@webpieces/repo-workflow-core 0.0.1

package/src/merged-branches.js

@@ -0,0 +1,521 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MergedBranchesService = exports.ADJUDICATED_CLASSIFICATIONS = exports.CLASSIFICATION_DETACHED = exports.CLASSIFICATION_CURRENT = exports.CLASSIFICATION_LOCKED = exports.CLASSIFICATION_PRUNABLE = exports.CLASSIFICATION_IN_USE = exports.CLASSIFICATION_NEVER_PROPOSED = exports.CLASSIFICATION_CONTENT_IN_MAIN = exports.CLASSIFICATION_SUPERSEDED = exports.CLASSIFICATION_NO_COMMITS = exports.CLASSIFICATION_BACKUP_OF_LIVE = exports.CLASSIFICATION_BACKUP_OF_MERGED = exports.CLASSIFICATION_MERGED_PR = exports.CACHE_STALE_AFTER_MS = exports.CacheFreshness = exports.MergedBranchesCache = exports.DeletableWorktree = exports.DeletableBranch = exports.MergedBranch = void 0;
+const tslib_1 = require("tslib");
+const child_process_1 = require("child_process");
+const fs = tslib_1.__importStar(require("fs"));
+const inversify_1 = require("inversify");
+const tooling_common_1 = require("@webpieces/tooling-common");
+const tooling_common_2 = require("@webpieces/tooling-common");
+const to_error_1 = require("@webpieces/tooling-common/to-error");
+const worktrees_1 = require("./worktrees");
+const worktree_lock_verdicts_1 = require("./worktree-lock-verdicts");
+const merged_branch_verdicts_1 = require("./merged-branch-verdicts");
+var merged_branch_verdicts_2 = require("./merged-branch-verdicts");
+Object.defineProperty(exports, "MergedBranch", { enumerable: true, get: function () { return merged_branch_verdicts_2.MergedBranch; } });
+Object.defineProperty(exports, "DeletableBranch", { enumerable: true, get: function () { return merged_branch_verdicts_2.DeletableBranch; } });
+Object.defineProperty(exports, "DeletableWorktree", { enumerable: true, get: function () { return merged_branch_verdicts_2.DeletableWorktree; } });
+Object.defineProperty(exports, "MergedBranchesCache", { enumerable: true, get: function () { return merged_branch_verdicts_2.MergedBranchesCache; } });
+Object.defineProperty(exports, "CacheFreshness", { enumerable: true, get: function () { return merged_branch_verdicts_2.CacheFreshness; } });
+Object.defineProperty(exports, "CACHE_STALE_AFTER_MS", { enumerable: true, get: function () { return merged_branch_verdicts_2.CACHE_STALE_AFTER_MS; } });
+Object.defineProperty(exports, "CLASSIFICATION_MERGED_PR", { enumerable: true, get: function () { return merged_branch_verdicts_2.CLASSIFICATION_MERGED_PR; } });
+Object.defineProperty(exports, "CLASSIFICATION_BACKUP_OF_MERGED", { enumerable: true, get: function () { return merged_branch_verdicts_2.CLASSIFICATION_BACKUP_OF_MERGED; } });
+Object.defineProperty(exports, "CLASSIFICATION_BACKUP_OF_LIVE", { enumerable: true, get: function () { return merged_branch_verdicts_2.CLASSIFICATION_BACKUP_OF_LIVE; } });
+Object.defineProperty(exports, "CLASSIFICATION_NO_COMMITS", { enumerable: true, get: function () { return merged_branch_verdicts_2.CLASSIFICATION_NO_COMMITS; } });
+Object.defineProperty(exports, "CLASSIFICATION_SUPERSEDED", { enumerable: true, get: function () { return merged_branch_verdicts_2.CLASSIFICATION_SUPERSEDED; } });
+Object.defineProperty(exports, "CLASSIFICATION_CONTENT_IN_MAIN", { enumerable: true, get: function () { return merged_branch_verdicts_2.CLASSIFICATION_CONTENT_IN_MAIN; } });
+Object.defineProperty(exports, "CLASSIFICATION_NEVER_PROPOSED", { enumerable: true, get: function () { return merged_branch_verdicts_2.CLASSIFICATION_NEVER_PROPOSED; } });
+Object.defineProperty(exports, "CLASSIFICATION_IN_USE", { enumerable: true, get: function () { return merged_branch_verdicts_2.CLASSIFICATION_IN_USE; } });
+Object.defineProperty(exports, "CLASSIFICATION_PRUNABLE", { enumerable: true, get: function () { return merged_branch_verdicts_2.CLASSIFICATION_PRUNABLE; } });
+Object.defineProperty(exports, "CLASSIFICATION_LOCKED", { enumerable: true, get: function () { return merged_branch_verdicts_2.CLASSIFICATION_LOCKED; } });
+Object.defineProperty(exports, "CLASSIFICATION_CURRENT", { enumerable: true, get: function () { return merged_branch_verdicts_2.CLASSIFICATION_CURRENT; } });
+Object.defineProperty(exports, "CLASSIFICATION_DETACHED", { enumerable: true, get: function () { return merged_branch_verdicts_2.CLASSIFICATION_DETACHED; } });
+Object.defineProperty(exports, "ADJUDICATED_CLASSIFICATIONS", { enumerable: true, get: function () { return merged_branch_verdicts_2.ADJUDICATED_CLASSIFICATIONS; } });
+/**
+ * The "which local branches are dead?" cache.
+ *
+ * WHY a cache, and why a STALE one is correct: cleanup is eventual, never urgent. A branch that
+ * merged 30 seconds ago simply survives until the next refresh — nobody cares. So the (slow, network)
+ * merged-PR lookup runs in the DETACHED background refresher, and the branch-creation-guard only READS
+ * this file on its blocking path. Staleness is the whole point: it is what keeps the guard fast.
+ *
+ * WHY the GitHub PR API and not git: the repo squash-merges, which destroys BOTH commit ancestry and
+ * patch-id. `git branch --merged` and `git cherry` therefore report merged branches as unmerged
+ * (observed: deanhiller/config-overhaul, PR #188, merged — yet its patch is absent from main). A MERGED
+ * PR is the only trustworthy signal, and ONE bulk `gh pr list --state merged` answers for every branch.
+ */
+const MERGED_BRANCHES_FILE = 'merged-branches.json';
+// How many merged PRs to pull in the single bulk lookup. Branches older than this window are
+// vanishingly unlikely to still be checked out locally; if one is, it lands in `keep` and a human
+// decides — the fail-safe direction.
+const MERGED_PR_LOOKUP_LIMIT = 100;
+// Suffixes the squash-merge tooling appends to a feature branch when it snapshots it mid-sync
+// (base → baseSquash / basewp2 / basePreMerge3). GitHub has never seen these SHAs, so no PR will ever
+// name them — they can only be reaped by stripping back to the base branch they were cloned from.
+const BACKUP_SUFFIX = /(?:Squash|PreMerge\d*|wp\d+)$/;
+/**
+ * Internal: the bulk PR lookup, indexed.
+ *
+ * `merged` drives the DELETE verdicts and comes from the `--state merged` call, unchanged — the
+ * reaping logic must not get looser or tighter here. `state` is display-only, from a second
+ * `--state all` call, and answers the question a human needs in order to say "yes, delete it":
+ * was there a PR at all, and did it close without merging? It fails soft to an empty map.
+ */
+class PrRef {
+    number;
+    state;
+    constructor(prNumber, state) {
+        this.number = prNumber;
+        this.state = state;
+    }
+}
+class PrLookup {
+    merged;
+    state;
+    /**
+     * Highest merged PR number seen. A branch whose own PR CLOSED UNMERGED below this number means work
+     * kept landing after it was abandoned — the "superseded by a later PR" signal, obtained without
+     * having to guess WHICH PR superseded it.
+     */
+    latestMergedPr;
+    constructor(merged, state, latestMergedPr = 0) {
+        this.merged = merged;
+        this.state = state;
+        this.latestMergedPr = latestMergedPr;
+    }
+}
+// Internal: a classification result. `deletable` is the decision; `entry` carries the branch + reason
+// either way (a spared branch still needs its reason recorded, and it has no PR to key off).
+class Verdict {
+    deletable;
+    entry;
+    constructor(deletable, entry) {
+        this.deletable = deletable;
+        this.entry = entry;
+    }
+}
+let MergedBranchesService = class MergedBranchesService {
+    worktrees;
+    dotDir;
+    atomicFile;
+    locks;
+    // Defaulted so the non-DI call sites (`new MergedBranchesService()` in the guard and the detached
+    // refresher) keep working, while inversify still injects the singleton when resolved from a container.
+    constructor(worktrees = new worktrees_1.WorktreeService(), dotDir = tooling_common_2.dotWebpieces, atomicFile = new tooling_common_1.AtomicFile(), locks = new worktree_lock_verdicts_1.WorktreeLockVerdicts()) {
+        this.worktrees = worktrees;
+        this.dotDir = dotDir;
+        this.atomicFile = atomicFile;
+        this.locks = locks;
+    }
+    /**
+     * SHARED scope — one per repo, in the primary clone, NOT one per worktree. This file's contents
+     * describe every branch AND every worktree in the repo, so a per-worktree copy was a repo-wide fact
+     * stored N times and therefore N times wrong: branch-creation-guard reported "8 parked local
+     * branches" against an actual 1, reading a copy that predated deletions made from another worktree.
+     */
+    mergedBranchesPath(repoRoot) {
+        return this.dotDir.sharedFile(repoRoot, MERGED_BRANCHES_FILE);
+    }
+    // Pure read — any error (missing file, malformed JSON) returns null so the guard fails OPEN.
+    readMergedBranches(repoRoot) {
+        // eslint-disable-next-line @webpieces/no-unmanaged-exceptions
+        try {
+            const cachePath = this.mergedBranchesPath(repoRoot);
+            if (!fs.existsSync(cachePath))
+                return null;
+            const raw = JSON.parse(fs.readFileSync(cachePath, 'utf8'));
+            return new merged_branch_verdicts_1.MergedBranchesCache(raw.timestamp ?? '', this.reviveList(raw.deletable), this.reviveList(raw.keep), this.reviveWorktrees(raw.worktrees));
+        }
+        catch (err) {
+            const error = (0, to_error_1.toError)(err);
+            void error;
+            return null;
+        }
+    }
+    /**
+     * How old is this cache, and may its numbers be quoted as fact?
+     *
+     * `now` is a parameter purely so the specs can pin it; every caller passes nothing.
+     */
+    freshness(cache, now = Date.now()) {
+        const written = Date.parse(cache.timestamp);
+        if (Number.isNaN(written))
+            return new merged_branch_verdicts_1.CacheFreshness(true, -1, cache.timestamp);
+        const ageMs = Math.max(0, now - written);
+        const ageMinutes = Math.floor(ageMs / 60000);
+        return new merged_branch_verdicts_1.CacheFreshness(ageMs > merged_branch_verdicts_1.CACHE_STALE_AFTER_MS, ageMinutes, cache.timestamp);
+    }
+    /**
+     * Drop every cached verdict whose subject no longer exists, using only LOCAL, instant git reads.
+     *
+     * The verdicts themselves are NOT re-derived here — that is the detached refresher's job and it
+     * needs the network. This answers a different and much cheaper question: does this branch / this
+     * worktree still exist at all? A cache written before a `git branch -D` or a `git worktree remove`
+     * keeps naming things that are gone, and a reader that counts those entries reports a repo that
+     * does not exist (observed: 8 parked branches asserted against an actual 1) and then blocks on it.
+     *
+     * Fails toward the cache: if git cannot answer (empty branch list), the cache is returned untouched
+     * rather than emptied, since "git failed" must never read as "everything was deleted".
+     */
+    reconcile(repoRoot, cache) {
+        const live = new Set(this.localBranches(repoRoot));
+        const trees = this.worktrees.listWorktrees(repoRoot);
+        const livePaths = new Set(trees.map((tree) => tree.path));
+        const keepBranch = (entry) => live.size === 0 || live.has(entry.branch);
+        const keepTree = (entry) => trees.length === 0 || livePaths.has(entry.path);
+        return new merged_branch_verdicts_1.MergedBranchesCache(cache.timestamp, cache.deletable.filter(keepBranch), cache.keep.filter(keepBranch), cache.worktrees.filter(keepTree));
+    }
+    /**
+     * ATOMIC write. Now that this file is shared by every worktree it has N concurrent writers (one
+     * detached refresher per agent), and its readers are the guards' BLOCKING path. A plain
+     * `writeFileSync` truncates before it writes, so a reader landing in that window gets a torn
+     * document — the reader-side retry added in PR #526 cannot rescue a syntactically valid PREFIX.
+     * Fixed where it belongs: temp file + `rename()`, which POSIX makes atomic. See AtomicFile.
+     *
+     * This buys ATOMIC READS, not lost-update protection: two read-modify-write cycles still end
+     * last-writer-wins. That is acceptable and deliberate — this is a DERIVED cache, recomputed from
+     * `gh` + git by the refresher, and wp-cleanup recomputes rather than trusting it before deleting
+     * anything. Nothing here is transactional and no caller may assume it is.
+     */
+    writeMergedBranches(repoRoot, cache) {
+        this.atomicFile.writeJsonAtomic(this.mergedBranchesPath(repoRoot), cache);
+    }
+    /**
+     * Every local branch except `main`. Uses `git for-each-ref`, NOT `git branch` — the latter is a
+     * porcelain command whose output the branch-creation-guard's own regex mistakes for a branch
+     * CREATION, so the guard would block the cleanup it just demanded.
+     */
+    localBranches(repoRoot) {
+        const result = this.capture(repoRoot, 'git', ['for-each-ref', '--format=%(refname:short)', 'refs/heads/']);
+        if (!result.ok || result.out === '')
+            return [];
+        return result.out
+            .split('\n')
+            .map((line) => line.trim())
+            .filter((line) => line.length > 0 && line !== 'main');
+    }
+    /**
+     * The SLOW path, run only inside the detached refresher. ONE bulk `gh` call, then a purely local
+     * classification. Never run on the hook's blocking path.
+     */
+    computeMergedBranches(repoRoot, ignoreStaleAgentLocks) {
+        const merged = this.fetchMergedPrs(repoRoot);
+        const byBranch = new Map();
+        for (const entry of merged)
+            byBranch.set(entry.branch, entry.pr);
+        let latestMergedPr = 0;
+        for (const entry of merged) {
+            if (entry.pr > latestMergedPr)
+                latestMergedPr = entry.pr;
+        }
+        const prs = new PrLookup(byBranch, this.fetchPrStates(repoRoot), latestMergedPr);
+        const trees = this.worktrees.listWorktrees(repoRoot);
+        const holder = new Map();
+        for (const tree of trees) {
+            if (tree.branch !== '')
+                holder.set(tree.branch, tree.path);
+        }
+        const deletable = [];
+        const keep = [];
+        for (const branch of this.localBranches(repoRoot)) {
+            const verdict = this.classify(repoRoot, branch, prs);
+            // A branch checked out in ANY worktree (including the branch we are standing on right here)
+            // cannot be deleted — git refuses, and since the reap is ONE `git branch -D a b c`, a single
+            // such branch would fail the entire command and strand the branches that would have deleted
+            // fine. Spare it LOUDLY (into `keep`, with the reason) rather than dropping it silently: the
+            // worktree list below is what actually reaps it, and a human should see the connection.
+            const heldAt = holder.get(branch);
+            if (heldAt !== undefined) {
+                keep.push(new merged_branch_verdicts_1.DeletableBranch(branch, `checked out in worktree '${heldAt}' — remove that worktree before deleting the branch`, verdict.entry.pr, verdict.entry.sha, verdict.entry.commits, verdict.entry.prState, merged_branch_verdicts_1.CLASSIFICATION_IN_USE));
+                continue;
+            }
+            if (verdict.deletable)
+                deletable.push(verdict.entry);
+            else
+                keep.push(verdict.entry);
+        }
+        const worktrees = this.classifyWorktrees(repoRoot, trees, prs, ignoreStaleAgentLocks);
+        return new merged_branch_verdicts_1.MergedBranchesCache(new Date().toISOString(), deletable, keep, worktrees);
+    }
+    /**
+     * Verdicts for the worktree budget. The main worktree is excluded outright — it is the primary
+     * clone and is not a thing you can remove.
+     *
+     * A worktree is deletable when its directory is already gone (`prunable`), or when its branch is
+     * dead by the very same proof the branch cap uses — a MERGED PR, its own or that of the branch it
+     * snapshots. Nothing else. It is spared when its LOCK still stands (see WorktreeLockVerdicts for
+     * what makes one stand), when it is the worktree we are standing in right now (removing your own
+     * cwd is not a thing to suggest to an agent), or when its branch is anything short of provably
+     * merged — INCLUDING a branch with no commits yet, which is what every worktree looks like while
+     * an agent is working in it. `deletable` means PROVABLY dead and nothing weaker; wp-cleanup reaps
+     * the zero-commit ones on top of that, but only after checking on disk whether anybody is holding
+     * them (see CLASSIFICATION_NO_COMMITS), which is a question these verdicts do not answer.
+     *
+     * THE BRANCH VERDICT IS COMPUTED BEFORE THE LOCK IS RULED ON, which is new and is the point: one
+     * of the four things that can override an agent lock is the branch already being provably dead,
+     * and that cannot be weighed until it is known. Two extra local git calls per locked worktree, on
+     * a path that only ever runs in the detached refresher and in wp-cleanup itself.
+     */
+    classifyWorktrees(repoRoot, trees, prs, ignoreStaleAgentLocks) {
+        const out = [];
+        for (const tree of trees) {
+            if (tree.isMain)
+                continue;
+            if (tree.prunable) {
+                out.push(new merged_branch_verdicts_1.DeletableWorktree(tree.path, tree.branch, 'its directory is gone — `git worktree prune` clears it', 0, true, merged_branch_verdicts_1.CLASSIFICATION_PRUNABLE));
+                continue;
+            }
+            const verdict = tree.branch === '' ? null : this.classify(repoRoot, tree.branch, prs);
+            // An OVERRIDDEN lock leaves the worktree judged on its branch below, exactly like an
+            // unlocked one — with `unlockBeforeRemove` set by annotate() so the reap clears the lock.
+            const decision = tree.locked ? this.lockDecision(tree, verdict, ignoreStaleAgentLocks) : null;
+            if (decision !== null && decision.spare) {
+                out.push(new merged_branch_verdicts_1.DeletableWorktree(tree.path, tree.branch, decision.reason, 0, false, merged_branch_verdicts_1.CLASSIFICATION_LOCKED));
+                continue;
+            }
+            if (tree.path === repoRoot) {
+                out.push(this.locks.annotate(new merged_branch_verdicts_1.DeletableWorktree(tree.path, tree.branch, 'you are standing in it', 0, false, merged_branch_verdicts_1.CLASSIFICATION_CURRENT), decision));
+                continue;
+            }
+            if (verdict === null) {
+                out.push(this.locks.annotate(new merged_branch_verdicts_1.DeletableWorktree(tree.path, '', 'detached HEAD — no branch to check, so a human must decide', 0, false, merged_branch_verdicts_1.CLASSIFICATION_DETACHED), decision));
+                continue;
+            }
+            // The branch's OWN classification token rides along unchanged. That is what lets wp-cleanup
+            // group probably-dead worktrees exactly the way it groups probably-dead branches, instead of
+            // inventing a second, parallel notion of "how dead is this".
+            out.push(this.locks.annotate(new merged_branch_verdicts_1.DeletableWorktree(tree.path, tree.branch, verdict.entry.reason, verdict.entry.pr, verdict.deletable, verdict.entry.classification), decision));
+        }
+        return out;
+    }
+    // The lock verdict for one worktree. The evidence gathering (and what it deliberately declines to
+    // gather) lives in WorktreeLockVerdicts — see `gather` there.
+    lockDecision(tree, verdict, ignoreStaleAgentLocks) {
+        return this.locks.decide(this.locks.gather(tree, verdict !== null && verdict.deletable, ignoreStaleAgentLocks));
+    }
+    /**
+     * Verdict for one branch: its own merged PR, else the base it was backed up from, else empty.
+     *
+     * The verdict itself is unchanged. What is new is that EVERY entry now carries its tip SHA, its
+     * unique-commit count and its PR state, so a `keep` can be shown to a human as a delete candidate
+     * rather than just counted. This runs only in the detached refresher, so the two extra local git
+     * calls per branch cost the blocking hook path nothing.
+     */
+    classify(repoRoot, branch, prs) {
+        const sha = this.tipSha(repoRoot, branch);
+        const commits = this.commitsAheadOfMain(repoRoot, branch);
+        const known = prs.state.get(branch);
+        const prState = known ? known.state : '';
+        const own = prs.merged.get(branch);
+        if (own !== undefined) {
+            return new Verdict(true, new merged_branch_verdicts_1.DeletableBranch(branch, `PR #${String(own)} merged`, own, sha, commits, prState || 'MERGED', merged_branch_verdicts_1.CLASSIFICATION_MERGED_PR));
+        }
+        const base = branch.replace(BACKUP_SUFFIX, '');
+        if (base !== branch && base.length > 0) {
+            const basePr = prs.merged.get(base);
+            if (basePr !== undefined) {
+                return new Verdict(true, new merged_branch_verdicts_1.DeletableBranch(branch, `squash-merge backup of '${base}' (PR #${String(basePr)} merged) — its job is done`, basePr, sha, commits, prState, merged_branch_verdicts_1.CLASSIFICATION_BACKUP_OF_MERGED));
+            }
+            // The base has not MERGED — but a snapshot is a copy of its base by construction, so as
+            // long as the base still exists this branch is provably not the only copy of anything.
+            // Falling through to classifySpared told the human the opposite ("may be the only copy in
+            // existence"), which is unanswerable-by-design and is why these accumulated.
+            //
+            // DELETABLE, not merely promptable. Asking about it was still asking a question with only
+            // one honest answer — the base branch is right there holding the same work — and every
+            // ask lands on a human who is being asked to authorise a delete the tooling can already
+            // PROVE is lossless. That is the pile: `wp-start-upsert-pr` mints another snapshot on
+            // every run, so the branch cap fills with copies nobody can be bothered to adjudicate.
+            // The proof here is as strong as a merged PR (a live sibling ref holds the content), and
+            // the reap archives to an `archive/<date>/<branch>` tag and logs a `recover=` first.
+            if (this.branchExists(repoRoot, base)) {
+                const basePrState = prs.state.get(base);
+                const liveness = basePrState
+                    ? `PR #${String(basePrState.number)} ${basePrState.state}`
+                    : 'no PR yet';
+                return new Verdict(true, new merged_branch_verdicts_1.DeletableBranch(branch, `pre-merge snapshot of '${base}' (${liveness}) — '${base}' still exists and holds ` +
+                    `this work, so this is a spare copy, not the only one`, basePrState ? basePrState.number : 0, sha, commits, prState, merged_branch_verdicts_1.CLASSIFICATION_BACKUP_OF_LIVE));
+            }
+        }
+        // Zero commits of its own. NOT deletable BY THIS VERDICT — the verdicts answer "is this
+        // provably dead?", and a husk is not. wp-cleanup reaps it anyway, after asking the one
+        // question this service cannot: is anybody HOLDING it (uncommitted files, a live lock, the
+        // tree you are standing in)? That check needs the worktree on disk, so it lives there and the
+        // verdict stays exactly what it is — see CLASSIFICATION_NO_COMMITS.
+        if (commits === 0) {
+            return new Verdict(false, new merged_branch_verdicts_1.DeletableBranch(branch, 'no commits of its own — identical to origin/main, so deleting the ref loses a NAME, not a '
+                + 'commit. wp-cleanup reaps this by default; a worktree holding it is spared when it has '
+                + 'uncommitted files or a live lock, i.e. when somebody is working in it', 0, sha, 0, prState, merged_branch_verdicts_1.CLASSIFICATION_NO_COMMITS));
+        }
+        return new Verdict(false, this.classifySpared(repoRoot, branch, prs, sha, commits, prState));
+    }
+    /**
+     * The three genuinely different reasons a branch survives the deletable proofs, ordered by how
+     * confidently a human can say yes to deleting it.
+     *
+     * The safety posture is UNCHANGED: all three are still SPARED, never auto-deleted. The only thing
+     * that changed is that wp-cleanup can now ask a question whose answer is knowable.
+     */
+    // eslint-disable-next-line @typescript-eslint/max-params
+    classifySpared(repoRoot, branch, prs, sha, commits, prState) {
+        const known = prs.state.get(branch);
+        // A PR that CLOSED without merging, in a repo that has merged later PRs, is near-certainly the
+        // abandoned first attempt at work that landed under a different number.
+        if (known !== undefined && known.state === 'CLOSED' && prs.latestMergedPr > known.number) {
+            return new merged_branch_verdicts_1.DeletableBranch(branch, `PR #${String(known.number)} was CLOSED UNMERGED and later PRs (through ` +
+                `#${String(prs.latestMergedPr)}) have merged — near-certainly superseded`, known.number, sha, commits, prState, merged_branch_verdicts_1.CLASSIFICATION_SUPERSEDED);
+        }
+        // `git cherry` compares by PATCH-ID, so it survives cherry-picks and rebases. It does NOT
+        // survive a squash — which is exactly why this is a spared verdict and not a deletable proof.
+        if (this.contentAlreadyInMain(repoRoot, branch)) {
+            return new merged_branch_verdicts_1.DeletableBranch(branch, `all ${String(commits)} commit(s) already have an equivalent in origin/main ` +
+                `(git cherry) — content is not unique`, known ? known.number : 0, sha, commits, prState, merged_branch_verdicts_1.CLASSIFICATION_CONTENT_IN_MAIN);
+        }
+        const why = known
+            ? `PR #${String(known.number)} is ${known.state} (not merged); holds ` +
+                `${String(commits)} unique commit(s) — a human must decide`
+            : `never had a PR; holds ${String(commits)} unique commit(s) that may be the only copy in existence`;
+        return new merged_branch_verdicts_1.DeletableBranch(branch, why, 0, sha, commits, prState, merged_branch_verdicts_1.CLASSIFICATION_NEVER_PROPOSED);
+    }
+    /**
+     * True when EVERY commit on the branch has a patch-equivalent already in origin/main.
+     *
+     * `git cherry origin/main <branch>` prints one line per commit: `+ <sha>` = not upstream,
+     * `- <sha>` = an equivalent change IS upstream. All-minus means the content landed (typically by
+     * cherry-pick or rebase-merge) even though the SHAs differ. Any failure returns false — "cannot
+     * prove the content is in main" must never read as "safe".
+     */
+    contentAlreadyInMain(repoRoot, branch) {
+        const result = this.capture(repoRoot, 'git', ['cherry', 'origin/main', branch]);
+        if (!result.ok || result.out === '')
+            return false;
+        const lines = result.out.split('\n')
+            .map((line) => line.trim())
+            .filter((line) => line !== '');
+        if (lines.length === 0)
+            return false;
+        return lines.every((line) => line.startsWith('-'));
+    }
+    /**
+     * Does this local branch exist? Used to prove a snapshot is not the last copy of its work — the
+     * base branch being present is that proof. Verifies it is a BRANCH (`refs/heads/`), not just any
+     * resolvable rev, so a tag or a stray SHA sharing the name cannot stand in for the base.
+     */
+    branchExists(repoRoot, branch) {
+        return this.capture(repoRoot, 'git', ['show-ref', '--verify', '--quiet', `refs/heads/${branch}`]).ok;
+    }
+    // Short tip SHA — the value that makes any delete of this branch reversible.
+    tipSha(repoRoot, branch) {
+        const result = this.capture(repoRoot, 'git', ['rev-parse', '--short', branch]);
+        return result.ok ? result.out : '';
+    }
+    /**
+     * Commits on `branch` that are not on origin/main. Returns -1 ("assume it has work") whenever the
+     * count cannot be established — an unresolvable origin/main must never read as "empty branch".
+     */
+    commitsAheadOfMain(repoRoot, branch) {
+        const result = this.capture(repoRoot, 'git', ['rev-list', '--count', `origin/main..${branch}`]);
+        if (!result.ok)
+            return -1;
+        const count = Number(result.out);
+        return Number.isInteger(count) ? count : -1;
+    }
+    /**
+     * The ONE bulk network call. Every merged PR's head branch in a single round trip — no per-branch
+     * lookups. Fails SOFT: if `gh` is missing, unauthenticated, or offline we return [], which makes
+     * every branch a `keep`. The guard then deletes nothing rather than guessing.
+     */
+    fetchMergedPrs(repoRoot) {
+        const result = this.capture(repoRoot, 'gh', [
+            'pr', 'list',
+            '--state', 'merged',
+            '--limit', String(MERGED_PR_LOOKUP_LIMIT),
+            '--json', 'number,headRefName',
+        ]);
+        if (!result.ok || result.out === '')
+            return [];
+        // eslint-disable-next-line @webpieces/no-unmanaged-exceptions
+        try {
+            const raw = JSON.parse(result.out);
+            const out = [];
+            for (const entry of raw) {
+                const branch = entry.headRefName ?? '';
+                const pr = entry.number ?? 0;
+                if (branch !== '' && pr > 0)
+                    out.push(new merged_branch_verdicts_1.MergedBranch(branch, pr));
+            }
+            return out;
+        }
+        catch (err) {
+            const error = (0, to_error_1.toError)(err);
+            void error;
+            return [];
+        }
+    }
+    /**
+     * The DISPLAY-only second lookup: every PR (any state) keyed by head branch, so a spared branch can
+     * be shown to a human as "PR #12 CLOSED (not merged)" or "no PR" instead of an opaque name. Kept
+     * SEPARATE from fetchMergedPrs on purpose — folding both into one `--state all` call would let a
+     * flood of open/closed PRs push older MERGED ones out of the limit and silently stop reaping real
+     * dead branches. Fails soft to an empty map: the verdicts do not depend on it.
+     */
+    fetchPrStates(repoRoot) {
+        const out = new Map();
+        const result = this.capture(repoRoot, 'gh', [
+            'pr', 'list',
+            '--state', 'all',
+            '--limit', String(MERGED_PR_LOOKUP_LIMIT),
+            '--json', 'number,headRefName,state',
+        ]);
+        if (!result.ok || result.out === '')
+            return out;
+        // eslint-disable-next-line @webpieces/no-unmanaged-exceptions
+        try {
+            const raw = JSON.parse(result.out);
+            for (const entry of raw) {
+                const branch = entry.headRefName ?? '';
+                const pr = entry.number ?? 0;
+                // `gh` lists newest-first, so the FIRST entry for a branch is its latest PR — keep it.
+                if (branch !== '' && pr > 0 && !out.has(branch)) {
+                    out.set(branch, new PrRef(pr, entry.state ?? ''));
+                }
+            }
+            return out;
+        }
+        catch (err) {
+            const error = (0, to_error_1.toError)(err);
+            void error;
+            return out;
+        }
+    }
+    reviveList(raw) {
+        if (!raw)
+            return [];
+        return raw.map((entry) => new merged_branch_verdicts_1.DeletableBranch(entry.branch ?? '', entry.reason ?? '', entry.pr ?? 0, entry.sha ?? '', entry.commits ?? -1, entry.prState ?? '', entry.classification ?? merged_branch_verdicts_1.CLASSIFICATION_NEVER_PROPOSED));
+    }
+    reviveWorktrees(raw) {
+        if (!raw)
+            return [];
+        return raw.map((entry) => {
+            const verdict = new merged_branch_verdicts_1.DeletableWorktree(entry.path ?? '', entry.branch ?? '', entry.reason ?? '', entry.pr ?? 0, entry.deletable ?? false, entry.classification ?? merged_branch_verdicts_1.CLASSIFICATION_NEVER_PROPOSED);
+            verdict.unlockBeforeRemove = entry.unlockBeforeRemove ?? false;
+            return verdict;
+        });
+    }
+    // Run a command capturing trimmed stdout; ok=false on spawn failure or non-zero exit.
+    capture(repoRoot, cmd, args) {
+        const result = (0, child_process_1.spawnSync)(cmd, args, { cwd: repoRoot, encoding: 'utf8' });
+        if (result.status !== 0 || typeof result.stdout !== 'string')
+            return { ok: false, out: '' };
+        return { ok: true, out: result.stdout.trim() };
+    }
+};
+exports.MergedBranchesService = MergedBranchesService;
+exports.MergedBranchesService = MergedBranchesService = tslib_1.__decorate([
+    (0, inversify_1.injectable)(inversify_1.bindingScopeValues.Singleton),
+    tslib_1.__metadata("design:paramtypes", [worktrees_1.WorktreeService,
+        tooling_common_2.DotWebpieces,
+        tooling_common_1.AtomicFile,
+        worktree_lock_verdicts_1.WorktreeLockVerdicts])
+], MergedBranchesService);
+//# sourceMappingURL=merged-branches.js.map

package/src/merged-branches.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"merged-branches.js","sourceRoot":"","sources":["../../../../../packages/tooling/repo-workflow-core/src/merged-branches.ts"],"names":[],"mappings":";;;;AAAA,iDAA0C;AAC1C,+CAAyB;AACzB,yCAA2D;AAE3D,8DAAuD;AACvD,8DAAuE;AACvE,iEAA6D;AAC7D,2CAAwD;AACxD,qEAA8E;AAC9E,qEAmBkC;AAElC,mEAoBkC;AAnB9B,sHAAA,YAAY,OAAA;AACZ,yHAAA,eAAe,OAAA;AACf,2HAAA,iBAAiB,OAAA;AACjB,6HAAA,mBAAmB,OAAA;AACnB,wHAAA,cAAc,OAAA;AACd,8HAAA,oBAAoB,OAAA;AACpB,kIAAA,wBAAwB,OAAA;AACxB,yIAAA,+BAA+B,OAAA;AAC/B,uIAAA,6BAA6B,OAAA;AAC7B,mIAAA,yBAAyB,OAAA;AACzB,mIAAA,yBAAyB,OAAA;AACzB,wIAAA,8BAA8B,OAAA;AAC9B,uIAAA,6BAA6B,OAAA;AAC7B,+HAAA,qBAAqB,OAAA;AACrB,iIAAA,uBAAuB,OAAA;AACvB,+HAAA,qBAAqB,OAAA;AACrB,gIAAA,sBAAsB,OAAA;AACtB,iIAAA,uBAAuB,OAAA;AACvB,qIAAA,2BAA2B,OAAA;AAI/B;;;;;;;;;;;;GAYG;AAEH,MAAM,oBAAoB,GAAG,sBAAsB,CAAC;AAEpD,6FAA6F;AAC7F,kGAAkG;AAClG,qCAAqC;AACrC,MAAM,sBAAsB,GAAG,GAAG,CAAC;AAEnC,8FAA8F;AAC9F,sGAAsG;AACtG,kGAAkG;AAClG,MAAM,aAAa,GAAG,+BAA+B,CAAC;AAEtD;;;;;;;GAOG;AACH,MAAM,KAAK;IACP,MAAM,CAAS;IACf,KAAK,CAAS;IAEd,YAAY,QAAgB,EAAE,KAAa;QACvC,IAAI,CAAC,MAAM,GAAG,QAAQ,CAAC;QACvB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACvB,CAAC;CACJ;AAED,MAAM,QAAQ;IACV,MAAM,CAAsB;IAC5B,KAAK,CAAqB;IAC1B;;;;OAIG;IACH,cAAc,CAAS;IAEvB,YAAY,MAA2B,EAAE,KAAyB,EAAE,iBAAyB,CAAC;QAC1F,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;IACzC,CAAC;CACJ;AAED,sGAAsG;AACtG,6FAA6F;AAC7F,MAAM,OAAO;IACT,SAAS,CAAU;IACnB,KAAK,CAAkB;IAEvB,YAAY,SAAkB,EAAE,KAAsB;QAClD,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACvB,CAAC;CACJ;AAoDM,IAAM,qBAAqB,GAA3B,MAAM,qBAAqB;IAIT;IACA;IACA;IACA;IANrB,kGAAkG;IAClG,uGAAuG;IACvG,YACqB,YAA6B,IAAI,2BAAe,EAAE,EAClD,SAAuB,6BAAY,EACnC,aAAyB,IAAI,2BAAU,EAAE,EACzC,QAA8B,IAAI,6CAAoB,EAAE;QAHxD,cAAS,GAAT,SAAS,CAAyC;QAClD,WAAM,GAAN,MAAM,CAA6B;QACnC,eAAU,GAAV,UAAU,CAA+B;QACzC,UAAK,GAAL,KAAK,CAAmD;IAC1E,CAAC;IAEJ;;;;;OAKG;IACH,kBAAkB,CAAC,QAAgB;QAC/B,OAAO,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,oBAAoB,CAAC,CAAC;IAClE,CAAC;IAED,6FAA6F;IAC7F,kBAAkB,CAAC,QAAgB;QAC/B,8DAA8D;QAC9D,IAAI,CAAC;YACD,MAAM,SAAS,GAAG,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;YACpD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAa,CAAC;YACvE,OAAO,IAAI,4CAAmB,CAC1B,GAAG,CAAC,SAAS,IAAI,EAAE,EACnB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,EAC9B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EACzB,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,CACtC,CAAC;QACN,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACpB,MAAM,KAAK,GAAG,IAAA,kBAAO,EAAC,GAAG,CAAC,CAAC;YAC3B,KAAK,KAAK,CAAC;YACX,OAAO,IAAI,CAAC;QAChB,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,SAAS,CAAC,KAA0B,EAAE,MAAc,IAAI,CAAC,GAAG,EAAE;QAC1D,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,uCAAc,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAChF,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,GAAG,OAAO,CAAC,CAAC;QACzC,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC;QAC7C,OAAO,IAAI,uCAAc,CAAC,KAAK,GAAG,6CAAoB,EAAE,UAAU,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IACzF,CAAC;IAED;;;;;;;;;;;OAWG;IACH,SAAS,CAAC,QAAgB,EAAE,KAA0B;QAClD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC;QACnD,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QACrD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAc,EAAU,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAE5E,MAAM,UAAU,GAAG,CAAC,KAAsB,EAAW,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAClG,MAAM,QAAQ,GAAG,CAAC,KAAwB,EAAW,EAAE,CACnD,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAEpD,OAAO,IAAI,4CAAmB,CAC1B,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,EAClC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,EAC7B,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CACnC,CAAC;IACN,CAAC;IAED;;;;;;;;;;;OAWG;IACH,mBAAmB,CAAC,QAAgB,EAAE,KAA0B;QAC5D,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC,CAAC;IAC9E,CAAC;IAED;;;;OAIG;IACH,aAAa,CAAC,QAAgB;QAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,cAAc,EAAE,2BAA2B,EAAE,aAAa,CAAC,CAAC,CAAC;QAC3G,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,GAAG,KAAK,EAAE;YAAE,OAAO,EAAE,CAAC;QAC/C,OAAO,MAAM,CAAC,GAAG;aACZ,KAAK,CAAC,IAAI,CAAC;aACX,GAAG,CAAC,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;aAC1C,MAAM,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,KAAK,MAAM,CAAC,CAAC;IAC/E,CAAC;IAED;;;OAGG;IACH,qBAAqB,CAAC,QAAgB,EAAE,qBAA8B;QAClE,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAC7C,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;QAC3C,KAAK,MAAM,KAAK,IAAI,MAAM;YAAE,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;QACjE,IAAI,cAAc,GAAG,CAAC,CAAC;QACvB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YACzB,IAAI,KAAK,CAAC,EAAE,GAAG,cAAc;gBAAE,cAAc,GAAG,KAAK,CAAC,EAAE,CAAC;QAC7D,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC,CAAC;QAEjF,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QACrD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;QACzC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACvB,IAAI,IAAI,CAAC,MAAM,KAAK,EAAE;gBAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/D,CAAC;QAED,MAAM,SAAS,GAAsB,EAAE,CAAC;QACxC,MAAM,IAAI,GAAsB,EAAE,CAAC;QAEnC,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;YAErD,4FAA4F;YAC5F,6FAA6F;YAC7F,4FAA4F;YAC5F,6FAA6F;YAC7F,wFAAwF;YACxF,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAClC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACvB,IAAI,CAAC,IAAI,CAAC,IAAI,wCAAe,CACzB,MAAM,EACN,4BAA4B,MAAM,qDAAqD,EACvF,OAAO,CAAC,KAAK,CAAC,EAAE,EAChB,OAAO,CAAC,KAAK,CAAC,GAAG,EACjB,OAAO,CAAC,KAAK,CAAC,OAAO,EACrB,OAAO,CAAC,KAAK,CAAC,OAAO,EACrB,8CAAqB,CACxB,CAAC,CAAC;gBACH,SAAS;YACb,CAAC;YAED,IAAI,OAAO,CAAC,SAAS;gBAAE,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;;gBAChD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAClC,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,qBAAqB,CAAC,CAAC;QACtF,OAAO,IAAI,4CAAmB,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;IACzF,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACK,iBAAiB,CACrB,QAAgB,EAChB,KAAiB,EACjB,GAAa,EACb,qBAA8B;QAE9B,MAAM,GAAG,GAAwB,EAAE,CAAC;QAEpC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACvB,IAAI,IAAI,CAAC,MAAM;gBAAE,SAAS;YAE1B,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAChB,GAAG,CAAC,IAAI,CAAC,IAAI,0CAAiB,CAC1B,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,wDAAwD,EAAE,CAAC,EAAE,IAAI,EACzF,gDAAuB,CAAC,CAAC,CAAC;gBAC9B,SAAS;YACb,CAAC;YAED,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YACtF,qFAAqF;YACrF,0FAA0F;YAC1F,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,EAAE,qBAAqB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC9F,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;gBACtC,GAAG,CAAC,IAAI,CAAC,IAAI,0CAAiB,CAC1B,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,8CAAqB,CAAC,CAAC,CAAC;gBAC/E,SAAS;YACb,CAAC;YACD,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACzB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,0CAAiB,CAC9C,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,wBAAwB,EAAE,CAAC,EAAE,KAAK,EAAE,+CAAsB,CAAC,EACvF,QAAQ,CAAC,CAAC,CAAC;gBACX,SAAS;YACb,CAAC;YACD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACnB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,0CAAiB,CAC9C,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,4DAA4D,EAAE,CAAC,EAAE,KAAK,EACrF,gDAAuB,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;gBACzC,SAAS;YACb,CAAC;YAED,4FAA4F;YAC5F,6FAA6F;YAC7F,6DAA6D;YAC7D,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,0CAAiB,CAC9C,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,OAAO,CAAC,SAAS,EACjF,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;QAClD,CAAC;QAED,OAAO,GAAG,CAAC;IACf,CAAC;IAED,kGAAkG;IAClG,8DAA8D;IACtD,YAAY,CAAC,IAAc,EAAE,OAAuB,EAAE,qBAA8B;QACxF,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CACtC,IAAI,EAAE,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,SAAS,EAAE,qBAAqB,CAAC,CAAC,CAAC;IAC7E,CAAC;IAED;;;;;;;OAOG;IACK,QAAQ,CAAC,QAAgB,EAAE,MAAc,EAAE,GAAa;QAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC1D,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACpC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAEzC,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACpB,OAAO,IAAI,OAAO,CAAC,IAAI,EAAE,IAAI,wCAAe,CACxC,MAAM,EAAE,OAAO,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,IAAI,QAAQ,EAC3E,iDAAwB,CAAC,CAAC,CAAC;QACnC,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;QAC/C,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACpC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACvB,OAAO,IAAI,OAAO,CAAC,IAAI,EAAE,IAAI,wCAAe,CACxC,MAAM,EACN,2BAA2B,IAAI,UAAU,MAAM,CAAC,MAAM,CAAC,4BAA4B,EACnF,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,wDAA+B,CACjE,CAAC,CAAC;YACP,CAAC;YACD,wFAAwF;YACxF,uFAAuF;YACvF,0FAA0F;YAC1F,6EAA6E;YAC7E,EAAE;YACF,0FAA0F;YAC1F,uFAAuF;YACvF,wFAAwF;YACxF,sFAAsF;YACtF,uFAAuF;YACvF,yFAAyF;YACzF,qFAAqF;YACrF,IAAI,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC;gBACpC,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACxC,MAAM,QAAQ,GAAG,WAAW;oBACxB,CAAC,CAAC,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,WAAW,CAAC,KAAK,EAAE;oBAC1D,CAAC,CAAC,WAAW,CAAC;gBAClB,OAAO,IAAI,OAAO,CAAC,IAAI,EAAE,IAAI,wCAAe,CACxC,MAAM,EACN,0BAA0B,IAAI,MAAM,QAAQ,QAAQ,IAAI,2BAA2B;oBACnF,sDAAsD,EACtD,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAC3D,sDAA6B,CAChC,CAAC,CAAC;YACP,CAAC;QACL,CAAC;QAED,wFAAwF;QACxF,uFAAuF;QACvF,2FAA2F;QAC3F,8FAA8F;QAC9F,oEAAoE;QACpE,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;YAChB,OAAO,IAAI,OAAO,CAAC,KAAK,EAAE,IAAI,wCAAe,CACzC,MAAM,EACN,4FAA4F;kBAC1F,wFAAwF;kBACxF,uEAAuE,EACzE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,OAAO,EAAE,kDAAyB,CAAC,CAAC,CAAC;QACxD,CAAC;QAED,OAAO,IAAI,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IACjG,CAAC;IAED;;;;;;OAMG;IACH,yDAAyD;IACjD,cAAc,CAClB,QAAgB,EAAE,MAAc,EAAE,GAAa,EAAE,GAAW,EAAE,OAAe,EAAE,OAAe;QAE9F,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAEpC,+FAA+F;QAC/F,wEAAwE;QACxE,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,GAAG,CAAC,cAAc,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;YACvF,OAAO,IAAI,wCAAe,CACtB,MAAM,EACN,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,8CAA8C;gBACzE,IAAI,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,2CAA2C,EACzE,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,kDAAyB,CACjE,CAAC;QACN,CAAC;QAED,0FAA0F;QAC1F,8FAA8F;QAC9F,IAAI,IAAI,CAAC,oBAAoB,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;YAC9C,OAAO,IAAI,wCAAe,CACtB,MAAM,EACN,OAAO,MAAM,CAAC,OAAO,CAAC,uDAAuD;gBAC7E,sCAAsC,EACtC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,uDAA8B,CAClF,CAAC;QACN,CAAC;QAED,MAAM,GAAG,GAAG,KAAK;YACb,CAAC,CAAC,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,KAAK,CAAC,KAAK,uBAAuB;gBACpE,GAAG,MAAM,CAAC,OAAO,CAAC,yCAAyC;YAC7D,CAAC,CAAC,yBAAyB,MAAM,CAAC,OAAO,CAAC,0DAA0D,CAAC;QACzG,OAAO,IAAI,wCAAe,CACtB,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,sDAA6B,CAAC,CAAC;IAC9E,CAAC;IAED;;;;;;;OAOG;IACK,oBAAoB,CAAC,QAAgB,EAAE,MAAc;QACzD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC;QAChF,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,GAAG,KAAK,EAAE;YAAE,OAAO,KAAK,CAAC;QAClD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;aAC/B,GAAG,CAAC,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;aAC1C,MAAM,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC;QACpD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACrC,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IACxE,CAAC;IAED;;;;OAIG;IACK,YAAY,CAAC,QAAgB,EAAE,MAAc;QACjD,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,cAAc,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACzG,CAAC;IAED,6EAA6E;IACrE,MAAM,CAAC,QAAgB,EAAE,MAAc;QAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,WAAW,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;QAC/E,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACvC,CAAC;IAED;;;OAGG;IACK,kBAAkB,CAAC,QAAgB,EAAE,MAAc;QACvD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,UAAU,EAAE,SAAS,EAAE,gBAAgB,MAAM,EAAE,CAAC,CAAC,CAAC;QAChG,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,CAAC,CAAC,CAAC;QAC1B,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjC,OAAO,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,CAAC;IAED;;;;OAIG;IACK,cAAc,CAAC,QAAgB;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE;YACxC,IAAI,EAAE,MAAM;YACZ,SAAS,EAAE,QAAQ;YACnB,SAAS,EAAE,MAAM,CAAC,sBAAsB,CAAC;YACzC,QAAQ,EAAE,oBAAoB;SACjC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,GAAG,KAAK,EAAE;YAAE,OAAO,EAAE,CAAC;QAE/C,8DAA8D;QAC9D,IAAI,CAAC;YACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAkB,CAAC;YACpD,MAAM,GAAG,GAAmB,EAAE,CAAC;YAC/B,KAAK,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;gBACtB,MAAM,MAAM,GAAG,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC;gBACvC,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC;gBAC7B,IAAI,MAAM,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC;oBAAE,GAAG,CAAC,IAAI,CAAC,IAAI,qCAAY,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;YACxE,CAAC;YACD,OAAO,GAAG,CAAC;QACf,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACpB,MAAM,KAAK,GAAG,IAAA,kBAAO,EAAC,GAAG,CAAC,CAAC;YAC3B,KAAK,KAAK,CAAC;YACX,OAAO,EAAE,CAAC;QACd,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACK,aAAa,CAAC,QAAgB;QAClC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAiB,CAAC;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE;YACxC,IAAI,EAAE,MAAM;YACZ,SAAS,EAAE,KAAK;YAChB,SAAS,EAAE,MAAM,CAAC,sBAAsB,CAAC;YACzC,QAAQ,EAAE,0BAA0B;SACvC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,GAAG,KAAK,EAAE;YAAE,OAAO,GAAG,CAAC;QAEhD,8DAA8D;QAC9D,IAAI,CAAC;YACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAkB,CAAC;YACpD,KAAK,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;gBACtB,MAAM,MAAM,GAAG,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC;gBACvC,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC;gBAC7B,uFAAuF;gBACvF,IAAI,MAAM,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC9C,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;gBACtD,CAAC;YACL,CAAC;YACD,OAAO,GAAG,CAAC;QACf,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACpB,MAAM,KAAK,GAAG,IAAA,kBAAO,EAAC,GAAG,CAAC,CAAC;YAC3B,KAAK,KAAK,CAAC;YACX,OAAO,GAAG,CAAC;QACf,CAAC;IACL,CAAC;IAEO,UAAU,CAAC,GAA+B;QAC9C,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,CAAC;QACpB,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,KAAmB,EAAmB,EAAE,CAAC,IAAI,wCAAe,CACxE,KAAK,CAAC,MAAM,IAAI,EAAE,EAClB,KAAK,CAAC,MAAM,IAAI,EAAE,EAClB,KAAK,CAAC,EAAE,IAAI,CAAC,EACb,KAAK,CAAC,GAAG,IAAI,EAAE,EACf,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC,EACnB,KAAK,CAAC,OAAO,IAAI,EAAE,EACnB,KAAK,CAAC,cAAc,IAAI,sDAA6B,CACxD,CAAC,CAAC;IACP,CAAC;IAEO,eAAe,CAAC,GAA8B;QAClD,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,CAAC;QACpB,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,KAAkB,EAAqB,EAAE;YACrD,MAAM,OAAO,GAAG,IAAI,0CAAiB,CACjC,KAAK,CAAC,IAAI,IAAI,EAAE,EAChB,KAAK,CAAC,MAAM,IAAI,EAAE,EAClB,KAAK,CAAC,MAAM,IAAI,EAAE,EAClB,KAAK,CAAC,EAAE,IAAI,CAAC,EACb,KAAK,CAAC,SAAS,IAAI,KAAK,EACxB,KAAK,CAAC,cAAc,IAAI,sDAA6B,CACxD,CAAC;YACF,OAAO,CAAC,kBAAkB,GAAG,KAAK,CAAC,kBAAkB,IAAI,KAAK,CAAC;YAC/D,OAAO,OAAO,CAAC;QACnB,CAAC,CAAC,CAAC;IACP,CAAC;IAED,sFAAsF;IAC9E,OAAO,CAAC,QAAgB,EAAE,GAAW,EAAE,IAAc;QACzD,MAAM,MAAM,GAAG,IAAA,yBAAS,EAAC,GAAG,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QACzE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;QAC5F,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;IACnD,CAAC;CACJ,CAAA;AA1fY,sDAAqB;gCAArB,qBAAqB;IADjC,IAAA,sBAAU,EAAC,8BAAkB,CAAC,SAAS,CAAC;6CAKL,2BAAe;QAClB,6BAAY;QACR,2BAAU;QACf,6CAAoB;GAPvC,qBAAqB,CA0fjC","sourcesContent":["import { spawnSync } from 'child_process';\nimport * as fs from 'fs';\nimport { injectable, bindingScopeValues } from 'inversify';\n\nimport { AtomicFile } from '@webpieces/tooling-common';\nimport { DotWebpieces, dotWebpieces } from '@webpieces/tooling-common';\nimport { toError } from '@webpieces/tooling-common/to-error';\nimport { Worktree, WorktreeService } from './worktrees';\nimport { LockDecision, WorktreeLockVerdicts } from './worktree-lock-verdicts';\nimport {\n    CacheFreshness,\n    CACHE_STALE_AFTER_MS,\n    CLASSIFICATION_BACKUP_OF_LIVE,\n    CLASSIFICATION_BACKUP_OF_MERGED,\n    CLASSIFICATION_CONTENT_IN_MAIN,\n    CLASSIFICATION_CURRENT,\n    CLASSIFICATION_DETACHED,\n    CLASSIFICATION_IN_USE,\n    CLASSIFICATION_LOCKED,\n    CLASSIFICATION_MERGED_PR,\n    CLASSIFICATION_NEVER_PROPOSED,\n    CLASSIFICATION_NO_COMMITS,\n    CLASSIFICATION_PRUNABLE,\n    CLASSIFICATION_SUPERSEDED,\n    DeletableBranch,\n    DeletableWorktree,\n    MergedBranch,\n    MergedBranchesCache,\n} from './merged-branch-verdicts';\n\nexport {\n    MergedBranch,\n    DeletableBranch,\n    DeletableWorktree,\n    MergedBranchesCache,\n    CacheFreshness,\n    CACHE_STALE_AFTER_MS,\n    CLASSIFICATION_MERGED_PR,\n    CLASSIFICATION_BACKUP_OF_MERGED,\n    CLASSIFICATION_BACKUP_OF_LIVE,\n    CLASSIFICATION_NO_COMMITS,\n    CLASSIFICATION_SUPERSEDED,\n    CLASSIFICATION_CONTENT_IN_MAIN,\n    CLASSIFICATION_NEVER_PROPOSED,\n    CLASSIFICATION_IN_USE,\n    CLASSIFICATION_PRUNABLE,\n    CLASSIFICATION_LOCKED,\n    CLASSIFICATION_CURRENT,\n    CLASSIFICATION_DETACHED,\n    ADJUDICATED_CLASSIFICATIONS,\n} from './merged-branch-verdicts';\n\n\n/**\n * The \"which local branches are dead?\" cache.\n *\n * WHY a cache, and why a STALE one is correct: cleanup is eventual, never urgent. A branch that\n * merged 30 seconds ago simply survives until the next refresh — nobody cares. So the (slow, network)\n * merged-PR lookup runs in the DETACHED background refresher, and the branch-creation-guard only READS\n * this file on its blocking path. Staleness is the whole point: it is what keeps the guard fast.\n *\n * WHY the GitHub PR API and not git: the repo squash-merges, which destroys BOTH commit ancestry and\n * patch-id. `git branch --merged` and `git cherry` therefore report merged branches as unmerged\n * (observed: deanhiller/config-overhaul, PR #188, merged — yet its patch is absent from main). A MERGED\n * PR is the only trustworthy signal, and ONE bulk `gh pr list --state merged` answers for every branch.\n */\n\nconst MERGED_BRANCHES_FILE = 'merged-branches.json';\n\n// How many merged PRs to pull in the single bulk lookup. Branches older than this window are\n// vanishingly unlikely to still be checked out locally; if one is, it lands in `keep` and a human\n// decides — the fail-safe direction.\nconst MERGED_PR_LOOKUP_LIMIT = 100;\n\n// Suffixes the squash-merge tooling appends to a feature branch when it snapshots it mid-sync\n// (base → baseSquash / basewp2 / basePreMerge3). GitHub has never seen these SHAs, so no PR will ever\n// name them — they can only be reaped by stripping back to the base branch they were cloned from.\nconst BACKUP_SUFFIX = /(?:Squash|PreMerge\\d*|wp\\d+)$/;\n\n/**\n * Internal: the bulk PR lookup, indexed.\n *\n * `merged` drives the DELETE verdicts and comes from the `--state merged` call, unchanged — the\n * reaping logic must not get looser or tighter here. `state` is display-only, from a second\n * `--state all` call, and answers the question a human needs in order to say \"yes, delete it\":\n * was there a PR at all, and did it close without merging? It fails soft to an empty map.\n */\nclass PrRef {\n    number: number;\n    state: string;\n\n    constructor(prNumber: number, state: string) {\n        this.number = prNumber;\n        this.state = state;\n    }\n}\n\nclass PrLookup {\n    merged: Map<string, number>;\n    state: Map<string, PrRef>;\n    /**\n     * Highest merged PR number seen. A branch whose own PR CLOSED UNMERGED below this number means work\n     * kept landing after it was abandoned — the \"superseded by a later PR\" signal, obtained without\n     * having to guess WHICH PR superseded it.\n     */\n    latestMergedPr: number;\n\n    constructor(merged: Map<string, number>, state: Map<string, PrRef>, latestMergedPr: number = 0) {\n        this.merged = merged;\n        this.state = state;\n        this.latestMergedPr = latestMergedPr;\n    }\n}\n\n// Internal: a classification result. `deletable` is the decision; `entry` carries the branch + reason\n// either way (a spared branch still needs its reason recorded, and it has no PR to key off).\nclass Verdict {\n    deletable: boolean;\n    entry: DeletableBranch;\n\n    constructor(deletable: boolean, entry: DeletableBranch) {\n        this.deletable = deletable;\n        this.entry = entry;\n    }\n}\n\n// Raw JSON shapes for the cast at the parse boundary.\ninterface RawDeletable {\n    branch?: string;\n    reason?: string;\n    pr?: number;\n    // Absent in caches written before the \"ask the human which of these to delete\" remedy existed.\n    sha?: string;\n    commits?: number;\n    prState?: string;\n    // Absent before classification existed — revives to the conservative 'never-proposed'.\n    classification?: string;\n}\n\ninterface RawWorktree {\n    path?: string;\n    branch?: string;\n    reason?: string;\n    pr?: number;\n    deletable?: boolean;\n    // Absent before worktree verdicts carried a classification — revives to 'never-proposed'.\n    classification?: string;\n    // Absent before stale agent locks were recognised — revives to false, i.e. \"there is no lock to\n    // clear\", which is the fail-safe direction: the removal fails loudly instead of overriding a lock\n    // this release cannot see a reason for.\n    unlockBeforeRemove?: boolean;\n}\n\ninterface RawCache {\n    timestamp?: string;\n    deletable?: RawDeletable[];\n    keep?: RawDeletable[];\n    // Absent in caches written by releases before the worktree cap existed — revives to [], which\n    // makes the worktree cap fail OPEN on a stale file rather than hard-failing the guard.\n    worktrees?: RawWorktree[];\n}\n\ninterface RawMergedPr {\n    number?: number;\n    headRefName?: string;\n    // Only requested by the display-only fetchPrStates call.\n    state?: string;\n}\n\n// Result of a captured git/gh invocation: ok=false on spawn failure or non-zero exit.\ninterface CmdCapture {\n    ok: boolean;\n    out: string;\n}\n\n@injectable(bindingScopeValues.Singleton)\nexport class MergedBranchesService {\n    // Defaulted so the non-DI call sites (`new MergedBranchesService()` in the guard and the detached\n    // refresher) keep working, while inversify still injects the singleton when resolved from a container.\n    constructor(\n        private readonly worktrees: WorktreeService = new WorktreeService(),\n        private readonly dotDir: DotWebpieces = dotWebpieces,\n        private readonly atomicFile: AtomicFile = new AtomicFile(),\n        private readonly locks: WorktreeLockVerdicts = new WorktreeLockVerdicts(),\n    ) {}\n\n    /**\n     * SHARED scope — one per repo, in the primary clone, NOT one per worktree. This file's contents\n     * describe every branch AND every worktree in the repo, so a per-worktree copy was a repo-wide fact\n     * stored N times and therefore N times wrong: branch-creation-guard reported \"8 parked local\n     * branches\" against an actual 1, reading a copy that predated deletions made from another worktree.\n     */\n    mergedBranchesPath(repoRoot: string): string {\n        return this.dotDir.sharedFile(repoRoot, MERGED_BRANCHES_FILE);\n    }\n\n    // Pure read — any error (missing file, malformed JSON) returns null so the guard fails OPEN.\n    readMergedBranches(repoRoot: string): MergedBranchesCache | null {\n        // eslint-disable-next-line @webpieces/no-unmanaged-exceptions\n        try {\n            const cachePath = this.mergedBranchesPath(repoRoot);\n            if (!fs.existsSync(cachePath)) return null;\n            const raw = JSON.parse(fs.readFileSync(cachePath, 'utf8')) as RawCache;\n            return new MergedBranchesCache(\n                raw.timestamp ?? '',\n                this.reviveList(raw.deletable),\n                this.reviveList(raw.keep),\n                this.reviveWorktrees(raw.worktrees),\n            );\n        } catch (err: unknown) {\n            const error = toError(err);\n            void error;\n            return null;\n        }\n    }\n\n    /**\n     * How old is this cache, and may its numbers be quoted as fact?\n     *\n     * `now` is a parameter purely so the specs can pin it; every caller passes nothing.\n     */\n    freshness(cache: MergedBranchesCache, now: number = Date.now()): CacheFreshness {\n        const written = Date.parse(cache.timestamp);\n        if (Number.isNaN(written)) return new CacheFreshness(true, -1, cache.timestamp);\n        const ageMs = Math.max(0, now - written);\n        const ageMinutes = Math.floor(ageMs / 60000);\n        return new CacheFreshness(ageMs > CACHE_STALE_AFTER_MS, ageMinutes, cache.timestamp);\n    }\n\n    /**\n     * Drop every cached verdict whose subject no longer exists, using only LOCAL, instant git reads.\n     *\n     * The verdicts themselves are NOT re-derived here — that is the detached refresher's job and it\n     * needs the network. This answers a different and much cheaper question: does this branch / this\n     * worktree still exist at all? A cache written before a `git branch -D` or a `git worktree remove`\n     * keeps naming things that are gone, and a reader that counts those entries reports a repo that\n     * does not exist (observed: 8 parked branches asserted against an actual 1) and then blocks on it.\n     *\n     * Fails toward the cache: if git cannot answer (empty branch list), the cache is returned untouched\n     * rather than emptied, since \"git failed\" must never read as \"everything was deleted\".\n     */\n    reconcile(repoRoot: string, cache: MergedBranchesCache): MergedBranchesCache {\n        const live = new Set(this.localBranches(repoRoot));\n        const trees = this.worktrees.listWorktrees(repoRoot);\n        const livePaths = new Set(trees.map((tree: Worktree): string => tree.path));\n\n        const keepBranch = (entry: DeletableBranch): boolean => live.size === 0 || live.has(entry.branch);\n        const keepTree = (entry: DeletableWorktree): boolean =>\n            trees.length === 0 || livePaths.has(entry.path);\n\n        return new MergedBranchesCache(\n            cache.timestamp,\n            cache.deletable.filter(keepBranch),\n            cache.keep.filter(keepBranch),\n            cache.worktrees.filter(keepTree),\n        );\n    }\n\n    /**\n     * ATOMIC write. Now that this file is shared by every worktree it has N concurrent writers (one\n     * detached refresher per agent), and its readers are the guards' BLOCKING path. A plain\n     * `writeFileSync` truncates before it writes, so a reader landing in that window gets a torn\n     * document — the reader-side retry added in PR #526 cannot rescue a syntactically valid PREFIX.\n     * Fixed where it belongs: temp file + `rename()`, which POSIX makes atomic. See AtomicFile.\n     *\n     * This buys ATOMIC READS, not lost-update protection: two read-modify-write cycles still end\n     * last-writer-wins. That is acceptable and deliberate — this is a DERIVED cache, recomputed from\n     * `gh` + git by the refresher, and wp-cleanup recomputes rather than trusting it before deleting\n     * anything. Nothing here is transactional and no caller may assume it is.\n     */\n    writeMergedBranches(repoRoot: string, cache: MergedBranchesCache): void {\n        this.atomicFile.writeJsonAtomic(this.mergedBranchesPath(repoRoot), cache);\n    }\n\n    /**\n     * Every local branch except `main`. Uses `git for-each-ref`, NOT `git branch` — the latter is a\n     * porcelain command whose output the branch-creation-guard's own regex mistakes for a branch\n     * CREATION, so the guard would block the cleanup it just demanded.\n     */\n    localBranches(repoRoot: string): string[] {\n        const result = this.capture(repoRoot, 'git', ['for-each-ref', '--format=%(refname:short)', 'refs/heads/']);\n        if (!result.ok || result.out === '') return [];\n        return result.out\n            .split('\\n')\n            .map((line: string): string => line.trim())\n            .filter((line: string): boolean => line.length > 0 && line !== 'main');\n    }\n\n    /**\n     * The SLOW path, run only inside the detached refresher. ONE bulk `gh` call, then a purely local\n     * classification. Never run on the hook's blocking path.\n     */\n    computeMergedBranches(repoRoot: string, ignoreStaleAgentLocks: boolean): MergedBranchesCache {\n        const merged = this.fetchMergedPrs(repoRoot);\n        const byBranch = new Map<string, number>();\n        for (const entry of merged) byBranch.set(entry.branch, entry.pr);\n        let latestMergedPr = 0;\n        for (const entry of merged) {\n            if (entry.pr > latestMergedPr) latestMergedPr = entry.pr;\n        }\n        const prs = new PrLookup(byBranch, this.fetchPrStates(repoRoot), latestMergedPr);\n\n        const trees = this.worktrees.listWorktrees(repoRoot);\n        const holder = new Map<string, string>();\n        for (const tree of trees) {\n            if (tree.branch !== '') holder.set(tree.branch, tree.path);\n        }\n\n        const deletable: DeletableBranch[] = [];\n        const keep: DeletableBranch[] = [];\n\n        for (const branch of this.localBranches(repoRoot)) {\n            const verdict = this.classify(repoRoot, branch, prs);\n\n            // A branch checked out in ANY worktree (including the branch we are standing on right here)\n            // cannot be deleted — git refuses, and since the reap is ONE `git branch -D a b c`, a single\n            // such branch would fail the entire command and strand the branches that would have deleted\n            // fine. Spare it LOUDLY (into `keep`, with the reason) rather than dropping it silently: the\n            // worktree list below is what actually reaps it, and a human should see the connection.\n            const heldAt = holder.get(branch);\n            if (heldAt !== undefined) {\n                keep.push(new DeletableBranch(\n                    branch,\n                    `checked out in worktree '${heldAt}' — remove that worktree before deleting the branch`,\n                    verdict.entry.pr,\n                    verdict.entry.sha,\n                    verdict.entry.commits,\n                    verdict.entry.prState,\n                    CLASSIFICATION_IN_USE,\n                ));\n                continue;\n            }\n\n            if (verdict.deletable) deletable.push(verdict.entry);\n            else keep.push(verdict.entry);\n        }\n\n        const worktrees = this.classifyWorktrees(repoRoot, trees, prs, ignoreStaleAgentLocks);\n        return new MergedBranchesCache(new Date().toISOString(), deletable, keep, worktrees);\n    }\n\n    /**\n     * Verdicts for the worktree budget. The main worktree is excluded outright — it is the primary\n     * clone and is not a thing you can remove.\n     *\n     * A worktree is deletable when its directory is already gone (`prunable`), or when its branch is\n     * dead by the very same proof the branch cap uses — a MERGED PR, its own or that of the branch it\n     * snapshots. Nothing else. It is spared when its LOCK still stands (see WorktreeLockVerdicts for\n     * what makes one stand), when it is the worktree we are standing in right now (removing your own\n     * cwd is not a thing to suggest to an agent), or when its branch is anything short of provably\n     * merged — INCLUDING a branch with no commits yet, which is what every worktree looks like while\n     * an agent is working in it. `deletable` means PROVABLY dead and nothing weaker; wp-cleanup reaps\n     * the zero-commit ones on top of that, but only after checking on disk whether anybody is holding\n     * them (see CLASSIFICATION_NO_COMMITS), which is a question these verdicts do not answer.\n     *\n     * THE BRANCH VERDICT IS COMPUTED BEFORE THE LOCK IS RULED ON, which is new and is the point: one\n     * of the four things that can override an agent lock is the branch already being provably dead,\n     * and that cannot be weighed until it is known. Two extra local git calls per locked worktree, on\n     * a path that only ever runs in the detached refresher and in wp-cleanup itself.\n     */\n    private classifyWorktrees(\n        repoRoot: string,\n        trees: Worktree[],\n        prs: PrLookup,\n        ignoreStaleAgentLocks: boolean,\n    ): DeletableWorktree[] {\n        const out: DeletableWorktree[] = [];\n\n        for (const tree of trees) {\n            if (tree.isMain) continue;\n\n            if (tree.prunable) {\n                out.push(new DeletableWorktree(\n                    tree.path, tree.branch, 'its directory is gone — `git worktree prune` clears it', 0, true,\n                    CLASSIFICATION_PRUNABLE));\n                continue;\n            }\n\n            const verdict = tree.branch === '' ? null : this.classify(repoRoot, tree.branch, prs);\n            // An OVERRIDDEN lock leaves the worktree judged on its branch below, exactly like an\n            // unlocked one — with `unlockBeforeRemove` set by annotate() so the reap clears the lock.\n            const decision = tree.locked ? this.lockDecision(tree, verdict, ignoreStaleAgentLocks) : null;\n            if (decision !== null && decision.spare) {\n                out.push(new DeletableWorktree(\n                    tree.path, tree.branch, decision.reason, 0, false, CLASSIFICATION_LOCKED));\n                continue;\n            }\n            if (tree.path === repoRoot) {\n                out.push(this.locks.annotate(new DeletableWorktree(\n                    tree.path, tree.branch, 'you are standing in it', 0, false, CLASSIFICATION_CURRENT),\n                decision));\n                continue;\n            }\n            if (verdict === null) {\n                out.push(this.locks.annotate(new DeletableWorktree(\n                    tree.path, '', 'detached HEAD — no branch to check, so a human must decide', 0, false,\n                    CLASSIFICATION_DETACHED), decision));\n                continue;\n            }\n\n            // The branch's OWN classification token rides along unchanged. That is what lets wp-cleanup\n            // group probably-dead worktrees exactly the way it groups probably-dead branches, instead of\n            // inventing a second, parallel notion of \"how dead is this\".\n            out.push(this.locks.annotate(new DeletableWorktree(\n                tree.path, tree.branch, verdict.entry.reason, verdict.entry.pr, verdict.deletable,\n                verdict.entry.classification), decision));\n        }\n\n        return out;\n    }\n\n    // The lock verdict for one worktree. The evidence gathering (and what it deliberately declines to\n    // gather) lives in WorktreeLockVerdicts — see `gather` there.\n    private lockDecision(tree: Worktree, verdict: Verdict | null, ignoreStaleAgentLocks: boolean): LockDecision {\n        return this.locks.decide(this.locks.gather(\n            tree, verdict !== null && verdict.deletable, ignoreStaleAgentLocks));\n    }\n\n    /**\n     * Verdict for one branch: its own merged PR, else the base it was backed up from, else empty.\n     *\n     * The verdict itself is unchanged. What is new is that EVERY entry now carries its tip SHA, its\n     * unique-commit count and its PR state, so a `keep` can be shown to a human as a delete candidate\n     * rather than just counted. This runs only in the detached refresher, so the two extra local git\n     * calls per branch cost the blocking hook path nothing.\n     */\n    private classify(repoRoot: string, branch: string, prs: PrLookup): Verdict {\n        const sha = this.tipSha(repoRoot, branch);\n        const commits = this.commitsAheadOfMain(repoRoot, branch);\n        const known = prs.state.get(branch);\n        const prState = known ? known.state : '';\n\n        const own = prs.merged.get(branch);\n        if (own !== undefined) {\n            return new Verdict(true, new DeletableBranch(\n                branch, `PR #${String(own)} merged`, own, sha, commits, prState || 'MERGED',\n                CLASSIFICATION_MERGED_PR));\n        }\n\n        const base = branch.replace(BACKUP_SUFFIX, '');\n        if (base !== branch && base.length > 0) {\n            const basePr = prs.merged.get(base);\n            if (basePr !== undefined) {\n                return new Verdict(true, new DeletableBranch(\n                    branch,\n                    `squash-merge backup of '${base}' (PR #${String(basePr)} merged) — its job is done`,\n                    basePr, sha, commits, prState, CLASSIFICATION_BACKUP_OF_MERGED,\n                ));\n            }\n            // The base has not MERGED — but a snapshot is a copy of its base by construction, so as\n            // long as the base still exists this branch is provably not the only copy of anything.\n            // Falling through to classifySpared told the human the opposite (\"may be the only copy in\n            // existence\"), which is unanswerable-by-design and is why these accumulated.\n            //\n            // DELETABLE, not merely promptable. Asking about it was still asking a question with only\n            // one honest answer — the base branch is right there holding the same work — and every\n            // ask lands on a human who is being asked to authorise a delete the tooling can already\n            // PROVE is lossless. That is the pile: `wp-start-upsert-pr` mints another snapshot on\n            // every run, so the branch cap fills with copies nobody can be bothered to adjudicate.\n            // The proof here is as strong as a merged PR (a live sibling ref holds the content), and\n            // the reap archives to an `archive/<date>/<branch>` tag and logs a `recover=` first.\n            if (this.branchExists(repoRoot, base)) {\n                const basePrState = prs.state.get(base);\n                const liveness = basePrState\n                    ? `PR #${String(basePrState.number)} ${basePrState.state}`\n                    : 'no PR yet';\n                return new Verdict(true, new DeletableBranch(\n                    branch,\n                    `pre-merge snapshot of '${base}' (${liveness}) — '${base}' still exists and holds ` +\n                    `this work, so this is a spare copy, not the only one`,\n                    basePrState ? basePrState.number : 0, sha, commits, prState,\n                    CLASSIFICATION_BACKUP_OF_LIVE,\n                ));\n            }\n        }\n\n        // Zero commits of its own. NOT deletable BY THIS VERDICT — the verdicts answer \"is this\n        // provably dead?\", and a husk is not. wp-cleanup reaps it anyway, after asking the one\n        // question this service cannot: is anybody HOLDING it (uncommitted files, a live lock, the\n        // tree you are standing in)? That check needs the worktree on disk, so it lives there and the\n        // verdict stays exactly what it is — see CLASSIFICATION_NO_COMMITS.\n        if (commits === 0) {\n            return new Verdict(false, new DeletableBranch(\n                branch,\n                'no commits of its own — identical to origin/main, so deleting the ref loses a NAME, not a '\n                + 'commit. wp-cleanup reaps this by default; a worktree holding it is spared when it has '\n                + 'uncommitted files or a live lock, i.e. when somebody is working in it',\n                0, sha, 0, prState, CLASSIFICATION_NO_COMMITS));\n        }\n\n        return new Verdict(false, this.classifySpared(repoRoot, branch, prs, sha, commits, prState));\n    }\n\n    /**\n     * The three genuinely different reasons a branch survives the deletable proofs, ordered by how\n     * confidently a human can say yes to deleting it.\n     *\n     * The safety posture is UNCHANGED: all three are still SPARED, never auto-deleted. The only thing\n     * that changed is that wp-cleanup can now ask a question whose answer is knowable.\n     */\n    // eslint-disable-next-line @typescript-eslint/max-params\n    private classifySpared(\n        repoRoot: string, branch: string, prs: PrLookup, sha: string, commits: number, prState: string,\n    ): DeletableBranch {\n        const known = prs.state.get(branch);\n\n        // A PR that CLOSED without merging, in a repo that has merged later PRs, is near-certainly the\n        // abandoned first attempt at work that landed under a different number.\n        if (known !== undefined && known.state === 'CLOSED' && prs.latestMergedPr > known.number) {\n            return new DeletableBranch(\n                branch,\n                `PR #${String(known.number)} was CLOSED UNMERGED and later PRs (through ` +\n                `#${String(prs.latestMergedPr)}) have merged — near-certainly superseded`,\n                known.number, sha, commits, prState, CLASSIFICATION_SUPERSEDED,\n            );\n        }\n\n        // `git cherry` compares by PATCH-ID, so it survives cherry-picks and rebases. It does NOT\n        // survive a squash — which is exactly why this is a spared verdict and not a deletable proof.\n        if (this.contentAlreadyInMain(repoRoot, branch)) {\n            return new DeletableBranch(\n                branch,\n                `all ${String(commits)} commit(s) already have an equivalent in origin/main ` +\n                `(git cherry) — content is not unique`,\n                known ? known.number : 0, sha, commits, prState, CLASSIFICATION_CONTENT_IN_MAIN,\n            );\n        }\n\n        const why = known\n            ? `PR #${String(known.number)} is ${known.state} (not merged); holds ` +\n              `${String(commits)} unique commit(s) — a human must decide`\n            : `never had a PR; holds ${String(commits)} unique commit(s) that may be the only copy in existence`;\n        return new DeletableBranch(\n            branch, why, 0, sha, commits, prState, CLASSIFICATION_NEVER_PROPOSED);\n    }\n\n    /**\n     * True when EVERY commit on the branch has a patch-equivalent already in origin/main.\n     *\n     * `git cherry origin/main <branch>` prints one line per commit: `+ <sha>` = not upstream,\n     * `- <sha>` = an equivalent change IS upstream. All-minus means the content landed (typically by\n     * cherry-pick or rebase-merge) even though the SHAs differ. Any failure returns false — \"cannot\n     * prove the content is in main\" must never read as \"safe\".\n     */\n    private contentAlreadyInMain(repoRoot: string, branch: string): boolean {\n        const result = this.capture(repoRoot, 'git', ['cherry', 'origin/main', branch]);\n        if (!result.ok || result.out === '') return false;\n        const lines = result.out.split('\\n')\n            .map((line: string): string => line.trim())\n            .filter((line: string): boolean => line !== '');\n        if (lines.length === 0) return false;\n        return lines.every((line: string): boolean => line.startsWith('-'));\n    }\n\n    /**\n     * Does this local branch exist? Used to prove a snapshot is not the last copy of its work — the\n     * base branch being present is that proof. Verifies it is a BRANCH (`refs/heads/`), not just any\n     * resolvable rev, so a tag or a stray SHA sharing the name cannot stand in for the base.\n     */\n    private branchExists(repoRoot: string, branch: string): boolean {\n        return this.capture(repoRoot, 'git', ['show-ref', '--verify', '--quiet', `refs/heads/${branch}`]).ok;\n    }\n\n    // Short tip SHA — the value that makes any delete of this branch reversible.\n    private tipSha(repoRoot: string, branch: string): string {\n        const result = this.capture(repoRoot, 'git', ['rev-parse', '--short', branch]);\n        return result.ok ? result.out : '';\n    }\n\n    /**\n     * Commits on `branch` that are not on origin/main. Returns -1 (\"assume it has work\") whenever the\n     * count cannot be established — an unresolvable origin/main must never read as \"empty branch\".\n     */\n    private commitsAheadOfMain(repoRoot: string, branch: string): number {\n        const result = this.capture(repoRoot, 'git', ['rev-list', '--count', `origin/main..${branch}`]);\n        if (!result.ok) return -1;\n        const count = Number(result.out);\n        return Number.isInteger(count) ? count : -1;\n    }\n\n    /**\n     * The ONE bulk network call. Every merged PR's head branch in a single round trip — no per-branch\n     * lookups. Fails SOFT: if `gh` is missing, unauthenticated, or offline we return [], which makes\n     * every branch a `keep`. The guard then deletes nothing rather than guessing.\n     */\n    private fetchMergedPrs(repoRoot: string): MergedBranch[] {\n        const result = this.capture(repoRoot, 'gh', [\n            'pr', 'list',\n            '--state', 'merged',\n            '--limit', String(MERGED_PR_LOOKUP_LIMIT),\n            '--json', 'number,headRefName',\n        ]);\n        if (!result.ok || result.out === '') return [];\n\n        // eslint-disable-next-line @webpieces/no-unmanaged-exceptions\n        try {\n            const raw = JSON.parse(result.out) as RawMergedPr[];\n            const out: MergedBranch[] = [];\n            for (const entry of raw) {\n                const branch = entry.headRefName ?? '';\n                const pr = entry.number ?? 0;\n                if (branch !== '' && pr > 0) out.push(new MergedBranch(branch, pr));\n            }\n            return out;\n        } catch (err: unknown) {\n            const error = toError(err);\n            void error;\n            return [];\n        }\n    }\n\n    /**\n     * The DISPLAY-only second lookup: every PR (any state) keyed by head branch, so a spared branch can\n     * be shown to a human as \"PR #12 CLOSED (not merged)\" or \"no PR\" instead of an opaque name. Kept\n     * SEPARATE from fetchMergedPrs on purpose — folding both into one `--state all` call would let a\n     * flood of open/closed PRs push older MERGED ones out of the limit and silently stop reaping real\n     * dead branches. Fails soft to an empty map: the verdicts do not depend on it.\n     */\n    private fetchPrStates(repoRoot: string): Map<string, PrRef> {\n        const out = new Map<string, PrRef>();\n        const result = this.capture(repoRoot, 'gh', [\n            'pr', 'list',\n            '--state', 'all',\n            '--limit', String(MERGED_PR_LOOKUP_LIMIT),\n            '--json', 'number,headRefName,state',\n        ]);\n        if (!result.ok || result.out === '') return out;\n\n        // eslint-disable-next-line @webpieces/no-unmanaged-exceptions\n        try {\n            const raw = JSON.parse(result.out) as RawMergedPr[];\n            for (const entry of raw) {\n                const branch = entry.headRefName ?? '';\n                const pr = entry.number ?? 0;\n                // `gh` lists newest-first, so the FIRST entry for a branch is its latest PR — keep it.\n                if (branch !== '' && pr > 0 && !out.has(branch)) {\n                    out.set(branch, new PrRef(pr, entry.state ?? ''));\n                }\n            }\n            return out;\n        } catch (err: unknown) {\n            const error = toError(err);\n            void error;\n            return out;\n        }\n    }\n\n    private reviveList(raw: RawDeletable[] | undefined): DeletableBranch[] {\n        if (!raw) return [];\n        return raw.map((entry: RawDeletable): DeletableBranch => new DeletableBranch(\n            entry.branch ?? '',\n            entry.reason ?? '',\n            entry.pr ?? 0,\n            entry.sha ?? '',\n            entry.commits ?? -1,\n            entry.prState ?? '',\n            entry.classification ?? CLASSIFICATION_NEVER_PROPOSED,\n        ));\n    }\n\n    private reviveWorktrees(raw: RawWorktree[] | undefined): DeletableWorktree[] {\n        if (!raw) return [];\n        return raw.map((entry: RawWorktree): DeletableWorktree => {\n            const verdict = new DeletableWorktree(\n                entry.path ?? '',\n                entry.branch ?? '',\n                entry.reason ?? '',\n                entry.pr ?? 0,\n                entry.deletable ?? false,\n                entry.classification ?? CLASSIFICATION_NEVER_PROPOSED,\n            );\n            verdict.unlockBeforeRemove = entry.unlockBeforeRemove ?? false;\n            return verdict;\n        });\n    }\n\n    // Run a command capturing trimmed stdout; ok=false on spawn failure or non-zero exit.\n    private capture(repoRoot: string, cmd: string, args: string[]): CmdCapture {\n        const result = spawnSync(cmd, args, { cwd: repoRoot, encoding: 'utf8' });\n        if (result.status !== 0 || typeof result.stdout !== 'string') return { ok: false, out: '' };\n        return { ok: true, out: result.stdout.trim() };\n    }\n}\n"]}