mixdog 1.4.0 → 1.4.2

package/src/runtime/shared/worktrees/manager.mjs

@@ -40,6 +40,7 @@ import {
 } from './file-recovery.mjs';
 import { lstat, mkdir, readdir, readFile, rm, rmdir, stat } from 'node:fs/promises';
 import { dirname, join, relative, resolve, sep } from 'node:path';
+import { isPidAlive } from '../pid-liveness.mjs';
 import {
   managedWorktreePath,
   managedWorktreeRoot,
@@ -49,6 +50,7 @@ import {
   WORKTREE_SNAPSHOT_KIND,
   worktreeBranchName,
   worktreeError,
+  worktreeRefusal,
 } from './contract.mjs';
 import {
   assertCarryable,
@@ -68,6 +70,7 @@ import {
   listWorktrees,
   localBranches,
   parseStatusPaths,
+  remoteDefaultBranches,
   runGit,
   throwIfAborted,
   validBranchName,
@@ -84,7 +87,7 @@ import {
 } from './include.mjs';
 import { linkWorktreeDependencies } from './dependencies.mjs';
 import { withRepoLock as withRepoMutationLock } from './lock.mjs';
-import { holdWorkspaceActivity } from './activity-gate.mjs';
+import { holdWorkspaceActivityAsync } from './activity-gate.mjs';
 import { withAdvisoryLocks } from '../../agent/orchestrator/tools/builtin/advisory-lock.mjs';
 import { mergeBranchIntoCheckout, operationInProgress } from './merge.mjs';
 import { readOwnerLease, removeOwnerLease, sameOwner, writeOwnerLease } from './owner.mjs';
@@ -122,17 +125,7 @@ function sessionRootOf(record) {
 // ---------------------------------------------------------------------------
 // Host configuration (settings source, free-space probe); tests override it.
 
-/** pid probe (signal 0); EPERM means the process exists. */
-function processAlive(pid) {
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch (error) {
-    return error?.code === 'EPERM';
-  }
-}
-
-const DEFAULT_CONFIG = Object.freeze({ settings: null, freeBytes: freeBytesAt, processAlive });
+const DEFAULT_CONFIG = Object.freeze({ settings: null, freeBytes: freeBytesAt, processAlive: isPidAlive });
 let config = { ...DEFAULT_CONFIG };
 
 /**
@@ -757,6 +750,11 @@ export async function resolveBranchWorkspace({
         repoCommonDir: repo.repoCommonDir,
       };
     }
+    // Checked out in a managed worktree, the branch a remote declares its
+    // default would stay locked away from the project folder.
+    if (!create && (await remoteDefaultBranches(repo.projectPath)).includes(branch)) {
+      throw worktreeError('WORKTREE_DEFAULT_BRANCH', undefined, { branch });
+    }
     const entry = await createManagedWorktree({
       projectPath,
       sessionId,
@@ -770,10 +768,6 @@ export async function resolveBranchWorkspace({
       confirmLarge,
       signal,
     });
-    const record = await getRecord(entry.id);
-    record.mergeTarget = repo.currentBranch;
-    await putRecord(record);
-    entry.mergeTarget = repo.currentBranch;
     return { path: entry.path, branch, entry, created: true, repoCommonDir: repo.repoCommonDir };
   });
 }
@@ -976,6 +970,174 @@ async function snapshotHolderLive(record, live) {
   return !!lease && lease.pid !== process.pid && leaseProcessAlive(lease);
 }
 
+/** The project folder's uncommitted changes under the requested `carryChanges` mode; `ask` refuses while there are any. */
+async function judgePendingChanges(repo, projectSubdir, carryChanges) {
+  // A carry is judged by the same status read that counts the changes.
+  let pendingChanges = [];
+  if (carryChanges === 'carry') pendingChanges = await assertCarryable(repo.topLevel, projectSubdir);
+  else if (carryChanges) pendingChanges = await uncommittedChanges(repo.topLevel, projectSubdir);
+  if (pendingChanges.length && carryChanges === 'ask') {
+    throw worktreeError('WORKTREE_DIRTY_CHOICE', undefined, {
+      count: pendingChanges.length,
+      paths: pendingChanges.slice(0, DIRTY_CHOICE_PREVIEW),
+    });
+  }
+  return pendingChanges;
+}
+
+/** The commit a new worktree starts from and the branch a merge targets by default. */
+async function resolveStartPoint(repo, { baseBranch, startCommit, signal }) {
+  let baseCommit = repo.headCommit;
+  let mergeTarget = repo.currentBranch;
+  if (baseBranch) {
+    baseCommit = await branchCommit(repo.projectPath, baseBranch, { signal });
+    if (!baseCommit) {
+      throw worktreeError('WORKTREE_UNSUPPORTED_REPO', `Base branch ${baseBranch} does not exist.`, { baseBranch });
+    }
+    mergeTarget = baseBranch;
+  }
+  // A new branch at an explicit start point (`git worktree add -b <b> <path> <commit-ish>`).
+  if (startCommit) baseCommit = await resolveCommit(repo.projectPath, startCommit, signal);
+  return { baseCommit, mergeTarget };
+}
+
+/** The record a creation reserves before git is asked to add the checkout. */
+function newCreationRecord({
+  slug,
+  branch,
+  repo,
+  owner,
+  txId,
+  baseCommit,
+  mergeTarget,
+  existingBranch,
+  exactBranch,
+  tracked,
+  includePlan,
+}) {
+  return {
+    id: slug,
+    txId,
+    repoCommonDir: repo.repoCommonDir,
+    projectPath: repo.projectPath,
+    projectSubdir: projectSubdirOf(repo.topLevel, repo.projectPath),
+    path: managedWorktreePath(repo.repoCommonDir, slug),
+    branch,
+    baseCommit,
+    // An existing branch has no base it branched from: it merges where a
+    // merge first takes it (recorded then), and until that its own work is
+    // what it gained here since baseCommit.
+    mergeTarget: existingBranch ? null : mergeTarget,
+    createdAt: Date.now(),
+    ownerSessionId: owner.sessionId,
+    existingBranch,
+    exactBranch,
+    state: 'creating',
+    disposable: false,
+    warnings: [...(tracked.submodules ? ['submodules'] : []), ...includePlan.warnings],
+    resources: { worktree: null, lock: null, owner: null, includes: [] },
+    deleting: null,
+    recovery: null,
+  };
+}
+
+/**
+ * Locks the fresh checkout, binds its owner lease, moves or leaves the
+ * project folder's changes, applies the includes and links dependencies.
+ * `carry.moved` is set as soon as changes were carried, so a later failure
+ * can put them back.
+ */
+async function populateCheckout({
+  record,
+  owner,
+  repo,
+  projectSubdir,
+  signal,
+  pendingChanges,
+  carryChanges,
+  baseCommit,
+  includePlan,
+  carry,
+}) {
+  await setResource(record, 'worktree', 'created');
+  throwIfAborted(signal);
+  await setResource(record, 'lock', 'pending');
+  await runGit(repo.projectPath, ['worktree', 'lock', '--reason', `mixdog session=${owner.sessionId}`, record.path]);
+  await setResource(record, 'lock', 'created');
+  await setResource(record, 'owner', 'pending');
+  await writeOwnerLease(record, owner);
+  await setResource(record, 'owner', 'created');
+  // Carried before the include entries are copied, so an include never
+  // stands in the way of a carried file; the status is read again here,
+  // right before acting.
+  let changes = pendingChanges.length ? { mode: 'left', count: pendingChanges.length } : null;
+  if (carryChanges === 'carry') {
+    carry.moved = await carryUncommittedChanges({
+      topLevel: repo.topLevel,
+      projectSubdir,
+      worktreePath: record.path,
+      baseCommit,
+      label: record.id,
+    });
+    // The recovery ref stays until the caller has committed the move
+    // (dropCarryRecoveryRef) or put the changes back (restoreCarriedChanges).
+    changes = carry.moved.count
+      ? { mode: 'carried', count: carry.moved.count, recoveryRef: carry.moved.recoveryRef }
+      : null;
+  }
+  const applied = await applyIncludes(includePlan, record.path, (ledger) => recordInclude(record, ledger));
+  throwIfAborted(signal);
+  // After the includes: one that already brought a node_modules wins.
+  const linkedDependencies = await linkWorktreeDependencies({
+    mainDir: repo.projectPath,
+    worktreeDir: projectSubdir ? join(record.path, ...projectSubdir.split('/')) : record.path,
+    worktreeRel: projectSubdir,
+    signal,
+    record: (ledger) => recordInclude(record, ledger),
+  });
+  throwIfAborted(signal);
+  record.warnings = [...record.warnings, ...applied.warnings];
+  const made = (record.resources.includes || []).filter((item) => item.status === 'created');
+  const rels = (predicate) => made.filter(predicate).map((item) => item.rel);
+  // What creation did, for the agent's note at the first turn there (transitions.mjs).
+  const prepared = {
+    root: repo.topLevel,
+    copied: rels((item) => item.mode === 'copy'),
+    linked: rels((item) => item.mode === 'link' && !item.dependency),
+    dependencies: linkedDependencies,
+    skipped: [...includePlan.warnings, ...applied.warnings],
+  };
+  // Whichever path made it (a worktree task, a branch selection, `git
+  // worktree add`), the first turn a session runs here prepares its
+  // dependencies (claimWorktreeSetup).
+  record.setup = { pending: true, prepared };
+  record.state = 'ready';
+  await putRecord(record);
+  return { ...entryView(record), prepared, ...(changes ? { changes } : {}) };
+}
+
+/** The error a failed creation throws, after its carried changes and partial checkout are undone. */
+async function failCreation(error, { record, carried, repo, projectSubdir, needed, root }) {
+  // Carried already: the changes go back to the project folder before the
+  // worktree that holds them is rolled back (the recovery ref keeps them
+  // either way).
+  let carryRestore = null;
+  if (carried?.recoveryRef) {
+    carryRestore = await restoreFromRecoveryRef(repo.topLevel, projectSubdir, carried.recoveryRef)
+      .then(() => ({ restored: true, recoveryRef: carried.recoveryRef }))
+      .catch((restoreError) => ({
+        restored: false,
+        recoveryRef: carried.recoveryRef,
+        error: String(restoreError?.message || restoreError),
+      }));
+  }
+  const rollback = await rollbackCreation(record, error);
+  const failure = isDiskFullError(error) ? await diskFullFailure(error, { needed, root }) : error;
+  if (!rollback.complete) failure.rollback = rollback;
+  if (carryRestore) failure.carryRestore = carryRestore;
+  return failure;
+}
+
 /**
  * `carryChanges` decides the project folder's uncommitted changes (tracked
  * and untracked, ignored excluded), judged under the repository lock:
@@ -1031,29 +1193,10 @@ export async function createManagedWorktree({
     throwIfAborted(signal);
 
     const projectSubdir = projectSubdirOf(repo.topLevel, repo.projectPath);
-    // A carry is judged by the same status read that counts the changes.
-    let pendingChanges = [];
-    if (carryChanges === 'carry') pendingChanges = await assertCarryable(repo.topLevel, projectSubdir);
-    else if (carryChanges) pendingChanges = await uncommittedChanges(repo.topLevel, projectSubdir);
-    if (pendingChanges.length && carryChanges === 'ask') {
-      throw worktreeError('WORKTREE_DIRTY_CHOICE', undefined, {
-        count: pendingChanges.length,
-        paths: pendingChanges.slice(0, DIRTY_CHOICE_PREVIEW),
-      });
-    }
+    const pendingChanges = await judgePendingChanges(repo, projectSubdir, carryChanges);
 
     const settings = await currentWorktreeSettings();
-    let baseCommit = repo.headCommit;
-    let mergeTarget = repo.currentBranch;
-    if (baseBranch) {
-      baseCommit = await branchCommit(repo.projectPath, baseBranch, { signal });
-      if (!baseCommit) {
-        throw worktreeError('WORKTREE_UNSUPPORTED_REPO', `Base branch ${baseBranch} does not exist.`, { baseBranch });
-      }
-      mergeTarget = baseBranch;
-    }
-    // A new branch at an explicit start point (`git worktree add -b <b> <path> <commit-ish>`).
-    if (startCommit) baseCommit = await resolveCommit(repo.projectPath, startCommit, signal);
+    const { baseCommit, mergeTarget } = await resolveStartPoint(repo, { baseBranch, startCommit, signal });
 
     // The main checkout's local env files come along on their own;
     // `.worktreeinclude` applies on top.
@@ -1096,7 +1239,7 @@ export async function createManagedWorktree({
         }
       );
     let record = await reserve();
-    let carried = null;
+    const carry = { moved: null };
 
     try {
       await mkdir(root, { recursive: true });
@@ -1117,84 +1260,20 @@ export async function createManagedWorktree({
         await setResource(record, 'worktree', 'pending');
         await addCheckout(record);
       }
-      await setResource(record, 'worktree', 'created');
-      throwIfAborted(signal);
-      await setResource(record, 'lock', 'pending');
-      await runGit(repo.projectPath, [
-        'worktree',
-        'lock',
-        '--reason',
-        `mixdog session=${owner.sessionId}`,
-        record.path,
-      ]);
-      await setResource(record, 'lock', 'created');
-      await setResource(record, 'owner', 'pending');
-      await writeOwnerLease(record, owner);
-      await setResource(record, 'owner', 'created');
-      // Carried before the include entries are copied, so an include never
-      // stands in the way of a carried file; the status is read again here,
-      // right before acting.
-      let changes = pendingChanges.length ? { mode: 'left', count: pendingChanges.length } : null;
-      if (carryChanges === 'carry') {
-        carried = await carryUncommittedChanges({
-          topLevel: repo.topLevel,
-          projectSubdir,
-          worktreePath: record.path,
-          baseCommit,
-          label: record.id,
-        });
-        // The recovery ref stays until the caller has committed the move
-        // (dropCarryRecoveryRef) or put the changes back (restoreCarriedChanges).
-        changes = carried.count ? { mode: 'carried', count: carried.count, recoveryRef: carried.recoveryRef } : null;
-      }
-      const applied = await applyIncludes(includePlan, record.path, (ledger) => recordInclude(record, ledger));
-      throwIfAborted(signal);
-      // After the includes: one that already brought a node_modules wins.
-      const linkedDependencies = await linkWorktreeDependencies({
-        mainDir: repo.projectPath,
-        worktreeDir: projectSubdir ? join(record.path, ...projectSubdir.split('/')) : record.path,
-        worktreeRel: projectSubdir,
+      return await populateCheckout({
+        record,
+        owner,
+        repo,
+        projectSubdir,
         signal,
-        record: (ledger) => recordInclude(record, ledger),
+        pendingChanges,
+        carryChanges,
+        baseCommit,
+        includePlan,
+        carry,
       });
-      throwIfAborted(signal);
-      record.warnings = [...record.warnings, ...applied.warnings];
-      const made = (record.resources.includes || []).filter((item) => item.status === 'created');
-      const rels = (predicate) => made.filter(predicate).map((item) => item.rel);
-      // What creation did, for the agent's note at the first turn there (transitions.mjs).
-      const prepared = {
-        root: repo.topLevel,
-        copied: rels((item) => item.mode === 'copy'),
-        linked: rels((item) => item.mode === 'link' && !item.dependency),
-        dependencies: linkedDependencies,
-        skipped: [...includePlan.warnings, ...applied.warnings],
-      };
-      // Whichever path made it (a worktree task, a branch selection, `git
-      // worktree add`), the first turn a session runs here prepares its
-      // dependencies (claimWorktreeSetup).
-      record.setup = { pending: true, prepared };
-      record.state = 'ready';
-      await putRecord(record);
-      return { ...entryView(record), prepared, ...(changes ? { changes } : {}) };
     } catch (error) {
-      // Carried already: the changes go back to the project folder before the
-      // worktree that holds them is rolled back (the recovery ref keeps them
-      // either way).
-      let carryRestore = null;
-      if (carried?.recoveryRef) {
-        carryRestore = await restoreFromRecoveryRef(repo.topLevel, projectSubdir, carried.recoveryRef)
-          .then(() => ({ restored: true, recoveryRef: carried.recoveryRef }))
-          .catch((restoreError) => ({
-            restored: false,
-            recoveryRef: carried.recoveryRef,
-            error: String(restoreError?.message || restoreError),
-          }));
-      }
-      const rollback = await rollbackCreation(record, error);
-      const failure = isDiskFullError(error) ? await diskFullFailure(error, { needed, root }) : error;
-      if (!rollback.complete) failure.rollback = rollback;
-      if (carryRestore) failure.carryRestore = carryRestore;
-      throw failure;
+      throw await failCreation(error, { record, carried: carry.moved, repo, projectSubdir, needed, root });
     }
 
     async function reserveName() {
@@ -1210,27 +1289,19 @@ export async function createManagedWorktree({
       if (!(await validBranchName(repo.projectPath, branch))) {
         throw worktreeError('WORKTREE_UNSUPPORTED_REPO', `Branch name ${branch} is not valid.`, { branch });
       }
-      const candidate = {
-        id: slug,
-        txId,
-        repoCommonDir: repo.repoCommonDir,
-        projectPath: repo.projectPath,
-        projectSubdir: projectSubdirOf(repo.topLevel, repo.projectPath),
-        path: managedWorktreePath(repo.repoCommonDir, slug),
+      const candidate = newCreationRecord({
+        slug,
         branch,
+        repo,
+        owner,
+        txId,
         baseCommit,
         mergeTarget,
-        createdAt: Date.now(),
-        ownerSessionId: owner.sessionId,
         existingBranch,
         exactBranch: requestedBranch !== null,
-        state: 'creating',
-        disposable: false,
-        warnings: [...(tracked.submodules ? ['submodules'] : []), ...includePlan.warnings],
-        resources: { worktree: null, lock: null, owner: null, includes: [] },
-        deleting: null,
-        recovery: null,
-      };
+        tracked,
+        includePlan,
+      });
       return (await insertRecord(candidate)) ? candidate : null;
     }
   });
@@ -1356,9 +1427,12 @@ export async function createSnapshotWorktree({
  * one is admitted there until the returned release. A folder no longer a
  * checkout admits no consumer (activity-gate tracks git checkouts only).
  */
-function holdSnapshotFolder(record) {
+async function holdSnapshotFolder(record) {
   if (!existsSync(join(record.path, '.git'))) return () => {};
-  return holdWorkspaceActivity([record.path]);
+  const release = await holdWorkspaceActivityAsync([record.path]);
+  // Settles once the removal was attempted. It fails only when workspace
+  // admission stopped (reported there), which keeps the folder held.
+  return () => release().catch(() => {});
 }
 
 /** A refusal that only says "something still runs there" (retry once it ends). */
@@ -1400,9 +1474,7 @@ export async function removeSessionSnapshots(sessionId, { txIds = null } = {}) {
   const only = txIds ? new Set(txIds) : null;
   const held = Object.values((await readRegistry()).entries).filter(
     (record) =>
-      record.kind === WORKTREE_SNAPSHOT_KIND &&
-      record.holderSessionId === sessionId &&
-      (!only || only.has(record.txId))
+      record.kind === WORKTREE_SNAPSHOT_KIND && record.holderSessionId === sessionId && (!only || only.has(record.txId))
   );
   for (const record of held) {
     const row = { id: record.id, txId: record.txId };
@@ -1854,19 +1926,59 @@ export async function removeManagedWorktree({
       if (!current && !expected) throw worktreeError('WORKTREE_MISSING', undefined, { entryId });
       return skipped;
     }
-    assertNotShared(current, sessionId);
-    if (current.state === 'creating' || current.state === 'recovery') {
-      const rollback = await rollbackCreation(current);
-      return rollback.complete ? { removed: true } : { removed: false, retryable: true, remaining: rollback.remaining };
+    return removeLocked(current, { force, sessionId, preserveBranch, safeOnly });
+  });
+}
+
+/** The removal of `current`, under its repository lock. */
+async function removeLocked(current, { force, sessionId, preserveBranch = false, safeOnly = false }) {
+  assertNotShared(current, sessionId);
+  if (current.state === 'creating' || current.state === 'recovery') {
+    const rollback = await rollbackCreation(current);
+    return rollback.complete ? { removed: true } : { removed: false, retryable: true, remaining: rollback.remaining };
+  }
+  // Every deletion attempt of a snapshot, a resumed one included, waits
+  // for (refuses on) its consumers.
+  const release = current.kind === WORKTREE_SNAPSHOT_KIND ? await holdSnapshotFolder(current) : () => {};
+  try {
+    return await decideAndFinishDeletion(current, { force, preserveBranch, safeOnly });
+  } finally {
+    await release();
+  }
+}
+
+/**
+ * Remove a worktree whose owner is gone, on an explicit request: under the
+ * repository lock its retention is read again right before anything moves,
+ * so an owner that came back (a live session, a running lease holder) or a
+ * session the store still keeps it for refuses (WORKTREE_BUSY_JOBS). Then
+ * the ordinary removal guards apply (dirty or unmerged work needs `force`).
+ * @param {{ entryId: string, force?: boolean, liveSessionIds?: string[], retainedSessionIds?: string[] }} input
+ */
+export async function removeOrphanedWorktree({
+  entryId,
+  force = false,
+  liveSessionIds = [],
+  retainedSessionIds = [],
+} = {}) {
+  const record = await getRecord(entryId);
+  if (!record) throw worktreeError('WORKTREE_MISSING', undefined, { entryId });
+  return withRepoLock(record.repoCommonDir, async () => {
+    const current = await getRecord(entryId);
+    if (!current || current.kind === WORKTREE_SNAPSHOT_KIND) {
+      throw worktreeError('WORKTREE_MISSING', undefined, { entryId });
     }
-    // Every deletion attempt of a snapshot, a resumed one included, waits
-    // for (refuses on) its consumers.
-    const release = current.kind === WORKTREE_SNAPSHOT_KIND ? holdSnapshotFolder(current) : () => {};
-    try {
-      return await decideAndFinishDeletion(current, { force, preserveBranch, safeOnly });
-    } finally {
-      release();
+    const { ownerLive, removable } = await retentionOf(current, new Set(liveSessionIds), new Set(retainedSessionIds));
+    if (ownerLive) throw worktreeRefusal('workspace-lease', { entryId });
+    if (!removable) {
+      // Retained recovery data names itself; otherwise sessions still keep it.
+      await assertRecoveryStoresClear(current);
+      throw worktreeRefusal('workspace-retained', {
+        entryId,
+        sessions: [current.ownerSessionId, ...(current.sharedSessionIds ?? [])].filter(Boolean),
+      });
     }
+    return removeLocked(current, { force });
   });
 }
 
@@ -1900,25 +2012,7 @@ export async function listManagedWorktrees({ liveSessionIds = [], retainedSessio
   const retained = new Set(retainedSessionIds);
   const rows = [];
   for (const record of Object.values((await readRegistry()).entries)) {
-    const snapshot = record.kind === WORKTREE_SNAPSHOT_KIND;
-    const ownerLive = snapshot
-      ? await snapshotHolderLive(record, live)
-      : (!!record.ownerSessionId && live.has(record.ownerSessionId)) ||
-        leaseProcessAlive(await readOwnerLease(record));
-    const isRetained = !!record.ownerSessionId && retained.has(record.ownerSessionId);
-    // A snapshot outlives no holder: the prune removes it, changes and all.
-    let removable = snapshot
-      ? !ownerLive
-      : !record.sharedSessionIds?.length &&
-        (record.state !== 'ready' || (!ownerLive && (record.disposable === true || !isRetained)));
-    if (removable) {
-      try {
-        await assertRecoveryStoresClear(record);
-      } catch (error) {
-        if (error?.code !== 'WORKTREE_FILE_RECOVERY') throw error;
-        removable = false;
-      }
-    }
+    const { ownerLive, retained: isRetained, removable } = await retentionOf(record, live, retained);
     rows.push({
       ...entryView(record),
       projectPath: record.projectPath,
@@ -1930,6 +2024,29 @@ export async function listManagedWorktrees({ liveSessionIds = [], retainedSessio
   return rows;
 }
 
+/** Who keeps `record` (listManagedWorktrees): `live` and `retained` are session id sets. */
+async function retentionOf(record, live, retained) {
+  const snapshot = record.kind === WORKTREE_SNAPSHOT_KIND;
+  const ownerLive = snapshot
+    ? await snapshotHolderLive(record, live)
+    : (!!record.ownerSessionId && live.has(record.ownerSessionId)) || leaseProcessAlive(await readOwnerLease(record));
+  const isRetained = !!record.ownerSessionId && retained.has(record.ownerSessionId);
+  // A snapshot outlives no holder: the prune removes it, changes and all.
+  let removable = snapshot
+    ? !ownerLive
+    : !record.sharedSessionIds?.length &&
+      (record.state !== 'ready' || (!ownerLive && (record.disposable === true || !isRetained)));
+  if (removable) {
+    try {
+      await assertRecoveryStoresClear(record);
+    } catch (error) {
+      if (error?.code !== 'WORKTREE_FILE_RECOVERY') throw error;
+      removable = false;
+    }
+  }
+  return { ownerLive, retained: isRetained, removable };
+}
+
 /**
  * Conservative reconcile (daemon startup, and the manual prune). Always:
  * resumes interrupted deletions, rolls back interrupted creations of no
@@ -1995,7 +2112,7 @@ export async function reconcileManagedWorktrees({
               // surviving folder since still keeps it.
               let release;
               try {
-                release = holdSnapshotFolder(record);
+                release = await holdSnapshotFolder(record);
               } catch (error) {
                 if (!snapshotInUse(error)) throw error;
                 report.kept.push({ id: record.id, reason: 'snapshot-in-use' });
@@ -2004,7 +2121,7 @@ export async function reconcileManagedWorktrees({
               try {
                 reportDeletion(record, await finishDeletion(record));
               } finally {
-                release();
+                await release();
               }
               continue;
             }
@@ -2020,7 +2137,7 @@ export async function reconcileManagedWorktrees({
               let release = null;
               if (!(await snapshotHolderLive(record, live))) {
                 try {
-                  release = holdSnapshotFolder(record);
+                  release = await holdSnapshotFolder(record);
                 } catch (error) {
                   if (!snapshotInUse(error)) throw error;
                 }
@@ -2036,7 +2153,7 @@ export async function reconcileManagedWorktrees({
                 await putRecord(record);
                 reportDeletion(record, await finishDeletion(record));
               } finally {
-                release();
+                await release();
               }
               continue;
             }

package/src/runtime/shared/worktrees/test-support.mjs

@@ -1,26 +1,22 @@
 // Temporary git repositories and data dirs for the worktree suites.
 import '../git-direct.test-support.mjs';
 import { execFileSync } from 'node:child_process';
-import { appendFileSync, chmodSync, cpSync, existsSync, mkdtempSync, rmSync, writeFileSync, mkdirSync } from 'node:fs';
-import { tmpdir } from 'node:os';
+import { appendFileSync, chmodSync, cpSync, existsSync, writeFileSync, mkdirSync } from 'node:fs';
 import { dirname, join } from 'node:path';
+import { makeTempDirSync, removeTempDirSync } from '../../../../scripts/lib/scoped-temp.mjs';
 
 const created = [];
 
+// A suite that never calls cleanupTempDirs still has its directories removed
+// when the process exits.
 export function tempDir(prefix = 'mixdog-wt-') {
-  const dir = mkdtempSync(join(tmpdir(), prefix));
+  const dir = makeTempDirSync(prefix);
   created.push(dir);
   return dir;
 }
 
 export function cleanupTempDirs() {
-  for (const dir of created.splice(0)) {
-    try {
-      rmSync(dir, { recursive: true, force: true, maxRetries: 5, retryDelay: 50 });
-    } catch {
-      /* best effort */
-    }
-  }
+  for (const dir of created.splice(0)) removeTempDirSync(dir);
 }
 
 const GIT_ENV = { ...process.env, GIT_TERMINAL_PROMPT: '0', GIT_EDITOR: 'true' };