every subsequent bash/chdir in this node fails permanently and the
- *  mandated post-close `crtr push final` can never run. Recreate it as an
- *  empty tombstone directory so the path still resolves regardless. */
-function bestEffortRemoveWorktreeCheckout(wt, options = {}) {
-    const remove = worktreeCleanupRunner(['worktree', 'remove', wt.path], wt.repo_root, options);
-    const worktreeRemoved = remove.status === 0;
-    if (worktreeRemoved && existsSync(wt.path)) {
-        // `git worktree remove` can leave the (now empty) mount dir behind; tidy it best-effort.
-        try {
-            rmdirSync(wt.path);
-        }
-        catch { /* non-empty or busy — leave it */ }
-    }
-    if (!existsSync(wt.path)) {
-        try {
-            mkdirSync(wt.path, { recursive: true });
-        }
-        catch { /* best-effort; leaves cwd broken only if this also fails */ }
-    }
-    if (worktreeRemoved)
-        return { worktreeRemoved };
-    const detail = (remove.stderr.trim() || remove.stdout.trim()).trim();
-    const timeoutDetail = remove.timedOut
-        ? `cleanup timed out after ${options.timeoutMs}ms`
-        : `could not be removed automatically${detail ? ` (${detail})` : ''}`;
-    const manualGuidance = remove.timedOut
-        ? timeoutRecoveryGuidance(wt, options)
-        : `run \`git -C ${shellQuote(wt.repo_root)} worktree remove ${shellQuote(wt.path)}\` after confirming it is safe to delete.`;
-    return {
-        worktreeRemoved,
-        worktreeRemoveError: `the checkout at ${wt.path} ${timeoutDetail} ${manualGuidance}`,
-    };
-}
-/** Atomic multi-ref transaction shared by close and auto-drop: as ONE Git ref
- *  transaction, verifies `refs/heads/<wt.base_ref>` still equals `baseSha`
- *  AND deletes `refs/heads/<wt.branch>` only if it still equals `branchSha`
- *  — both preconditions and the delete are checked and applied together via
- *  `git update-ref --stdin`, which commits every command in its input
- *  atomically (any failed precondition aborts the whole transaction; see
- *  `rollbackManagedWorktreeLocked` above for the single-ref precursor of
- *  this pattern). A single-ref compare-and-delete on the branch alone is not
- *  enough: both callers prove containment against a specific base SHA, and
- *  that base can move (an external force-reset) in the window between the
- *  proof and this call just as easily as the branch can. Binding the base's
- *  live value into the SAME transaction as the branch delete closes that
- *  window — the delete can only succeed at the instant both refs are
- *  simultaneously exactly what was proven, so a base rewrite can never leave
- *  a proven commit unreachable from any head. */
-function bestEffortDeleteBranchWithBaseProof(wt, branchSha, baseSha) {
-    return bestEffortDeleteBranchWithContainmentProof(wt, branchSha, `refs/heads/${wt.base_ref}`, baseSha);
-}
+// ---------------------------------------------------------------------------
+// Push-final auto-drop of a clean, zero-commit managed worktree
+// ---------------------------------------------------------------------------
 /** Delete a source branch only while the ref that proved it already delivered
  *  is still at the exact inspected SHA. `containingRef` can be the recorded
  *  local base or that base's remote-tracking upstream. */
@@ -573,7 +447,7 @@ function proveAbsentPathManagedWorktree(wt) {
  * work is delivered. This deliberately never recommends `worktree close`:
  * that command cannot operate on the absent checkout. */
 export function missingWorktreeRecoveryHint(wt) {
-    return `The recorded checkout path is gone, but crtr cannot prove ${wt.branch} is already delivered. Push or land ${wt.branch}, then rerun \`crtr push final\`; if you cannot establish what happened to the branch, ask the human with \`crtr human ask\`.`;
+    return `The recorded checkout path is gone, but crtr cannot prove ${wt.branch} is already delivered. Push or land ${wt.branch}, then rerun \`crtr push final\`; if you cannot establish what happened to the branch, ask the user with \`crtr human send\`.`;
 }
 /** Fix B's shared "nothing to land" test — the SAME clean-worktree definition
  *  `close`'s own dirty check now naturally satisfies once `.git/info/exclude`
@@ -582,20 +456,11 @@ export function missingWorktreeRecoveryHint(wt) {
  *  be a git-ancestor of (or equal to) the CURRENT tip of its recorded base
  *  branch — i.e. landing it would be a pure no-op. Any ambiguity (missing
  *  path, mid-rebase, wrong branch, an unresolvable base, or a real ancestry
- *  divergence) returns null: this function only ever proves "safe to drop"
+ *  divergence) returns null: this function only ever proves a no-op land
  *  when a live git check establishes it, never on a heuristic guess, so real
- *  unlanded work always falls through to the existing explicit-close guard.
- *  This proof is NOT itself the safety boundary — it only decides whether
- *  auto-drop is even attempted. `autoDropCleanManagedWorktreeLocked` below
- *  re-proves containment against the LIVE base immediately before the
- *  destructive delete, refuses outright if the checkout cannot be removed,
- *  and conditions the delete itself on BOTH `branchSha` and that same live
- *  base SHA via `bestEffortDeleteBranchWithBaseProof`'s atomic multi-ref
- *  transaction — those checks, not this one, are what close the TOCTOU gap.
- *  Exported (alongside
- *  `autoDropCleanManagedWorktreeLocked`) purely so regression tests can
- *  inject a race in the window between proving and cleanup; production code
- *  must always go through `autoDropCleanManagedWorktree`. */
+ *  unlanded work always falls through to the explicit-close guard. The locked
+ *  path re-checks this predicate before recording deferred cleanup; production
+ *  code must always go through `autoDropCleanManagedWorktree`. */
 export function proveCleanEmptyManagedWorktree(wt) {
     if (wt.state !== 'open')
         return null;
@@ -627,13 +492,13 @@ export function proveCleanEmptyManagedWorktree(wt) {
 }
 /** Conclude an absent-path record only after `proveAbsentPathManagedWorktree`
  * has established the same no-unlanded-work property required by auto-drop.
- * There is no checkout left to remove; persistClosedWorktreeState writes the
- * closed record and repoints cwd exactly like the normal tombstone path. */
+ * There is no checkout left to remove; persistClosedWorktreeState records the
+ * completed cleanup and repoints cwd to the durable base checkout. */
 function autoDropAbsentPathManagedWorktreeLocked(nodeId, wt, proof) {
     if (existsSync(wt.path))
         return null;
     if (proof.branchSha === null) {
-        persistClosedWorktreeState(nodeId, wt);
+        persistClosedWorktreeState(nodeId, wt, 'complete');
         return { node_id: nodeId, branch: wt.branch, worktree_path: wt.path, worktree_removed: true, branch_deleted: true };
     }
     if (proof.containingRef === undefined || proof.containingSha === undefined)
@@ -641,93 +506,26 @@ function autoDropAbsentPathManagedWorktreeLocked(nodeId, wt, proof) {
     const { branchDeleted } = bestEffortDeleteBranchWithContainmentProof(wt, proof.branchSha, proof.containingRef, proof.containingSha);
     if (!branchDeleted)
         return null;
-    persistClosedWorktreeState(nodeId, wt);
+    persistClosedWorktreeState(nodeId, wt, 'complete');
     return { node_id: nodeId, branch: wt.branch, worktree_path: wt.path, worktree_removed: true, branch_deleted: true };
 }
-/** Exported (see `proveCleanEmptyManagedWorktree`'s doc) so regression tests
- *  can call it directly with a proof captured before injecting a race.
- *  Returns null — persisting NO state change — when the immediate base
- *  re-verification, the checkout removal, or the atomic base+branch delete
- *  refuses: the caller (`autoDropCleanManagedWorktree`, and `push final`
- *  above it) then falls through to the existing `open_managed_worktree`
- *  guard exactly as if this worktree had never looked droppable. In every
- *  refusal case the branch, and every commit reachable from it, is
- *  unconditionally preserved — that is the actual safety property this
- *  function guarantees. A checkout-removal refusal in particular must be
- *  treated as a full refusal, not a partial success: if the checkout cannot
- *  be removed (e.g. a file reappeared after the clean predicate ran), the
- *  branch is still checked out somewhere, so this function must never reach
- *  the ref-deletion transaction or mutate managed-worktree state — both the
- *  branch and the live checkout stay fully recoverable and the caller's
- *  `open_managed_worktree` guard fires. */
+/** Re-check a clean auto-drop before closing its record. `push final` runs
+ * inside the owner broker, so it has the same destructive-cwd boundary as
+ * explicit close: removal and branch deletion are deferred until that owner
+ * has exited. */
 export function autoDropCleanManagedWorktreeLocked(nodeId, wt, proof) {
-    // Re-verify containment against the LIVE base immediately before doing
-    // anything destructive: the proof above may already be stale by the time
-    // we get here — `withRepositoryWorktreeLock` only serializes crtr's OWN
-    // worktree mutations, not ordinary `git commit`/`git reset` run by any
-    // other process in the checkout, nor an external force-reset of the base
-    // branch. Re-resolving the base and re-running the ancestor check fresh
-    // (rather than trusting `proof.baseSha`) means a base fast-forward keeps a
-    // genuinely-contained tip provably contained, while any other base
-    // rewrite (or the base vanishing) fails this closed before we touch
-    // anything. This SAME `liveBaseSha` is what the ref transaction below
-    // verifies again at the moment of the delete — re-checking it here only
-    // decides whether to attempt cleanup at all; the transaction is what
-    // actually closes the race.
-    let liveBaseSha;
-    try {
-        liveBaseSha = resolveLandableBase(wt.repo_root, wt.base_ref);
-    }
-    catch {
-        return null;
-    }
-    const stillContained = gitSync(['merge-base', '--is-ancestor', proof.branchSha, liveBaseSha], wt.repo_root);
-    if (stillContained.status !== 0)
-        return null;
-    // Checkout removal has to come BEFORE the ref-deletion transaction, not
-    // after: `git worktree remove`'s cleanliness check needs the checked-out
-    // branch's ref to still resolve to compute a diff, so deleting the ref
-    // first turns every tracked file into what looks like an unresolvable path
-    // and `worktree remove` refuses outright (verified directly against git).
-    // This ordering is still safe: removal alone never touches
-    // `refs/heads/<branch>` or anything reachable from it — a commit that
-    // lands here is fully preserved as an ordinary (no longer checked-out)
-    // local branch, exactly as droppable-or-not as it was, until the
-    // transaction below either consumes it or refuses. A removal REFUSAL,
-    // though, must stop cleanup here entirely: low-level ref deletion bypasses
-    // Git's own checked-out-branch protection, so deleting the branch while
-    // its checkout is still live would strand that checkout with no branch to
-    // point at it.
-    const { worktreeRemoved } = bestEffortRemoveWorktreeCheckout(wt);
-    if (!worktreeRemoved)
-        return null;
-    // THE safety boundary: this only succeeds if `refs/heads/<wt.base_ref>` is
-    // still exactly `liveBaseSha` AND `refs/heads/<branch>` is still exactly
-    // `proof.branchSha`, verified and applied as one atomic transaction. A
-    // commit made anywhere in the checkout, or an external rewrite of the
-    // base, at any point up to and including this instant makes the whole
-    // transaction fail closed instead of silently destroying new work. On
-    // refusal the branch, and everything reachable from it, is fully intact
-    // and enumerable; only the convenience checkout may already be gone
-    // (tombstoned by the removal above), recoverable with a fresh
-    // `git worktree add` against the still-live branch. `state` is left
-    // untouched ('open') below specifically so this refusal is never mistaken
-    // for a completed drop.
-    const { branchDeleted } = bestEffortDeleteBranchWithBaseProof(wt, proof.branchSha, liveBaseSha);
-    if (!branchDeleted)
+    const current = proveCleanEmptyManagedWorktree(wt);
+    if (current === null || current.branchSha !== proof.branchSha)
         return null;
-    // Only now — with the branch ref provably gone at the proven SHA and the
-    // base provably unchanged — is it safe to commit to the drop. Reuse the
-    // shared closed-worktree transition (see `persistClosedWorktreeState`) so
-    // this path repoints `cwd` to the base checkout exactly like an explicit
-    // close — a later revive's tombstone-vs-missing-cwd check depends on it.
-    persistClosedWorktreeState(nodeId, wt);
+    // The owner is still running in this checkout while it publishes final.
+    // Preserve its files and checked-out branch; physical cleanup is explicitly
+    // recorded as pending rather than racing Git's recursive removal.
+    persistClosedWorktreeState(nodeId, wt, 'pending');
     return {
         node_id: nodeId,
         branch: wt.branch,
         worktree_path: wt.path,
-        worktree_removed: true,
-        branch_deleted: true,
+        ...deferredCleanupResult(wt),
     };
 }
 /** `push final`'s escape hatch: a managed worktree that has
@@ -737,7 +535,7 @@ export function autoDropCleanManagedWorktreeLocked(nodeId, wt, proof) {
  *  that never had anything to close in the first place (a read-only
  *  review node). Returns null and changes nothing when the worktree is not
  *  PROVABLY empty-and-clean by `proveCleanEmptyManagedWorktree`, OR when a
- *  concurrent mutation invalidates that proof before the destructive delete
+ *  concurrent mutation invalidates that proof before the record is closed
  *  (see `autoDropCleanManagedWorktreeLocked`); the caller's existing
  *  `open_managed_worktree` guard then still applies unchanged — real
  *  commits, real uncommitted changes, and a lost race all require the
@@ -757,8 +555,8 @@ export function autoDropCleanManagedWorktree(nodeId) {
         const locked = openManagedWorktreeForNode(nodeId);
         if (locked === null)
             return null;
-        // Re-prove the matching predicate under the lock before any state or ref
-        // mutation. A path that reappeared follows the ordinary checkout path.
+        // Re-prove the matching predicate under the lock before changing state.
+        // A path that reappeared follows the ordinary checkout path.
         if (!existsSync(locked.path)) {
             const proof = proveAbsentPathManagedWorktree(locked);
             return proof === null ? null : autoDropAbsentPathManagedWorktreeLocked(nodeId, locked, proof);

package/dist/daemon/api/__tests__/seam/profile-delete.test.d.ts

@@ -0,0 +1 @@
+export {};