@north-light/crouter 0.3.318 → 0.3.319

package/dist/core/__tests__/integration/worktree-reap.test.js

@@ -1,842 +0,0 @@
-// Managed worktrees: the reap half — auto-drop of clean checkouts, absent or
-// relocated checkouts, and the atomic branch delete's re-verified predicates
-// against commits landing mid-cleanup. Split from its land half
-// (worktree-land.test.ts) only so the two run as two parallel files.
-import { test, before, after, beforeEach } from 'node:test';
-import assert from 'node:assert/strict';
-import { mkdtempSync, mkdirSync, renameSync, rmSync, existsSync, writeFileSync, chmodSync, realpathSync } from 'node:fs';
-import { spawn } from 'node:child_process';
-import { homedir, tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { gitSync } from '../../git.js';
-import { withExclusiveDirectoryLockAsync } from '../../exclusive-lock.js';
-import { createManagedWorktree, closeManagedWorktree, worktreeLockPathForCommonDir } from '../../worktree.js';
-import { abandonManagedWorktreeAsync } from '../../worktree-mutation-async.js';
-import { reconcileManagedWorktree } from '../../worktree-sweep.js';
-import { createApiServer } from '../../../daemon/api/server.js';
-import { ManagedWorktreeSweepReconciler } from '../../../daemon/reconcilers/managed-worktree-sweep.js';
-import { apiSocketPath } from '../../canvas/paths.js';
-import { ApiError, CrtrClient } from '../../../api/index.js';
-import { createNode, getNode } from '../../canvas/canvas.js';
-import { headlessBrokerHost } from '../../runtime/host.js';
-import { reviveNode } from '../../runtime/revive.js';
-import { bindTestFleet } from '../helpers/fleet.js';
-import { resetFleetForTests } from '../../runtime/fleet.js';
-import { closeDb, migrate, openDb } from '../../canvas/db.js';
-import { closeScopedStores } from '../../scoped-state/db.js';
-import { initializeFreshScopedStore } from '../../scoped-state/migrate.js';
-import { userScopeRoot } from '../../scope.js';
-let home;
-let remoteDir;
-let sourceDir;
-let previousHome;
-const scratchRoot = join(homedir(), '.crouter', 'canvas', 'scratch');
-function run(args, cwd) {
-    const res = gitSync(args, cwd);
-    if (res.status !== 0) {
-        throw new Error(`git ${args.join(' ')} failed in ${cwd}: ${res.stderr || res.stdout}`);
-    }
-}
-function node(id, over = {}) {
-    return {
-        node_id: id,
-        name: id,
-        created: new Date().toISOString(),
-        cwd: '/tmp/work',
-        kind: 'general',
-        mode: 'base',
-        lifecycle: 'terminal',
-        status: 'active',
-        ...over,
-    };
-}
-before(() => {
-    // NOT realpath'd on purpose: the macOS tmpdir is reached through the
-    // `/var` → `/private/var` symlink, so the recorded managed-worktree path and
-    // git's canonical `worktree list` output differ as strings while naming one
-    // directory. Every path-ownership check must judge identity, not spelling.
-    mkdirSync(scratchRoot, { recursive: true });
-    home = mkdtempSync(join(scratchRoot, 'crtr-worktree-home-'));
-    previousHome = process.env['HOME'];
-    process.env['HOME'] = home;
-    process.env['CRTR_HOME'] = home;
-    // Bare "remote" wired up as origin so the test can prove landing NEVER pushes
-    // to it (managed worktrees are based on and land onto local `main` only).
-    remoteDir = mkdtempSync(join(tmpdir(), 'crtr-worktree-remote-'));
-    run(['init', '--bare'], remoteDir);
-    sourceDir = mkdtempSync(join(tmpdir(), 'crtr-worktree-source-'));
-    run(['init', '-b', 'main'], sourceDir);
-    run(['config', 'user.email', 'test@example.com'], sourceDir);
-    run(['config', 'user.name', 'Test'], sourceDir);
-    writeFileSync(join(sourceDir, 'README.md'), 'hello\n');
-    run(['add', '.'], sourceDir);
-    run(['commit', '-m', 'init'], sourceDir);
-    run(['remote', 'add', 'origin', remoteDir], sourceDir);
-    run(['push', '-u', 'origin', 'main'], sourceDir);
-});
-beforeEach(() => {
-    closeDb();
-    closeScopedStores();
-    rmSync(home, { recursive: true, force: true });
-    process.env['CRTR_HOME'] = home;
-    migrate(openDb());
-    initializeFreshScopedStore({ kind: 'user', root: userScopeRoot() });
-});
-after(() => {
-    closeDb();
-    closeScopedStores();
-    rmSync(home, { recursive: true, force: true });
-    rmSync(remoteDir, { recursive: true, force: true });
-    rmSync(sourceDir, { recursive: true, force: true });
-    delete process.env['CRTR_HOME'];
-    if (previousHome === undefined)
-        delete process.env['HOME'];
-    else
-        process.env['HOME'] = previousHome;
-});
-// Fix B (#327/#333): a managed worktree with zero commits ahead of its base
-// and nothing uncommitted has nothing to land — push-final's auto-drop path
-// (autoDropCleanManagedWorktree) must close it without requiring an explicit
-// `node worktree close`.
-test('autoDropCleanManagedWorktree drops a clean, zero-commit worktree', async () => {
-    const { autoDropCleanManagedWorktree } = await import('../../worktree.js');
-    const nodeId = 'wt-auto-drop-empty';
-    const wt = createManagedWorktree(sourceDir, nodeId);
-    createNode(node(nodeId, { cwd: wt.path, managed_worktree: wt }));
-    const result = autoDropCleanManagedWorktree(nodeId);
-    assert.ok(result !== null, 'a worktree with zero commits and a clean tree must be droppable');
-    assert.equal(result?.worktree_removed, false);
-    assert.match(result?.worktree_remove_error ?? '', /cleanup pending/);
-    const meta = getNode(nodeId);
-    assert.equal(meta?.managed_worktree?.state, 'closed');
-    assert.equal(meta?.managed_worktree?.cleanup, 'pending');
-    assert.ok(gitSync(['worktree', 'list', '--porcelain'], sourceDir).stdout.includes(wt.path), 'Git keeps the caller checkout registered until it exits');
-    assert.equal(meta?.cwd, wt.repo_root, 'auto-dropped node cwd repoints to the durable base checkout');
-    assert.equal(gitSync(['rev-parse', '--git-dir'], meta.cwd).status, 0, 'repointed cwd resolves to a real git checkout');
-    assert.ok(existsSync(join(wt.path, '.git')), 'the intact caller worktree remains a git checkout');
-    const outcome = await reconcileManagedWorktree(nodeId, { stillEligible: () => true });
-    assert.equal(outcome.status, 'complete', 'the daemon-owned sweep consumes pending cleanup after the caller exits');
-    assert.equal(existsSync(wt.path), false, 'the sweep removes the deferred caller checkout');
-    assert.equal(gitSync(['show-ref', '--verify', '--quiet', `refs/heads/${wt.branch}`], sourceDir).status, 1, 'the sweep deletes the clean managed branch');
-    const swept = getNode(nodeId)?.managed_worktree;
-    assert.deepEqual({ state: swept?.state, cleanup: swept?.cleanup }, { state: 'closed', cleanup: 'complete' });
-});
-test('a dead managed child keeps its open checkout through the sweep and revives there (#962)', async () => {
-    const repo = mkdtempSync(join(scratchRoot, 'crtr-worktree-962-'));
-    const nodeId = 'wt-sweep-dead-open';
-    const originalLaunch = headlessBrokerHost.launch;
-    try {
-        run(['init', '-b', 'main'], repo);
-        run(['config', 'user.email', 'test@example.com'], repo);
-        run(['config', 'user.name', 'Test'], repo);
-        writeFileSync(join(repo, 'README.md'), 'hello\n');
-        run(['add', '.'], repo);
-        run(['commit', '-m', 'init'], repo);
-        const wt = createManagedWorktree(repo, nodeId);
-        createNode(node(nodeId, { cwd: wt.path, status: 'dead', managed_worktree: wt }));
-        const reconciler = new ManagedWorktreeSweepReconciler();
-        let pass;
-        reconciler.run(Date.now(), {
-            lifecycle: {
-                acceptsDetachedWork: () => true,
-                registerDetached: (work) => { pass = work; },
-            },
-            fleet: { isClaimed: () => false },
-        });
-        await pass;
-        const afterSweep = getNode(nodeId);
-        assert.equal(afterSweep.managed_worktree?.state, 'open', 'a failed launch does not authorize disposal');
-        assert.equal(afterSweep.cwd, wt.path, 'the sweep leaves the durable launch cwd unchanged');
-        assert.ok(existsSync(wt.path), 'the isolated checkout remains available for recovery');
-        const testFleet = bindTestFleet();
-        const launchCwds = [];
-        headlessBrokerHost.launch = (id, _inv, options) => {
-            launchCwds.push(options.cwd);
-            const handle = { pid: process.pid, exited: new Promise(() => { }) };
-            testFleet.fleet.register(id, handle);
-            return handle;
-        };
-        const revived = await reviveNode(nodeId, { resume: false, capacity: 'freeze' });
-        assert.equal(revived.outcome, 'launched');
-        assert.deepEqual(launchCwds, [wt.path], 'a fresh revive launches in the retained managed checkout');
-        const closedId = 'wt-sweep-closed';
-        const closedWt = createManagedWorktree(repo, closedId);
-        createNode(node(closedId, { cwd: closedWt.path, status: 'done', managed_worktree: closedWt }));
-        closeManagedWorktree(closedId);
-        const cleanup = await reconcileManagedWorktree(closedId, { stillEligible: () => true });
-        assert.equal(cleanup.status, 'complete', 'a successful close is still physically cleaned after its engine exits');
-        assert.equal(getNode(closedId)?.cwd, repo, 'a successful close deliberately repoints future launch cwd to the repository root');
-        launchCwds.length = 0;
-        const closedRevive = await reviveNode(closedId, { resume: false, capacity: 'freeze' });
-        assert.equal(closedRevive.outcome, 'launched');
-        assert.deepEqual(launchCwds, [repo], 'a closed node still revives against the repository root');
-    }
-    finally {
-        headlessBrokerHost.launch = originalLaunch;
-        resetFleetForTests();
-        rmSync(repo, { recursive: true, force: true });
-    }
-});
-test('the sweep does not conclude a missing record while its branch survives in a moved repository', async () => {
-    const repo = mkdtempSync(join(scratchRoot, 'crtr-worktree-moved-root-'));
-    const movedRepo = join(scratchRoot, `crtr-worktree-moved-root-destination-${Date.now()}`);
-    const nodeId = 'wt-sweep-moved-root';
-    try {
-        run(['init', '-b', 'main'], repo);
-        run(['config', 'user.email', 'test@example.com'], repo);
-        run(['config', 'user.name', 'Test'], repo);
-        writeFileSync(join(repo, 'README.md'), 'hello\n');
-        run(['add', '.'], repo);
-        run(['commit', '-m', 'init'], repo);
-        const wt = createManagedWorktree(repo, nodeId);
-        createNode(node(nodeId, { cwd: wt.path, status: 'done', managed_worktree: wt }));
-        run(['worktree', 'remove', wt.path], repo);
-        renameSync(repo, movedRepo);
-        const outcome = await reconcileManagedWorktree(nodeId, { stillEligible: () => true });
-        assert.deepEqual(outcome.status === 'refused' ? outcome.reason : undefined, 'repo_unavailable');
-        assert.equal(getNode(nodeId)?.managed_worktree?.state, 'open', 'a missing recorded path cannot prove the worktree branch is gone');
-        assert.equal(gitSync(['show-ref', '--verify', '--quiet', `refs/heads/${wt.branch}`], movedRepo).status, 0, 'the moved repository still holds the managed branch');
-    }
-    finally {
-        rmSync(repo, { recursive: true, force: true });
-        rmSync(movedRepo, { recursive: true, force: true });
-    }
-});
-test('the sweep retries containment when the base upstream advances', async () => {
-    const nodeId = 'wt-sweep-upstream-advance';
-    const wt = createManagedWorktree(sourceDir, nodeId);
-    createNode(node(nodeId, { cwd: wt.path, status: 'done', managed_worktree: wt }));
-    writeFileSync(join(wt.path, 'delivered.txt'), 'delivered remotely\n');
-    run(['add', 'delivered.txt'], wt.path);
-    run(['-c', 'user.email=test@example.com', '-c', 'user.name=Test', 'commit', '-m', 'delivered work'], wt.path);
-    const refused = await reconcileManagedWorktree(nodeId, { stillEligible: () => true });
-    assert.equal(refused.status, 'refused');
-    const before = getNode(nodeId)?.managed_worktree?.sweep?.observed;
-    assert.ok(before, 'the initial refusal records the observation that caused backoff');
-    run(['push', 'origin', `${wt.branch}:main`], wt.path);
-    run(['fetch', 'origin'], sourceDir);
-    const completed = await reconcileManagedWorktree(nodeId, { stillEligible: () => true });
-    assert.equal(completed.status, 'complete', 'a newly contained branch is re-proved instead of remaining in backoff');
-    assert.equal(existsSync(wt.path), false, 'the newly contained checkout is removed');
-});
-test('the sweep refuses a managed checkout with uncommitted changes', async () => {
-    const nodeId = 'wt-sweep-dirty';
-    const wt = createManagedWorktree(sourceDir, nodeId);
-    createNode(node(nodeId, { cwd: wt.path, status: 'done', managed_worktree: wt }));
-    writeFileSync(join(wt.path, 'uncommitted.txt'), 'must survive\n');
-    const outcome = await reconcileManagedWorktree(nodeId, { stillEligible: () => true });
-    assert.equal(outcome.status, 'refused');
-    assert.equal(outcome.status === 'refused' ? outcome.reason : undefined, 'dirty_worktree');
-    assert.ok(existsSync(join(wt.path, 'uncommitted.txt')), 'the uncommitted file remains in the checkout');
-    assert.equal(gitSync(['show-ref', '--verify', '--quiet', `refs/heads/${wt.branch}`], sourceDir).status, 0, 'the managed branch remains');
-    assert.equal(getNode(nodeId)?.managed_worktree?.state, 'open', 'the record remains unreconciled');
-});
-// The lock the sweep holds serializes worktree operations, NOT node lifecycle:
-// a revive can land in any await between the containment proof and the removal.
-// So eligibility is re-asked immediately before every destructive step, and a
-// node that came back keeps the checkout it is now running in.
-test('the sweep stops before removing a checkout whose node revived mid-pass', async () => {
-    const nodeId = 'wt-sweep-revived-mid-pass';
-    const wt = createManagedWorktree(sourceDir, nodeId);
-    createNode(node(nodeId, { cwd: wt.path, status: 'done', managed_worktree: wt }));
-    // True on the first ask (the pass starts), false afterwards (the revive won).
-    // Everything about this worktree is otherwise disposable: it is clean and its
-    // tip is its base, so ONLY the recheck can save it.
-    let asks = 0;
-    const outcome = await reconcileManagedWorktree(nodeId, {
-        stillEligible: () => {
-            asks += 1;
-            return asks === 1;
-        },
-    });
-    assert.ok(asks > 1, 'eligibility is re-asked before the destructive steps, not once per pass');
-    assert.equal(outcome.status, 'skipped');
-    assert.equal(outcome.status === 'skipped' ? outcome.reason : undefined, 'node_no_longer_terminal');
-    assert.ok(existsSync(join(wt.path, '.git')), 'the revived node keeps the checkout it is running in');
-    assert.equal(gitSync(['show-ref', '--verify', '--quiet', `refs/heads/${wt.branch}`], sourceDir).status, 0, 'its branch survives');
-    const record = getNode(nodeId)?.managed_worktree;
-    assert.equal(record?.state, 'open', 'the record is untouched, so a later pass can resume it');
-    assert.equal(record?.sweep, undefined, 'a revived node is not charged a refusal or a backoff');
-});
-test('the sweep refuses unlanded commits when close never recorded land intent', async () => {
-    const nodeId = 'wt-sweep-no-land-intent';
-    const wt = createManagedWorktree(sourceDir, nodeId);
-    createNode(node(nodeId, { cwd: wt.path, status: 'done', managed_worktree: wt }));
-    writeFileSync(join(wt.path, 'unlanded.txt'), 'must survive\n');
-    run(['add', 'unlanded.txt'], wt.path);
-    run(['-c', 'user.email=test@example.com', '-c', 'user.name=Test', 'commit', '-m', 'unlanded work'], wt.path);
-    const branchSha = gitSync(['rev-parse', 'HEAD'], wt.path).stdout.trim();
-    const outcome = await reconcileManagedWorktree(nodeId, { stillEligible: () => true });
-    assert.equal(outcome.status, 'refused');
-    assert.equal(outcome.status === 'refused' ? outcome.reason : undefined, 'unlanded_work');
-    assert.ok(existsSync(wt.path), 'the checkout remains available for a human');
-    assert.equal(gitSync(['rev-parse', wt.branch], sourceDir).stdout.trim(), branchSha, 'the unlanded branch remains intact');
-    assert.equal(getNode(nodeId)?.managed_worktree?.state, 'open', 'the record remains unreconciled');
-});
-test('the sweep removes a rebased branch whose patches already landed', async () => {
-    const nodeId = 'wt-sweep-patch-identity';
-    const wt = createManagedWorktree(sourceDir, nodeId);
-    createNode(node(nodeId, { cwd: wt.path, status: 'done', managed_worktree: wt }));
-    writeFileSync(join(wt.path, 'patch-identity.txt'), 'same content\n');
-    run(['add', 'patch-identity.txt'], wt.path);
-    run(['-c', 'user.email=test@example.com', '-c', 'user.name=Test', 'commit', '-m', 'child patch'], wt.path);
-    const childSha = gitSync(['rev-parse', 'HEAD'], wt.path).stdout.trim();
-    writeFileSync(join(sourceDir, 'patch-identity.txt'), 'same content\n');
-    run(['add', 'patch-identity.txt'], sourceDir);
-    run(['-c', 'user.email=test@example.com', '-c', 'user.name=Test', 'commit', '-m', 'landed independently'], sourceDir);
-    assert.notEqual(gitSync(['rev-parse', 'main'], sourceDir).stdout.trim(), childSha, 'the independently landed patch has a different commit identity');
-    const outcome = await reconcileManagedWorktree(nodeId, { stillEligible: () => true });
-    assert.equal(outcome.status, 'complete', 'patch identity proves the rebased branch content is already present');
-    assert.equal(existsSync(wt.path), false, 'the redundant checkout is removed');
-    assert.equal(gitSync(['show-ref', '--verify', '--quiet', `refs/heads/${wt.branch}`], sourceDir).status, 1, 'the redundant branch is deleted');
-    assert.equal(getNode(nodeId)?.managed_worktree?.cleanup, 'complete');
-});
-test('the sweep removes a squash-merged branch whose merge is a content no-op', async () => {
-    const nodeId = 'wt-sweep-content-noop';
-    const wt = createManagedWorktree(sourceDir, nodeId);
-    createNode(node(nodeId, { cwd: wt.path, status: 'done', managed_worktree: wt }));
-    writeFileSync(join(wt.path, 'squash-one.txt'), 'one\n');
-    run(['add', 'squash-one.txt'], wt.path);
-    run(['-c', 'user.email=test@example.com', '-c', 'user.name=Test', 'commit', '-m', 'first child patch'], wt.path);
-    writeFileSync(join(wt.path, 'squash-two.txt'), 'two\n');
-    run(['add', 'squash-two.txt'], wt.path);
-    run(['-c', 'user.email=test@example.com', '-c', 'user.name=Test', 'commit', '-m', 'second child patch'], wt.path);
-    run(['merge', '--squash', wt.branch], sourceDir);
-    run(['commit', '-m', 'squash landed child work'], sourceDir);
-    const outcome = await reconcileManagedWorktree(nodeId, { stillEligible: () => true });
-    assert.equal(outcome.status, 'complete', 'a content-no-op merge proves squash-landed work is safe to remove');
-    assert.equal(existsSync(wt.path), false, 'the redundant checkout is removed');
-    assert.equal(gitSync(['show-ref', '--verify', '--quiet', `refs/heads/${wt.branch}`], sourceDir).status, 1, 'the squash-landed branch is deleted');
-    assert.equal(getNode(nodeId)?.managed_worktree?.cleanup, 'complete');
-});
-// The same real-commit case close already protects: a worktree with actual
-// unlanded work must NEVER be auto-dropped by push-final.
-// #671 also makes the explicit close terminal: once the checkout was safely
-// removed after remote delivery, close concludes the record rather than
-// sending the node to a recovery command that cannot address an absent path.
-test('closeManagedWorktree concludes an absent checkout whose branch is delivered to its base upstream (#671)', () => {
-    const repo = mkdtempSync(join(tmpdir(), 'crtr-worktree-671-close-'));
-    const remote = mkdtempSync(join(tmpdir(), 'crtr-worktree-671-close-remote-'));
-    try {
-        run(['init', '-b', 'main'], repo);
-        run(['config', 'user.email', 'test@example.com'], repo);
-        run(['config', 'user.name', 'Test'], repo);
-        writeFileSync(join(repo, 'README.md'), 'hello\n');
-        run(['add', '.'], repo);
-        run(['commit', '-m', 'init'], repo);
-        run(['init', '--bare'], remote);
-        run(['remote', 'add', 'origin', remote], repo);
-        run(['push', '-u', 'origin', 'main'], repo);
-        const nodeId = 'wt-671-close';
-        const wt = createManagedWorktree(repo, nodeId);
-        createNode(node(nodeId, { cwd: wt.path, managed_worktree: wt }));
-        writeFileSync(join(wt.path, 'delivered.txt'), 'delivered remotely\n');
-        run(['add', '.'], wt.path);
-        run(['-c', 'user.email=test@example.com', '-c', 'user.name=Test', 'commit', '-m', 'delivered remotely'], wt.path);
-        const deliveredSha = gitSync(['rev-parse', 'HEAD'], wt.path).stdout.trim();
-        run(['push', 'origin', `${wt.branch}:main`], wt.path);
-        run(['fetch', 'origin'], repo);
-        run(['worktree', 'remove', wt.path], repo);
-        const result = closeManagedWorktree(nodeId);
-        assert.equal(result.landed_sha, deliveredSha, 'close reports the already-delivered branch tip');
-        assert.equal(result.worktree_removed, true, 'the absent path is already removed');
-        assert.equal(result.branch_deleted, true, 'the redundant local branch is deleted with upstream proof');
-        assert.equal(getNode(nodeId)?.managed_worktree?.state, 'closed');
-        assert.equal(getNode(nodeId)?.cwd, wt.repo_root, 'the closed record repoints revive to the durable base checkout');
-    }
-    finally {
-        rmSync(repo, { recursive: true, force: true });
-        rmSync(remote, { recursive: true, force: true });
-    }
-});
-// #671 review finding (Major): the recorded path being absent does not mean
-// the branch has no live checkout — `git worktree move` can relocate it
-// elsewhere. The branch must never be low-level-deleted while still checked
-// out somewhere, even when its tip is already contained in the base upstream.
-test('closeManagedWorktree refuses when the recorded path is absent but the branch is checked out elsewhere with uncommitted work', () => {
-    const repo = mkdtempSync(join(tmpdir(), 'crtr-worktree-671-moved-'));
-    const remote = mkdtempSync(join(tmpdir(), 'crtr-worktree-671-moved-remote-'));
-    const movedPath = mkdtempSync(join(tmpdir(), 'crtr-worktree-671-moved-dest-'));
-    rmSync(movedPath, { recursive: true, force: true });
-    try {
-        run(['init', '-b', 'main'], repo);
-        run(['config', 'user.email', 'test@example.com'], repo);
-        run(['config', 'user.name', 'Test'], repo);
-        writeFileSync(join(repo, 'README.md'), 'hello\n');
-        run(['add', '.'], repo);
-        run(['commit', '-m', 'init'], repo);
-        run(['init', '--bare'], remote);
-        run(['remote', 'add', 'origin', remote], repo);
-        run(['push', '-u', 'origin', 'main'], repo);
-        const nodeId = 'wt-671-moved';
-        const wt = createManagedWorktree(repo, nodeId);
-        createNode(node(nodeId, { cwd: wt.path, managed_worktree: wt }));
-        writeFileSync(join(wt.path, 'delivered.txt'), 'delivered remotely\n');
-        run(['add', '.'], wt.path);
-        run(['-c', 'user.email=test@example.com', '-c', 'user.name=Test', 'commit', '-m', 'delivered remotely'], wt.path);
-        run(['push', 'origin', `${wt.branch}:main`], wt.path);
-        run(['fetch', 'origin'], repo);
-        // Relocate the checkout — the recorded `wt.path` is now absent, but the
-        // branch is still live at `movedPath`, and unrelated new work is added
-        // there AFTER the move, so it is not reachable from origin/main.
-        run(['worktree', 'move', wt.path, movedPath], repo);
-        assert.equal(existsSync(wt.path), false, 'the recorded path must actually be absent for this test to be meaningful');
-        writeFileSync(join(movedPath, 'uncommitted-after-move.txt'), 'must not be lost\n');
-        assert.throws(() => closeManagedWorktree(nodeId), (error) => error instanceof Error && 'code' in error && error.code === 'worktree_missing', 'a branch still checked out elsewhere must never be concluded from the absent recorded path alone');
-        assert.equal(getNode(nodeId)?.managed_worktree?.state, 'open', 'the record must stay open — the branch has a live checkout with uncommitted work');
-        const refCheck = gitSync(['rev-parse', '--verify', `refs/heads/${wt.branch}`], repo);
-        assert.equal(refCheck.status, 0, 'the branch must be preserved — it is still checked out');
-        assert.ok(existsSync(join(movedPath, 'uncommitted-after-move.txt')), 'the uncommitted work at the relocated checkout must remain intact');
-    }
-    finally {
-        rmSync(repo, { recursive: true, force: true });
-        rmSync(remote, { recursive: true, force: true });
-        rmSync(movedPath, { recursive: true, force: true });
-    }
-});
-test('autoDropCleanManagedWorktree refuses a worktree with a real commit ahead of base', async () => {
-    const { autoDropCleanManagedWorktree } = await import('../../worktree.js');
-    const nodeId = 'wt-auto-drop-real-work';
-    const wt = createManagedWorktree(sourceDir, nodeId);
-    createNode(node(nodeId, { cwd: wt.path, managed_worktree: wt }));
-    writeFileSync(join(wt.path, 'real-work.txt'), 'work\n');
-    run(['add', '.'], wt.path);
-    run(['-c', 'user.email=test@example.com', '-c', 'user.name=Test', 'commit', '-m', 'real work'], wt.path);
-    const result = autoDropCleanManagedWorktree(nodeId);
-    assert.equal(result, null, 'a worktree with a real commit ahead of base must never be silently dropped');
-    assert.equal(getNode(nodeId)?.managed_worktree?.state, 'open', 'the worktree must remain open for an explicit close');
-    assert.ok(existsSync(wt.path), 'the checkout with real work must remain intact');
-});
-// Real uncommitted (non-crtr-bookkeeping) changes must also refuse auto-drop,
-// even with zero commits.
-test('autoDropCleanManagedWorktree refuses a worktree with real uncommitted changes', async () => {
-    const { autoDropCleanManagedWorktree } = await import('../../worktree.js');
-    const nodeId = 'wt-auto-drop-dirty';
-    const wt = createManagedWorktree(sourceDir, nodeId);
-    createNode(node(nodeId, { cwd: wt.path, managed_worktree: wt }));
-    writeFileSync(join(wt.path, 'uncommitted.txt'), 'not yet committed\n');
-    const result = autoDropCleanManagedWorktree(nodeId);
-    assert.equal(result, null, 'real uncommitted changes must never be silently dropped');
-    assert.equal(getNode(nodeId)?.managed_worktree?.state, 'open');
-});
-test('async close returns the typed lock refusal before the client socket timeout (#1024)', async () => {
-    const nodeId = 'wt-async-close-busy';
-    const wt = createManagedWorktree(sourceDir, nodeId);
-    createNode(node(nodeId, { cwd: wt.path, managed_worktree: wt }));
-    const commonDir = realpathSync(join(sourceDir, gitSync(['rev-parse', '--git-common-dir'], sourceDir).stdout.trim()));
-    const lockModule = new URL('../../exclusive-lock.ts', import.meta.url).href;
-    const child = spawn(process.execPath, ['--import', 'tsx/esm', '--input-type=module', '--eval', `
-    const { withExclusiveDirectoryLockAsync } = await import(${JSON.stringify(lockModule)});
-    await withExclusiveDirectoryLockAsync(${JSON.stringify(worktreeLockPathForCommonDir(commonDir))}, async () => {
-      console.log('locked');
-      await new Promise((resolve) => setTimeout(resolve, 40_000));
-    });
-  `], { env: { ...process.env, CRTR_HOME: home }, stdio: ['ignore', 'pipe', 'pipe'] });
-    try {
-        await new Promise((resolve, reject) => {
-            let output = '';
-            child.stdout.on('data', (chunk) => { output += chunk; if (output.includes('locked'))
-                resolve(); });
-            child.once('error', reject);
-            child.once('exit', (code) => reject(new Error(`lock holder exited before acquiring the lock (${code})`)));
-        });
-        const server = createApiServer();
-        try {
-            await new Promise((resolve) => setTimeout(resolve, 25));
-            const client = new CrtrClient({ socketPath: apiSocketPath(), autostart: false });
-            const started = Date.now();
-            await assert.rejects(client.closeWorktree(nodeId), (error) => error instanceof ApiError && error.code === 'worktree_lock_timeout');
-            assert.ok(Date.now() - started < 30_000, 'the daemon must serialize the typed busy refusal before the 30s client timeout');
-        }
-        finally {
-            await server.close();
-        }
-    }
-    finally {
-        child.kill('SIGTERM');
-    }
-});
-test('async close yields while an async repository holder runs, keeping API requests responsive (#1024)', async () => {
-    const zeroId = 'wt-async-close-zero';
-    const committedId = 'wt-async-close-committed';
-    const zero = createManagedWorktree(sourceDir, zeroId);
-    const committed = createManagedWorktree(sourceDir, committedId);
-    createNode(node(zeroId, { cwd: zero.path, managed_worktree: zero }));
-    createNode(node(committedId, { cwd: committed.path, managed_worktree: committed }));
-    writeFileSync(join(committed.path, 'committed.txt'), 'work\n');
-    run(['add', 'committed.txt'], committed.path);
-    run(['-c', 'user.email=test@example.com', '-c', 'user.name=Test', 'commit', '-m', 'work'], committed.path);
-    const commonDir = realpathSync(join(sourceDir, gitSync(['rev-parse', '--git-common-dir'], sourceDir).stdout.trim()));
-    let release;
-    const held = new Promise((resolve) => { release = resolve; });
-    const holder = withExclusiveDirectoryLockAsync(worktreeLockPathForCommonDir(commonDir), async () => { await held; });
-    await new Promise((resolve) => setTimeout(resolve, 25));
-    const server = createApiServer();
-    try {
-        await new Promise((resolve) => setTimeout(resolve, 25));
-        const client = new CrtrClient({ socketPath: apiSocketPath(), autostart: false });
-        const zeroClose = client.closeWorktree(zeroId);
-        const committedClose = client.closeWorktree(committedId);
-        const responsive = await Promise.race([client.listNodes().then(() => true), new Promise((resolve) => setTimeout(() => resolve(false), 250))]);
-        assert.equal(responsive, true, 'a waiting close must not block another daemon request');
-        release();
-        await holder;
-        const [zeroResult, committedResult] = await Promise.all([zeroClose, committedClose]);
-        assert.equal(zeroResult.landed_sha, zero.base_sha, 'the zero-commit close returns its actual result after the holder releases');
-        assert.equal(committedResult.landed_sha, gitSync(['rev-parse', 'HEAD'], committed.path).stdout.trim(), 'the committed close returns its actual landed result after the holder releases');
-    }
-    finally {
-        release();
-        await holder;
-        await server.close();
-    }
-});
-test('async abandon retains clean committed work after its base branch is deleted without a remote (#929)', async () => {
-    const repo = mkdtempSync(join(tmpdir(), 'crtr-worktree-929-'));
-    try {
-        run(['init', '-b', 'main'], repo);
-        run(['config', 'user.email', 'test@example.com'], repo);
-        run(['config', 'user.name', 'Test'], repo);
-        writeFileSync(join(repo, 'README.md'), 'hello\n');
-        run(['add', '.'], repo);
-        run(['commit', '-m', 'init'], repo);
-        const nodeId = 'wt-abandon-missing-base';
-        const wt = createManagedWorktree(repo, nodeId);
-        createNode(node(nodeId, { cwd: wt.path, status: 'done', managed_worktree: wt }));
-        writeFileSync(join(wt.path, 'committed.txt'), 'committed work\n');
-        run(['add', 'committed.txt'], wt.path);
-        run(['commit', '-m', 'real work'], wt.path);
-        const tipSha = gitSync(['rev-parse', 'HEAD'], wt.path).stdout.trim();
-        assert.equal(gitSync(['remote'], repo).stdout.trim(), '', 'the repository has no remote that could prove delivery');
-        run(['checkout', '--detach'], repo);
-        run(['branch', '-D', 'main'], repo);
-        const result = await abandonManagedWorktreeAsync(nodeId, 'test-invoker');
-        assert.equal(result.branch_deleted, false, 'without containment proof the committed branch must be retained');
-        assert.equal(result.tip_sha, tipSha, 'abandon must retain the exact committed tip');
-        assert.equal(existsSync(wt.path), false, 'abandon removes only the checkout');
-        assert.equal(gitSync(['rev-parse', wt.branch], repo).stdout.trim(), tipSha, 'the retained branch still reaches the committed work');
-        assert.equal(getNode(nodeId)?.managed_worktree?.state, 'abandoned', 'the node records the abandoned disposition');
-    }
-    finally {
-        rmSync(repo, { recursive: true, force: true });
-    }
-});
-test('abandon preserves committed and dirty work, records its retained tip, and releases finalization', async () => {
-    const nodeId = 'wt-abandon';
-    const wt = createManagedWorktree(sourceDir, nodeId);
-    writeFileSync(join(wt.path, 'committed.txt'), 'committed work\n');
-    run(['add', '.'], wt.path);
-    run(['-c', 'user.email=test@example.com', '-c', 'user.name=Test', 'commit', '-m', 'real work'], wt.path);
-    writeFileSync(join(wt.path, 'dirty.txt'), 'dirty work\n');
-    createNode(node(nodeId, { cwd: wt.path, status: 'done', managed_worktree: wt }));
-    const server = createApiServer();
-    try {
-        await new Promise((resolve) => setTimeout(resolve, 25));
-        const client = new CrtrClient({ socketPath: apiSocketPath(), autostart: false });
-        const result = await client.abandonWorktree(nodeId, { by: 'test-invoker' });
-        const meta = getNode(nodeId);
-        assert.equal(gitSync(['rev-parse', wt.branch], sourceDir).stdout.trim(), result.tip_sha, 'the retained branch names the recorded tip');
-        assert.equal(gitSync(['show', `${result.tip_sha}:committed.txt`], sourceDir).stdout, 'committed work\n', 'the pre-existing commit remains reachable');
-        assert.equal(gitSync(['show', `${result.tip_sha}:dirty.txt`], sourceDir).stdout, 'dirty work\n', 'the WIP commit preserves dirty work');
-        assert.equal(gitSync(['show', '-s', '--format=%an <%ae>%n%s%n%(trailers:only)', result.tip_sha], sourceDir).stdout, `crtr-abandon <crtr-abandon@localhost>\ncrtr-abandon\nCrtr-Abandon: ${nodeId} ${meta?.managed_worktree?.abandoned?.at}\n\n`, 'the WIP commit has the reserved author, subject sentinel, and durable trailer');
-        assert.equal(existsSync(wt.path), false, 'the checkout is removed');
-        assert.equal(meta?.managed_worktree?.state, 'abandoned', 'the node records the abandoned disposition');
-        assert.deepEqual(meta?.managed_worktree?.abandoned, { branch: wt.branch, tip_sha: result.tip_sha, at: meta?.managed_worktree?.abandoned?.at, by: 'test-invoker' }, 'the metadata names the retained tip and invoker');
-        assert.equal(meta?.cwd, wt.repo_root, 'the node cwd repoints to the repository root');
-        await client.pushReport(nodeId, { tier: 'final', body: 'abandoned work preserved' });
-        assert.ok(getNode(nodeId)?.final_report, 'push final proceeds after abandon releases the worktree gate');
-    }
-    finally {
-        await server.close();
-    }
-});
-// The actual #327 positive case: a branch with REAL commits whose tip is
-// already contained in a base that moved forward past this worktree's
-// original base_sha (a manager landed the same change another way, without
-// ever going through crtr's own close path). This must auto-drop and, above
-// all, must never lose the work — it stays reachable from the moved base.
-test('autoDropCleanManagedWorktree drops a branch with real commits already contained in a moved base (#327)', async () => {
-    const { autoDropCleanManagedWorktree } = await import('../../worktree.js');
-    const repo = mkdtempSync(join(tmpdir(), 'crtr-worktree-327-'));
-    run(['init', '-b', 'main'], repo);
-    run(['config', 'user.email', 'test@example.com'], repo);
-    run(['config', 'user.name', 'Test'], repo);
-    writeFileSync(join(repo, 'README.md'), 'hello\n');
-    run(['add', '.'], repo);
-    run(['commit', '-m', 'init'], repo);
-    const nodeId = 'wt-327-positive';
-    const wt = createManagedWorktree(repo, nodeId);
-    createNode(node(nodeId, { cwd: wt.path, managed_worktree: wt }));
-    writeFileSync(join(wt.path, 'feature.txt'), 'landed elsewhere\n');
-    run(['add', '.'], wt.path);
-    run(['-c', 'user.email=test@example.com', '-c', 'user.name=Test', 'commit', '-m', 'feature'], wt.path);
-    const branchSha = gitSync(['rev-parse', 'HEAD'], wt.path).stdout.trim();
-    // A manager fast-forwards main past this branch's own tip directly in the
-    // primary checkout — the base moved AFTER the worktree was created, and
-    // this branch's commits are now redundant, not lost.
-    run(['merge', '--ff-only', branchSha], repo);
-    assert.equal(gitSync(['rev-parse', 'main'], repo).stdout.trim(), branchSha);
-    const result = autoDropCleanManagedWorktree(nodeId);
-    assert.ok(result !== null, 'a branch whose commits are already contained in a moved base has nothing left to land');
-    assert.equal(result?.branch_deleted, false);
-    assert.equal(getNode(nodeId)?.managed_worktree?.state, 'closed');
-    assert.equal(getNode(nodeId)?.managed_worktree?.cleanup, 'pending');
-    assert.equal(gitSync(['show-ref', '--verify', '--quiet', `refs/heads/${wt.branch}`], repo).status, 0, 'the caller branch remains checked out until cleanup runs after exit');
-    // The work itself is NOT lost — it stays reachable from main, which is the point.
-    assert.equal(gitSync(['merge-base', '--is-ancestor', branchSha, 'main'], repo).status, 0, 'the landed commit must remain reachable from main after the drop');
-    rmSync(repo, { recursive: true, force: true });
-});
-// A clean child whose recorded base branch vanished has nothing to land only
-// when its live HEAD exactly matches the persisted creation SHA.
-test('autoDropCleanManagedWorktree drops a clean worktree at base_sha when its recorded base branch no longer resolves', async () => {
-    const { autoDropCleanManagedWorktree } = await import('../../worktree.js');
-    const repo = mkdtempSync(join(tmpdir(), 'crtr-worktree-missingbase-'));
-    run(['init', '-b', 'main'], repo);
-    run(['config', 'user.email', 'test@example.com'], repo);
-    run(['config', 'user.name', 'Test'], repo);
-    writeFileSync(join(repo, 'README.md'), 'hello\n');
-    run(['add', '.'], repo);
-    run(['commit', '-m', 'init'], repo);
-    const nodeId = 'wt-missing-base';
-    const wt = createManagedWorktree(repo, nodeId);
-    createNode(node(nodeId, { cwd: wt.path, managed_worktree: wt }));
-    // The recorded base branch ('main') has been renamed away since creation.
-    run(['branch', '-m', 'main', 'renamed-main'], repo);
-    const result = autoDropCleanManagedWorktree(nodeId);
-    assert.ok(result !== null, 'a clean worktree exactly at its recorded base SHA has nothing to land');
-    assert.equal(getNode(nodeId)?.managed_worktree?.state, 'closed');
-    assert.ok(existsSync(wt.path));
-    rmSync(repo, { recursive: true, force: true });
-});
-// Reap may take the same missing-base no-op only after show-ref completed with
-// its documented absent-ref status; inspection failures must remain visible.
-test('autoDropCleanManagedWorktree surfaces a failed base ref inspection', async () => {
-    const { autoDropCleanManagedWorktree } = await import('../../worktree.js');
-    const nodeId = 'wt-reap-base-ref-inspection-failure';
-    const wt = createManagedWorktree(sourceDir, nodeId);
-    createNode(node(nodeId, { cwd: wt.path, managed_worktree: wt }));
-    const wrapperDir = mkdtempSync(join(tmpdir(), 'crtr-git-wrapper-'));
-    const wrapperPath = join(wrapperDir, 'git');
-    const originalPath = process.env['PATH'] ?? '';
-    writeFileSync(wrapperPath, `#!/bin/sh
-if [ "$1" = "show-ref" ] && [ "$2" = "--verify" ] && [ "$3" = "--quiet" ] && [ "$4" = "refs/heads/main" ]; then
-  echo "simulated unreadable ref store" >&2
-  exit 128
-fi
-PATH="$CRTR_TEST_REAL_PATH" exec git "$@"
-`);
-    chmodSync(wrapperPath, 0o755);
-    process.env['CRTR_TEST_REAL_PATH'] = originalPath;
-    process.env['PATH'] = `${wrapperDir}:${originalPath}`;
-    try {
-        assert.throws(() => autoDropCleanManagedWorktree(nodeId), (error) => error instanceof Error
-            && 'code' in error
-            && error.code === 'base_branch_inspection_failed'
-            && 'detail' in error
-            && typeof error.detail === 'string'
-            && error.detail.includes('status: 128')
-            && error.detail.includes('stderr: simulated unreadable ref store'));
-    }
-    finally {
-        process.env['PATH'] = originalPath;
-        delete process.env['CRTR_TEST_REAL_PATH'];
-        rmSync(wrapperDir, { recursive: true, force: true });
-        run(['worktree', 'remove', wt.path], sourceDir);
-        run(['branch', '-D', wt.branch], sourceDir);
-    }
-    assert.equal(getNode(nodeId)?.managed_worktree?.state, 'open', 'the failed inspection must not mark a clean worktree closed');
-    assert.ok(!existsSync(wt.path), 'the test must clean up its temporary checkout');
-});
-// The Critical fix: the TOCTOU race between proving clean-and-contained and
-// the destructive branch delete. `proveCleanEmptyManagedWorktree` and
-// `autoDropCleanManagedWorktreeLocked` are exported specifically so these
-// tests can inject a race deterministically in the window between them —
-// exactly the window the repository lock does NOT close (it only serializes
-// crtr's own worktree mutations, not ordinary `git commit`/`git reset`/an
-// external base rewrite run by any other process against the checkout).
-// A concurrent commit lands on the managed branch after the predicate proved
-// it clean-and-contained, but before cleanup deletes it. The atomic
-// compare-and-delete must refuse, leaving the branch (and the new commit)
-// fully intact.
-test('the atomic delete refuses when a commit lands on the branch between the predicate and cleanup', async () => {
-    const { proveCleanEmptyManagedWorktree, autoDropCleanManagedWorktreeLocked } = await import('../../worktree.js');
-    const nodeId = 'wt-race-branch-commit';
-    const wt = createManagedWorktree(sourceDir, nodeId);
-    createNode(node(nodeId, { cwd: wt.path, managed_worktree: wt }));
-    const proof = proveCleanEmptyManagedWorktree(wt);
-    assert.ok(proof !== null, 'a fresh clean, zero-commit worktree must prove droppable');
-    // Simulate a concurrent process committing new work on the managed branch
-    // in the window between the predicate and cleanup.
-    writeFileSync(join(wt.path, 'concurrent-work.txt'), 'a real commit landed mid-cleanup\n');
-    run(['add', '.'], wt.path);
-    run(['-c', 'user.email=test@example.com', '-c', 'user.name=Test', 'commit', '-m', 'concurrent work'], wt.path);
-    const concurrentSha = gitSync(['rev-parse', 'HEAD'], wt.path).stdout.trim();
-    assert.notEqual(concurrentSha, proof?.branchSha, 'the branch must have actually moved past the proven SHA for this test to be meaningful');
-    const result = autoDropCleanManagedWorktreeLocked(nodeId, wt, proof);
-    assert.equal(result, null, 'the atomic delete must refuse once the branch has moved past the proven SHA');
-    assert.equal(getNode(nodeId)?.managed_worktree?.state, 'open', 'state must stay open — nothing may be marked safely dropped');
-    assert.ok(existsSync(wt.path), 'the path must still resolve (tombstoned if the checkout itself was removed) — never left dangling');
-    // The actual safety property: the branch ref, and the concurrent commit it
-    // now names, are fully preserved — regardless of whether the checkout
-    // itself survived (git requires removing it before the ref delete can even
-    // be attempted; see the ordering note on autoDropCleanManagedWorktreeLocked).
-    const refCheck = gitSync(['rev-parse', '--verify', `refs/heads/${wt.branch}`], wt.repo_root);
-    assert.equal(refCheck.status, 0, 'the branch ref must still exist');
-    assert.equal(refCheck.stdout.trim(), concurrentSha, 'the branch, and the concurrent commit it names, must still be reachable — nothing was lost');
-});
-// An external rewrite of the base branch (e.g. a force-reset) invalidates the
-// containment proof in the same window. The re-verification immediately
-// before the delete must catch this even though the branch itself never
-// moved.
-test('the re-verified base containment refuses when the base is rewritten between the predicate and cleanup', async () => {
-    const { proveCleanEmptyManagedWorktree, autoDropCleanManagedWorktreeLocked } = await import('../../worktree.js');
-    const repo = mkdtempSync(join(tmpdir(), 'crtr-worktree-race-base-'));
-    run(['init', '-b', 'main'], repo);
-    run(['config', 'user.email', 'test@example.com'], repo);
-    run(['config', 'user.name', 'Test'], repo);
-    writeFileSync(join(repo, 'README.md'), 'hello\n');
-    run(['add', '.'], repo);
-    run(['commit', '-m', 'init'], repo);
-    const nodeId = 'wt-race-base-rewrite';
-    const wt = createManagedWorktree(repo, nodeId);
-    createNode(node(nodeId, { cwd: wt.path, managed_worktree: wt }));
-    const proof = proveCleanEmptyManagedWorktree(wt);
-    assert.ok(proof !== null, 'a fresh clean, zero-commit worktree must prove droppable');
-    // Simulate an external force-reset of the base branch in the same window —
-    // an unrelated rewrite (not a fast-forward), so the proven branch tip is no
-    // longer an ancestor of the new base tip.
-    writeFileSync(join(repo, 'rewritten.txt'), 'unrelated history\n');
-    run(['add', '.'], repo);
-    run(['-c', 'user.email=test@example.com', '-c', 'user.name=Test', 'commit', '--amend', '-m', 'rewritten base tip'], repo);
-    const rewrittenBaseSha = gitSync(['rev-parse', 'main'], repo).stdout.trim();
-    assert.notEqual(rewrittenBaseSha, proof?.baseSha, 'the base must have actually moved for this test to be meaningful');
-    const stillAncestor = gitSync(['merge-base', '--is-ancestor', proof.branchSha, rewrittenBaseSha], repo);
-    assert.notEqual(stillAncestor.status, 0, 'the rewrite must actually break containment for this test to be meaningful');
-    const result = autoDropCleanManagedWorktreeLocked(nodeId, wt, proof);
-    assert.equal(result, null, 'a base rewrite that breaks containment must refuse the drop');
-    assert.equal(getNode(nodeId)?.managed_worktree?.state, 'open', 'state must stay open — nothing may be marked safely dropped');
-    assert.ok(existsSync(wt.path), 'the checkout must remain intact');
-    assert.equal(gitSync(['show-ref', '--verify', '--quiet', `refs/heads/${wt.branch}`], repo).status, 0, 'the branch ref must still exist — nothing was lost');
-    rmSync(repo, { recursive: true, force: true });
-});
-// The base-ref TOCTOU: a branch-only compare-and-delete refuses when the
-// BRANCH moves, but a base force-reset between the containment proof and the
-// delete could still leave the delete's own condition (the branch equals the
-// proven SHA) satisfied while the branch is no longer contained in anything.
-// `bestEffortDeleteBranchWithBaseProof` closes this by binding the base's
-// live value into the SAME atomic transaction as the branch delete. These
-// tests reproduce the race against real Git by wrapping the `git worktree
-// remove` call each cleanup path makes strictly between its live ancestry
-// re-check and its ref-deletion transaction — the same technique used above
-// for the branch-only race, and the same one the independent re-review used
-// to reproduce this exact Critical against `6de1c8d`.
-test('close-landed atomic delete refuses when the base is force-reset between landing and the cleanup delete', () => {
-    const repo = mkdtempSync(join(tmpdir(), 'crtr-worktree-close-base-window-'));
-    run(['init', '-b', 'main'], repo);
-    run(['config', 'user.email', 'test@example.com'], repo);
-    run(['config', 'user.name', 'Test'], repo);
-    writeFileSync(join(repo, 'README.md'), 'hello\n');
-    run(['add', '.'], repo);
-    run(['commit', '-m', 'init'], repo);
-    const preLandMainSha = gitSync(['rev-parse', 'main'], repo).stdout.trim();
-    const nodeId = 'wt-close-base-window';
-    const wt = createManagedWorktree(repo, nodeId);
-    createNode(node(nodeId, { cwd: wt.path, managed_worktree: wt }));
-    writeFileSync(join(wt.path, 'feature.txt'), 'work\n');
-    run(['add', '.'], wt.path);
-    run(['-c', 'user.email=test@example.com', '-c', 'user.name=Test', 'commit', '-m', 'feature'], wt.path);
-    // Wrap `git worktree remove` — the call `bestEffortRemoveWorktreeCheckout`
-    // makes right after landing (fast-forwarding main to the new tip) but
-    // strictly before the atomic base+branch delete transaction — to reset main
-    // away from the just-landed tip in exactly that window.
-    const wrapperDir = mkdtempSync(join(tmpdir(), 'crtr-git-wrapper-'));
-    const wrapperPath = join(wrapperDir, 'git');
-    const originalPath = process.env['PATH'] ?? '';
-    writeFileSync(wrapperPath, `#!/bin/sh
-if [ "$1" = "worktree" ] && [ "$2" = "remove" ] && [ "$3" = "${wt.path}" ]; then
-  PATH="$CRTR_TEST_REAL_PATH" git -C "${repo}" update-ref refs/heads/main "${preLandMainSha}"
-fi
-PATH="$CRTR_TEST_REAL_PATH" exec git "$@"
-`);
-    chmodSync(wrapperPath, 0o755);
-    process.env['CRTR_TEST_REAL_PATH'] = originalPath;
-    process.env['PATH'] = `${wrapperDir}:${originalPath}`;
-    let result;
-    try {
-        result = closeManagedWorktree(nodeId);
-    }
-    finally {
-        process.env['PATH'] = originalPath;
-        delete process.env['CRTR_TEST_REAL_PATH'];
-        rmSync(wrapperDir, { recursive: true, force: true });
-    }
-    assert.equal(result.branch_deleted, false, 'a base reset in the window between landing and cleanup must refuse the branch delete');
-    assert.ok(result.branch_delete_error, 'the refusal must be surfaced as a non-fatal cleanup error');
-    assert.equal(getNode(nodeId)?.managed_worktree?.state, 'closed', 'the land already succeeded — a cleanup refusal must not un-close it');
-    const refCheck = gitSync(['rev-parse', '--verify', `refs/heads/${wt.branch}`], repo);
-    assert.equal(refCheck.status, 0, 'the source branch must be preserved when cleanup refuses');
-    assert.equal(refCheck.stdout.trim(), result.landed_sha, 'the preserved branch must still name the landed commit — no orphaned landed commit');
-    rmSync(repo, { recursive: true, force: true });
-});
-// Checkout-removal refusal: `bestEffortRemoveWorktreeCheckout` can report
-// `worktreeRemoved: false` (real Git refused `worktree remove` because a
-// file reappeared after the clean predicate ran). That refusal must itself
-// refuse the whole cleanup — never reach the low-level ref-deletion
-// transaction, which bypasses Git's own checked-out-branch protection.
-test('auto-drop refuses and preserves the branch and checkout when checkout removal is refused after the clean predicate', async () => {
-    const { proveCleanEmptyManagedWorktree, autoDropCleanManagedWorktreeLocked } = await import('../../worktree.js');
-    const nodeId = 'wt-auto-drop-removal-refused';
-    const wt = createManagedWorktree(sourceDir, nodeId);
-    createNode(node(nodeId, { cwd: wt.path, managed_worktree: wt }));
-    const proof = proveCleanEmptyManagedWorktree(wt);
-    assert.ok(proof !== null, 'a fresh clean, zero-commit worktree must prove droppable');
-    // A file appears after the clean predicate ran — real `git worktree
-    // remove` (no --force) correctly refuses to remove a dirty checkout.
-    writeFileSync(join(wt.path, 'late-arrival.txt'), 'appeared after the clean predicate\n');
-    const result = autoDropCleanManagedWorktreeLocked(nodeId, wt, proof);
-    assert.equal(result, null, 'a checkout-removal refusal must refuse the whole drop, not just skip the branch delete');
-    assert.equal(getNode(nodeId)?.managed_worktree?.state, 'open', 'refused cleanup must never mutate managed-worktree state');
-    assert.equal(gitSync(['show-ref', '--verify', '--quiet', `refs/heads/${wt.branch}`], sourceDir).status, 0, 'the branch must never reach the ref-deletion transaction');
-    const list = gitSync(['worktree', 'list', '--porcelain'], sourceDir);
-    assert.ok(list.stdout.includes(wt.path), 'the checkout must remain registered and recoverable');
-    assert.ok(existsSync(join(wt.path, 'late-arrival.txt')), 'the live checkout, including its uncommitted file, must remain intact');
-});
-test('close-landed never low-level-deletes the source branch when checkout removal is refused', () => {
-    const nodeId = 'wt-close-removal-refused';
-    const wt = createManagedWorktree(sourceDir, nodeId);
-    createNode(node(nodeId, { cwd: wt.path, managed_worktree: wt }));
-    writeFileSync(join(wt.path, 'removal-refused-work.txt'), 'work\n');
-    run(['add', '.'], wt.path);
-    run(['-c', 'user.email=test@example.com', '-c', 'user.name=Test', 'commit', '-m', 'feature'], wt.path);
-    // Wrap `git worktree remove` to drop an untracked file into the checkout
-    // immediately before delegating to the real removal, so the real
-    // `git worktree remove` (no --force) refuses — exactly as it would if a
-    // process wrote into the checkout after close's own dirty check ran.
-    const wrapperDir = mkdtempSync(join(tmpdir(), 'crtr-git-wrapper-'));
-    const wrapperPath = join(wrapperDir, 'git');
-    const originalPath = process.env['PATH'] ?? '';
-    writeFileSync(wrapperPath, `#!/bin/sh
-if [ "$1" = "worktree" ] && [ "$2" = "remove" ] && [ "$3" = "${wt.path}" ]; then
-  echo "late arrival" > "${wt.path}/late-arrival.txt"
-fi
-PATH="$CRTR_TEST_REAL_PATH" exec git "$@"
-`);
-    chmodSync(wrapperPath, 0o755);
-    process.env['CRTR_TEST_REAL_PATH'] = originalPath;
-    process.env['PATH'] = `${wrapperDir}:${originalPath}`;
-    let result;
-    try {
-        result = closeManagedWorktree(nodeId);
-    }
-    finally {
-        process.env['PATH'] = originalPath;
-        delete process.env['CRTR_TEST_REAL_PATH'];
-        rmSync(wrapperDir, { recursive: true, force: true });
-    }
-    assert.equal(result.worktree_removed, false, 'the real checkout removal must genuinely refuse');
-    assert.equal(result.branch_deleted, false, 'a checkout-removal refusal must never be treated as safe to low-level-delete the branch');
-    assert.equal(getNode(nodeId)?.managed_worktree?.state, 'closed', 'the land already succeeded — a cleanup refusal must not un-close it');
-    const refCheck = gitSync(['rev-parse', '--verify', `refs/heads/${wt.branch}`], sourceDir);
-    assert.equal(refCheck.status, 0, 'the source branch must be preserved when its checkout could not be removed');
-    assert.equal(refCheck.stdout.trim(), result.landed_sha, 'the preserved branch must still name the landed commit');
-});