@yemi33/minions 0.1.2231 → 0.1.2233

package/dashboard/js/render-other.js

@@ -38,6 +38,14 @@ function _renderProjectBranch(p) {
   if (p.gitState === 'missing') return '<span class="project-warn" title="Project localPath does not exist on disk">(path not found)</span>';
   if (p.gitState === 'non-git') return '<span class="project-muted" title="Project path exists but is not a git repository">(not a git repo)</span>';
   if (p.gitState !== 'ok' || !p.gitBranch) return '';
+  // opg-microsoft/minions#295: the engine flags `gitStale: true` when tracked
+  // git refs have advanced past the cached snapshot (e.g. the operator ran
+  // `git switch` / `git pull` directly in a live checkout outside the
+  // dashboard). The cached gitBranch/gitDirty are then known-stale — rendering
+  // them would briefly show the OLD branch name as if current. Fall back to a
+  // neutral "refreshing" chip until the async cache refresh lands on the next
+  // poll, rather than presenting a known-stale branch/dirty indicator.
+  if (p.gitStale) return '<span class="project-muted" title="Branch changed outside the dashboard — refreshing…">(refreshing…)</span>';
   const branch = escHtml(p.gitBranch);
   const mainBranch = p.mainBranch ? escHtml(p.mainBranch) : '';
   const remoteDefault = p.remoteDefaultBranch ? escHtml(p.remoteDefaultBranch) : '';

package/dashboard/js/settings.js

@@ -244,7 +244,10 @@ async function openSettings() {
     } catch (e) { liveProj = null; }
     var remoteDefault = (liveProj && liveProj.remoteDefaultBranch) || '';
     var mismatch = !!(liveProj && liveProj.branchMismatch);
-    var localBranch = (liveProj && liveProj.gitBranch) || '';
+    // Suppress the "Local HEAD" hint when the engine flags this status stale
+    // (opg-microsoft/minions#295) — the cached gitBranch is known-stale after
+    // an external checkout change and would show the OLD branch as current.
+    var localBranch = (liveProj && !liveProj.gitStale && liveProj.gitBranch) || '';
     var driftNote = mismatch
       ? '<div style="font-size:var(--text-sm);color:var(--yellow);margin-top:4px">⚠ Configured main (<code>' + escHtml(p.mainBranch || '') + '</code>) differs from origin/HEAD (<code>' + escHtml(remoteDefault) + '</code>) — config is likely stale.</div>'
       : '';

package/docs/completion-reports.md

@@ -261,10 +261,27 @@ Defined in `engine/shared.js` as `FAILURE_CLASS`. Use the canonical hyphenated s
 | `out-of-context` | Context window exhausted | Flag for human review |
 | `max-turns` | Claude CLI `error_max_turns` — work in progress | Retry same agent |
 | `completion-nonce-mismatch` | Completion JSON missing or mismatched `nonce` (forged completion). See [Trust boundary](#trust-boundary). | Never retry (untrusted) |
+| `worktree-preflight` | Pre-spawn worktree validation rejected the dispatch (nested-in-project, drive-root collapse, missing base). See [Pre-spawn preflight vs agent failure](#pre-spawn-preflight-vs-agent-failure). | Never retry |
+| `live-checkout-dirty` | Live-checkout project tree had uncommitted changes; engine refused to spawn in-place. See [Pre-spawn preflight vs agent failure](#pre-spawn-preflight-vs-agent-failure). | Never retry |
+| `workspace-manifest-repo-forbidden` | Dispatch routed an agent to a repo not in its `workspace_manifest.allowed_repos`. See [Pre-spawn preflight vs agent failure](#pre-spawn-preflight-vs-agent-failure). | Never retry |
 | `unknown` | Unclassified failure | Default retry logic |
 
 Use `"N/A"` when `status` is `success` or `partial` without a failure.
 
+## Pre-spawn preflight vs agent failure
+
+A handful of `failure_class` values are written by the **engine at dispatch time**, *before the agent process is ever spawned*. They are emitted from `spawnAgent` (`engine.js`) while it sets up the worktree, validates the checkout, or enforces the workspace manifest — the engine calls `completeDispatch(... DISPATCH_RESULT.ERROR ...)` and returns without launching any runtime. **A completion report carrying one of these classes does not imply the agent ran any work**; no prompt was sent, no edits were attempted, and there is no agent-authored `note` or output to interpret.
+
+| `failure_class` | Pre-spawn trigger | `engine/shared.js` |
+|---|---|---|
+| `worktree-preflight` | Worktree placement validation failed: the worktree would nest inside the project, the resolved root collapsed to a drive root, or the base directory was missing. | `FAILURE_CLASS.WORKTREE_PREFLIGHT` (~`shared.js:4279`) |
+| `live-checkout-dirty` | Live-checkout mode (`project.checkoutMode: 'live'`) found uncommitted changes in `project.localPath`; the engine never `reset`/`clean`s the operator tree, so it refuses to spawn. | `FAILURE_CLASS.LIVE_CHECKOUT_DIRTY` (~`shared.js:4289`) |
+| `workspace-manifest-repo-forbidden` | The dispatch routed the agent to a repo not listed in its `workspace_manifest.allowed_repos`. Structural — widen the manifest or route the work elsewhere. | `FAILURE_CLASS.WORKSPACE_MANIFEST_REPO` (~`shared.js:4292`) |
+
+`WORKTREE_ROOTDIR_COLLAPSED_TO_DRIVE_ROOT` is **not** a standalone enum value: it is an `Error.code` thrown by the worktree path resolver (`shared.js`) which `spawnAgent` catches and maps to the non-retryable `worktree-preflight` class (`engine.js`). It surfaces in logs/diagnostics, but the report's `failure_class` is always `worktree-preflight`.
+
+All three classes are **never retryable** — they signal a structural/environment problem the same agent would hit again. Resolve the underlying cause (clean the live tree, fix the worktree root, widen the manifest) before re-dispatching.
+
 ## No-op semantics
 
 A no-op completion declares that the agent correctly **declined** to do the work — the change was already shipped on master, the dispatch premise was wrong, the flagged review comment was an author-note, etc.

package/docs/worktree-lifecycle.md

@@ -7,7 +7,7 @@ the **quarantine path** (dirty/divergent → quarantine dir + retry), and the
 Lifecycle keeps the cross-cutting invariants; the detail lives here.
 
 > Source of truth: `engine/worktree-pool.js`, `engine/shared.js#removeWorktree`
-> + `_retryFsOp`, `engine.js` (`_quarantineDirtyWorktree`, `_renameWithRetry`,
+> + `_retryFsOp`, `engine.js` (`_quarantineDirtyWorktree`,
 > `_killGitDescendantsForWorktree`, `pruneOrphanWorktrees*`, `gcDispatchWorktreeIfOrphan`),
 > `engine/cleanup.js`. Last verified: 2026-06-09.
 
@@ -93,11 +93,15 @@ the `.git/index.lock` acquire around the untracked-cache refresh inside
 place. **Most incidents are closed by 1b alone.**
 Toggle: `ENGINE_DEFAULTS.statusProbeUseNoOptionalLocks` (default `true`).
 
-### Layer 1a — `_renameWithRetry` with jittered backoff
+### Layer 1a — quarantine rename via `shared._retryFsOp` with jittered backoff
 
-6 attempts × 250 ms base × 2^N exponential + 200 ms random jitter
-(~16 s worst-case). Only retries on `EBUSY|EPERM|EACCES|ENOTEMPTY`;
-rethrows other codes immediately. Toggles:
+The quarantine rename (`fs.renameSync(worktreePath, quarantinedPath)`) is wrapped
+in `shared._retryFsOp` (P-a1c4f7e2 collapsed the former bespoke
+`engine.js#_renameWithRetry` into the shared helper). 6 attempts × 250 ms base ×
+2^N exponential + 200 ms random jitter (~16 s worst-case). Only retries on
+`EBUSY|EPERM|EACCES|ENOTEMPTY` (`shared._WORKTREE_RETRYABLE_CODES`); rethrows
+other codes immediately. `_quarantineDirtyWorktree` passes the rename-specific
+budget explicitly. Toggles:
 `ENGINE_DEFAULTS.quarantineRenameRetryAttempts` (6),
 `quarantineRenameRetryBaseMs` (250).
 

package/engine/cleanup.js

@@ -1591,6 +1591,34 @@ function runPeriodicWorktreeSweep(config) {
   let scanned = 0, kept = 0, evicted = 0, failed = 0, outOfRootEvicted = 0, prunedRegistry = 0;
   let missingDirReclaimed = 0, missingDirSkippedLive = 0;
   const _writeToInbox = (a, s, c) => { try { return shared.writeToInbox(a, s, c); } catch (_e) { return false; } };
+
+  // P-d8f1a3c6 — shell `git worktree list --porcelain` at most once per project
+  // per tick and share the parsed trees with BOTH registry-based pruners
+  // (out-of-root + missing-dir reclaim) instead of each self-shelling. Keyed on
+  // the resolved localPath so projects sharing a parent repo only list once. A
+  // project missing from the map (list/shell failure here) falls back to the
+  // consumer's own self-shelling path. `pruneOrphanWorktrees` (r1, fs-readdir
+  // based) never lists and is unaffected.
+  const parsedTreesByProject = new Map();
+  for (const project of projects) {
+    if (!project || !project.localPath) continue;
+    let rootDir;
+    try { rootDir = path.resolve(String(project.localPath)); } catch { continue; }
+    if (parsedTreesByProject.has(rootDir)) continue; // dedup shared-parent projects
+    let rootExists = false;
+    try { rootExists = fs.existsSync(rootDir); } catch { rootExists = false; }
+    if (!rootExists) continue;
+    try {
+      const raw = String(shared.execSilent('git --no-optional-locks worktree list --porcelain', {
+        cwd: rootDir, timeout: 15000, windowsHide: true,
+      }) || '');
+      parsedTreesByProject.set(rootDir, shared.parseWorktreePorcelain(raw));
+    } catch (e) {
+      // Leave unset → the consumer self-shells (existing fallback path).
+      log('warn', `worktree-gc periodic list ${project.name || rootDir}: ${e.message}`);
+    }
+  }
+
   try {
     const r1 = worktreeGc.pruneOrphanWorktrees({
       projects, dispatchSnap, worktreeRootRel, log: _log, config, writeToInbox: _writeToInbox,
@@ -1604,6 +1632,7 @@ function runPeriodicWorktreeSweep(config) {
   try {
     const r2 = worktreeGc.pruneOrphanWorktreesFromGitRegistry({
       projects, dispatchSnap, worktreeRootRel, log: _log, config, writeToInbox: _writeToInbox,
+      parsedTreesByProject,
     });
     scanned += r2.scanned || 0;
     kept += r2.kept || 0;
@@ -1620,7 +1649,7 @@ function runPeriodicWorktreeSweep(config) {
   // interrupted `git worktree add` bricks the branch until a human intervenes.
   try {
     const r3 = worktreeGc.reclaimMissingDirWorktrees({
-      projects, log: _log, config,
+      projects, log: _log, config, parsedTreesByProject,
     });
     missingDirReclaimed += r3.reclaimed || 0;
     missingDirSkippedLive += r3.skippedLive || 0;

package/engine/queries.js

@@ -2698,12 +2698,23 @@ function getProjectGitStatus(localPath, configuredMainBranch = null) {
   // "behind: 8" after the user has already pulled to current — see
   // yemi33/minions#2848. Null those specific counters so the dashboard
   // shows a pending state for ahead/behind until the background probe
-  // settles; branch and dirty flags stay valid enough on the cached
-  // value (and update on the next poll once the probe lands). TTL-expiry
-  // fall-throughs (refsAdvanced=false) still return the prior counters
-  // because nothing local has actually changed there.
+  // settles. TTL-expiry fall-throughs (refsAdvanced=false) still return the
+  // prior counters because nothing local has actually changed there.
+  //
+  // opg-microsoft/minions#295: gitBranch/gitDirty on the cached value are
+  // ALSO known-stale once refs have advanced (e.g. the operator ran
+  // `git switch` / `git pull` directly in a live checkout outside the
+  // dashboard). The cached value still carries the OLD branch name, so a
+  // consumer rendering `gitBranch` as authoritative briefly shows the
+  // pre-switch branch as if current. We keep the cached gitBranch/gitDirty
+  // on the object (so the next poll can self-correct without a flash of
+  // "missing"), but add a `gitStale: true` marker so render paths can avoid
+  // presenting the known-stale branch/dirty as current and fall back to a
+  // neutral "refreshing" presentation. The async refresh scheduled above
+  // self-corrects on the next poll. We do NOT add a synchronous git probe
+  // here — status rebuild must never block the event loop.
   if (refsAdvanced) {
-    return { ...cached.value, ahead: null, behind: null };
+    return { ...cached.value, ahead: null, behind: null, gitStale: true };
   }
   return cached.value;
 }

package/engine/shared.js

@@ -2032,7 +2032,7 @@ function writeToInbox(agentId, slug, content, _inboxDir, metadata) {
 // ── Process Spawning ────────────────────────────────────────────────────────
 // All child process calls go through these to ensure windowsHide: true
 
-const { execSync: _execSync, spawnSync: _spawnSync, spawn: _spawn, exec: _cbExec, execFile: _cbExecFile } = require('child_process');
+const { execSync: _execSync, execFileSync: _execFileSync, spawnSync: _spawnSync, spawn: _spawn, exec: _cbExec, execFile: _cbExecFile } = require('child_process');
 const { promisify: _promisify } = require('util');
 const _execFileAsync = _promisify(_cbExecFile);
 
@@ -8296,6 +8296,13 @@ function _writeWorktreeSkipLiveInboxNote(worktreePath, callerTag) {
   } catch { /* best-effort — never throw from the skip-note writer */ }
 }
 
+// P-c7e2b405 — INTENTIONAL divergence from worktree-gc.reapAndRemoveWorktree:
+// this is the low-level `git worktree remove --force` → fs.rmSync → rd /s /q
+// removal primitive WITH its own EBUSY/_retryFsOp backoff loop. The engine-side
+// helper INJECTS this function as its `removeWorktree` and owns the
+// reap/escalate/marker-gate orchestration around it. It is deliberately NOT
+// folded into the helper (shared.js must not import the engine-side reaper —
+// layering boundary).
 function removeWorktree(wtPath, gitRoot, worktreeRoot, opts = {}) {
   const resolved = path.resolve(wtPath);
   const resolvedRoot = path.resolve(worktreeRoot) + path.sep;
@@ -8326,14 +8333,24 @@ function removeWorktree(wtPath, gitRoot, worktreeRoot, opts = {}) {
       return false;
     }
   } catch { /* bad gitRoot — fall through to the .git probe */ }
-  try {
-    const st = fs.lstatSync(path.join(resolved, '.git'));
-    if (st && st.isDirectory()) {
-      log('warn', `removeWorktree: refusing to remove ${wtPath} — it is a real git repo (.git is a directory, not a linked-worktree pointer)`);
-      try { bumpWorktreeGcMetric('refusedRealRepo'); } catch { /* metric optional */ }
-      return false;
-    }
-  } catch { /* no .git, or unreadable — normal worktree husk; continue */ }
+  // P-b3d9a162 — the `.git`-is-a-directory refusal, extracted so it can run at
+  // BOTH the top of the function AND again immediately before the fallback
+  // fs.rmSync. A Windows file-lock can release between the two checks — the
+  // primary `git worktree remove --force` failing on that lock drops us into
+  // the catch, where a freshly-exposed real `.git` directory would otherwise be
+  // wiped. Returns true ⇒ the caller MUST abort (refuse the delete).
+  const _refuseIfRealRepo = (resolved) => {
+    try {
+      const st = fs.lstatSync(path.join(resolved, '.git'));
+      if (st && st.isDirectory()) {
+        log('warn', `removeWorktree: refusing to remove ${wtPath} — it is a real git repo (.git is a directory, not a linked-worktree pointer)`);
+        try { bumpWorktreeGcMetric('refusedRealRepo'); } catch { /* metric optional */ }
+        return true;
+      }
+    } catch { /* no .git, or unreadable — normal worktree husk; continue */ }
+    return false;
+  };
+  if (_refuseIfRealRepo(resolved)) return false;
   // W-mq5rwwss000f30a7 — never wipe a worktree while an agent is actively
   // dispatched inside it. isWorktreePathLive fails OPEN (returns true) when
   // the dispatches table is unreachable, so we err on the side of leaking
@@ -8363,12 +8380,19 @@ function removeWorktree(wtPath, gitRoot, worktreeRoot, opts = {}) {
 
   bumpWorktreeGcMetric('attempts');
   try {
-    exec(`git worktree remove "${wtPath}" --force`, { cwd: gitRoot, stdio: 'pipe', timeout: 15000, windowsHide: true });
+    // P-1d7a4f80 — argv form (shell:false) so wtPath can never be re-parsed by a shell.
+    shellSafeGitSync(['worktree', 'remove', wtPath, '--force'], { cwd: gitRoot, timeout: 15000 });
     _removeWorktreeFailures.delete(resolved);
     bumpWorktreeGcMetric('success');
     return true;
   } catch (gitErr) {
     try {
+      // P-b3d9a162 — re-run the real-repo refusal: a lock that released only
+      // AFTER the top-of-function probe (and made the primary `git worktree
+      // remove` throw above) can expose a real `.git` directory right here.
+      // Refuse before the fallback rmSync so we never recurse-delete a real
+      // repo on the fallback path.
+      if (_refuseIfRealRepo(resolved)) return false;
       // W-mq5o6bvy000x7191 (Layer 1): retry fs.rmSync with exponential backoff
       // for transient Windows file-locks (EPERM/EBUSY/EACCES/ENOTEMPTY) before
       // falling through to rd /s /q. A single AV/Explorer/vscode lock during
@@ -8377,7 +8401,7 @@ function removeWorktree(wtPath, gitRoot, worktreeRoot, opts = {}) {
         () => fs.rmSync(resolved, { recursive: true, force: true }),
         `fs.rmSync(${resolved})`
       );
-      try { exec('git worktree prune', { cwd: gitRoot, stdio: 'pipe', timeout: 10000, windowsHide: true }); } catch {}
+      try { shellSafeGitSync(['worktree', 'prune'], { cwd: gitRoot, timeout: 10000 }); } catch {}
       _removeWorktreeFailures.delete(resolved);
       bumpWorktreeGcMetric('success');
       if (attempt > 1) bumpWorktreeGcMetric('successAfterRetry');
@@ -8387,8 +8411,11 @@ function removeWorktree(wtPath, gitRoot, worktreeRoot, opts = {}) {
       // locked files, and partially-deleted directories (not just EPERM)
       if (process.platform === 'win32') {
         try {
-          exec(`cmd /c rd /s /q "${resolved}"`, { stdio: 'pipe', timeout: 15000, windowsHide: true });
-          try { exec('git worktree prune', { cwd: gitRoot, stdio: 'pipe', timeout: 10000, windowsHide: true }); } catch {}
+          // P-1d7a4f80 — argv form (shell:false). `rd` is a cmd.exe builtin so it
+          // must run via `cmd /c`, but the worktree path is passed as a discrete
+          // argv element rather than interpolated into a shell string.
+          _execFileSync('cmd', ['/c', 'rd', '/s', '/q', resolved], { stdio: 'pipe', timeout: 15000, windowsHide: true });
+          try { shellSafeGitSync(['worktree', 'prune'], { cwd: gitRoot, timeout: 10000 }); } catch {}
           _removeWorktreeFailures.delete(resolved);
           bumpWorktreeGcMetric('success');
           return true;

package/engine/worktree-gc.js

@@ -347,6 +347,162 @@ function _postReapRetry(wtPath, gitRoot, parentDir, resolvedPath, _removeWorktre
   return false;
 }
 
+/**
+ * P-c7e2b405 — shared "reap-then-remove" core for the THREE worktree pruners
+ * (gcDispatchWorktreeIfOrphan, pruneOrphanWorktrees in-root,
+ * pruneOrphanWorktreesFromGitRegistry out-of-root). It folds the previously
+ * copy-pasted slow-retry gate / ownership-marker gate / remove+escalate+
+ * post-reap-retry tail into one decision surface so the three sites cannot
+ * drift apart.
+ *
+ * Encapsulates, in order:
+ *   (1) slow-retry gate — only when `slowRetryMs` is a number (the two
+ *       sweeps pass it; the dispatch-end caller leaves it null so a fresh
+ *       worktree is never slow-gated). Skip → `{ outcome:'skip',
+ *       reason:'slow-retry' }`.
+ *   (2) ownership-marker gate — only when `requireOwnerMarker:true`
+ *       (fail-open: a read error counts as "no marker"). No marker → KEEP the
+ *       foreign/hand-made worktree, emit the debug log, and never escalate.
+ *       Skip → `{ outcome:'skip', reason:'no-marker' }`.
+ *   (3) pre-remove reaper hook — `reapHolders(path,{excludeDispatchId,
+ *       ownerDispatchId})` when injected (dispatch-end only). Best-effort;
+ *       a throw never blocks the removal that follows.
+ *   (4) remove — the injected `removeWorktree(path,gitRoot,parentDir,rmOpts)`.
+ *       We do NOT re-implement its EBUSY/_retryFsOp backoff; removeWorktree
+ *       owns that loop. The live-guard ALSO stays authoritative inside
+ *       shared.removeWorktree + engine._reapWorktreeHolders (both fail-open) —
+ *       it is never re-implemented here.
+ *   (5) outcome accounting — on truthy: bump `evicted` on each `stats` object,
+ *       _markStuckSuccess, optional success metric, info log. On false/throw:
+ *       bump `failed`, _maybeEscalateStuck (with each site's exact
+ *       reason/findProcessesWithCwdInside/killImmediate/config/writeToInbox
+ *       args), warn log (gated on alreadyEscalated + suppression), and the
+ *       `if (reapedPids.length) _postReapRetry(...)` tail when
+ *       `enablePostReapRetry`.
+ *
+ * Returns `{ outcome, removed, reason, escalated, stuckEscalated, reapedPids }`
+ * matching gcDispatchWorktreeIfOrphan's existing contract. When `stats`
+ * objects are supplied the helper mutates their evicted/failed/kept counters
+ * directly (the sweeps); the dispatch-end caller passes none and maps the
+ * return value instead.
+ */
+function reapAndRemoveWorktree(opts) {
+  const {
+    worktreePath,
+    gitRoot,
+    parentDir,
+    resolved: resolvedIn = null,
+    rmOpts,
+    // gates
+    slowRetryMs = null,
+    requireOwnerMarker = false,
+    // pre-remove reaper (dispatch-end only)
+    reapHolders = null,
+    excludeDispatchId = null,
+    ownerDispatchId = null,
+    // escalation flavor
+    escalateReason = null, // 'orphan-sweep' for the two sweeps; null for dispatch-end
+    findProcessesWithCwdInside = null,
+    killImmediate = null,
+    config = null,
+    writeToInbox = null,
+    sleepSyncFn = null,
+    // accounting + logging
+    stats = [],
+    successReason = 'orphan',
+    successMetric = null,
+    recheckSuppressedAfterEscalate = false,
+    enablePostReapRetry = false,
+    onRemovedLog = null,
+    onFailLog = null,
+    onMarkerSkipLog = null,
+    // injected deps (real-impl defaults)
+    removeWorktree = null,
+    hasOwnerMarker = null,
+    log = _noopLog,
+  } = opts || {};
+
+  const _removeFn = typeof removeWorktree === 'function' ? removeWorktree : shared.removeWorktree;
+  const _hasMarker = typeof hasOwnerMarker === 'function' ? hasOwnerMarker : shared.hasWorktreeOwnerMarker;
+  const resolved = resolvedIn || (() => { try { return path.resolve(worktreePath); } catch { return worktreePath; } })();
+  const _bumpStats = (key) => { for (const s of stats) { if (s && typeof s[key] === 'number') s[key]++; } };
+  const _idle = () => ({ outcome: 'skip', removed: false, escalated: false, stuckEscalated: false, reapedPids: [] });
+
+  // (1) slow-retry gate — sweeps only.
+  if (typeof slowRetryMs === 'number') {
+    if (!_shouldSlowRetry(resolved, slowRetryMs)) {
+      _bumpStats('kept');
+      return { ..._idle(), reason: 'slow-retry' };
+    }
+  }
+
+  // (2) ownership-marker gate — fail-open (no marker ⇒ KEEP foreign/hand-made).
+  if (requireOwnerMarker) {
+    let owned = false;
+    try { owned = !!_hasMarker(worktreePath); }
+    catch (_e) { owned = false; }
+    if (!owned) {
+      _bumpStats('kept');
+      if (typeof onMarkerSkipLog === 'function') log('debug', onMarkerSkipLog());
+      return { ..._idle(), reason: 'no-marker' };
+    }
+  }
+
+  // Capture suppression state BEFORE the remove attempt (sweep semantics).
+  const suppressedBefore = _isStuckPathSuppressed(resolved);
+
+  // (3) pre-remove holder reap (dispatch-end injects engine._reapWorktreeHolders).
+  if (typeof reapHolders === 'function') {
+    try {
+      reapHolders(worktreePath, { excludeDispatchId, ownerDispatchId });
+    } catch (reapErr) {
+      log('warn', `worktree-gc: pre-remove reap threw for ${worktreePath}: ${reapErr && reapErr.message}`);
+    }
+  }
+
+  const _escalateOpts = {
+    config, writeToInbox,
+    reason: escalateReason,
+    findProcessesWithCwdInside, killImmediate,
+  };
+  const _shouldWarn = (escResult) => {
+    const suppressed = recheckSuppressedAfterEscalate
+      ? _isStuckPathSuppressed(resolved)
+      : suppressedBefore;
+    return !escResult.alreadyEscalated && !suppressed;
+  };
+  const _postReapOpts = { writeToInbox, sleepSyncFn };
+
+  // (4)+(5) remove + accounting. removeWorktree owns its own backoff loop.
+  try {
+    const removed = _removeFn(worktreePath, gitRoot, parentDir, rmOpts);
+    if (removed) {
+      _bumpStats('evicted');
+      _markStuckSuccess(resolved, { writeToInbox });
+      if (successMetric) { try { shared.bumpWorktreeGcMetric(successMetric); } catch { /* optional */ } }
+      if (typeof onRemovedLog === 'function') log('info', onRemovedLog());
+      return { outcome: 'gc', removed: true, reason: successReason, escalated: false, stuckEscalated: false, reapedPids: [] };
+    }
+    _bumpStats('failed');
+    const escResult = _maybeEscalateStuck(resolved, 'remove returned false', _escalateOpts);
+    if (_shouldWarn(escResult) && typeof onFailLog === 'function') log('warn', onFailLog('false'));
+    const reapedPids = escResult.reapedPids || [];
+    if (enablePostReapRetry && reapedPids.length > 0) {
+      _postReapRetry(worktreePath, gitRoot, parentDir, resolved, _removeFn, _postReapOpts, stats[0] || null, stats[1] || null, log, reapedPids);
+    }
+    return { outcome: 'gc-failed', removed: false, reason: 'remove-failed', escalated: escResult.escalated, stuckEscalated: escResult.escalated, reapedPids };
+  } catch (rmErr) {
+    _bumpStats('failed');
+    const escResult = _maybeEscalateStuck(resolved, rmErr && rmErr.message, _escalateOpts);
+    if (_shouldWarn(escResult) && typeof onFailLog === 'function') log('warn', onFailLog('threw', rmErr && rmErr.message));
+    const reapedPids = escResult.reapedPids || [];
+    if (enablePostReapRetry && reapedPids.length > 0) {
+      _postReapRetry(worktreePath, gitRoot, parentDir, resolved, _removeFn, _postReapOpts, stats[0] || null, stats[1] || null, log, reapedPids);
+    }
+    return { outcome: 'gc-failed', removed: false, reason: 'remove-threw', escalated: escResult.escalated, stuckEscalated: escResult.escalated, reapedPids };
+  }
+}
+
 /**
  * Decide whether a dispatch-end worktree should be GC'd.
  *
@@ -494,41 +650,34 @@ function gcDispatchWorktreeIfOrphan(opts) {
   if (!gitRoot || !worktreeRoot) {
     return { outcome: 'skip', reason: 'no-git-root', removed: false };
   }
-  const _removeFn = typeof removeWorktree === 'function' ? removeWorktree : shared.removeWorktree;
-  const _rmOpts = excludeDispatchId ? { excludeDispatchId } : undefined;
-  const resolved = (() => { try { return path.resolve(worktreePath); } catch { return worktreePath; } })();
-  // W-mqinlicl §6 — reap the ending dispatch's own orphaned descendant tree
-  // BEFORE attempting removal. The owning dispatch is still 'active' at this
-  // point, so it is passed as `ownerDispatchId` (terminal-owner discovery would
-  // miss it) and as `excludeDispatchId` so the reaper's live-guard ignores this
-  // dispatch's own row. Failure here must never block the removal that follows.
-  if (typeof reapHolders === 'function') {
-    try {
-      reapHolders(worktreePath, { excludeDispatchId, ownerDispatchId: excludeDispatchId });
-    } catch (reapErr) {
-      log('warn', `worktree-gc: pre-remove reap threw for ${worktreePath}: ${reapErr && reapErr.message}`);
-    }
-  }
-  try {
-    const removed = _removeFn(worktreePath, gitRoot, worktreeRoot, _rmOpts);
-    if (removed) {
-      _markStuckSuccess(resolved, { writeToInbox });
-      log('info', `worktree-gc: dispatch-end removed ${path.basename(worktreePath)}`);
-      return { outcome: 'gc', reason: decision.reason, removed: true };
-    }
-    // W-mq5o6bvy000x7191 (Layer 4): track stuck dirs even on soft-false returns.
-    const { escalated, alreadyEscalated } = _maybeEscalateStuck(resolved, 'remove returned false', { config, writeToInbox });
-    if (!alreadyEscalated && !_isStuckPathSuppressed(resolved)) {
-      log('warn', `worktree-gc: dispatch-end remove returned false for ${worktreePath}`);
-    }
-    return { outcome: 'gc-failed', reason: 'remove-failed', removed: false, stuckEscalated: escalated };
-  } catch (gcErr) {
-    const { escalated, alreadyEscalated } = _maybeEscalateStuck(resolved, gcErr && gcErr.message, { config, writeToInbox });
-    if (!alreadyEscalated && !_isStuckPathSuppressed(resolved)) {
-      log('warn', `worktree-gc: dispatch-end remove threw for ${worktreePath}: ${gcErr.message}`);
-    }
-    return { outcome: 'gc-failed', reason: 'remove-threw', removed: false, stuckEscalated: escalated };
+  // P-c7e2b405 — dispatch-end usage of the shared reap-then-remove core:
+  // requireOwnerMarker:false (a dispatch GCs its own worktree regardless of
+  // marker), no slow-retry gate (slowRetryMs left null — a fresh worktree must
+  // never be slow-gated), pre-remove reapHolders, and excludeDispatchId threaded
+  // both as the removeWorktree rmOpt and as the reaper's owner/exclude id.
+  const r = reapAndRemoveWorktree({
+    worktreePath,
+    gitRoot,
+    parentDir: worktreeRoot,
+    rmOpts: excludeDispatchId ? { excludeDispatchId } : undefined,
+    reapHolders,
+    excludeDispatchId,
+    ownerDispatchId: excludeDispatchId,
+    config,
+    writeToInbox,
+    removeWorktree,
+    log,
+    successReason: decision.reason,
+    recheckSuppressedAfterEscalate: true,
+    onRemovedLog: () => `worktree-gc: dispatch-end removed ${path.basename(worktreePath)}`,
+    onFailLog: (kind, errMsg) => kind === 'threw'
+      ? `worktree-gc: dispatch-end remove threw for ${worktreePath}: ${errMsg}`
+      : `worktree-gc: dispatch-end remove returned false for ${worktreePath}`,
+  });
+  if (r.outcome === 'gc') {
+    return { outcome: 'gc', reason: r.reason, removed: true };
   }
+  return { outcome: 'gc-failed', reason: r.reason, removed: false, stuckEscalated: r.stuckEscalated };
 }
 
 /**
@@ -570,6 +719,11 @@ function pruneOrphanWorktrees(opts) {
   const _buildWorktreeDirName = typeof opts.buildWorktreeDirName === 'function'
     ? opts.buildWorktreeDirName
     : shared.buildWorktreeDirName;
+  // P-c7e2b405 — in-root pruner now honors the ownership marker identically to
+  // the out-of-root pruner (was the one site that didn't gate on it).
+  const _hasOwnerMarker = typeof opts.hasOwnerMarker === 'function'
+    ? opts.hasOwnerMarker
+    : shared.hasWorktreeOwnerMarker;
   const _listManagedSpecs = typeof opts.listManagedSpecs === 'function'
     ? opts.listManagedSpecs
     : (() => {
@@ -680,59 +834,38 @@ function pruneOrphanWorktrees(opts) {
         }
       }
 
-      try {
-        // W-mq5o6bvy000x7191 (Layer 4): respect slow-cadence retry for paths
-        // that have escalated past `worktreeStuckThreshold`.
-        const wtResolved = path.resolve(wtPath);
-        const slowRetryMs = (opts.config?.engine?.worktreeStuckSlowRetryMs)
-          ?? shared.ENGINE_DEFAULTS.worktreeStuckSlowRetryMs
-          ?? (30 * 60 * 1000);
-        if (!_shouldSlowRetry(wtResolved, slowRetryMs)) {
-          projStats.kept++; result.kept++;
-          continue;
-        }
-        const suppressed = _isStuckPathSuppressed(wtResolved);
-        const removed = _removeWorktree(wtPath, rootDir, wtParent);
-        if (removed) {
-          projStats.evicted++; result.evicted++;
-          _markStuckSuccess(wtResolved, { writeToInbox: opts.writeToInbox });
-          log('info', `worktree-gc: boot-evicted orphan ${name} for project ${project.name || 'default'}`);
-        } else {
-          projStats.failed++; result.failed++;
-          const escResult = _maybeEscalateStuck(wtResolved, 'remove returned false', {
-            config: opts.config, writeToInbox: opts.writeToInbox,
-            reason: 'orphan-sweep',
-            findProcessesWithCwdInside: opts.findProcessesWithCwdInside,
-            killImmediate: opts.killImmediate,
-          });
-          if (!escResult.alreadyEscalated && !suppressed) {
-            log('warn', `worktree-gc: boot-evict returned false for ${wtPath}`);
-          }
-          // W-mq6f2fe0000557fa — if auto-reap killed any holders, retry the
-          // removal once after a brief settle window. Clear the failure
-          // cache entry so the post-reap retry isn't suppressed by the
-          // 3-strike cooldown.
-          if (escResult.reapedPids && escResult.reapedPids.length > 0) {
-            _postReapRetry(wtPath, rootDir, wtParent, wtResolved, _removeWorktree, opts, projStats, result, log, escResult.reapedPids);
-          }
-        }
-      } catch (rmErr) {
-        projStats.failed++; result.failed++;
-        const wtResolved = path.resolve(wtPath);
-        const suppressed = _isStuckPathSuppressed(wtResolved);
-        const escResult = _maybeEscalateStuck(wtResolved, rmErr && rmErr.message, {
-          config: opts.config, writeToInbox: opts.writeToInbox,
-          reason: 'orphan-sweep',
-          findProcessesWithCwdInside: opts.findProcessesWithCwdInside,
-          killImmediate: opts.killImmediate,
-        });
-        if (!escResult.alreadyEscalated && !suppressed) {
-          log('warn', `worktree-gc: boot-evict threw for ${wtPath}: ${rmErr.message}`);
-        }
-        if (escResult.reapedPids && escResult.reapedPids.length > 0) {
-          _postReapRetry(wtPath, rootDir, wtParent, wtResolved, _removeWorktree, opts, projStats, result, log, escResult.reapedPids);
-        }
-      }
+      // P-c7e2b405 — route the slow-retry gate, ownership-marker gate (now
+      // requireOwnerMarker:true to match the out-of-root pruner), remove,
+      // escalate, and post-reap-retry through the shared helper. Counters are
+      // mutated in-place via `stats`.
+      const wtResolved = path.resolve(wtPath);
+      const slowRetryMs = (opts.config?.engine?.worktreeStuckSlowRetryMs)
+        ?? shared.ENGINE_DEFAULTS.worktreeStuckSlowRetryMs
+        ?? (30 * 60 * 1000);
+      reapAndRemoveWorktree({
+        worktreePath: wtPath,
+        gitRoot: rootDir,
+        parentDir: wtParent,
+        resolved: wtResolved,
+        slowRetryMs,
+        requireOwnerMarker: true,
+        escalateReason: 'orphan-sweep',
+        findProcessesWithCwdInside: opts.findProcessesWithCwdInside,
+        killImmediate: opts.killImmediate,
+        config: opts.config,
+        writeToInbox: opts.writeToInbox,
+        sleepSyncFn: opts.sleepSyncFn,
+        stats: [projStats, result],
+        removeWorktree: _removeWorktree,
+        hasOwnerMarker: _hasOwnerMarker,
+        log,
+        enablePostReapRetry: true,
+        onRemovedLog: () => `worktree-gc: boot-evicted orphan ${name} for project ${project.name || 'default'}`,
+        onFailLog: (kind, errMsg) => kind === 'threw'
+          ? `worktree-gc: boot-evict threw for ${wtPath}: ${errMsg}`
+          : `worktree-gc: boot-evict returned false for ${wtPath}`,
+        onMarkerSkipLog: () => `worktree-gc: keeping in-root ${wtResolved} — no engine ownership marker (foreign/hand-made worktree)`,
+      });
     }
     result.perProject[project.name || rootDir] = projStats;
   }
@@ -756,6 +889,9 @@ function pruneOrphanWorktrees(opts) {
  *                       used to compute the inside-root set we DO NOT touch
  *                       here (the existing scanner handles it).
  *   - log / fs / removeWorktree / listManagedSpecs / execSilent — injection
+ *   - parsedTreesByProject — optional Map<resolvedLocalPath, parsedTrees>
+ *     (P-d8f1a3c6). When set for a project, skip the self-shell of
+ *     `git worktree list --porcelain` and reuse the supplied parsed trees.
  *
  * Protection rules mirror `pruneOrphanWorktrees`:
  *   1. The main checkout (path === projectLocalPath) is always kept.
@@ -792,6 +928,15 @@ function pruneOrphanWorktreesFromGitRegistry(opts) {
   const _parseWorktreePorcelain = typeof opts.parseWorktreePorcelain === 'function'
     ? opts.parseWorktreePorcelain
     : shared.parseWorktreePorcelain;
+  // P-d8f1a3c6 — optional pre-parsed worktree-trees map keyed on the resolved
+  // project localPath. When the periodic sweep already shelled + parsed
+  // `git worktree list --porcelain` for a project (and shares the result with
+  // the missing-dir reclaimer), reuse it and skip our own self-shell. Absent
+  // for a project ⇒ fall back to the self-shelling path so every direct caller
+  // and unit test keeps working unchanged.
+  const _parsedTreesByProject = opts.parsedTreesByProject instanceof Map
+    ? opts.parsedTreesByProject
+    : null;
   // W-mqecdoot — positive ownership gate. An out-of-root worktree is only
   // engine-managed if it carries the ownership marker we stamp at creation
   // (shared.writeWorktreeOwnerMarker). Worktrees a human created by hand
@@ -852,23 +997,26 @@ function pruneOrphanWorktreesFromGitRegistry(opts) {
     const wtParentPrefix = wtParentAbs + path.sep;
 
     const projStats = { scanned: 0, kept: 0, evicted: 0, failed: 0, prunedRegistry: 0 };
-    let raw = '';
-    try {
-      raw = String(_execSilent('git --no-optional-locks worktree list --porcelain', {
-        cwd: rootDir, timeout: 15000, windowsHide: true,
-      }) || '');
-    } catch (e) {
-      log('warn', `worktree-gc: git worktree list failed for ${project.name || rootDir}: ${e.message}`);
-      result.perProject[project.name || rootDir] = projStats;
-      continue;
-    }
-
     let trees;
-    try { trees = _parseWorktreePorcelain(raw); }
-    catch (e) {
-      log('warn', `worktree-gc: parse worktree list failed for ${project.name || rootDir}: ${e.message}`);
-      result.perProject[project.name || rootDir] = projStats;
-      continue;
+    if (_parsedTreesByProject && _parsedTreesByProject.has(rootDir)) {
+      trees = _parsedTreesByProject.get(rootDir);
+    } else {
+      let raw = '';
+      try {
+        raw = String(_execSilent('git --no-optional-locks worktree list --porcelain', {
+          cwd: rootDir, timeout: 15000, windowsHide: true,
+        }) || '');
+      } catch (e) {
+        log('warn', `worktree-gc: git worktree list failed for ${project.name || rootDir}: ${e.message}`);
+        result.perProject[project.name || rootDir] = projStats;
+        continue;
+      }
+      try { trees = _parseWorktreePorcelain(raw); }
+      catch (e) {
+        log('warn', `worktree-gc: parse worktree list failed for ${project.name || rootDir}: ${e.message}`);
+        result.perProject[project.name || rootDir] = projStats;
+        continue;
+      }
     }
 
     for (const wt of trees) {
@@ -904,71 +1052,43 @@ function pruneOrphanWorktreesFromGitRegistry(opts) {
         if (anchored) { projStats.kept++; result.kept++; continue; }
       }
 
-      // W-mqecdoot — ownership gate. Only ever evict a worktree the engine
-      // positively created (carries the ownership marker stamped at
-      // `git worktree add` time). No marker → it's a human's hand-made worktree
-      // (or a pre-marker legacy dir); KEEP it and do NOT escalate. The
+      // P-c7e2b405 — ownership-marker gate, slow-retry gate, remove, escalate,
+      // and post-reap-retry now all flow through the shared helper
+      // (requireOwnerMarker:true — W-mqecdoot: only ever evict a worktree the
+      // engine positively created; no marker → human's hand-made worktree, KEEP
+      // and never escalate). parentDir is the dir *containing* this worktree
+      // (not the project's worktreeRoot, since this dir lives out-of-root). The
       // `git worktree prune --expire=now` below still drops registry entries
       // whose dirs are already gone, which is safe regardless of ownership.
-      let owned = false;
-      try { owned = !!_hasOwnerMarker(wtAbs); }
-      catch (_e) { owned = false; }
-      if (!owned) {
-        projStats.kept++; result.kept++;
-        log('debug', `worktree-gc: keeping out-of-root ${wtAbs} — no engine ownership marker (foreign/hand-made worktree)`);
-        continue;
-      }
-
-      // Slow-cadence gate for already-escalated stuck paths
       const slowRetryMs = (opts.config?.engine?.worktreeStuckSlowRetryMs)
         ?? shared.ENGINE_DEFAULTS.worktreeStuckSlowRetryMs
         ?? (30 * 60 * 1000);
-      if (!_shouldSlowRetry(wtAbs, slowRetryMs)) {
-        projStats.kept++; result.kept++; continue;
-      }
-
-      // parentDir for the safety boundary check inside removeWorktree must be
-      // the dir *containing* this worktree (not the project's worktreeRoot,
-      // since that's not where this dir lives).
       const parentDir = path.dirname(wtAbs);
-      const suppressed = _isStuckPathSuppressed(wtAbs);
-      try {
-        const removed = _removeWorktree(wtAbs, rootDir, parentDir);
-        if (removed) {
-          projStats.evicted++; result.evicted++;
-          _markStuckSuccess(wtAbs, { writeToInbox: opts.writeToInbox });
-          try { shared.bumpWorktreeGcMetric('outOfRootEvicted'); } catch { /* optional */ }
-          log('info', `worktree-gc: out-of-root evicted ${wtAbs} for project ${project.name || 'default'}`);
-        } else {
-          projStats.failed++; result.failed++;
-          const escResult = _maybeEscalateStuck(wtAbs, 'remove returned false', {
-            config: opts.config, writeToInbox: opts.writeToInbox,
-            reason: 'orphan-sweep',
-            findProcessesWithCwdInside: opts.findProcessesWithCwdInside,
-            killImmediate: opts.killImmediate,
-          });
-          if (!escResult.alreadyEscalated && !suppressed) {
-            log('warn', `worktree-gc: out-of-root remove returned false for ${wtAbs}`);
-          }
-          if (escResult.reapedPids && escResult.reapedPids.length > 0) {
-            _postReapRetry(wtAbs, rootDir, parentDir, wtAbs, _removeWorktree, opts, projStats, result, log, escResult.reapedPids);
-          }
-        }
-      } catch (rmErr) {
-        projStats.failed++; result.failed++;
-        const escResult = _maybeEscalateStuck(wtAbs, rmErr && rmErr.message, {
-          config: opts.config, writeToInbox: opts.writeToInbox,
-          reason: 'orphan-sweep',
-          findProcessesWithCwdInside: opts.findProcessesWithCwdInside,
-          killImmediate: opts.killImmediate,
-        });
-        if (!escResult.alreadyEscalated && !suppressed) {
-          log('warn', `worktree-gc: out-of-root remove threw for ${wtAbs}: ${rmErr.message}`);
-        }
-        if (escResult.reapedPids && escResult.reapedPids.length > 0) {
-          _postReapRetry(wtAbs, rootDir, parentDir, wtAbs, _removeWorktree, opts, projStats, result, log, escResult.reapedPids);
-        }
-      }
+      reapAndRemoveWorktree({
+        worktreePath: wtAbs,
+        gitRoot: rootDir,
+        parentDir,
+        resolved: wtAbs,
+        slowRetryMs,
+        requireOwnerMarker: true,
+        escalateReason: 'orphan-sweep',
+        findProcessesWithCwdInside: opts.findProcessesWithCwdInside,
+        killImmediate: opts.killImmediate,
+        config: opts.config,
+        writeToInbox: opts.writeToInbox,
+        sleepSyncFn: opts.sleepSyncFn,
+        stats: [projStats, result],
+        removeWorktree: _removeWorktree,
+        hasOwnerMarker: _hasOwnerMarker,
+        log,
+        successMetric: 'outOfRootEvicted',
+        enablePostReapRetry: true,
+        onRemovedLog: () => `worktree-gc: out-of-root evicted ${wtAbs} for project ${project.name || 'default'}`,
+        onFailLog: (kind, errMsg) => kind === 'threw'
+          ? `worktree-gc: out-of-root remove threw for ${wtAbs}: ${errMsg}`
+          : `worktree-gc: out-of-root remove returned false for ${wtAbs}`,
+        onMarkerSkipLog: () => `worktree-gc: keeping out-of-root ${wtAbs} — no engine ownership marker (foreign/hand-made worktree)`,
+      });
     }
 
     // Always finish with `git worktree prune --expire=now` to drop registry
@@ -1019,7 +1139,9 @@ function pruneOrphanWorktreesFromGitRegistry(opts) {
  *
  * Injection points (all optional — default to the real implementations):
  *   projects, log, fs, execSilent, parseWorktreePorcelain, isWorktreePathLive,
- *   db.
+ *   db, parsedTreesByProject (Map<resolvedLocalPath, parsedTrees>; P-d8f1a3c6 —
+ *   when set for a project, skip the self-shell of `git worktree list
+ *   --porcelain` and reuse the supplied parsed trees).
  *
  * Returns `{ scanned, reclaimed, skippedLive, failed, perProject }` where
  * `scanned` counts only the missing-dir candidates considered (dirs that still
@@ -1036,6 +1158,14 @@ function reclaimMissingDirWorktrees(opts) {
   const _parseWorktreePorcelain = typeof opts.parseWorktreePorcelain === 'function'
     ? opts.parseWorktreePorcelain
     : shared.parseWorktreePorcelain;
+  // P-d8f1a3c6 — optional pre-parsed worktree-trees map keyed on the resolved
+  // project localPath, shared with pruneOrphanWorktreesFromGitRegistry so the
+  // periodic sweep only shells `git worktree list --porcelain` once per
+  // project. Absent for a project ⇒ self-shell (back-compat for direct callers
+  // and existing unit tests).
+  const _parsedTreesByProject = opts.parsedTreesByProject instanceof Map
+    ? opts.parsedTreesByProject
+    : null;
   const _isWorktreePathLive = typeof opts.isWorktreePathLive === 'function'
     ? opts.isWorktreePathLive
     : shared.isWorktreePathLive;
@@ -1053,23 +1183,26 @@ function reclaimMissingDirWorktrees(opts) {
     if (!rootExists) continue;
 
     const projStats = { scanned: 0, reclaimed: 0, skippedLive: 0, failed: 0 };
-    let raw = '';
-    try {
-      raw = String(_execSilent('git --no-optional-locks worktree list --porcelain', {
-        cwd: rootDir, timeout: 15000, windowsHide: true,
-      }) || '');
-    } catch (e) {
-      log('warn', `worktree-gc: missing-dir reclaim list failed for ${project.name || rootDir}: ${e.message}`);
-      result.perProject[project.name || rootDir] = projStats;
-      continue;
-    }
-
     let trees;
-    try { trees = _parseWorktreePorcelain(raw); }
-    catch (e) {
-      log('warn', `worktree-gc: missing-dir reclaim parse failed for ${project.name || rootDir}: ${e.message}`);
-      result.perProject[project.name || rootDir] = projStats;
-      continue;
+    if (_parsedTreesByProject && _parsedTreesByProject.has(rootDir)) {
+      trees = _parsedTreesByProject.get(rootDir);
+    } else {
+      let raw = '';
+      try {
+        raw = String(_execSilent('git --no-optional-locks worktree list --porcelain', {
+          cwd: rootDir, timeout: 15000, windowsHide: true,
+        }) || '');
+      } catch (e) {
+        log('warn', `worktree-gc: missing-dir reclaim list failed for ${project.name || rootDir}: ${e.message}`);
+        result.perProject[project.name || rootDir] = projStats;
+        continue;
+      }
+      try { trees = _parseWorktreePorcelain(raw); }
+      catch (e) {
+        log('warn', `worktree-gc: missing-dir reclaim parse failed for ${project.name || rootDir}: ${e.message}`);
+        result.perProject[project.name || rootDir] = projStats;
+        continue;
+      }
     }
 
     let reclaimedHere = 0;
@@ -1137,6 +1270,7 @@ module.exports = {
   pruneOrphanWorktrees,
   pruneOrphanWorktreesFromGitRegistry,
   reclaimMissingDirWorktrees, // W-mqifblkf00149df5 — locked-initializing missing-dir reaper
+  reapAndRemoveWorktree, // P-c7e2b405 — shared reap-then-remove core (exported for testing)
   // exported for testing (W-mq5o6bvy000x7191)
   _resetStuckPathsForTesting,
   _stuckPaths,

package/engine.js

@@ -1047,37 +1047,6 @@ function _statusPorcelainCmd() {
     : 'git status --porcelain';
 }
 
-// W-mq5n1zx5 — Layer 1a: rename worktree dir with jittered backoff. The
-// raw `fs.renameSync` used to throw Windows EBUSY/EPERM/EACCES if a
-// lingering `git.exe` descendant (typically leaked by a status-probe
-// timeout) still held a packfile handle. We retry with capped exponential
-// backoff + random jitter so the descendant has time to exit on its own.
-// Worst-case wall time ≈ baseMs * (2^attempts) ≈ 16s when attempts=6,
-// baseMs=250 — small enough not to wedge a tick, large enough to clear
-// the typical race. Throws the LAST error on exhaustion so the caller
-// can decide whether to fall back to `git worktree remove --force`.
-async function _renameWithRetry(src, dst, opts = {}) {
-  const attempts = Number(opts.attempts) > 0
-    ? Number(opts.attempts)
-    : ENGINE_DEFAULTS.quarantineRenameRetryAttempts;
-  const baseMs = Number(opts.baseMs) > 0
-    ? Number(opts.baseMs)
-    : ENGINE_DEFAULTS.quarantineRenameRetryBaseMs;
-  let lastErr;
-  for (let i = 0; i < attempts; i++) {
-    try { fs.renameSync(src, dst); return { attempts: i + 1 }; }
-    catch (e) {
-      if (!['EBUSY', 'EPERM', 'EACCES', 'ENOTEMPTY'].includes(e.code)) throw e;
-      lastErr = e;
-      if (i < attempts - 1) {
-        const delay = baseMs * (2 ** i) + Math.random() * 200;
-        await new Promise(r => setTimeout(r, delay));
-      }
-    }
-  }
-  throw lastErr;
-}
-
 // W-mqila0t5 — resolve the worktree-holder reap probe timeout, honoring a
 // `config.engine.statusProbeKillTimeoutMs` override (the dashboard Settings
 // control persists there) and falling back to the ENGINE_DEFAULTS default.
@@ -1223,7 +1192,17 @@ function _reapWorktreeHolders(worktreePath, opts = {}) {
   }
   if (live) { result.skipped = true; result.reason = 'live'; return result; }
 
-  // Layer 0 — legacy git.exe-by-cmdline sweep.
+  // Layer 0 — legacy git.exe-by-cmdline sweep. NOT redundant with Layer 2
+  // (P-e2a6c9d4, evaluated): Layer 2 (findProcessCwdHolders) matches purely on a
+  // process's CWD resolving at/under THIS worktree (engine/shared.js
+  // _windowsCwdProbeScript + _parseCwdHolderLines filter on cwd only). Layer 0
+  // matches `git.exe` by `CommandLine -like '*<worktreePath>*'` regardless of CWD.
+  // The case Layer 2 cannot see: a git.exe the engine itself spawns FROM the repo
+  // root referencing the worktree by argument — e.g. `git -C <gitRoot> worktree
+  // remove <wt>` / `git worktree prune` / `git worktree add <wt>` — its CWD is the
+  // repo root, not under <wt>, so Layer 2 never emits it, but it can still hold a
+  // packfile/dir handle on <wt>. Layer 0's command-line match is the only layer
+  // that reaps it. Keep both.
   try { result.layer0 = (layer0Fn(worktreePath).killed) || 0; }
   catch { /* best-effort */ }
 
@@ -1653,6 +1632,11 @@ async function assertCleanSharedWorktree(rootDir, worktreePath, branchName, disp
 // field is populated and `result.quarantined` stays false (env-blocked
 // path); a normal return means quarantine succeeded.
 async function _quarantineDirtyWorktree(rootDir, worktreePath, branchName, gitOpts, diag = {}) {
+  // P-c7e2b405 — INTENTIONAL divergence from worktree-gc.reapAndRemoveWorktree:
+  // this is the bespoke dirty-worktree quarantine flow (rename → branch backup-ref
+  // → reset → fetch), NOT a plain reap-then-remove. It is deliberately NOT folded
+  // into the shared helper. It does share the same live-guard + holder-reap
+  // primitives (isWorktreePathLive + _reapWorktreeHolders below).
   const ts = Date.now();
   const quarantinedPath = `${worktreePath}-quarantine-${ts}`;
   _bumpQuarantineOutcome('attempts', 1);
@@ -1693,11 +1677,24 @@ async function _quarantineDirtyWorktree(rootDir, worktreePath, branchName, gitOp
   // W-mq5n1zx5 Layer 1a: rename with jittered backoff. Replaces the bare
   // `fs.renameSync(worktreePath, quarantinedPath)` that used to throw
   // Windows EBUSY uncatchably and burn the WI's auto-recovery budget.
+  // Consolidated onto shared._retryFsOp (P-a1c4f7e2): same base*2^i+jitter
+  // backoff math and identical retryable-code set (shared._WORKTREE_RETRYABLE_CODES
+  // === {EBUSY,EPERM,EACCES,ENOTEMPTY}, the exact set the old _renameWithRetry
+  // used). Pass the quarantine-specific attempts/baseMs so the rename keeps its
+  // own retry budget rather than adopting the worktree-remove default. _retryFsOp
+  // is synchronous (blocking sleepMs backoff), so no await here.
   let renameAttempts = 0;
   let renameError = null;
   try {
-    const r = await _renameWithRetry(worktreePath, quarantinedPath);
-    renameAttempts = r.attempts || 1;
+    const r = shared._retryFsOp(
+      () => fs.renameSync(worktreePath, quarantinedPath),
+      `rename ${worktreePath} -> ${quarantinedPath}`,
+      {
+        attempts: ENGINE_DEFAULTS.quarantineRenameRetryAttempts,
+        baseMs: ENGINE_DEFAULTS.quarantineRenameRetryBaseMs,
+      },
+    );
+    renameAttempts = r.attempt || 1;
   } catch (e) {
     renameError = e;
   }
@@ -2634,8 +2631,29 @@ async function spawnAgent(dispatchItem, config) {
                   log('info', `Retrying -b create after prune for ${branchName}`);
                   try { await shared.shellSafeGit(['worktree', 'prune'], { ..._gitOpts, cwd: rootDir, timeout: 15000 }); } catch { /* optional */ }
                   removeStaleIndexLock(rootDir);
-                  // Clean up partial worktree directory from failed attempt
-                  try { if (fs.existsSync(worktreePath)) fs.rmSync(worktreePath, { recursive: true, force: true }); } catch { /* optional */ }
+                  // Clean up partial worktree directory from the failed -b
+                  // attempt. Keep this a RAW fs.rmSync: this husk pre-dates
+                  // `git worktree add`, so git does not yet own it and
+                  // shared.removeWorktree's `git worktree remove --force` would
+                  // no-op on it (P-b3d9a162). Two guards before the delete:
+                  //   1. isWorktreePathLive (fail-open): skip if another
+                  //      dispatch raced onto this path — it returns true on a
+                  //      SQL outage, so we leak the husk rather than nuke a
+                  //      sibling agent's live worktree. Exclude our OWN id.
+                  //   2. belt-and-braces: never recurse-delete a path that
+                  //      carries its own `.git` DIRECTORY (a mis-pointed
+                  //      worktreePath onto a real repo) — a linked worktree's
+                  //      `.git` is a FILE, so this never blocks a real husk.
+                  try {
+                    const _huskGit = path.join(worktreePath, '.git');
+                    let _huskIsRealRepo = false;
+                    try { _huskIsRealRepo = fs.existsSync(_huskGit) && fs.lstatSync(_huskGit).isDirectory(); } catch { /* unreadable — treat as husk */ }
+                    if (fs.existsSync(worktreePath)
+                        && !_huskIsRealRepo
+                        && !shared.isWorktreePathLive(worktreePath, { excludeDispatchId: id })) {
+                      fs.rmSync(worktreePath, { recursive: true, force: true });
+                    }
+                  } catch { /* optional */ }
                   try {
                     await runWorktreeAdd(rootDir, worktreePath, ['-b', branchName, _freshCreateBase], _worktreeGitOpts, 0);
                   } catch (e1b) {
@@ -10016,7 +10034,7 @@ module.exports = {
   gitOutputToString, gitErrorOutput, classifyDepMergeFailureOutput, listUnmergedFiles, // exported for testing
   buildDepConflictFixItem, deriveConflictFixKey, // exported for testing (W-mpcwojgr000a0244)
   isWorktreeRetryableError, removeStaleIndexLock, syncReusedWorktree, assertCleanSharedWorktree, _quarantineDirtyWorktree, // exported for testing
-  _renameWithRetry, _statusPorcelainCmd, _killGitDescendantsForWorktree, _bumpQuarantineOutcome, // exported for testing (W-mq5n1zx5)
+  _statusPorcelainCmd, _killGitDescendantsForWorktree, _bumpQuarantineOutcome, // exported for testing (W-mq5n1zx5)
   _reapWorktreeHolders, _findTerminalWorktreeOwners, // exported for testing (W-mqila0t5 — CWD-pinned holder reap)
   pruneStaleWorktreeForBranch, // exported for testing
   findExistingWorktree, // exported for testing

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yemi33/minions",
-  "version": "0.1.2231",
+  "version": "0.1.2233",
   "description": "Multi-agent AI dev team that runs from ~/.minions/ — five autonomous agents share a single engine, dashboard, and knowledge base",
   "bin": {
     "minions": "bin/minions.js"