sync-worktrees 4.2.0 → 5.0.0

package/dist/mcp-server.js

@@ -4,10 +4,10 @@
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 
 // src/mcp/context.ts
-import * as fs10 from "fs/promises";
-import * as path14 from "path";
+import * as fs17 from "fs/promises";
+import * as path20 from "path";
 import pLimit3 from "p-limit";
-import simpleGit6 from "simple-git";
+import simpleGit7 from "simple-git";
 
 // src/constants.ts
 var GIT_CONSTANTS = {
@@ -18,6 +18,10 @@ var GIT_CONSTANTS = {
   COMMON_DEFAULT_BRANCHES: ["main", "master", "develop", "trunk"],
   BARE_DIR_NAME: ".bare",
   DIVERGED_DIR_NAME: ".diverged",
+  REMOVED_DIR_NAME: ".removed",
+  TRASH_DIR_NAME: ".trash",
+  TRASH_REF_PREFIX: "refs/sync-worktrees/trash/",
+  KEEP_REF_PREFIX: "refs/sync-worktrees/keep/",
   LFS_HEADER: "version https://git-lfs.github.com/spec/",
   SUBMODULE_STATUS_ADDED: "+",
   SUBMODULE_STATUS_REMOVED: "-",
@@ -63,7 +67,16 @@ var DEFAULT_CONFIG = {
   FETCH_TIMEOUT_MS: 3e5,
   CLONE_TIMEOUT_MS: 9e5,
   LOCK_STALE_MS: 6e5,
-  LOCK_UPDATE_MS: 3e4
+  LOCK_UPDATE_MS: 3e4,
+  MAINTENANCE: {
+    ENABLED: true,
+    INTERVAL: "7d"
+  },
+  TRASH: {
+    ENABLED: true,
+    RETENTION_DAYS: 30,
+    MIGRATE_LEGACY: true
+  }
 };
 var ERROR_MESSAGES = {
   GIT_NOT_INITIALIZED: "Git service not initialized. Call initialize() first.",
@@ -98,6 +111,15 @@ var CONFIG_FILE_NAMES = [
   "sync-worktrees.config.mjs",
   "sync-worktrees.config.cjs"
 ];
+var MAINTENANCE_CONSTANTS = {
+  STATE_FILENAME: "sync-worktrees-maintenance.json"
+};
+var TRASH_CONSTANTS = {
+  MANIFEST_FILENAME: "manifest.json",
+  PAYLOAD_DIRNAME: "payload",
+  BUNDLE_FILENAME: "commits.bundle",
+  SCHEMA_VERSION: 1
+};
 var METADATA_CONSTANTS = {
   MAX_HISTORY_ENTRIES: 10,
   METADATA_FILENAME: "sync-metadata.json",
@@ -140,15 +162,22 @@ var GitOperationError = class extends GitError {
     super(`Git operation '${operation}' failed: ${details}`, "OPERATION_FAILED", cause);
   }
 };
+var FastForwardError = class extends GitError {
+  constructor(branchName, cause) {
+    super(`Cannot fast-forward branch '${branchName}'`, "FAST_FORWARD_FAILED", cause);
+    this.branchName = branchName;
+  }
+  branchName;
+};
 var WorktreeError = class extends SyncWorktreesError {
   constructor(message, code, cause) {
     super(message, `WORKTREE_${code}`, cause);
   }
 };
 var WorktreeNotCleanError = class extends WorktreeError {
-  constructor(path16, reasons) {
-    super(`Worktree at '${path16}' is not clean: ${reasons.join(", ")}`, "NOT_CLEAN");
-    this.path = path16;
+  constructor(path22, reasons) {
+    super(`Worktree at '${path22}' is not clean: ${reasons.join(", ")}`, "NOT_CLEAN");
+    this.path = path22;
     this.reasons = reasons;
   }
   path;
@@ -175,6 +204,18 @@ var ConfigFileNotFoundError = class extends ConfigError {
   }
   configPath;
 };
+var TrashError = class extends SyncWorktreesError {
+  constructor(message, code, cause) {
+    super(message, `TRASH_${code}`, cause);
+  }
+};
+var TrashOperationError = class extends TrashError {
+  constructor(operation, details, cause) {
+    super(`Trash operation '${operation}' failed: ${details}`, "OPERATION_FAILED", cause);
+    this.operation = operation;
+  }
+  operation;
+};
 
 // src/utils/branch-filter.ts
 function matchesPattern(name, pattern) {
@@ -196,16 +237,73 @@ function filterBranchesByName(branches, include, exclude) {
   return result;
 }
 
+// src/utils/date-filter.ts
+function parseDuration(durationStr) {
+  const match = durationStr.match(/^(\d+)([hdwmy])$/);
+  if (!match) {
+    return null;
+  }
+  const value = parseInt(match[1], 10);
+  const unit = match[2];
+  const multipliers = {
+    h: 60 * 60 * 1e3,
+    // hours
+    d: 24 * 60 * 60 * 1e3,
+    // days
+    w: 7 * 24 * 60 * 60 * 1e3,
+    // weeks
+    m: 30 * 24 * 60 * 60 * 1e3,
+    // months (approximate)
+    y: 365 * 24 * 60 * 60 * 1e3
+    // years (approximate)
+  };
+  return value * multipliers[unit];
+}
+function filterBranchesByAge(branches, maxAge) {
+  const maxAgeMs = parseDuration(maxAge);
+  if (maxAgeMs === null) {
+    console.warn(`Invalid duration format: ${maxAge}. Using all branches.`);
+    return branches;
+  }
+  const cutoffDate = new Date(Date.now() - maxAgeMs);
+  return branches.filter(({ lastActivity }) => lastActivity >= cutoffDate);
+}
+function formatDuration(durationStr) {
+  const match = durationStr.match(/^(\d+)([hdwmy])$/);
+  if (!match) {
+    return durationStr;
+  }
+  const value = parseInt(match[1], 10);
+  const unit = match[2];
+  const unitNames = {
+    h: value === 1 ? "hour" : "hours",
+    d: value === 1 ? "day" : "days",
+    w: value === 1 ? "week" : "weeks",
+    m: value === 1 ? "month" : "months",
+    y: value === 1 ? "year" : "years"
+  };
+  return `${value} ${unitNames[unit]}`;
+}
+
 // src/utils/file-exists.ts
 import * as fs from "fs/promises";
-async function fileExists(path16) {
+async function fileExists(path22) {
   try {
-    await fs.access(path16);
+    await fs.access(path22);
     return true;
   } catch {
     return false;
   }
 }
+async function probePathExists(path22) {
+  try {
+    await fs.access(path22);
+    return "exists";
+  } catch (error) {
+    const code = error.code;
+    return code === "ENOENT" || code === "ENOTDIR" ? "missing" : "unknown";
+  }
+}
 
 // src/utils/git-url.ts
 function extractRepoNameFromUrl(gitUrl) {
@@ -296,7 +394,8 @@ var CLONE_MODE_CONFLICTING_FIELDS = [
   "branchExclude",
   "branchMaxAge",
   "updateExistingWorktrees",
-  "bareRepoDir"
+  "bareRepoDir",
+  "trash"
 ];
 var ConfigLoaderService = class {
   async findConfigUpward(startDir) {
@@ -399,6 +498,12 @@ var ConfigLoaderService = class {
       if (repoObj.sparseCheckout !== void 0) {
         this.validateSparseCheckoutConfig(repoObj.sparseCheckout, `Repository '${repoObj.name}'`);
       }
+      if (repoObj.maintenance !== void 0) {
+        this.validateMaintenanceConfig(repoObj.maintenance, `Repository '${repoObj.name}'`);
+      }
+      if (repoObj.trash !== void 0) {
+        this.validateTrashConfig(repoObj.trash, `Repository '${repoObj.name}'`);
+      }
       this.validateDepth(repoObj.depth, `Repository '${repoObj.name}' depth`);
       this.validateRepositoryMode(repoObj, configObj.defaults);
     });
@@ -435,6 +540,12 @@ var ConfigLoaderService = class {
       if (defaults.sparseCheckout !== void 0) {
         this.validateSparseCheckoutConfig(defaults.sparseCheckout, "defaults");
       }
+      if (defaults.maintenance !== void 0) {
+        this.validateMaintenanceConfig(defaults.maintenance, "defaults");
+      }
+      if (defaults.trash !== void 0) {
+        this.validateTrashConfig(defaults.trash, "defaults");
+      }
       this.validateDepth(defaults.depth, "defaults.depth");
       if (defaults.mode !== void 0 && !isRepositoryMode(defaults.mode)) {
         throw new ConfigValidationError("defaults.mode", "must be 'clone' or 'worktree'");
@@ -462,6 +573,46 @@ var ConfigLoaderService = class {
       throw new ConfigValidationError(field, "must be a positive safe integer");
     }
   }
+  validateMaintenanceConfig(value, context) {
+    if (value === void 0) return;
+    if (typeof value !== "object" || value === null) {
+      throw new Error(`'maintenance' in ${context} must be an object`);
+    }
+    const maintenance = value;
+    if (maintenance.enabled !== void 0 && typeof maintenance.enabled !== "boolean") {
+      throw new Error(`'maintenance.enabled' in ${context} must be a boolean`);
+    }
+    if (maintenance.aggressive !== void 0 && typeof maintenance.aggressive !== "boolean") {
+      throw new Error(`'maintenance.aggressive' in ${context} must be a boolean`);
+    }
+    if (maintenance.interval !== void 0) {
+      const parsed = typeof maintenance.interval === "string" ? parseDuration(maintenance.interval) : null;
+      if (parsed === null || parsed <= 0) {
+        throw new Error(
+          `'maintenance.interval' in ${context} must be a positive duration string like '7d', '24h', or '2w'`
+        );
+      }
+    }
+  }
+  validateTrashConfig(value, context) {
+    if (value === void 0) return;
+    if (typeof value !== "object" || value === null) {
+      throw new Error(`'trash' in ${context} must be an object`);
+    }
+    const trash = value;
+    if (trash.enabled !== void 0 && typeof trash.enabled !== "boolean") {
+      throw new Error(`'trash.enabled' in ${context} must be a boolean`);
+    }
+    if (trash.migrateLegacy !== void 0 && typeof trash.migrateLegacy !== "boolean") {
+      throw new Error(`'trash.migrateLegacy' in ${context} must be a boolean`);
+    }
+    if (trash.retentionDays !== void 0 && (typeof trash.retentionDays !== "number" || !Number.isFinite(trash.retentionDays) || trash.retentionDays <= 0)) {
+      throw new Error(`'trash.retentionDays' in ${context} must be a positive number`);
+    }
+    if (trash.warnSizeBytes !== void 0 && (typeof trash.warnSizeBytes !== "number" || !Number.isFinite(trash.warnSizeBytes) || trash.warnSizeBytes <= 0)) {
+      throw new Error(`'trash.warnSizeBytes' in ${context} must be a positive number`);
+    }
+  }
   validateRetryConfig(value, context) {
     if (typeof value !== "object" || value === null) {
       throw new Error(context === "retry config" ? "'retry' must be an object" : `Invalid 'retry' in ${context}`);
@@ -733,6 +884,18 @@ var ConfigLoaderService = class {
     if (sparse) {
       resolved.sparseCheckout = sparse;
     }
+    if (repo.maintenance || defaults?.maintenance) {
+      resolved.maintenance = {
+        ...defaults?.maintenance || {},
+        ...repo.maintenance || {}
+      };
+    }
+    if (repo.trash || defaults?.trash) {
+      resolved.trash = {
+        ...defaults?.trash || {},
+        ...repo.trash || {}
+      };
+    }
     return resolved;
   }
   isDuplicateRepoUrl(repo, all, defaults) {
@@ -926,6 +1089,31 @@ function isMissingRemoteRefError(errorMessage) {
   return MISSING_REMOTE_REF_PATTERNS.some((pattern) => errorMessage.includes(pattern));
 }
 
+// src/utils/lock-path.ts
+import { createHash } from "crypto";
+import * as os from "os";
+import * as path3 from "path";
+function getCloneModeLockTarget(config) {
+  const hash = createHash("sha256").update(path3.resolve(config.worktreeDir)).digest("hex").slice(0, 16);
+  const stateBase = process.env.XDG_STATE_HOME && process.env.XDG_STATE_HOME.length > 0 ? process.env.XDG_STATE_HOME : path3.join(os.homedir(), ".cache");
+  const dir = path3.join(stateBase, "sync-worktrees", "locks");
+  return { dir, file: `${hash}.lock` };
+}
+function getRemovalAuditLogPath(config) {
+  const name = config.name;
+  const configDir = config.__configFileDir;
+  const hash = createHash("sha256").update(path3.resolve(config.worktreeDir)).digest("hex").slice(0, 16);
+  if (configDir) {
+    return path3.join(
+      configDir,
+      ".sync-worktrees-state",
+      `${sanitizeNameForPath(name ?? "repo", "removal audit log name")}-${hash}-removals.jsonl`
+    );
+  }
+  const stateBase = process.env.XDG_STATE_HOME && process.env.XDG_STATE_HOME.length > 0 ? process.env.XDG_STATE_HOME : path3.join(os.homedir(), ".cache");
+  return path3.join(stateBase, "sync-worktrees", "removals", `${hash}.jsonl`);
+}
+
 // src/utils/retry.ts
 var DEFAULT_OPTIONS = {
   maxAttempts: "unlimited",
@@ -996,7 +1184,7 @@ async function retry(fn, options = {}) {
       const jitter = opts.jitterMs > 0 ? Math.random() * opts.jitterMs : 0;
       const delay = baseDelay + jitter;
       opts.onRetry(error, attempt, lfsContext);
-      await new Promise((resolve11) => setTimeout(resolve11, delay));
+      await new Promise((resolve13) => setTimeout(resolve13, delay));
       attempt++;
     }
   }
@@ -1067,7 +1255,7 @@ var PhaseTimer = class {
     return results;
   }
 };
-function formatDuration(ms) {
+function formatDuration2(ms) {
   if (ms < 1e3) {
     return `${ms}ms`;
   }
@@ -1089,7 +1277,7 @@ function formatTimingTable(totalDuration, phaseResults, repoName) {
     }
   });
   table.push([{ colSpan: 3, content: header, hAlign: "center" }]);
-  table.push(["Total Sync", formatDuration(totalDuration), ""]);
+  table.push(["Total Sync", formatDuration2(totalDuration), ""]);
   for (let i = 0; i < phaseResults.length; i++) {
     const result = phaseResults[i];
     const isLast = i === phaseResults.length - 1;
@@ -1097,14 +1285,14 @@ function formatTimingTable(totalDuration, phaseResults, repoName) {
     const prefix = isLast ? "\u2514\u2500" : "\u251C\u2500";
     const name = `  ${prefix} ${result.name}${countStr}`;
     const efficiency = result.efficiency ? `${result.efficiency}%` : "";
-    table.push([name, formatDuration(result.duration), efficiency]);
+    table.push([name, formatDuration2(result.duration), efficiency]);
   }
   return table.toString();
 }
 
 // src/services/clone-sync.service.ts
 import * as fs3 from "fs/promises";
-import * as path4 from "path";
+import * as path5 from "path";
 import simpleGit from "simple-git";
 
 // src/utils/git-progress.ts
@@ -1133,7 +1321,7 @@ function makeGitProgressHandler(logger, emitProgress) {
 
 // src/services/file-copy.service.ts
 import * as fs2 from "fs/promises";
-import * as path3 from "path";
+import * as path4 from "path";
 import { glob } from "glob";
 var DEFAULT_IGNORE_PATTERNS = [
   "**/node_modules/**",
@@ -1160,8 +1348,8 @@ var FileCopyService = class {
     }
     const filesToCopy = await this.expandPatterns(sourceDir, patterns);
     for (const relativePath of filesToCopy) {
-      const sourcePath = path3.join(sourceDir, relativePath);
-      const destPath = path3.join(destDir, relativePath);
+      const sourcePath = path4.join(sourceDir, relativePath);
+      const destPath = path4.join(destDir, relativePath);
       try {
         const copied = await this.copyFile(sourcePath, destPath);
         if (copied) {
@@ -1200,7 +1388,7 @@ var FileCopyService = class {
     if (await fileExists(destPath)) {
       return false;
     }
-    const destDir = path3.dirname(destPath);
+    const destDir = path4.dirname(destPath);
     await fs2.mkdir(destDir, { recursive: true });
     await fs2.copyFile(sourcePath, destPath);
     return true;
@@ -1262,7 +1450,7 @@ var BranchCreatedActionsService = class {
 function formatCloneSkipReason(reason) {
   switch (reason.kind) {
     case "branch_mismatch":
-      return reason.phase === "init" ? `clone is on '${reason.currentBranch}', expected '${reason.expectedBranch}' (since process start)` : `clone is on '${reason.currentBranch}', expected '${reason.expectedBranch}'`;
+      return reason.phase === "init" ? `clone is on '${reason.currentBranch}', expected '${reason.expectedBranch}' (since process start) \u2014 update 'branch' in the config or switch the clone back` : `clone is on '${reason.currentBranch}', expected '${reason.expectedBranch}' \u2014 update 'branch' in the config or switch the clone back`;
     case "head_unreadable":
       return `could not read HEAD: ${reason.error}`;
     case "dirty_tree":
@@ -1333,14 +1521,14 @@ var SyncOutcomeAccumulator = class {
     this.actions.push(action);
     this.counts[countKeyFor(action)]++;
   }
-  recordCreated(branch, path16) {
-    this.add({ kind: "created", branch, path: path16 });
+  recordCreated(branch, path22) {
+    this.add({ kind: "created", branch, path: path22 });
   }
-  recordRemoved(branch, path16) {
-    this.add({ kind: "removed", branch, path: path16 });
+  recordRemoved(branch, path22, warning) {
+    this.add({ kind: "removed", branch, path: path22, ...warning !== void 0 && { warning } });
   }
-  recordUpdated(branch, path16, reason) {
-    this.add({ kind: "updated", branch, path: path16, reason });
+  recordUpdated(branch, path22, reason) {
+    this.add({ kind: "updated", branch, path: path22, reason });
   }
   recordNoop(scope, reason, details) {
     this.add({ kind: "noop", scope, reason, ...details });
@@ -1348,8 +1536,8 @@ var SyncOutcomeAccumulator = class {
   recordSkipped(scope, reason, details) {
     this.add({ kind: "skipped", scope, reason, ...details });
   }
-  recordPreservedDiverged(branch, path16, preservedPath) {
-    this.add({ kind: "preserved-diverged", branch, path: path16, preservedPath });
+  recordPreservedDiverged(branch, path22, preservedPath) {
+    this.add({ kind: "preserved-diverged", branch, path: path22, preservedPath });
   }
   recordFailed(scope, error, details = {}) {
     this.add({ kind: "failed", scope, error, ...details });
@@ -1402,7 +1590,6 @@ function cloneSkipToOutcomeAction(reason, details = {}) {
 }
 
 // src/services/clone-sync.service.ts
-var ALL_REMOTE_BRANCHES_REFSPEC = "+refs/heads/*:refs/remotes/origin/*";
 var SHALLOW_RELATION_DEEPEN_TARGETS = [50, 200, 1e3];
 var CloneSyncService = class {
   constructor(config, gitService, logger, options = {}) {
@@ -1436,8 +1623,8 @@ var CloneSyncService = class {
     this.pendingInitSkip = null;
   }
   async getWorktrees() {
-    const worktreeDir = path4.resolve(this.config.worktreeDir);
-    if (!await fileExists(path4.join(worktreeDir, PATH_CONSTANTS.GIT_DIR))) {
+    const worktreeDir = path5.resolve(this.config.worktreeDir);
+    if (!await fileExists(path5.join(worktreeDir, PATH_CONSTANTS.GIT_DIR))) {
       return [];
     }
     const git = this.clientFor(worktreeDir, this.getFetchTimeoutMs());
@@ -1521,40 +1708,27 @@ var CloneSyncService = class {
     return env;
   }
   buildCloneArgs(branch) {
-    const args = ["--branch", branch, "--progress"];
+    const args = ["--branch", branch, "--single-branch", "--no-tags", "--progress"];
     if (this.config.depth !== void 0) {
-      args.push("--depth", String(this.config.depth), "--no-single-branch");
+      args.push("--depth", String(this.config.depth));
     }
     return args;
   }
-  async buildFetchArgs(git) {
-    const args = ["origin", "--prune", "--progress"];
+  getBranchRefspec(branch) {
+    return `+refs/heads/${branch}:refs/remotes/origin/${branch}`;
+  }
+  async buildFetchArgs(git, branch) {
+    const args = ["origin", "--prune", "--no-tags", "--progress"];
     if (this.config.depth !== void 0 && await this.isShallowRepository(git)) {
       args.push("--depth", String(this.config.depth));
     }
+    args.push(this.getBranchRefspec(branch));
     return args;
   }
-  async ensureAllRemoteBranchesRefspec(git) {
-    let fetchRefspecs = [];
-    try {
-      const output = await git.raw(["config", "--get-all", "remote.origin.fetch"]);
-      fetchRefspecs = output.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
-    } catch {
-      fetchRefspecs = [];
-    }
-    if (fetchRefspecs.includes(ALL_REMOTE_BRANCHES_REFSPEC)) return;
-    const customRefspecs = fetchRefspecs.filter((refspec) => !this.isOriginRemoteBranchTrackingRefspec(refspec));
-    this.logger.info(`Configuring '${this.repoName}' to fetch all remote branches from origin.`);
-    await git.raw(["remote", "set-branches", "origin", "*"]);
-    for (const refspec of customRefspecs) {
-      await git.raw(["config", "--add", "remote.origin.fetch", refspec]);
-    }
-  }
-  isOriginRemoteBranchTrackingRefspec(refspec) {
-    const withoutForce = refspec.startsWith("+") ? refspec.slice(1) : refspec;
-    if (withoutForce.startsWith("^")) return false;
-    const [source, destination] = withoutForce.split(":");
-    return source.startsWith("refs/heads/") && destination?.startsWith("refs/remotes/origin/") === true;
+  async configureSingleBranchRemote(git, branch) {
+    await git.raw(["config", "--replace-all", "remote.origin.fetch", this.getBranchRefspec(branch)]);
+    await git.raw(["config", "--replace-all", "remote.origin.tagOpt", "--no-tags"]);
+    await this.deleteStaleRemoteTrackingRefs(git, branch);
   }
   recordMissingRemoteRefSkip(branch) {
     this.recordSkip(
@@ -1563,7 +1737,10 @@ var CloneSyncService = class {
       `Skipping '${this.repoName}': origin/${branch} is missing`
     );
   }
-  async fetchWithRecovery(git, fetchArgs, worktreeDir, branch) {
+  async fetchWithRecovery(git, fetchArgs, worktreeDir, branch, recordSkip = true) {
+    const recordMissing = () => {
+      if (recordSkip) this.recordMissingRemoteRefSkip(branch);
+    };
     try {
       await git.fetch(fetchArgs);
       return { skipped: false };
@@ -1580,14 +1757,14 @@ var CloneSyncService = class {
           return { skipped: false };
         } catch (retryError) {
           if (isMissingRemoteRefError(getErrorMessage(retryError))) {
-            this.recordMissingRemoteRefSkip(branch);
+            recordMissing();
             return { skipped: true };
           }
           throw retryError;
         }
       }
       if (isMissingRemoteRefError(message)) {
-        this.recordMissingRemoteRefSkip(branch);
+        recordMissing();
         return { skipped: true };
       }
       throw fetchError;
@@ -1615,7 +1792,7 @@ var CloneSyncService = class {
     this.logger.info(
       `[deepen] Existing shallow clone for '${this.repoName}' has no configured depth; fetching full history...`
     );
-    await git.fetch(["--unshallow"]);
+    await git.fetch(["--unshallow", "--no-tags"]);
   }
   getDeepenTargets() {
     const configuredDepth = this.config.depth;
@@ -1635,8 +1812,9 @@ var CloneSyncService = class {
       "--depth",
       String(targetDepth),
       "--prune",
+      "--no-tags",
       "--progress",
-      `+refs/heads/${branch}:refs/remotes/origin/${branch}`
+      this.getBranchRefspec(branch)
     ]);
   }
   async resolveBranch() {
@@ -1653,6 +1831,153 @@ var CloneSyncService = class {
     this.emitProgress({ phase: "branch", message: `Resolved default branch '${this.resolvedBranch}'` });
     return this.resolvedBranch;
   }
+  parseLsRemoteHeads(output) {
+    return output.split(/\r?\n/).map((line) => line.trim()).filter(Boolean).map((line) => line.split(/\s+/)[1] ?? "").filter((ref) => ref.startsWith("refs/heads/")).map((ref) => ref.slice("refs/heads/".length)).filter((branch) => branch.length > 0);
+  }
+  async getRemoteBranches() {
+    const worktreeDir = path5.resolve(this.config.worktreeDir);
+    const repoArg = await fileExists(path5.join(worktreeDir, PATH_CONSTANTS.GIT_DIR)) ? "origin" : this.config.repoUrl;
+    const git = repoArg === "origin" ? this.clientFor(worktreeDir, this.getFetchTimeoutMs()) : simpleGit(this.buildGitOptions(this.getFetchTimeoutMs())).env(this.buildGitEnv());
+    const output = await git.raw(["ls-remote", "--heads", repoArg]);
+    return this.parseLsRemoteHeads(output);
+  }
+  async localBranchExists(git, branch) {
+    try {
+      await git.raw(["show-ref", "--verify", `refs/heads/${branch}`]);
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  async localBranchCanFastForward(git, branch) {
+    const localRef = `refs/heads/${branch}`;
+    const remoteRef = `refs/remotes/origin/${branch}`;
+    let localSha;
+    let remoteSha;
+    try {
+      localSha = (await git.raw(["rev-parse", localRef])).trim();
+      remoteSha = (await git.raw(["rev-parse", remoteRef])).trim();
+    } catch {
+      return false;
+    }
+    if (localSha === remoteSha) return true;
+    try {
+      const mergeBase = (await git.raw(["merge-base", localRef, remoteRef])).trim();
+      return mergeBase === localSha;
+    } catch {
+      return false;
+    }
+  }
+  async deleteRemoteTrackingRef(git, refName) {
+    try {
+      await git.raw(["update-ref", "-d", refName]);
+    } catch {
+    }
+  }
+  async deleteStaleRemoteTrackingRefs(git, branch) {
+    let refsOutput;
+    try {
+      refsOutput = await git.raw(["for-each-ref", "--format=%(refname)", "refs/remotes/origin"]);
+    } catch {
+      return;
+    }
+    const keepRef = `refs/remotes/origin/${branch}`;
+    const refsToDelete = refsOutput.split(/\r?\n/).map((ref) => ref.trim()).filter((ref) => ref && ref !== keepRef && ref !== "refs/remotes/origin/HEAD");
+    for (const ref of refsToDelete) {
+      await this.deleteRemoteTrackingRef(git, ref);
+    }
+  }
+  async restoreBranchAfterCheckoutFailure(git, previousBranch, attemptedBranch) {
+    if (!previousBranch || previousBranch === "HEAD" || previousBranch === attemptedBranch) return;
+    try {
+      await git.raw(["switch", previousBranch]);
+    } catch (error) {
+      this.logger.warn(
+        `Failed to restore '${this.repoName}' to '${previousBranch}' after checkout failure: ${getErrorMessage(error)}`
+      );
+    }
+  }
+  async checkoutBranch(branch, options = {}) {
+    if (!this.initialized) {
+      await this.initialize();
+    }
+    const targetBranch = await this.resolveBranch();
+    if (branch !== targetBranch && !options.allowConfigDrift) {
+      throw new ConfigError(
+        this.config.branch ? `Cannot switch '${this.repoName}' to '${branch}': clone mode tracks the configured branch '${targetBranch}'. Update 'branch' in the config file first, then run checkout to converge.` : `Cannot switch '${this.repoName}' to '${branch}': no 'branch' is configured, so this clone tracks the remote default branch '${targetBranch}'. Set branch: "${branch}" in the config file first.`,
+        "CLONE_BRANCH_MISMATCH"
+      );
+    }
+    const worktreeDir = this.config.worktreeDir;
+    const git = this.clientFor(worktreeDir, this.getFetchTimeoutMs());
+    const originMismatch = await this.evaluateOriginMatch(git, worktreeDir);
+    if (originMismatch) {
+      throw new ConfigError(
+        `Cannot switch '${this.repoName}' to '${branch}': ${originMismatch.progressDetail}.`,
+        "ORIGIN_MISMATCH"
+      );
+    }
+    const currentBranch = (await git.raw(["rev-parse", "--abbrev-ref", "HEAD"])).trim();
+    if (currentBranch === "HEAD") {
+      throw new GitOperationError(
+        "checkout",
+        `'${this.repoName}' is on a detached HEAD; check out a branch manually (preserving any local commits) before switching the tracked branch`
+      );
+    }
+    if (currentBranch === branch) {
+      await this.configureSingleBranchRemote(git, branch);
+      this.resolvedBranch = branch;
+      this.pendingInitSkip = null;
+      this.warnConfigDriftAfterCheckout(branch, targetBranch);
+      return;
+    }
+    const isClean = await this.gitService.checkWorktreeStatus(worktreeDir);
+    if (!isClean) {
+      throw new WorktreeNotCleanError(worktreeDir, ["working tree has local changes"]);
+    }
+    await this.unshallowIfDepthRemoved(git);
+    const fetchArgs = await this.buildFetchArgs(git, branch);
+    if ((await this.fetchWithRecovery(git, fetchArgs, worktreeDir, branch, false)).skipped) {
+      throw new GitOperationError("checkout", `origin/${branch} is missing for '${this.repoName}'`);
+    }
+    if (!await this.hasRemoteBranch(git, branch)) {
+      throw new GitOperationError(
+        "checkout",
+        `origin/${branch} did not materialize after fetch for '${this.repoName}'`
+      );
+    }
+    if (await this.localBranchExists(git, branch)) {
+      if (!await this.localBranchCanFastForward(git, branch)) {
+        throw new FastForwardError(branch);
+      }
+      let switched = false;
+      try {
+        await git.raw(["switch", branch]);
+        switched = true;
+        await git.merge([`origin/${branch}`, "--ff-only"]);
+      } catch (error) {
+        if (switched) {
+          await this.restoreBranchAfterCheckoutFailure(git, currentBranch, branch);
+        }
+        throw error;
+      }
+    } else {
+      await git.raw(["switch", "-c", branch, "--track", `origin/${branch}`]);
+    }
+    await this.configureSingleBranchRemote(git, branch);
+    this.resolvedBranch = branch;
+    this.pendingInitSkip = null;
+    this.warnConfigDriftAfterCheckout(branch, targetBranch);
+  }
+  // resolvedBranch keeps in-session syncs on the new branch, but the config
+  // file still names the old one: the next process start will soft-skip with
+  // branch_mismatch on every tick until the config is updated.
+  warnConfigDriftAfterCheckout(branch, targetBranch) {
+    if (branch === targetBranch) return;
+    this.logger.warn(
+      `\u26A0\uFE0F '${this.repoName}' now tracks '${branch}', but the config ${this.config.branch ? `still says branch '${targetBranch}'` : `resolves the remote default '${targetBranch}'`}. Set branch: "${branch}" in the config file \u2014 after a restart every sync will soft-skip with branch_mismatch until it matches.`
+    );
+  }
   async initialize(outcome) {
     return this.withOutcome(outcome, () => this.initializeInternal());
   }
@@ -1676,7 +2001,7 @@ var CloneSyncService = class {
         return;
       }
       const git = this.clientFor(worktreeDir, this.getFetchTimeoutMs());
-      await this.ensureAllRemoteBranchesRefspec(git);
+      await this.configureSingleBranchRemote(git, branch);
       this.initialized = true;
       this.emitProgress({ phase: "clone", message: `Existing clone validated for '${this.repoName}'` });
       return;
@@ -1704,7 +2029,7 @@ var CloneSyncService = class {
       throw error;
     }
     const worktreeGit = this.clientFor(worktreeDir, this.getFetchTimeoutMs());
-    await this.ensureAllRemoteBranchesRefspec(worktreeGit);
+    await this.configureSingleBranchRemote(worktreeGit, branch);
     this.logger.info(`\u2705 Clone successful.`);
     this.emitProgress({ phase: "clone", message: `Clone successful for '${this.repoName}'` });
     if (this.config.sparseCheckout) {
@@ -1792,7 +2117,7 @@ var CloneSyncService = class {
       return;
     }
     const looksIncomplete = entries.every((e) => e.startsWith("."));
-    const hasUsableGit = entries.includes(PATH_CONSTANTS.GIT_DIR) && await fileExists(path4.join(worktreeDir, PATH_CONSTANTS.GIT_DIR, "HEAD"));
+    const hasUsableGit = entries.includes(PATH_CONSTANTS.GIT_DIR) && await fileExists(path5.join(worktreeDir, PATH_CONSTANTS.GIT_DIR, "HEAD"));
     if (looksIncomplete && !hasUsableGit) {
       try {
         await fs3.rm(worktreeDir, { recursive: true, force: true });
@@ -1807,7 +2132,7 @@ var CloneSyncService = class {
     }
   }
   getInitMarkerPath(worktreeDir) {
-    return path4.join(worktreeDir, PATH_CONSTANTS.GIT_DIR, PATH_CONSTANTS.CLONE_INIT_MARKER);
+    return path5.join(worktreeDir, PATH_CONSTANTS.GIT_DIR, PATH_CONSTANTS.CLONE_INIT_MARKER);
   }
   async runInitialFileCopy(worktreeDir, branch) {
     const marker = this.getInitMarkerPath(worktreeDir);
@@ -1859,7 +2184,7 @@ var CloneSyncService = class {
     if (currentBranch !== branch) {
       this.recordSkip(
         { kind: "branch_mismatch", phase: "sync", currentBranch, expectedBranch: branch },
-        `Clone at '${worktreeDir}' is on '${currentBranch}', expected '${branch}'. Skipping fetch+merge.`,
+        `Clone at '${worktreeDir}' is on '${currentBranch}', expected '${branch}'. Skipping fetch+merge. Update 'branch' in the config or switch the clone back.`,
         `Skipping '${this.repoName}': current branch '${currentBranch}' is not '${branch}'`
       );
       return;
@@ -1874,13 +2199,13 @@ var CloneSyncService = class {
       return;
     }
     await this.unshallowIfDepthRemoved(git);
-    await this.ensureAllRemoteBranchesRefspec(git);
-    const fetchArgs = await this.buildFetchArgs(git);
-    this.emitProgress({ phase: "fetch", message: `Fetching origin branches for '${this.repoName}'` });
+    await this.configureSingleBranchRemote(git, branch);
+    const fetchArgs = await this.buildFetchArgs(git, branch);
+    this.emitProgress({ phase: "fetch", message: `Fetching origin/${branch} for '${this.repoName}'` });
     if ((await this.fetchWithRecovery(git, fetchArgs, worktreeDir, branch)).skipped) {
       return;
     }
-    this.emitProgress({ phase: "fetch", message: `Fetched origin branches for '${this.repoName}'` });
+    this.emitProgress({ phase: "fetch", message: `Fetched origin/${branch} for '${this.repoName}'` });
     if (!await this.hasRemoteBranch(git, branch)) {
       this.recordSkip(
         { kind: "missing_remote_ref", branch, source: "post_fetch_verify" },
@@ -1970,63 +2295,233 @@ var CloneSyncService = class {
   }
 };
 
-// src/services/git.service.ts
-import * as fs6 from "fs/promises";
-import * as path8 from "path";
-import simpleGit5 from "simple-git";
+// src/services/git-maintenance.service.ts
+import * as fs5 from "fs/promises";
+import * as path6 from "path";
+import simpleGit2 from "simple-git";
 
-// src/utils/worktree-list-parser.ts
-function parseWorktreeListPorcelain(output) {
-  const worktrees = [];
-  let current = {};
-  const flush = () => {
-    if (!current.path) {
-      current = {};
-      return;
+// src/utils/atomic-write.ts
+import * as fs4 from "fs/promises";
+async function atomicWriteFile(filePath, content) {
+  const tmpPath = `${filePath}.${process.pid}.${Date.now()}.tmp`;
+  let renamed = false;
+  try {
+    const handle = await fs4.open(tmpPath, "w");
+    try {
+      await handle.writeFile(content, "utf-8");
+      await handle.sync();
+    } finally {
+      await handle.close();
     }
-    worktrees.push({
-      path: current.path,
-      branch: current.branch ?? null,
-      head: current.head ?? null,
-      detached: current.detached ?? false,
-      prunable: current.prunable ?? false,
-      locked: current.locked ?? false
-    });
-    current = {};
-  };
-  for (const line of output.split("\n")) {
-    if (line.startsWith("worktree ")) {
-      flush();
-      current.path = line.substring("worktree ".length);
-    } else if (line.startsWith("branch ")) {
-      current.branch = line.substring("branch ".length).replace("refs/heads/", "");
-    } else if (line.startsWith("HEAD ")) {
-      current.head = line.substring("HEAD ".length);
-    } else if (line === "detached") {
-      current.detached = true;
-    } else if (line === "prunable" || line.startsWith("prunable ")) {
-      current.prunable = true;
-    } else if (line === "locked" || line.startsWith("locked ")) {
-      current.locked = true;
-    } else if (line.trim() === "") {
-      flush();
+    try {
+      await fs4.rename(tmpPath, filePath);
+      renamed = true;
+    } catch (err) {
+      if (err.code === ERROR_MESSAGES.EXDEV) {
+        await fs4.copyFile(tmpPath, filePath);
+      } else {
+        throw err;
+      }
+    }
+  } finally {
+    if (!renamed) {
+      await fs4.unlink(tmpPath).catch(() => void 0);
     }
   }
-  flush();
-  return worktrees;
 }
 
-// src/services/sparse-checkout.service.ts
-import * as path5 from "path";
-import simpleGit2 from "simple-git";
-var SparseCheckoutService = class {
-  logger;
-  gitFactory;
-  warnedConfigs = /* @__PURE__ */ new WeakSet();
-  matcherCache = /* @__PURE__ */ new WeakMap();
-  constructor(logger, gitFactory) {
+// src/services/git-maintenance.service.ts
+var GitMaintenanceService = class {
+  constructor(config, gitService, logger, gitFactory = (cwd) => simpleGit2(cwd)) {
+    this.config = config;
+    this.gitService = gitService;
+    this.logger = logger ?? Logger.createDefault();
+    this.gitFactory = gitFactory;
+  }
+  config;
+  gitService;
+  logger;
+  gitFactory;
+  updateLogger(logger) {
+    this.logger = logger;
+  }
+  isEnabled() {
+    return this.config.maintenance?.enabled ?? DEFAULT_CONFIG.MAINTENANCE.ENABLED;
+  }
+  getIntervalMs() {
+    const fallback = parseDuration(DEFAULT_CONFIG.MAINTENANCE.INTERVAL);
+    const raw = this.config.maintenance?.interval;
+    if (raw === void 0) {
+      return fallback;
+    }
+    const parsed = parseDuration(raw);
+    if (parsed === null || parsed <= 0) {
+      this.logger.warn(`Invalid maintenance.interval '${raw}', using default ${DEFAULT_CONFIG.MAINTENANCE.INTERVAL}.`);
+      return fallback;
+    }
+    return parsed;
+  }
+  resolveTarget() {
+    if (resolveMode(this.config) === REPOSITORY_MODES.CLONE) {
+      const cwd = path6.resolve(this.config.worktreeDir);
+      return { cwd, gitDir: path6.join(cwd, PATH_CONSTANTS.GIT_DIR) };
+    }
+    const bare = this.gitService.getBareRepoPath();
+    return { cwd: bare, gitDir: bare };
+  }
+  getStatePath(gitDir) {
+    return path6.join(gitDir, MAINTENANCE_CONSTANTS.STATE_FILENAME);
+  }
+  async readState(statePath) {
+    try {
+      const parsed = JSON.parse(await fs5.readFile(statePath, "utf-8"));
+      if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+        return {};
+      }
+      return { ...parsed };
+    } catch {
+      return {};
+    }
+  }
+  async writeState(statePath, state) {
+    try {
+      await atomicWriteFile(statePath, JSON.stringify(state, null, 2));
+    } catch (error) {
+      this.logger.warn(`Failed to persist maintenance state: ${getErrorMessage(error)}`);
+    }
+  }
+  isDue(state, now) {
+    if (!state.lastAttemptAt) {
+      return true;
+    }
+    const last = new Date(state.lastAttemptAt).getTime();
+    if (Number.isNaN(last)) {
+      return true;
+    }
+    return now - last >= this.getIntervalMs();
+  }
+  /**
+   * Run `git gc` if maintenance is enabled and due. MUST be called while the
+   * repository operation lock is already held. Never throws: a gc failure is
+   * recorded and warned so it cannot fail the surrounding sync. The attempt
+   * timestamp is persisted even on failure, so a perpetually-failing gc is
+   * throttled instead of retried every tick.
+   */
+  async runIfDueUnlocked(now = Date.now()) {
+    if (!this.isEnabled()) {
+      return;
+    }
+    try {
+      const { cwd, gitDir } = this.resolveTarget();
+      try {
+        await fs5.access(gitDir);
+      } catch {
+        return;
+      }
+      const statePath = this.getStatePath(gitDir);
+      const state = await this.readState(statePath);
+      if (!this.isDue(state, now)) {
+        return;
+      }
+      const aggressive = this.config.maintenance?.aggressive ?? false;
+      const args = aggressive ? ["gc", "--prune=now"] : ["gc"];
+      const nowIso = new Date(now).toISOString();
+      state.lastAttemptAt = nowIso;
+      this.logger.info(`\u{1F9F9} Running git ${args.join(" ")} (maintenance)...`);
+      try {
+        await this.gitFactory(cwd).raw(args);
+        state.lastSuccessAt = nowIso;
+        delete state.lastError;
+        this.logger.info("\u{1F9F9} Maintenance complete.");
+      } catch (error) {
+        state.lastFailureAt = nowIso;
+        state.lastError = getErrorMessage(error);
+        this.logger.warn(`\u26A0\uFE0F  Maintenance (git ${args.join(" ")}) failed: ${state.lastError}`);
+      } finally {
+        await this.writeState(statePath, state);
+      }
+    } catch (error) {
+      this.logger.warn(`\u26A0\uFE0F  Maintenance skipped due to an unexpected error: ${getErrorMessage(error)}`);
+    }
+  }
+};
+
+// src/services/git.service.ts
+import * as fs9 from "fs/promises";
+import * as path11 from "path";
+import simpleGit6 from "simple-git";
+
+// src/utils/quarantine.ts
+import * as fs6 from "fs/promises";
+import * as path7 from "path";
+
+// src/utils/filename-timestamp.ts
+function filenameTimestamp(date = /* @__PURE__ */ new Date()) {
+  return date.toISOString().replace(/[:.]/g, "-");
+}
+
+// src/utils/quarantine.ts
+async function quarantineDirectory(dirPath) {
+  const baseDir = path7.join(path7.dirname(dirPath), GIT_CONSTANTS.REMOVED_DIR_NAME);
+  await fs6.mkdir(baseDir, { recursive: true });
+  const timestamp = filenameTimestamp();
+  const quarantinePath = path7.join(baseDir, `${timestamp}-${path7.basename(dirPath)}`);
+  await fs6.rename(dirPath, quarantinePath);
+  return quarantinePath;
+}
+
+// src/utils/worktree-list-parser.ts
+function parseWorktreeListPorcelain(output) {
+  const worktrees = [];
+  let current = {};
+  const flush = () => {
+    if (!current.path) {
+      current = {};
+      return;
+    }
+    worktrees.push({
+      path: current.path,
+      branch: current.branch ?? null,
+      head: current.head ?? null,
+      detached: current.detached ?? false,
+      prunable: current.prunable ?? false,
+      locked: current.locked ?? false
+    });
+    current = {};
+  };
+  for (const line of output.split("\n")) {
+    if (line.startsWith("worktree ")) {
+      flush();
+      current.path = line.substring("worktree ".length);
+    } else if (line.startsWith("branch ")) {
+      current.branch = line.substring("branch ".length).replace("refs/heads/", "");
+    } else if (line.startsWith("HEAD ")) {
+      current.head = line.substring("HEAD ".length);
+    } else if (line === "detached") {
+      current.detached = true;
+    } else if (line === "prunable" || line.startsWith("prunable ")) {
+      current.prunable = true;
+    } else if (line === "locked" || line.startsWith("locked ")) {
+      current.locked = true;
+    } else if (line.trim() === "") {
+      flush();
+    }
+  }
+  flush();
+  return worktrees;
+}
+
+// src/services/sparse-checkout.service.ts
+import * as path8 from "path";
+import simpleGit3 from "simple-git";
+var SparseCheckoutService = class {
+  logger;
+  gitFactory;
+  warnedConfigs = /* @__PURE__ */ new WeakSet();
+  matcherCache = /* @__PURE__ */ new WeakMap();
+  constructor(logger, gitFactory) {
     this.logger = logger ?? Logger.createDefault();
-    this.gitFactory = gitFactory ?? ((p) => simpleGit2(p));
+    this.gitFactory = gitFactory ?? ((p) => simpleGit3(p));
   }
   updateLogger(logger) {
     this.logger = logger;
@@ -2152,7 +2647,7 @@ var SparseCheckoutService = class {
       for (const pat of matcher.patterns) {
         if (p === pat || p.startsWith(pat + "/")) return true;
       }
-      return matcher.ancestorDirs.has(path5.posix.dirname(p));
+      return matcher.ancestorDirs.has(path8.posix.dirname(p));
     });
   }
   getMatcher(cfg) {
@@ -2179,9 +2674,9 @@ var SparseCheckoutService = class {
 };
 
 // src/services/worktree-metadata.service.ts
-import * as fs4 from "fs/promises";
-import * as path6 from "path";
-import simpleGit3 from "simple-git";
+import * as fs7 from "fs/promises";
+import * as path9 from "path";
+import simpleGit4 from "simple-git";
 var WorktreeMetadataService = class {
   logger;
   constructor(logger) {
@@ -2193,7 +2688,7 @@ var WorktreeMetadataService = class {
    * For example: /worktrees/fix/test-branch -> test-branch (not fix/test-branch)
    */
   getWorktreeDirectoryName(worktreePath) {
-    return path6.basename(worktreePath);
+    return path9.basename(worktreePath);
   }
   async getMetadataPath(bareRepoPath, worktreeName) {
     if (worktreeName.includes("/") || worktreeName.includes("\\")) {
@@ -2201,7 +2696,7 @@ var WorktreeMetadataService = class {
         `getMetadataPath requires a filesystem-safe worktree directory name, got '${worktreeName}'. Use getMetadataPathFromWorktreePath when starting from a raw branch name.`
       );
     }
-    return path6.join(
+    return path9.join(
       bareRepoPath,
       METADATA_CONSTANTS.WORKTREE_METADATA_PATH,
       worktreeName,
@@ -2214,31 +2709,13 @@ var WorktreeMetadataService = class {
   }
   async saveMetadata(bareRepoPath, worktreeName, metadata) {
     const metadataPath = await this.getMetadataPath(bareRepoPath, worktreeName);
-    await fs4.mkdir(path6.dirname(metadataPath), { recursive: true });
-    const tmpPath = `${metadataPath}.${process.pid}.${Date.now()}.tmp`;
-    let renamed = false;
-    try {
-      await fs4.writeFile(tmpPath, JSON.stringify(metadata, null, 2), "utf-8");
-      try {
-        await fs4.rename(tmpPath, metadataPath);
-        renamed = true;
-      } catch (err) {
-        if (err.code === ERROR_MESSAGES.EXDEV) {
-          await fs4.copyFile(tmpPath, metadataPath);
-        } else {
-          throw err;
-        }
-      }
-    } finally {
-      if (!renamed) {
-        await fs4.unlink(tmpPath).catch(() => void 0);
-      }
-    }
+    await fs7.mkdir(path9.dirname(metadataPath), { recursive: true });
+    await atomicWriteFile(metadataPath, JSON.stringify(metadata, null, 2));
   }
   async loadMetadata(bareRepoPath, worktreeName) {
     const metadataPath = await this.getMetadataPath(bareRepoPath, worktreeName);
     try {
-      const content = await fs4.readFile(metadataPath, "utf-8");
+      const content = await fs7.readFile(metadataPath, "utf-8");
       return JSON.parse(content);
     } catch {
       return null;
@@ -2247,7 +2724,7 @@ var WorktreeMetadataService = class {
   async loadMetadataFromPath(bareRepoPath, worktreePath) {
     const metadataPath = await this.getMetadataPathFromWorktreePath(bareRepoPath, worktreePath);
     try {
-      const content = await fs4.readFile(metadataPath, "utf-8");
+      const content = await fs7.readFile(metadataPath, "utf-8");
       const metadata = JSON.parse(content);
       if (!await this.validateMetadata(metadata)) {
         this.logger.warn(`Corrupted metadata for ${worktreePath}, treating as missing`);
@@ -2261,7 +2738,7 @@ var WorktreeMetadataService = class {
   async deleteMetadata(bareRepoPath, worktreeName) {
     const metadataPath = await this.getMetadataPath(bareRepoPath, worktreeName);
     try {
-      await fs4.unlink(metadataPath);
+      await fs7.unlink(metadataPath);
     } catch (error) {
       if (error.code !== "ENOENT") {
         throw error;
@@ -2271,7 +2748,7 @@ var WorktreeMetadataService = class {
   async deleteMetadataFromPath(bareRepoPath, worktreePath) {
     const metadataPath = await this.getMetadataPathFromWorktreePath(bareRepoPath, worktreePath);
     try {
-      await fs4.unlink(metadataPath);
+      await fs7.unlink(metadataPath);
     } catch (error) {
       if (error.code !== "ENOENT") {
         throw error;
@@ -2305,7 +2782,7 @@ var WorktreeMetadataService = class {
       this.logger.warn(`No metadata found for worktree ${worktreeDirName}`);
       this.logger.info(`  Attempting to create initial metadata...`);
       try {
-        const worktreeGit = simpleGit3(worktreePath);
+        const worktreeGit = simpleGit4(worktreePath);
         const currentCommit = await worktreeGit.revparse(["HEAD"]);
         const branchSummary = await worktreeGit.branch();
         const actualBranchName = branchSummary.current;
@@ -2352,6 +2829,25 @@ var WorktreeMetadataService = class {
     }
     await this.saveMetadata(bareRepoPath, worktreeDirName, existing);
   }
+  /**
+   * Records the upstream tip observed during this sync. This is what later
+   * proves "HEAD was fully pushed" after the remote branch is deleted, so it
+   * must only ever be overwritten with a live observation — callers must not
+   * invoke this once the upstream ref is gone.
+   */
+  async recordRemoteTip(bareRepoPath, worktreePath, ref, oid) {
+    const worktreeDirName = this.getWorktreeDirectoryName(worktreePath);
+    const existing = await this.loadMetadataFromPath(bareRepoPath, worktreePath);
+    if (!existing) {
+      this.logger.debug(`No metadata found for worktree ${worktreeDirName}; skipping remote tip recording`);
+      return;
+    }
+    if (existing.lastKnownRemoteTip?.ref === ref && existing.lastKnownRemoteTip.oid === oid) {
+      return;
+    }
+    existing.lastKnownRemoteTip = { ref, oid, recordedAt: (/* @__PURE__ */ new Date()).toISOString() };
+    await this.saveMetadata(bareRepoPath, worktreeDirName, existing);
+  }
   async createInitialMetadata(bareRepoPath, worktreeName, commit, upstreamBranch, parentBranch, parentCommit) {
     const metadata = {
       lastSyncCommit: commit,
@@ -2406,9 +2902,9 @@ var WorktreeMetadataService = class {
 };
 
 // src/services/worktree-status.service.ts
-import * as fs5 from "fs/promises";
-import * as path7 from "path";
-import simpleGit4 from "simple-git";
+import * as fs8 from "fs/promises";
+import * as path10 from "path";
+import simpleGit5 from "simple-git";
 var OPERATION_FILES = [
   { file: GIT_OPERATIONS.MERGE_HEAD, type: "merge" },
   { file: GIT_OPERATIONS.CHERRY_PICK_HEAD, type: "cherry-pick" },
@@ -2439,8 +2935,9 @@ var WorktreeStatusService = class {
     }
     return true;
   }
-  async getFullWorktreeStatus(worktreePath, includeDetails = false, lastSyncCommit) {
-    if (!await fileExists(worktreePath)) {
+  async getFullWorktreeStatus(worktreePath, includeDetails = false, lastSyncCommit, lastKnownRemoteTip) {
+    const pathProbe = await probePathExists(worktreePath);
+    if (pathProbe === "missing") {
       return {
         isClean: true,
         hasUnpushedCommits: false,
@@ -2448,25 +2945,44 @@ var WorktreeStatusService = class {
         hasOperationInProgress: false,
         hasModifiedSubmodules: false,
         upstreamGone: false,
+        fullyPushedUpstreamDeleted: false,
         canRemove: true,
         reasons: []
       };
     }
-    const snap = await this.collectSnapshot(worktreePath, lastSyncCommit);
+    if (pathProbe === "unknown") {
+      return {
+        isClean: false,
+        hasUnpushedCommits: true,
+        hasStashedChanges: true,
+        hasOperationInProgress: true,
+        hasModifiedSubmodules: true,
+        upstreamGone: false,
+        fullyPushedUpstreamDeleted: false,
+        canRemove: false,
+        reasons: ["cannot verify worktree path (filesystem probe failed)"]
+      };
+    }
+    const snap = await this.collectSnapshot(worktreePath, lastSyncCommit, lastKnownRemoteTip);
     const isClean = this.deriveIsClean(snap);
-    const hasUnpushedCommits = !snap.detached && (snap.unpushedCount ?? 1) > 0;
+    const anyRemoteUnpushed = (snap.unpushedAnyRemoteCount ?? 1) > 0;
+    const sinceSyncUnpushed = snap.sinceSyncChecked && (snap.sinceSyncCount ?? 1) > 0;
+    const hasUnpushedCommits = !snap.detached && (anyRemoteUnpushed || sinceSyncUnpushed);
+    const recordedRefGone = lastKnownRemoteTip !== void 0 && snap.remoteBranches.length > 0 && !snap.remoteBranches.includes(lastKnownRemoteTip.ref);
+    const fullyPushedUpstreamDeleted = hasUnpushedCommits && recordedRefGone && snap.headPushedToRecordedTip === true;
     const hasStashedChanges = snap.stashTotal === null ? true : snap.stashTotal > 0;
-    const hasOperationInProgress = snap.gitDir === null ? true : snap.operationFile !== null;
+    const hasOperationInProgress = snap.gitDir === null ? true : snap.operationFile !== null || snap.operationProbeUnknown;
     const hasModifiedSubmodules = this.deriveModifiedSubmodules(snap).length > 0 || snap.submoduleStatus === null;
     const upstreamGone = !snap.detached && snap.upstream !== null && snap.remoteBranches.length > 0 ? !snap.remoteBranches.includes(snap.upstream) : false;
     const reasons = [];
     if (!isClean) reasons.push("uncommitted changes");
-    if (hasUnpushedCommits) reasons.push("unpushed commits");
+    if (hasUnpushedCommits && !fullyPushedUpstreamDeleted) reasons.push("unpushed commits");
     if (hasStashedChanges) reasons.push("stashed changes");
     if (hasOperationInProgress) reasons.push("operation in progress");
     if (hasModifiedSubmodules) reasons.push("modified submodules");
     if (upstreamGone) reasons.push("upstream gone");
-    const canRemove = isClean && !hasUnpushedCommits && !hasStashedChanges && !hasOperationInProgress && !hasModifiedSubmodules;
+    if (snap.detached) reasons.push("detached HEAD");
+    const canRemove = isClean && (!hasUnpushedCommits || fullyPushedUpstreamDeleted) && !hasStashedChanges && !hasOperationInProgress && !hasModifiedSubmodules && !snap.detached;
     const details = includeDetails ? this.buildStatusDetails(snap) : void 0;
     return {
       isClean,
@@ -2475,12 +2991,13 @@ var WorktreeStatusService = class {
       hasOperationInProgress,
       hasModifiedSubmodules,
       upstreamGone,
+      fullyPushedUpstreamDeleted,
       canRemove,
       reasons,
       details
     };
   }
-  async collectSnapshot(worktreePath, lastSyncCommit) {
+  async collectSnapshot(worktreePath, lastSyncCommit, lastKnownRemoteTip) {
     const git = this.createGitInstance(worktreePath);
     const [status, branchResult, remoteBranchesResult, stashResult, submoduleResult, gitDirResult] = await Promise.all([
       git.status().catch((e) => {
@@ -2505,19 +3022,33 @@ var WorktreeStatusService = class {
     const currentBranch = branchResult?.current ?? null;
     const detached = !branchResult?.current || Boolean(branchResult?.detached);
     let upstream = null;
-    let unpushedCount = null;
+    let unpushedAnyRemoteCount = null;
+    let sinceSyncCount = null;
+    let headPushedToRecordedTip = null;
     if (!detached && currentBranch) {
-      const revListArgs = lastSyncCommit ? ["rev-list", "--count", `${lastSyncCommit}..HEAD`] : ["rev-list", "--count", currentBranch, "--not", "--remotes"];
-      const [upstreamResult, unpushedResult] = await Promise.all([
+      const [upstreamResult, anyRemoteResult, sinceSyncResult, recordedTipResult] = await Promise.all([
         git.raw(["rev-parse", "--abbrev-ref", `${currentBranch}@{upstream}`]).then(
           (raw) => ({ ok: true, value: raw }),
           (error) => ({ ok: false, error })
         ),
-        git.raw(revListArgs).then(
+        git.raw(["rev-list", "--count", currentBranch, "--not", "--remotes"]).then(
           (raw) => ({ ok: true, value: raw }),
           (error) => ({ ok: false, error })
-        )
+        ),
+        lastSyncCommit ? git.raw(["rev-list", "--count", `${lastSyncCommit}..HEAD`]).then(
+          (raw) => ({ ok: true, value: raw }),
+          (error) => ({ ok: false, error })
+        ) : Promise.resolve(null),
+        // Zero commits in <tip>..HEAD ⟺ HEAD is the recorded tip or behind it.
+        // NOT merge-base --is-ancestor: simple-git resolves its silent exit-1
+        // ("not an ancestor") as success because nothing is written to stderr.
+        // Any failure (e.g. the recorded oid was gc'd) reads as "not proven".
+        lastKnownRemoteTip ? git.raw(["rev-list", "--count", `${lastKnownRemoteTip.oid}..HEAD`]).then(
+          (raw) => this.parseCount(raw) === 0,
+          () => false
+        ) : Promise.resolve(null)
       ]);
+      headPushedToRecordedTip = recordedTipResult;
       if (upstreamResult.ok) {
         upstream = upstreamResult.value.trim() || null;
       } else {
@@ -2526,13 +3057,20 @@ var WorktreeStatusService = class {
           this.logger.error(`Unexpected error checking upstream status for ${worktreePath}: ${errorMessage}`);
         }
       }
-      if (unpushedResult.ok) {
-        unpushedCount = parseInt(unpushedResult.value.trim(), 10);
+      if (anyRemoteResult.ok) {
+        unpushedAnyRemoteCount = this.parseCount(anyRemoteResult.value);
       } else {
-        this.logger.error(`Error checking unpushed commits`, unpushedResult.error);
+        this.logger.error(`Error checking unpushed commits`, anyRemoteResult.error);
+      }
+      if (sinceSyncResult) {
+        if (sinceSyncResult.ok) {
+          sinceSyncCount = this.parseCount(sinceSyncResult.value);
+        } else {
+          this.logger.error(`Error checking commits since last sync`, sinceSyncResult.error);
+        }
       }
     }
-    const operationFile = gitDirResult ? await this.detectOperationFile(gitDirResult) : null;
+    const operationProbe = gitDirResult ? await this.detectOperationFile(gitDirResult) : { file: null, unknown: false };
     let untrackedNotIgnored = [];
     if (status && status.not_added.length > 0) {
       try {
@@ -2548,14 +3086,22 @@ var WorktreeStatusService = class {
       detached,
       remoteBranches: remoteBranchesResult?.all ?? [],
       upstream,
-      unpushedCount,
+      unpushedAnyRemoteCount,
+      sinceSyncCount,
+      sinceSyncChecked: lastSyncCommit !== void 0,
+      headPushedToRecordedTip,
       stashTotal: stashResult?.total ?? null,
       submoduleStatus: submoduleResult,
-      operationFile,
+      operationFile: operationProbe.file,
+      operationProbeUnknown: operationProbe.unknown,
       gitDir: gitDirResult,
       untrackedNotIgnored
     };
   }
+  parseCount(raw) {
+    const count = parseInt(raw.trim(), 10);
+    return Number.isNaN(count) ? null : count;
+  }
   deriveIsClean(snap) {
     const status = snap.status;
     if (!status) return false;
@@ -2595,7 +3141,8 @@ var WorktreeStatusService = class {
       if (status.conflicted.length > 0) details.conflictedFilesList = status.conflicted;
     }
     if (snap.untrackedNotIgnored.length > 0) details.untrackedFilesList = snap.untrackedNotIgnored;
-    if (!snap.detached && snap.unpushedCount !== null) details.unpushedCommitCount = snap.unpushedCount;
+    const unpushedCount = snap.unpushedAnyRemoteCount ?? snap.sinceSyncCount;
+    if (!snap.detached && unpushedCount !== null) details.unpushedCommitCount = unpushedCount;
     if (snap.stashTotal !== null) details.stashCount = snap.stashTotal;
     const opType = this.operationTypeFromFile(snap.operationFile);
     if (opType) details.operationType = opType;
@@ -2610,34 +3157,37 @@ var WorktreeStatusService = class {
   async detectOperationFile(gitDir) {
     const results = await Promise.all(
       OPERATION_FILES.map(
-        ({ file }) => fs5.access(path7.join(gitDir, file)).then(
-          () => true,
-          () => false
+        ({ file }) => fs8.access(path10.join(gitDir, file)).then(
+          () => "present",
+          (error) => error.code === "ENOENT" ? "absent" : "unknown"
         )
       )
     );
-    const idx = results.findIndex(Boolean);
-    return idx >= 0 ? OPERATION_FILES[idx].file : null;
+    const idx = results.findIndex((result) => result === "present");
+    if (idx >= 0) return { file: OPERATION_FILES[idx].file, unknown: false };
+    return { file: null, unknown: results.includes("unknown") };
   }
   async hasUnpushedCommits(worktreePath, lastSyncCommit) {
     const worktreeGit = this.createGitInstance(worktreePath);
     try {
       if (await this.isDetachedHead(worktreeGit)) {
-        return false;
+        return true;
       }
       const branchSummary = await worktreeGit.branch();
       const currentBranch = branchSummary.current;
+      const anyRemoteResult = await worktreeGit.raw(["rev-list", "--count", currentBranch, "--not", "--remotes"]);
+      const anyRemoteCount = this.parseCount(anyRemoteResult);
+      if (anyRemoteCount === null || anyRemoteCount > 0) {
+        return true;
+      }
       if (lastSyncCommit) {
-        try {
-          const newCommitsResult = await worktreeGit.raw(["rev-list", "--count", `${lastSyncCommit}..HEAD`]);
-          const newCommitsCount = parseInt(newCommitsResult.trim(), 10);
-          return newCommitsCount > 0;
-        } catch {
+        const sinceSyncResult = await worktreeGit.raw(["rev-list", "--count", `${lastSyncCommit}..HEAD`]);
+        const sinceSyncCount = this.parseCount(sinceSyncResult);
+        if (sinceSyncCount === null || sinceSyncCount > 0) {
+          return true;
         }
       }
-      const result = await worktreeGit.raw(["rev-list", "--count", currentBranch, "--not", "--remotes"]);
-      const unpushedCount = parseInt(result.trim(), 10);
-      return unpushedCount > 0;
+      return false;
     } catch (error) {
       this.logger.error(`Error checking unpushed commits`, error);
       return true;
@@ -2693,14 +3243,15 @@ var WorktreeStatusService = class {
   async hasOperationInProgress(worktreePath) {
     try {
       const gitDir = await this.resolveGitDir(worktreePath);
-      return await this.detectOperationFile(gitDir) !== null;
+      const probe = await this.detectOperationFile(gitDir);
+      return probe.unknown || probe.file !== null;
     } catch (error) {
       this.logger.error(`Error checking operation in progress for ${worktreePath}`, error);
       return true;
     }
   }
-  async validateWorktreeForRemoval(worktreePath, lastSyncCommit) {
-    const status = await this.getFullWorktreeStatus(worktreePath, false, lastSyncCommit);
+  async validateWorktreeForRemoval(worktreePath, lastSyncCommit, lastKnownRemoteTip) {
+    const status = await this.getFullWorktreeStatus(worktreePath, false, lastSyncCommit, lastKnownRemoteTip);
     if (!status.canRemove) {
       throw new WorktreeNotCleanError(worktreePath, status.reasons);
     }
@@ -2731,14 +3282,14 @@ var WorktreeStatusService = class {
     }
   }
   async resolveGitDir(worktreePath) {
-    const gitPath = path7.join(worktreePath, PATH_CONSTANTS.GIT_DIR);
+    const gitPath = path10.join(worktreePath, PATH_CONSTANTS.GIT_DIR);
     try {
-      const stat4 = await fs5.stat(gitPath);
+      const stat4 = await fs8.stat(gitPath);
       if (stat4.isFile()) {
-        const content = await fs5.readFile(gitPath, "utf-8");
+        const content = await fs8.readFile(gitPath, "utf-8");
         const gitdirMatch = content.match(new RegExp(`^${GIT_CONSTANTS.GITDIR_PREFIX}\\s*(.+)$`, "m"));
         if (gitdirMatch) {
-          return path7.resolve(worktreePath, gitdirMatch[1].trim());
+          return path10.resolve(worktreePath, gitdirMatch[1].trim());
         }
         throw new GitOperationError("resolve-git-dir", `Failed to parse gitdir from .git file at ${gitPath}`);
       }
@@ -2752,10 +3303,10 @@ var WorktreeStatusService = class {
     }
   }
   createGitInstance(worktreePath) {
-    const key = `${path7.resolve(worktreePath)}::${this.config.skipLfs ? "1" : "0"}`;
+    const key = `${path10.resolve(worktreePath)}::${this.config.skipLfs ? "1" : "0"}`;
     let git = this.gitInstances.get(key);
     if (!git) {
-      git = this.config.skipLfs ? simpleGit4(worktreePath).env({ [ENV_CONSTANTS.GIT_LFS_SKIP_SMUDGE]: "1" }) : simpleGit4(worktreePath);
+      git = this.config.skipLfs ? simpleGit5(worktreePath).env({ [ENV_CONSTANTS.GIT_LFS_SKIP_SMUDGE]: "1" }) : simpleGit5(worktreePath);
       this.gitInstances.set(key, git);
     }
     return git;
@@ -2776,7 +3327,7 @@ var GitService = class {
     this.progressEmitter = progressEmitter;
     this.logger = logger ?? Logger.createDefault(void 0, config.debug);
     this.bareRepoPath = this.config.bareRepoDir || getDefaultBareRepoDir(this.config.repoUrl);
-    this.mainWorktreePath = path8.join(this.config.worktreeDir, GIT_CONSTANTS.DEFAULT_BRANCH);
+    this.mainWorktreePath = path11.join(this.config.worktreeDir, GIT_CONSTANTS.DEFAULT_BRANCH);
     this.metadataService = new WorktreeMetadataService(this.logger);
     this.statusService = new WorktreeStatusService({ skipLfs: this.config.skipLfs }, this.logger);
     this.sparseCheckoutService = new SparseCheckoutService(this.logger);
@@ -2806,10 +3357,10 @@ var GitService = class {
     return this.config.cloneTimeoutMs ?? DEFAULT_CONFIG.CLONE_TIMEOUT_MS;
   }
   getCachedGit(dirPath, useLfsSkip = false) {
-    const key = `${path8.resolve(dirPath)}::${useLfsSkip ? "1" : "0"}`;
+    const key = `${path11.resolve(dirPath)}::${useLfsSkip ? "1" : "0"}`;
     let git = this.gitInstances.get(key);
     if (!git) {
-      const base = simpleGit5(dirPath, this.buildSimpleGitOptions(this.getFetchTimeoutMs()));
+      const base = simpleGit6(dirPath, this.buildSimpleGitOptions(this.getFetchTimeoutMs()));
       git = useLfsSkip ? base.env({ [ENV_CONSTANTS.GIT_LFS_SKIP_SMUDGE]: "1" }) : base;
       this.gitInstances.set(key, git);
     }
@@ -2829,11 +3380,11 @@ var GitService = class {
   async initialize() {
     const { repoUrl } = this.config;
     try {
-      await fs6.access(path8.join(this.bareRepoPath, "HEAD"));
+      await fs9.access(path11.join(this.bareRepoPath, "HEAD"));
     } catch {
       this.logger.info(`Cloning from "${repoUrl}" as bare repository into "${this.bareRepoPath}"...`);
-      await fs6.mkdir(path8.dirname(this.bareRepoPath), { recursive: true });
-      const cloneBase = simpleGit5(this.buildSimpleGitOptions(this.getCloneTimeoutMs()));
+      await fs9.mkdir(path11.dirname(this.bareRepoPath), { recursive: true });
+      const cloneBase = simpleGit6(this.buildSimpleGitOptions(this.getCloneTimeoutMs()));
       const cloneGit = this.isLfsSkipEnabled() ? cloneBase.env({ [ENV_CONSTANTS.GIT_LFS_SKIP_SMUDGE]: "1" }) : cloneBase;
       await cloneGit.clone(repoUrl, this.bareRepoPath, ["--bare", "--progress"]);
       this.logger.info("\u2705 Clone successful.");
@@ -2851,17 +3402,17 @@ var GitService = class {
     this.logger.info("Fetching remote branches...");
     await bareGit.fetch(["--all", "--progress"]);
     this.defaultBranch = await this.detectDefaultBranch(bareGit);
-    this.mainWorktreePath = path8.join(this.config.worktreeDir, this.defaultBranch);
+    this.mainWorktreePath = path11.join(this.config.worktreeDir, this.defaultBranch);
     let needsMainWorktree = true;
     try {
       const worktrees = await this.getWorktreesFromBare(bareGit);
-      needsMainWorktree = !worktrees.some((w) => path8.resolve(w.path) === path8.resolve(this.mainWorktreePath));
+      needsMainWorktree = !worktrees.some((w) => path11.resolve(w.path) === path11.resolve(this.mainWorktreePath));
     } catch {
     }
     if (needsMainWorktree) {
       this.logger.info(`Creating ${this.defaultBranch} worktree at "${this.mainWorktreePath}"...`);
-      await fs6.mkdir(this.config.worktreeDir, { recursive: true });
-      const absoluteWorktreePath = path8.resolve(this.mainWorktreePath);
+      await fs9.mkdir(this.config.worktreeDir, { recursive: true });
+      const absoluteWorktreePath = path11.resolve(this.mainWorktreePath);
       const branches = await bareGit.branch();
       const defaultBranchExists = branches.all.includes(this.defaultBranch);
       const useNoCheckoutMain = !!this.config.sparseCheckout;
@@ -2897,7 +3448,7 @@ var GitService = class {
       }
       const updatedWorktrees = await this.getWorktreesFromBare(bareGit);
       const mainWorktreeRegistered = updatedWorktrees.some(
-        (w) => path8.resolve(w.path) === path8.resolve(this.mainWorktreePath)
+        (w) => path11.resolve(w.path) === path11.resolve(this.mainWorktreePath)
       );
       if (!mainWorktreeRegistered) {
         if (process.env.NODE_ENV !== ENV_CONSTANTS.NODE_ENV_TEST) {
@@ -2924,7 +3475,7 @@ var GitService = class {
     return this.bareRepoPath;
   }
   async getRemoteDefaultBranch(repoUrl) {
-    const git = simpleGit5(this.buildSimpleGitOptions(this.getFetchTimeoutMs()));
+    const git = simpleGit6(this.buildSimpleGitOptions(this.getFetchTimeoutMs()));
     try {
       const out = await git.raw(["ls-remote", "--symref", repoUrl, "HEAD"]);
       const match = out.match(/^ref: refs\/heads\/(\S+)\s+HEAD/m);
@@ -3008,7 +3559,7 @@ var GitService = class {
     return branches;
   }
   async verifyLfsFilesDownloaded(worktreePath, branchName) {
-    const worktreeGit = this.config.sparseCheckout ? simpleGit5(worktreePath).env({ ...sanitizeGitEnv(process.env), [ENV_CONSTANTS.GIT_ATTR_SOURCE]: "HEAD" }) : this.getCachedGit(worktreePath);
+    const worktreeGit = this.config.sparseCheckout ? simpleGit6(worktreePath).env({ ...sanitizeGitEnv(process.env), [ENV_CONSTANTS.GIT_ATTR_SOURCE]: "HEAD" }) : this.getCachedGit(worktreePath);
     try {
       const lfsFiles = await worktreeGit.raw(["lfs", "ls-files", "--name-only"]);
       let lfsFileList = lfsFiles.trim().split("\n").filter((f) => f.length > 0);
@@ -3019,7 +3570,7 @@ var GitService = class {
         const existence = await Promise.all(
           lfsFileList.map(async (f) => {
             try {
-              await fs6.access(path8.join(worktreePath, f));
+              await fs9.access(path11.join(worktreePath, f));
               return f;
             } catch {
               return null;
@@ -3047,9 +3598,9 @@ var GitService = class {
         let allDownloaded = true;
         const notDownloaded = [];
         for (const file of samplesToCheck) {
-          const filePath = path8.join(worktreePath, file);
+          const filePath = path11.join(worktreePath, file);
           try {
-            const handle = await fs6.open(filePath, "r");
+            const handle = await fs9.open(filePath, "r");
             try {
               const buffer = Buffer.alloc(200);
               const { bytesRead } = await handle.read(buffer, 0, buffer.length, 0);
@@ -3074,7 +3625,7 @@ var GitService = class {
         }
         retries++;
         if (retries < maxRetries) {
-          await new Promise((resolve11) => setTimeout(resolve11, retryDelay));
+          await new Promise((resolve13) => setTimeout(resolve13, retryDelay));
         }
       }
       this.logger.warn(
@@ -3136,20 +3687,23 @@ var GitService = class {
   }
   async addWorktree(branchName, worktreePath) {
     const bareGit = this.getCachedGit(this.bareRepoPath, this.isLfsSkipEnabled());
-    const absoluteWorktreePath = path8.resolve(worktreePath);
-    await fs6.mkdir(path8.dirname(absoluteWorktreePath), { recursive: true });
+    const absoluteWorktreePath = path11.resolve(worktreePath);
+    await fs9.mkdir(path11.dirname(absoluteWorktreePath), { recursive: true });
     try {
-      await fs6.access(absoluteWorktreePath);
+      await fs9.access(absoluteWorktreePath);
       const worktrees = await this.getWorktreesFromBare(bareGit);
-      const isValidWorktree = worktrees.some((w) => path8.resolve(w.path) === absoluteWorktreePath);
+      const isValidWorktree = worktrees.some((w) => path11.resolve(w.path) === absoluteWorktreePath);
       if (isValidWorktree) {
         this.logger.info(`  - Worktree for '${branchName}' already exists at '${absoluteWorktreePath}'`);
         return;
       } else {
         this.logger.info(`  - Cleaning up orphaned directory at '${absoluteWorktreePath}'`);
-        await fs6.rm(absoluteWorktreePath, { recursive: true, force: true });
+        await this.clearStaleWorktreeDirectory(absoluteWorktreePath);
+      }
+    } catch (error) {
+      if (error instanceof GitOperationError || error instanceof WorktreeError) {
+        throw error;
       }
-    } catch {
     }
     let createdNewBranch = false;
     try {
@@ -3186,17 +3740,14 @@ var GitService = class {
       }
       if (errorMessage.includes("already registered worktree")) {
         const worktrees = await this.getWorktreesFromBare(bareGit);
-        const existingWorktree = worktrees.find((w) => path8.resolve(w.path) === absoluteWorktreePath);
+        const existingWorktree = worktrees.find((w) => path11.resolve(w.path) === absoluteWorktreePath);
         if (existingWorktree && !existingWorktree.isPrunable) {
           this.logger.info(`  - Worktree for '${branchName}' was created by concurrent operation`);
           return;
         }
         this.logger.warn(`  - Worktree already registered but missing. Pruning and retrying...`);
         await bareGit.raw(["worktree", "prune"]);
-        try {
-          await fs6.rm(absoluteWorktreePath, { recursive: true, force: true });
-        } catch {
-        }
+        await this.clearStaleWorktreeDirectory(absoluteWorktreePath);
         let retryCreatedNewBranch = false;
         try {
           const { local: localBranchExists, remote: remoteBranchExists } = await this.branchExists(branchName);
@@ -3230,17 +3781,20 @@ var GitService = class {
       }
       this.logger.warn(`  - Failed to create worktree with tracking, falling back to simple add: ${error}`);
       try {
-        await fs6.access(absoluteWorktreePath);
+        await fs9.access(absoluteWorktreePath);
         const worktrees = await this.getWorktreesFromBare(bareGit);
-        const isValidWorktree = worktrees.some((w) => path8.resolve(w.path) === absoluteWorktreePath);
+        const isValidWorktree = worktrees.some((w) => path11.resolve(w.path) === absoluteWorktreePath);
         if (isValidWorktree) {
           this.logger.info(`  - Worktree for '${branchName}' already exists at '${absoluteWorktreePath}'`);
           return;
         } else {
           this.logger.info(`  - Cleaning up orphaned directory at '${absoluteWorktreePath}' before fallback attempt`);
-          await fs6.rm(absoluteWorktreePath, { recursive: true, force: true });
+          await this.clearStaleWorktreeDirectory(absoluteWorktreePath);
+        }
+      } catch (error2) {
+        if (error2 instanceof GitOperationError || error2 instanceof WorktreeError) {
+          throw error2;
         }
-      } catch {
       }
       try {
         const useNoCheckout = !!this.config.sparseCheckout;
@@ -3262,7 +3816,7 @@ var GitService = class {
         const fallbackErrorMessage = getErrorMessage(fallbackError);
         if (fallbackErrorMessage.includes("already registered worktree")) {
           const worktrees = await this.getWorktreesFromBare(bareGit);
-          const existingWorktree = worktrees.find((w) => path8.resolve(w.path) === absoluteWorktreePath);
+          const existingWorktree = worktrees.find((w) => path11.resolve(w.path) === absoluteWorktreePath);
           if (existingWorktree && !existingWorktree.isPrunable) {
             this.logger.info(`  - Worktree for '${branchName}' was created by concurrent operation during fallback`);
             return;
@@ -3331,9 +3885,19 @@ var GitService = class {
     wrapped.isUpstreamSetupFailure = true;
     return wrapped;
   }
-  async removeWorktree(worktreePath) {
+  async removeWorktree(worktreePath, options) {
     const bareGit = this.getCachedGit(this.bareRepoPath);
-    await bareGit.raw(["worktree", "remove", worktreePath, "--force"]);
+    const args = ["worktree", "remove", worktreePath];
+    if (options?.force) args.push("--force");
+    try {
+      await bareGit.raw(args);
+    } catch (error) {
+      const message = getErrorMessage(error);
+      if (!options?.force && /contains modified or untracked files|use --force/i.test(message)) {
+        throw new WorktreeNotCleanError(worktreePath, [`git refused removal: ${message}`]);
+      }
+      throw error;
+    }
     this.logger.info(`  - \u2705 Safely removed stale worktree at '${worktreePath}'.`);
     try {
       await this.metadataService.deleteMetadataFromPath(this.bareRepoPath, worktreePath);
@@ -3346,6 +3910,111 @@ var GitService = class {
     await bareGit.raw(["worktree", "prune"]);
     this.logger.info("Pruned worktree metadata.");
   }
+  async updateRef(refName, sha) {
+    const bareGit = this.getCachedGit(this.bareRepoPath);
+    await bareGit.raw(["update-ref", refName, sha]);
+  }
+  async deleteRef(refName) {
+    const bareGit = this.getCachedGit(this.bareRepoPath);
+    await bareGit.raw(["update-ref", "-d", refName]);
+  }
+  async listRefs(prefix) {
+    const bareGit = this.getCachedGit(this.bareRepoPath);
+    const raw = await bareGit.raw(["for-each-ref", "--format=%(refname)", prefix]);
+    return raw.split("\n").map((line) => line.trim()).filter((line) => line.length > 0);
+  }
+  async localBranchExists(branchName) {
+    const bareGit = this.getCachedGit(this.bareRepoPath);
+    try {
+      await bareGit.raw(["show-ref", "--verify", "--quiet", `${GIT_CONSTANTS.REFS.HEADS}${branchName}`]);
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  async getLocalBranchCommit(branchName) {
+    const bareGit = this.getCachedGit(this.bareRepoPath);
+    try {
+      return (await bareGit.raw(["rev-parse", `${GIT_CONSTANTS.REFS.HEADS}${branchName}^{commit}`])).trim();
+    } catch {
+      return null;
+    }
+  }
+  async createBranchAt(branchName, sha) {
+    const bareGit = this.getCachedGit(this.bareRepoPath);
+    await bareGit.raw(["branch", branchName, sha]);
+  }
+  async deleteLocalBranch(branchName) {
+    const bareGit = this.getCachedGit(this.bareRepoPath);
+    await bareGit.raw(["branch", "-D", branchName]);
+  }
+  // Bundles only commits not reachable from any remote — for fully-pushed
+  // refs that set is empty and `bundle create` would fail. Emptiness is
+  // pre-checked with rev-list (locale-independent) instead of parsing git's
+  // localized "empty bundle" stderr; after the pre-check, any bundle-create
+  // error is a real failure the caller must treat as fail-closed.
+  async createBundleFromRef(bundlePath, refName) {
+    const bareGit = this.getCachedGit(this.bareRepoPath);
+    const count = (await bareGit.raw(["rev-list", "--count", refName, "--not", "--remotes"])).trim();
+    if (count === "0") {
+      return false;
+    }
+    await bareGit.raw(["bundle", "create", bundlePath, refName, "--not", "--remotes"]);
+    return true;
+  }
+  // Registers the worktree and writes its .git link without populating files —
+  // restore overlays the preserved payload instead of a fresh checkout.
+  async addWorktreeNoCheckout(branchName, worktreePath) {
+    const bareGit = this.getCachedGit(this.bareRepoPath);
+    const absoluteWorktreePath = path11.resolve(worktreePath);
+    await fs9.mkdir(path11.dirname(absoluteWorktreePath), { recursive: true });
+    await bareGit.raw(["worktree", "add", "--no-checkout", absoluteWorktreePath, branchName]);
+  }
+  // Mixed reset: points the index at HEAD without touching working files, so
+  // overlaid payload content shows up as ordinary uncommitted changes.
+  async resetWorktreeIndex(worktreePath) {
+    const worktreeGit = this.getCachedGit(worktreePath);
+    await worktreeGit.raw(["reset"]);
+  }
+  // Injected by WorktreeSyncService when trash is enabled, so stale-directory
+  // cleanup follows the same reversible-removal pipeline as everything else.
+  // GitService cannot own a TrashService directly (TrashService depends on it).
+  staleDirectoryTrasher = null;
+  setStaleDirectoryTrasher(trasher) {
+    this.staleDirectoryTrasher = trasher;
+  }
+  // A stale directory that contains a .git may be a live checkout that git
+  // failed to report; quarantine it instead of deleting.
+  async clearStaleWorktreeDirectory(absoluteWorktreePath) {
+    const gitProbe = await probePathExists(path11.join(absoluteWorktreePath, PATH_CONSTANTS.GIT_DIR));
+    if (gitProbe === "unknown") {
+      throw new GitOperationError(
+        "clear-stale-directory",
+        `Cannot verify whether '${absoluteWorktreePath}' is a live checkout; refusing to clear it`
+      );
+    }
+    if (this.staleDirectoryTrasher) {
+      try {
+        const trashPath = await this.staleDirectoryTrasher(absoluteWorktreePath);
+        this.logger.info(`  - Moved stale directory at '${absoluteWorktreePath}' to trash ('${trashPath}')`);
+        return;
+      } catch (error) {
+        throw new GitOperationError(
+          "clear-stale-directory",
+          `Cannot move stale directory '${absoluteWorktreePath}' to trash: ${getErrorMessage(error)}`,
+          error instanceof Error ? error : void 0
+        );
+      }
+    }
+    if (gitProbe === "exists") {
+      const quarantinePath = await quarantineDirectory(absoluteWorktreePath);
+      this.logger.warn(
+        `  - \u26A0\uFE0F Directory at '${absoluteWorktreePath}' contains a .git; quarantined to '${quarantinePath}' instead of deleting.`
+      );
+      return;
+    }
+    await fs9.rm(absoluteWorktreePath, { recursive: true, force: true });
+  }
   async checkWorktreeStatus(worktreePath) {
     return this.statusService.checkWorktreeStatus(worktreePath);
   }
@@ -3361,7 +4030,37 @@ var GitService = class {
   }
   async getFullWorktreeStatus(worktreePath, includeDetails = false) {
     const metadata = await this.metadataService.loadMetadataFromPath(this.bareRepoPath, worktreePath);
-    return this.statusService.getFullWorktreeStatus(worktreePath, includeDetails, metadata?.lastSyncCommit);
+    return this.statusService.getFullWorktreeStatus(
+      worktreePath,
+      includeDetails,
+      metadata?.lastSyncCommit,
+      metadata?.lastKnownRemoteTip
+    );
+  }
+  /** Map of remote branch name (without "origin/") → tip oid, from the bare repo. */
+  async getRemoteBranchTips() {
+    const git = this.getGit();
+    const raw = await git.raw(["for-each-ref", "--format=%(refname:short) %(objectname)", GIT_CONSTANTS.REFS.REMOTES]);
+    const tips = /* @__PURE__ */ new Map();
+    for (const line of raw.split("\n")) {
+      const trimmed = line.trim();
+      if (!trimmed) continue;
+      const spaceIdx = trimmed.lastIndexOf(" ");
+      if (spaceIdx <= 0) continue;
+      const ref = trimmed.slice(0, spaceIdx);
+      const oid = trimmed.slice(spaceIdx + 1);
+      if (!ref.startsWith(GIT_CONSTANTS.REMOTE_PREFIX) || ref === `${GIT_CONSTANTS.REMOTE_PREFIX}HEAD`) continue;
+      tips.set(ref.slice(GIT_CONSTANTS.REMOTE_PREFIX.length), oid);
+    }
+    return tips;
+  }
+  async recordRemoteTip(worktreePath, branchName, oid) {
+    await this.metadataService.recordRemoteTip(
+      this.bareRepoPath,
+      worktreePath,
+      `${GIT_CONSTANTS.REMOTE_PREFIX}${branchName}`,
+      oid
+    );
   }
   async hasModifiedSubmodules(worktreePath) {
     return this.statusService.hasModifiedSubmodules(worktreePath);
@@ -3646,31 +4345,32 @@ var ProgressEmitter = class {
   }
 };
 
-// src/services/repo-operation-lock.ts
-import * as fs7 from "fs/promises";
-import * as path10 from "path";
-import * as lockfile from "proper-lockfile";
-
-// src/utils/lock-path.ts
-import { createHash } from "crypto";
-import * as os from "os";
-import * as path9 from "path";
-function getCloneModeLockTarget(config) {
-  const name = config.name;
-  const configDir = config.__configFileDir;
-  const hash = createHash("sha256").update(path9.resolve(config.worktreeDir)).digest("hex").slice(0, 16);
-  if (configDir) {
-    return {
-      dir: path9.join(configDir, ".sync-worktrees-state"),
-      file: `${sanitizeNameForPath(name ?? "repo", "clone-mode lock name")}-${hash}.lock`
-    };
+// src/services/removal-audit.service.ts
+import * as fs10 from "fs/promises";
+import * as path12 from "path";
+var RemovalAuditService = class {
+  constructor(logFilePath) {
+    this.logFilePath = logFilePath;
+  }
+  logFilePath;
+  async record(entry) {
+    await fs10.mkdir(path12.dirname(this.logFilePath), { recursive: true });
+    const line = JSON.stringify({ timestamp: (/* @__PURE__ */ new Date()).toISOString(), ...entry });
+    const handle = await fs10.open(this.logFilePath, "a");
+    try {
+      await handle.appendFile(`${line}
+`, "utf-8");
+      await handle.sync();
+    } finally {
+      await handle.close();
+    }
   }
-  const stateBase = process.env.XDG_STATE_HOME && process.env.XDG_STATE_HOME.length > 0 ? process.env.XDG_STATE_HOME : path9.join(os.homedir(), ".cache");
-  const dir = path9.join(stateBase, "sync-worktrees", "locks");
-  return { dir, file: `${hash}.lock` };
-}
+};
 
 // src/services/repo-operation-lock.ts
+import * as fs11 from "fs/promises";
+import * as path13 from "path";
+import * as lockfile from "proper-lockfile";
 var RepoOperationLock = class {
   constructor(config, gitService, logger = Logger.createDefault()) {
     this.config = config;
@@ -3695,10 +4395,10 @@ var RepoOperationLock = class {
   }
   async acquireCloneModeLock() {
     const target = getCloneModeLockTarget(this.config);
-    const lockTarget = path10.join(target.dir, target.file);
+    const lockTarget = path13.join(target.dir, target.file);
     try {
-      await fs7.mkdir(target.dir, { recursive: true });
-      await fs7.writeFile(lockTarget, "", { flag: "a" });
+      await fs11.mkdir(target.dir, { recursive: true });
+      await fs11.writeFile(lockTarget, "", { flag: "a" });
     } catch {
       return null;
     }
@@ -3707,7 +4407,7 @@ var RepoOperationLock = class {
   async acquireWorktreeModeLock() {
     const barePath = this.gitService.getBareRepoPath();
     try {
-      await fs7.mkdir(barePath, { recursive: true });
+      await fs11.mkdir(barePath, { recursive: true });
     } catch {
       return null;
     }
@@ -3768,80 +4468,735 @@ var SyncRetryPolicy = class {
           this.logger.info(`\u{1F504} Retrying synchronization...
 `);
         }
-      },
-      lfsRetryHandler: () => {
-        if (!this.config.skipLfs && !syncContext.lfsSkipEnabled) {
-          this.logger.info("\u26A0\uFE0F  Temporarily disabling LFS downloads for this sync...");
-          this.gitService.setLfsSkipEnabled(true);
-          syncContext.lfsSkipEnabled = true;
+      },
+      lfsRetryHandler: () => {
+        if (!this.config.skipLfs && !syncContext.lfsSkipEnabled) {
+          this.logger.info("\u26A0\uFE0F  Temporarily disabling LFS downloads for this sync...");
+          this.gitService.setLfsSkipEnabled(true);
+          syncContext.lfsSkipEnabled = true;
+        }
+      }
+    };
+  }
+  resetLfsSkipIfNeeded(syncContext) {
+    if (syncContext.lfsSkipEnabled && !this.config.skipLfs) {
+      this.gitService.setLfsSkipEnabled(false);
+    }
+  }
+};
+
+// src/services/trash-migration.service.ts
+import * as fs12 from "fs/promises";
+import * as path14 from "path";
+var REMOVED_ENTRY_RE = /^(\d{4}-\d{2}-\d{2}T\d{2}-\d{2}-\d{2}-\d{3}Z)-(.+)$/;
+var TrashMigrationService = class {
+  constructor(config, trashService, logger) {
+    this.config = config;
+    this.trashService = trashService;
+    this.logger = logger;
+  }
+  config;
+  trashService;
+  logger;
+  updateLogger(logger) {
+    this.logger = logger;
+  }
+  isEnabled() {
+    return this.trashService.isEnabled() && (this.config.trash?.migrateLegacy ?? DEFAULT_CONFIG.TRASH.MIGRATE_LEGACY);
+  }
+  async migrateLegacyUnlocked() {
+    if (!this.isEnabled()) return;
+    await this.migrateRemovedDir();
+    await this.migrateDivergedDir();
+  }
+  async migrateRemovedDir() {
+    const removedDir = path14.join(this.config.worktreeDir, GIT_CONSTANTS.REMOVED_DIR_NAME);
+    const names = await this.listDirectories(removedDir);
+    for (const name of names) {
+      const match = REMOVED_ENTRY_RE.exec(name);
+      const quarantinedAt = match ? this.parseQuarantineTimestamp(match[1]) : null;
+      if (!match || !quarantinedAt) {
+        this.logger.warn(`\u26A0\uFE0F Leaving unrecognized entry '${name}' in ${GIT_CONSTANTS.REMOVED_DIR_NAME}/ alone`);
+        continue;
+      }
+      try {
+        const entry = await this.trashService.trashDirectory({
+          dirPath: path14.join(removedDir, name),
+          reason: "legacy-adopt",
+          source: ".removed",
+          legacyOriginalName: name,
+          legacyQuarantinedAt: quarantinedAt,
+          headOid: null,
+          originalPath: path14.join(this.config.worktreeDir, match[2]),
+          auditAction: "trash_adopt"
+        });
+        this.logger.info(
+          `\u267B\uFE0F Adopted '${name}' from ${GIT_CONSTANTS.REMOVED_DIR_NAME}/ as trash entry '${entry.manifest.id}'`
+        );
+      } catch (error) {
+        this.logger.warn(`\u26A0\uFE0F Failed to adopt '${name}' into trash: ${getErrorMessage(error)}`);
+      }
+    }
+    await fs12.rmdir(removedDir).catch(() => void 0);
+  }
+  async migrateDivergedDir() {
+    const divergedDir = path14.join(this.config.worktreeDir, GIT_CONSTANTS.DIVERGED_DIR_NAME);
+    const names = await this.listDirectories(divergedDir);
+    for (const name of names) {
+      const dirPath = path14.join(divergedDir, name);
+      const info = await this.readDivergedInfo(dirPath);
+      const quarantinedAt = info?.divergedAt ? new Date(info.divergedAt) : null;
+      const hasOriginalPath = typeof info?.originalPath === "string" && info.originalPath.length > 0;
+      if (!info || !info.originalBranch || !hasOriginalPath || !quarantinedAt || Number.isNaN(quarantinedAt.getTime())) {
+        this.logger.warn(
+          `\u26A0\uFE0F Leaving entry '${name}' in ${GIT_CONSTANTS.DIVERGED_DIR_NAME}/ alone (no parseable ${METADATA_CONSTANTS.DIVERGED_INFO_FILE})`
+        );
+        continue;
+      }
+      try {
+        const entry = await this.trashService.trashDirectory({
+          dirPath,
+          reason: "legacy-adopt",
+          source: ".diverged",
+          branch: info.originalBranch,
+          legacyOriginalName: name,
+          legacyQuarantinedAt: quarantinedAt,
+          headOid: info.localCommit ?? null,
+          originalPath: info.originalPath,
+          auditAction: "trash_adopt",
+          keepPinOnReap: true
+        });
+        this.logger.info(
+          `\u267B\uFE0F Adopted '${name}' from ${GIT_CONSTANTS.DIVERGED_DIR_NAME}/ as trash entry '${entry.manifest.id}'`
+        );
+      } catch (error) {
+        this.logger.warn(`\u26A0\uFE0F Failed to adopt '${name}' into trash: ${getErrorMessage(error)}`);
+      }
+    }
+    await fs12.rmdir(divergedDir).catch(() => void 0);
+  }
+  async listDirectories(dirPath) {
+    try {
+      const dirents = await fs12.readdir(dirPath, { withFileTypes: true });
+      return dirents.filter((dirent) => dirent.isDirectory() && !dirent.isSymbolicLink()).map((dirent) => dirent.name);
+    } catch (error) {
+      if (error.code !== "ENOENT") {
+        this.logger.warn(`\u26A0\uFE0F Cannot scan '${dirPath}' for legacy trash adoption: ${getErrorMessage(error)}`);
+      }
+      return [];
+    }
+  }
+  async readDivergedInfo(dirPath) {
+    try {
+      const raw = await fs12.readFile(path14.join(dirPath, METADATA_CONSTANTS.DIVERGED_INFO_FILE), "utf-8");
+      return JSON.parse(raw);
+    } catch {
+      return null;
+    }
+  }
+  // quarantine timestamps replaced [:.] with "-": 2026-06-06T18-34-18-123Z
+  parseQuarantineTimestamp(raw) {
+    const match = /^(\d{4}-\d{2}-\d{2})T(\d{2})-(\d{2})-(\d{2})-(\d{3})Z$/.exec(raw);
+    if (!match) return null;
+    const date = /* @__PURE__ */ new Date(`${match[1]}T${match[2]}:${match[3]}:${match[4]}.${match[5]}Z`);
+    return Number.isNaN(date.getTime()) ? null : date;
+  }
+};
+
+// src/services/trash-reaper.service.ts
+import * as fs14 from "fs/promises";
+import * as path16 from "path";
+
+// src/utils/disk-space.ts
+import fastFolderSize from "fast-folder-size";
+async function calculateDirectorySize(dirPath) {
+  return new Promise((resolve13, reject) => {
+    fastFolderSize(dirPath, (err, bytes) => {
+      if (err) {
+        reject(err);
+        return;
+      }
+      if (bytes === void 0) {
+        reject(new Error(`fast-folder-size returned no bytes for ${dirPath}`));
+        return;
+      }
+      resolve13(bytes);
+    });
+  });
+}
+function formatBytes(bytes) {
+  if (bytes === 0) return "0 B";
+  const units = ["B", "KB", "MB", "GB", "TB"];
+  const k = 1024;
+  const decimals = 2;
+  const i = Math.floor(Math.log(bytes) / Math.log(k));
+  const value = bytes / Math.pow(k, i);
+  return `${value.toFixed(decimals)} ${units[i]}`;
+}
+
+// src/services/trash.service.ts
+import { randomBytes } from "crypto";
+import * as fs13 from "fs/promises";
+import * as path15 from "path";
+function isWorktreeRestorable(manifest) {
+  return manifest.branch !== null && manifest.headOid !== null && manifest.pinRef !== null;
+}
+function summarizeTrashEntries(entries) {
+  let totalSizeBytes = 0;
+  let unknownSizeCount = 0;
+  let soonest = null;
+  for (const { manifest } of entries) {
+    if (manifest.sizeBytes === null) {
+      unknownSizeCount++;
+    } else {
+      totalSizeBytes += manifest.sizeBytes;
+    }
+    if (soonest === null || manifest.expiresAt < soonest) {
+      soonest = manifest.expiresAt;
+    }
+  }
+  return { itemCount: entries.length, totalSizeBytes, unknownSizeCount, soonestExpiresAt: soonest };
+}
+var TrashService = class {
+  constructor(config, gitService, logger, removalAudit) {
+    this.config = config;
+    this.gitService = gitService;
+    this.logger = logger;
+    this.removalAudit = removalAudit;
+  }
+  config;
+  gitService;
+  logger;
+  removalAudit;
+  updateLogger(logger) {
+    this.logger = logger;
+  }
+  isEnabled() {
+    return this.config.trash?.enabled ?? DEFAULT_CONFIG.TRASH.ENABLED;
+  }
+  getTrashRoot() {
+    return path15.join(this.config.worktreeDir, GIT_CONSTANTS.TRASH_DIR_NAME);
+  }
+  getRetentionDays() {
+    return this.config.trash?.retentionDays ?? DEFAULT_CONFIG.TRASH.RETENTION_DAYS;
+  }
+  async trashDirectory(options) {
+    const deletedAt = /* @__PURE__ */ new Date();
+    const expiresAt = new Date(deletedAt.getTime() + this.getRetentionDays() * 864e5);
+    const keepPinOnReap = options.keepPinOnReap ?? false;
+    const headOid = options.headOid !== void 0 ? options.headOid : await this.resolveHeadOid(options);
+    if (keepPinOnReap && !headOid) {
+      throw new TrashOperationError(
+        "trash-directory",
+        `cannot create keep-on-reap trash entry for '${options.dirPath}': HEAD commit could not be resolved`
+      );
+    }
+    const sizeBytes = await calculateDirectorySize(options.dirPath).catch(() => null);
+    await fs13.mkdir(this.getTrashRoot(), { recursive: true });
+    const { id, containerPath } = await this.createContainer(deletedAt, path15.basename(options.dirPath));
+    const manifest = {
+      schemaVersion: TRASH_CONSTANTS.SCHEMA_VERSION,
+      id,
+      deletedAt: deletedAt.toISOString(),
+      expiresAt: expiresAt.toISOString(),
+      originalPath: path15.resolve(options.originalPath ?? options.dirPath),
+      branch: options.branch ?? null,
+      reason: options.reason,
+      sizeBytes,
+      headOid,
+      pinRef: null,
+      bundleFile: null,
+      source: options.source ?? "worktree",
+      legacyOriginalName: options.legacyOriginalName ?? null,
+      legacyQuarantinedAt: options.legacyQuarantinedAt?.toISOString() ?? null,
+      keepPinOnReap
+    };
+    try {
+      await this.writeManifest(containerPath, manifest);
+    } catch (error) {
+      await this.undoPartialTrash(containerPath, null);
+      throw new TrashOperationError(
+        "trash-directory",
+        `cannot write trash manifest for '${options.dirPath}': ${getErrorMessage(error)}`,
+        error instanceof Error ? error : void 0
+      );
+    }
+    const pinRef = headOid ? await this.createPinRef(id, headOid) : null;
+    if (keepPinOnReap && !pinRef) {
+      await this.undoPartialTrash(containerPath, pinRef);
+      throw new TrashOperationError(
+        "trash-directory",
+        `cannot create keep-on-reap trash entry '${id}' for '${options.dirPath}': pin ref could not be created`
+      );
+    }
+    let bundleFile = null;
+    if (keepPinOnReap && pinRef) {
+      try {
+        const created = await this.gitService.createBundleFromRef(
+          path15.join(containerPath, TRASH_CONSTANTS.BUNDLE_FILENAME),
+          pinRef
+        );
+        bundleFile = created ? TRASH_CONSTANTS.BUNDLE_FILENAME : null;
+      } catch (error) {
+        await this.undoPartialTrash(containerPath, pinRef);
+        throw new TrashOperationError(
+          "trash-directory",
+          `cannot bundle commits for keep-on-reap trash entry '${id}': ${getErrorMessage(error)}`,
+          error instanceof Error ? error : void 0
+        );
+      }
+    }
+    const payloadPath = path15.join(containerPath, TRASH_CONSTANTS.PAYLOAD_DIRNAME);
+    manifest.pinRef = pinRef;
+    manifest.bundleFile = bundleFile;
+    try {
+      await this.writeManifest(containerPath, manifest);
+      await fs13.rename(options.dirPath, payloadPath);
+    } catch (error) {
+      await this.undoPartialTrash(containerPath, pinRef);
+      const hint = error.code === "EXDEV" ? " (trash lives inside worktreeDir; a cross-device rename means the directory is on a different filesystem \u2014 co-locate it or set trash.enabled=false)" : "";
+      throw new TrashOperationError(
+        "trash-directory",
+        `cannot move '${options.dirPath}' to trash${hint}: ${getErrorMessage(error)}`,
+        error instanceof Error ? error : void 0
+      );
+    }
+    await this.removalAudit.record({
+      action: options.auditAction ?? "trash_create",
+      result: "success",
+      path: manifest.originalPath,
+      branch: manifest.branch ?? void 0,
+      trashId: id,
+      trashPath: payloadPath
+    }).catch(
+      (auditError) => this.logger.warn(`\u26A0\uFE0F Failed to write trash audit record: ${getErrorMessage(auditError)}`)
+    );
+    return { manifest, containerPath, payloadPath };
+  }
+  async listEntries() {
+    const root = this.getTrashRoot();
+    const entries = [];
+    const invalid = [];
+    let dirents;
+    try {
+      dirents = await fs13.readdir(root, { withFileTypes: true });
+    } catch (error) {
+      if (error.code === "ENOENT") {
+        return { entries, invalid };
+      }
+      throw error;
+    }
+    for (const dirent of dirents) {
+      const containerPath = path15.join(root, dirent.name);
+      if (dirent.isSymbolicLink()) {
+        invalid.push(containerPath);
+        continue;
+      }
+      if (!dirent.isDirectory()) {
+        continue;
+      }
+      const manifest = await this.readManifest(containerPath);
+      if (manifest === null) {
+        invalid.push(containerPath);
+        continue;
+      }
+      entries.push({
+        manifest,
+        containerPath,
+        payloadPath: path15.join(containerPath, TRASH_CONSTANTS.PAYLOAD_DIRNAME)
+      });
+    }
+    return { entries, invalid };
+  }
+  // The full reversible-removal sequence shared by prune and manual removal:
+  // payload to trash, dangling registration cleared, branch ref deleted.
+  // A ref-delete failure is a hygiene problem, not a failed removal — the
+  // payload and pin ref already capture everything restore needs, and restore
+  // tolerates a leftover ref at the trashed commit.
+  async trashAndUnregisterWorktree(options) {
+    const entry = await this.trashDirectory(options);
+    await this.gitService.removeWorktree(options.dirPath, { force: true });
+    let branchRefError;
+    try {
+      await this.deleteTrashedBranchRef(entry.manifest);
+    } catch (refError) {
+      branchRefError = getErrorMessage(refError);
+      this.logger.warn(
+        `\u26A0\uFE0F Leftover branch ref '${entry.manifest.branch}' after trashing '${entry.manifest.id}': ${branchRefError}`
+      );
+    }
+    return { entry, branchRefError };
+  }
+  async restore(id) {
+    const { entries } = await this.listEntries();
+    const entry = entries.find((candidate) => candidate.manifest.id === id);
+    if (!entry) {
+      throw new TrashOperationError("restore", `no trash entry with id '${id}'`);
+    }
+    const { manifest, containerPath, payloadPath } = entry;
+    if (await probePathExists(payloadPath) !== "exists") {
+      throw new TrashOperationError("restore", `payload missing or unverifiable for '${id}' at '${payloadPath}'`);
+    }
+    const destinationProbe = await probePathExists(manifest.originalPath);
+    if (destinationProbe !== "missing") {
+      const why = destinationProbe === "exists" ? "already exists" : "cannot be verified";
+      const hint = manifest.reason === "diverged-replace" && destinationProbe === "exists" ? " \u2014 a fresh worktree replaced this one when the branch diverged; remove that worktree first, or copy the files you need out of the trash payload manually" : "";
+      throw new TrashOperationError("restore", `destination '${manifest.originalPath}' ${why}${hint}`);
+    }
+    if (isWorktreeRestorable(manifest)) {
+      await this.restoreAsWorktree(manifest, payloadPath);
+    } else {
+      if (manifest.branch) {
+        this.logger.warn(
+          `\u26A0\uFE0F Trash entry '${id}' has no pinned commit; restoring files only \u2014 the directory will not be a registered worktree.`
+        );
+      }
+      await fs13.rename(payloadPath, manifest.originalPath);
+    }
+    await fs13.rm(containerPath, { recursive: true, force: true }).catch(
+      (error) => this.logger.warn(`\u26A0\uFE0F Failed to remove restored trash container '${containerPath}': ${getErrorMessage(error)}`)
+    );
+    if (manifest.pinRef) {
+      await this.gitService.deleteRef(manifest.pinRef).catch(
+        (error) => this.logger.warn(`\u26A0\uFE0F Failed to delete pin ref '${manifest.pinRef}': ${getErrorMessage(error)}`)
+      );
+    }
+    await this.removalAudit.record({
+      action: "trash_restore",
+      result: "success",
+      path: manifest.originalPath,
+      branch: manifest.branch ?? void 0,
+      trashId: id
+    }).catch(
+      (auditError) => this.logger.warn(`\u26A0\uFE0F Failed to write trash audit record: ${getErrorMessage(auditError)}`)
+    );
+    return manifest;
+  }
+  async deleteTrashedBranchRef(manifest) {
+    if (!manifest.branch) return;
+    if (!manifest.pinRef) {
+      this.logger.warn(
+        `\u26A0\uFE0F Keeping branch ref '${manifest.branch}' after trashing '${manifest.id}': entry has no pin ref, so the ref is the only gc protection left`
+      );
+      return;
+    }
+    try {
+      await this.gitService.deleteLocalBranch(manifest.branch);
+    } catch (error) {
+      throw new TrashOperationError(
+        "trash-branch-ref",
+        `cannot delete branch ref '${manifest.branch}' after trashing '${manifest.id}': ${getErrorMessage(error)}`,
+        error instanceof Error ? error : void 0
+      );
+    }
+  }
+  async restoreAsWorktree(manifest, payloadPath) {
+    const branch = manifest.branch;
+    const headOid = manifest.headOid;
+    const existingBranchOid = await this.gitService.getLocalBranchCommit(branch);
+    let createdBranch = false;
+    if (existingBranchOid !== null && existingBranchOid !== headOid) {
+      throw new TrashOperationError(
+        "restore",
+        `branch '${branch}' already exists at ${existingBranchOid}; expected trashed commit ${headOid}. Restore the files manually from '${payloadPath}' or move that branch first`
+      );
+    }
+    if (existingBranchOid === null) {
+      await this.gitService.createBranchAt(branch, headOid);
+      createdBranch = true;
+    }
+    try {
+      await this.gitService.addWorktreeNoCheckout(branch, manifest.originalPath);
+      await this.copyPayloadOver(payloadPath, manifest.originalPath);
+      await this.gitService.resetWorktreeIndex(manifest.originalPath);
+      if (this.config.sparseCheckout) {
+        await this.gitService.getSparseCheckoutService().applyToWorktree(manifest.originalPath, this.config.sparseCheckout);
+      }
+    } catch (error) {
+      await this.gitService.removeWorktree(manifest.originalPath, { force: true }).catch(
+        (rollbackError) => this.logger.warn(`\u26A0\uFE0F Restore rollback (worktree) failed: ${getErrorMessage(rollbackError)}`)
+      );
+      if (createdBranch) {
+        await this.gitService.deleteLocalBranch(branch).catch(
+          (rollbackError) => this.logger.warn(`\u26A0\uFE0F Restore rollback (branch) failed: ${getErrorMessage(rollbackError)}`)
+        );
+      }
+      throw new TrashOperationError(
+        "restore",
+        `failed to recreate worktree for '${manifest.id}'; trash entry left intact: ${getErrorMessage(error)}`,
+        error instanceof Error ? error : void 0
+      );
+    }
+  }
+  // The payload's top-level .git link points at a pruned admin dir; the fresh
+  // one written by `worktree add --no-checkout` must survive the overlay.
+  async copyPayloadOver(payloadPath, destination) {
+    await fs13.cp(payloadPath, destination, {
+      recursive: true,
+      force: true,
+      filter: (source) => !(path15.dirname(source) === payloadPath && path15.basename(source) === PATH_CONSTANTS.GIT_DIR)
+    });
+  }
+  async resolveHeadOid(options) {
+    if (!options.branch) return null;
+    try {
+      return (await this.gitService.getCurrentCommit(options.dirPath)).trim();
+    } catch (error) {
+      this.logger.warn(
+        `\u26A0\uFE0F Could not resolve HEAD for '${options.dirPath}'; trash entry will preserve files only: ${getErrorMessage(error)}`
+      );
+      return null;
+    }
+  }
+  // Pin failure degrades to a files-only trash entry rather than blocking the
+  // removal — the payload itself is still fully preserved either way.
+  async createPinRef(id, headOid) {
+    const refName = `${GIT_CONSTANTS.TRASH_REF_PREFIX}${id}`;
+    try {
+      await this.gitService.updateRef(refName, headOid);
+      return refName;
+    } catch (error) {
+      this.logger.warn(
+        `\u26A0\uFE0F Could not pin '${headOid}' for trash entry '${id}'; git gc may collect its objects: ${getErrorMessage(error)}`
+      );
+      return null;
+    }
+  }
+  async writeManifest(containerPath, manifest) {
+    const manifestPath = path15.join(containerPath, TRASH_CONSTANTS.MANIFEST_FILENAME);
+    await atomicWriteFile(manifestPath, JSON.stringify(manifest, null, 2));
+  }
+  async readManifest(containerPath) {
+    try {
+      const raw = await fs13.readFile(path15.join(containerPath, TRASH_CONSTANTS.MANIFEST_FILENAME), "utf-8");
+      const parsed = JSON.parse(raw);
+      if (typeof parsed.id !== "string" || typeof parsed.expiresAt !== "string" || typeof parsed.originalPath !== "string") {
+        return null;
+      }
+      return parsed;
+    } catch {
+      return null;
+    }
+  }
+  async undoPartialTrash(containerPath, pinRef) {
+    await fs13.rm(containerPath, { recursive: true, force: true }).catch(() => void 0);
+    if (pinRef) {
+      await this.gitService.deleteRef(pinRef).catch(() => void 0);
+    }
+  }
+  async createContainer(deletedAt, baseName) {
+    let lastError;
+    for (let attempt = 0; attempt < 3; attempt++) {
+      const id = this.generateId(deletedAt, baseName);
+      const containerPath = path15.join(this.getTrashRoot(), id);
+      try {
+        await fs13.mkdir(containerPath);
+        return { id, containerPath };
+      } catch (error) {
+        lastError = error;
+        if (error.code !== "EEXIST") break;
+      }
+    }
+    throw new TrashOperationError(
+      "trash-directory",
+      `cannot create trash container for '${baseName}': ${getErrorMessage(lastError)}`,
+      lastError instanceof Error ? lastError : void 0
+    );
+  }
+  // The id doubles as a refname component (refs/sync-worktrees/trash/<id>).
+  // The timestamp prefix and hex suffix rule out leading dots and ".lock"
+  // endings, but ".." inside the name would still make the ref invalid and
+  // silently degrade the entry to files-only.
+  generateId(deletedAt, baseName) {
+    const timestamp = filenameTimestamp(deletedAt);
+    const safeName = baseName.replace(/[^A-Za-z0-9._-]/g, "_").replace(/\.{2,}/g, "_");
+    return `${timestamp}-${safeName}-${randomBytes(3).toString("hex")}`;
+  }
+};
+
+// src/services/trash-reaper.service.ts
+var TrashReaperService = class {
+  constructor(config, trashService, logger, removalAudit, gitService) {
+    this.config = config;
+    this.trashService = trashService;
+    this.logger = logger;
+    this.removalAudit = removalAudit;
+    this.gitService = gitService;
+  }
+  config;
+  trashService;
+  logger;
+  removalAudit;
+  gitService;
+  updateLogger(logger) {
+    this.logger = logger;
+  }
+  // Disabled trash means "don't touch my trash" — existing entries are left
+  // alone rather than aged out behind the user's back.
+  async reapExpiredUnlocked(now = /* @__PURE__ */ new Date()) {
+    if (!this.trashService.isEnabled()) return;
+    let realRoot;
+    try {
+      realRoot = await fs14.realpath(this.trashService.getTrashRoot());
+    } catch (error) {
+      if (error.code === "ENOENT") {
+        this.logger.debug(`Trash reaper: no trash root; skipping pin-ref sweep`);
+        return;
+      }
+      this.logger.warn(`\u26A0\uFE0F Trash reaper skipped: cannot resolve trash root: ${getErrorMessage(error)}`);
+      return;
+    }
+    const { entries, invalid } = await this.trashService.listEntries();
+    for (const invalidPath of invalid) {
+      this.logger.warn(`\u26A0\uFE0F Trash reaper: leaving unrecognized entry '${invalidPath}' alone (no valid manifest)`);
+    }
+    const reapedIds = /* @__PURE__ */ new Set();
+    for (const entry of entries) {
+      const expiresAt = new Date(entry.manifest.expiresAt);
+      if (Number.isNaN(expiresAt.getTime())) {
+        this.logger.warn(`\u26A0\uFE0F Trash reaper: entry '${entry.manifest.id}' has an unparseable expiry; skipping`);
+        continue;
+      }
+      if (expiresAt.getTime() > now.getTime()) continue;
+      try {
+        const realEntry = await fs14.realpath(entry.containerPath);
+        if (!realEntry.startsWith(realRoot + path16.sep)) {
+          this.logger.warn(`\u26A0\uFE0F Trash reaper: entry '${entry.manifest.id}' resolves outside the trash root; skipping`);
+          continue;
+        }
+      } catch (error) {
+        this.logger.warn(
+          `\u26A0\uFE0F Trash reaper: cannot verify path of entry '${entry.manifest.id}'; skipping: ${getErrorMessage(error)}`
+        );
+        continue;
+      }
+      let keepRef = null;
+      if (entry.manifest.keepPinOnReap && entry.manifest.headOid) {
+        keepRef = `${GIT_CONSTANTS.KEEP_REF_PREFIX}${entry.manifest.id}`;
+        try {
+          await this.gitService.updateRef(keepRef, entry.manifest.headOid);
+        } catch (error) {
+          this.logger.warn(
+            `\u26A0\uFE0F Trash reaper: cannot create keep ref '${keepRef}' for '${entry.manifest.id}'; deferring reap: ${getErrorMessage(error)}`
+          );
+          continue;
         }
       }
-    };
+      try {
+        await this.removalAudit.record({
+          action: "trash_reap",
+          result: "attempt",
+          path: entry.manifest.originalPath,
+          branch: entry.manifest.branch ?? void 0,
+          trashId: entry.manifest.id,
+          trashPath: entry.payloadPath
+        });
+      } catch (auditError) {
+        this.logger.warn(
+          `\u26A0\uFE0F Trash reaper: cannot write audit log; skipping '${entry.manifest.id}': ${getErrorMessage(auditError)}`
+        );
+        continue;
+      }
+      try {
+        await fs14.rm(entry.containerPath, { recursive: true, force: true });
+      } catch (error) {
+        this.logger.warn(`\u26A0\uFE0F Trash reaper: failed to delete '${entry.manifest.id}': ${getErrorMessage(error)}`);
+        await this.removalAudit.record({
+          action: "trash_reap",
+          result: "failure",
+          path: entry.manifest.originalPath,
+          trashId: entry.manifest.id,
+          error: getErrorMessage(error)
+        }).catch(() => void 0);
+        continue;
+      }
+      if (entry.manifest.pinRef) {
+        await this.gitService.deleteRef(entry.manifest.pinRef).catch(
+          (error) => this.logger.warn(
+            `\u26A0\uFE0F Trash reaper: failed to delete pin ref '${entry.manifest.pinRef}': ${getErrorMessage(error)}`
+          )
+        );
+      }
+      reapedIds.add(entry.manifest.id);
+      this.logger.info(
+        `\u{1F5D1}\uFE0F Trash reaper: deleted expired entry '${entry.manifest.id}' (trashed ${entry.manifest.deletedAt})`
+      );
+      if (keepRef) {
+        this.logger.info(
+          `   Commits remain recoverable at '${keepRef}' (${entry.manifest.headOid}) \u2014 recover with: git branch <name> ${entry.manifest.headOid}`
+        );
+      }
+      await this.removalAudit.record({
+        action: "trash_reap",
+        result: "success",
+        path: entry.manifest.originalPath,
+        trashId: entry.manifest.id
+      }).catch(
+        (auditError) => this.logger.warn(`\u26A0\uFE0F Failed to write trash audit record: ${getErrorMessage(auditError)}`)
+      );
+    }
+    let containerNames = null;
+    try {
+      containerNames = new Set(await fs14.readdir(realRoot));
+    } catch (error) {
+      this.logger.warn(`\u26A0\uFE0F Trash reaper: cannot scan trash root for pin-ref sweep: ${getErrorMessage(error)}`);
+    }
+    if (containerNames !== null) {
+      await this.reapOrphanedPinRefs(containerNames);
+    }
+    this.warnIfOverThreshold(entries.filter((entry) => !reapedIds.has(entry.manifest.id)));
   }
-  resetLfsSkipIfNeeded(syncContext) {
-    if (syncContext.lfsSkipEnabled && !this.config.skipLfs) {
-      this.gitService.setLfsSkipEnabled(false);
+  // Pin refs whose trash container is gone would pin objects forever (failed
+  // ref delete during restore, manually emptied trash). Keyed on container
+  // existence, NOT manifest validity — an invalid-manifest entry still owns
+  // its pin because the reaper refuses to delete its payload. Deliberately
+  // any dirent name counts (files, symlinks): deleting a pin is irreversible
+  // once gc runs, while a stray name collision merely keeps one ref alive.
+  async reapOrphanedPinRefs(containerNames) {
+    let refs;
+    try {
+      refs = await this.gitService.listRefs(GIT_CONSTANTS.TRASH_REF_PREFIX.replace(/\/$/, ""));
+    } catch (error) {
+      this.logger.warn(`\u26A0\uFE0F Trash reaper: cannot list pin refs: ${getErrorMessage(error)}`);
+      return;
+    }
+    for (const ref of refs) {
+      if (!ref.startsWith(GIT_CONSTANTS.TRASH_REF_PREFIX)) continue;
+      const id = ref.slice(GIT_CONSTANTS.TRASH_REF_PREFIX.length);
+      if (id.length === 0 || id.includes("/")) {
+        this.logger.warn(`\u26A0\uFE0F Trash reaper: leaving unexpected ref '${ref}' alone`);
+        continue;
+      }
+      if (containerNames.has(id)) continue;
+      try {
+        await this.gitService.deleteRef(ref);
+        this.logger.info(`\u{1F5D1}\uFE0F Trash reaper: deleted orphaned pin ref '${ref}'`);
+      } catch (error) {
+        this.logger.warn(`\u26A0\uFE0F Trash reaper: failed to delete orphaned pin ref '${ref}': ${getErrorMessage(error)}`);
+      }
+    }
+  }
+  warnIfOverThreshold(remaining) {
+    const warnSizeBytes = this.config.trash?.warnSizeBytes;
+    if (warnSizeBytes === void 0) return;
+    const summary = summarizeTrashEntries(remaining);
+    if (summary.totalSizeBytes > warnSizeBytes) {
+      this.logger.warn(
+        `\u26A0\uFE0F Trash holds ${formatBytes(summary.totalSizeBytes)} across ${summary.itemCount} entries (threshold ${formatBytes(warnSizeBytes)}). Entries expire ${this.trashService.getRetentionDays()} days after removal.`
+      );
     }
   }
 };
 
 // src/services/worktree-mode-sync-runner.ts
-import * as fs9 from "fs/promises";
-import * as path13 from "path";
+import * as fs16 from "fs/promises";
+import * as path19 from "path";
 import pLimit from "p-limit";
 
-// src/utils/date-filter.ts
-function parseDuration(durationStr) {
-  const match = durationStr.match(/^(\d+)([hdwmy])$/);
-  if (!match) {
-    return null;
-  }
-  const value = parseInt(match[1], 10);
-  const unit = match[2];
-  const multipliers = {
-    h: 60 * 60 * 1e3,
-    // hours
-    d: 24 * 60 * 60 * 1e3,
-    // days
-    w: 7 * 24 * 60 * 60 * 1e3,
-    // weeks
-    m: 30 * 24 * 60 * 60 * 1e3,
-    // months (approximate)
-    y: 365 * 24 * 60 * 60 * 1e3
-    // years (approximate)
-  };
-  return value * multipliers[unit];
-}
-function filterBranchesByAge(branches, maxAge) {
-  const maxAgeMs = parseDuration(maxAge);
-  if (maxAgeMs === null) {
-    console.warn(`Invalid duration format: ${maxAge}. Using all branches.`);
-    return branches;
-  }
-  const cutoffDate = new Date(Date.now() - maxAgeMs);
-  return branches.filter(({ lastActivity }) => lastActivity >= cutoffDate);
-}
-function formatDuration2(durationStr) {
-  const match = durationStr.match(/^(\d+)([hdwmy])$/);
-  if (!match) {
-    return durationStr;
-  }
-  const value = parseInt(match[1], 10);
-  const unit = match[2];
-  const unitNames = {
-    h: value === 1 ? "hour" : "hours",
-    d: value === 1 ? "day" : "days",
-    w: value === 1 ? "week" : "weeks",
-    m: value === 1 ? "month" : "months",
-    y: value === 1 ? "year" : "years"
-  };
-  return `${value} ${unitNames[unit]}`;
-}
-
 // src/services/path-resolution.service.ts
 import { createHash as createHash2 } from "crypto";
-import * as fs8 from "fs";
-import * as path11 from "path";
+import * as fs15 from "fs";
+import * as path17 from "path";
 var BRANCH_STEM_MAX = 80;
 var BRANCH_HASH_LEN = 8;
 var PathResolutionService = class {
@@ -3851,22 +5206,22 @@ var PathResolutionService = class {
     return `${stem}-${hash}`;
   }
   getBranchWorktreePath(worktreeDir, branchName) {
-    return path11.join(worktreeDir, this.sanitizeBranchName(branchName));
+    return path17.join(worktreeDir, this.sanitizeBranchName(branchName));
   }
   resolveRealPath(inputPath) {
-    const absolute = path11.resolve(inputPath);
+    const absolute = path17.resolve(inputPath);
     const missing = [];
     let current = absolute;
-    while (!fs8.existsSync(current)) {
-      const parent = path11.dirname(current);
+    while (!fs15.existsSync(current)) {
+      const parent = path17.dirname(current);
       if (parent === current) {
         return absolute;
       }
-      missing.unshift(path11.basename(current));
+      missing.unshift(path17.basename(current));
       current = parent;
     }
     try {
-      return path11.join(fs8.realpathSync(current), ...missing);
+      return path17.join(fs15.realpathSync(current), ...missing);
     } catch {
       return absolute;
     }
@@ -3876,7 +5231,7 @@ var PathResolutionService = class {
     const a = fold(resolved);
     const b = fold(resolvedBase);
     if (a === b) return true;
-    return a.length > b.length && a.charAt(b.length) === path11.sep && a.startsWith(b);
+    return a.length > b.length && a.charAt(b.length) === path17.sep && a.startsWith(b);
   }
   normalizeWorktreePath(worktreePath, worktreeBaseDir) {
     const resolved = this.resolveRealPath(worktreePath);
@@ -3884,7 +5239,7 @@ var PathResolutionService = class {
     if (!this.isResolvedPathInsideBase(resolved, resolvedBase)) {
       throw new Error(`Worktree path '${worktreePath}' is outside base directory '${worktreeBaseDir}'`);
     }
-    return path11.relative(resolvedBase, resolved);
+    return path17.relative(resolvedBase, resolved);
   }
   isPathInsideBaseDir(targetPath, baseDir) {
     const resolved = this.resolveRealPath(targetPath);
@@ -3897,7 +5252,7 @@ var PathResolutionService = class {
 };
 
 // src/services/worktree-sync-planner.ts
-import * as path12 from "path";
+import * as path18 from "path";
 function createWorktreeSyncPlan(inventory, options = {}) {
   return {
     create: planCreateActions(inventory, options),
@@ -3915,12 +5270,12 @@ function planCreateActions(inventory, options = {}) {
   );
   const reservedPaths = /* @__PURE__ */ new Map();
   for (const worktree of inventory.existingWorktrees) {
-    reservedPaths.set(path12.resolve(worktree.path), worktree.branch);
+    reservedPaths.set(path18.resolve(worktree.path), worktree.branch);
   }
   const actions = [];
   for (const branch of newBranches) {
     const worktreePath = pathResolution2.getBranchWorktreePath(inventory.worktreeDir, branch);
-    const resolved = path12.resolve(worktreePath);
+    const resolved = path18.resolve(worktreePath);
     const conflictingBranch = reservedPaths.get(resolved);
     if (conflictingBranch && conflictingBranch !== branch) {
       actions.push({
@@ -3958,25 +5313,30 @@ function planSparseActions(inventory, sparseCheckout) {
 
 // src/services/worktree-mode-sync-runner.ts
 var WorktreeModeSyncRunner = class {
-  constructor(config, gitService, logger, progressEmitter) {
+  constructor(config, gitService, logger, progressEmitter, services) {
     this.config = config;
     this.gitService = gitService;
     this.logger = logger;
     this.progressEmitter = progressEmitter;
+    this.removalAudit = services?.removalAudit ?? new RemovalAuditService(getRemovalAuditLogPath(config));
+    this.trashService = services?.trashService ?? new TrashService(config, gitService, logger, this.removalAudit);
   }
   config;
   gitService;
   logger;
   progressEmitter;
   pathResolution = new PathResolutionService();
+  removalAudit;
+  trashService;
   updateLogger(logger) {
     this.logger = logger;
+    this.trashService.updateLogger(logger);
   }
   async runSyncAttempt(phaseTimer, syncContext, outcome) {
     await this.gitService.pruneWorktrees();
     await this.fetchLatestRemoteData(phaseTimer, syncContext);
     const { remoteBranches, defaultBranch } = await this.resolveSyncBranches();
-    await fs9.mkdir(this.config.worktreeDir, { recursive: true });
+    await fs16.mkdir(this.config.worktreeDir, { recursive: true });
     const worktrees = await this.gitService.getWorktrees();
     this.logger.info(`Found ${worktrees.length} existing Git worktrees.`);
     await this.cleanupOrphanedDirectories(worktrees);
@@ -3994,6 +5354,7 @@ var WorktreeModeSyncRunner = class {
       }
     );
     await this.createNewWorktreesWithTiming(syncPlan, phaseTimer, outcome);
+    await this.recordRemoteBranchTips([...worktrees, ...syncPlan.create.filter((action) => action.kind === "create")]);
     await this.pruneOldWorktreesWithTiming(syncPlan.prune, phaseTimer, outcome);
     if (this.config.updateExistingWorktrees !== false) {
       await this.updateExistingWorktreesWithTiming(syncPlan.update, phaseTimer, outcome);
@@ -4016,7 +5377,7 @@ var WorktreeModeSyncRunner = class {
           if (action.kind !== "check-sparse") return;
           try {
             try {
-              await fs9.access(action.path);
+              await fs16.access(action.path);
             } catch {
               return;
             }
@@ -4102,7 +5463,7 @@ var WorktreeModeSyncRunner = class {
     const filteredBranches = filterBranchesByAge(filteredByName, this.config.branchMaxAge);
     const remoteBranches = filteredBranches.map((b) => b.branch);
     this.logger.info(
-      `After filtering by age (${formatDuration2(this.config.branchMaxAge)}): ${remoteBranches.length} branches.`
+      `After filtering by age (${formatDuration(this.config.branchMaxAge)}): ${remoteBranches.length} branches.`
     );
     if (filteredByName.length > remoteBranches.length) {
       const excludedCount = filteredByName.length - remoteBranches.length;
@@ -4179,6 +5540,37 @@ var WorktreeModeSyncRunner = class {
     const successCount = results.filter((r) => r.status === "fulfilled").length;
     this.logger.info(`  Created ${successCount}/${plan.length} worktrees successfully`);
   }
+  // Persist each worktree's upstream tip while the remote ref still exists.
+  // This is the proof consulted after a squash-merge deletes the branch:
+  // "HEAD was on the remote before the deletion" — without it every such
+  // worktree reads as having unpushed commits forever. Best-effort: a failed
+  // recording only means that worktree stays conservatively preserved.
+  async recordRemoteBranchTips(worktrees) {
+    try {
+      const tips = await this.gitService.getRemoteBranchTips();
+      if (tips.size === 0) return;
+      const limit = pLimit(this.config.parallelism?.maxStatusChecks ?? DEFAULT_CONFIG.PARALLELISM.MAX_STATUS_CHECKS);
+      await Promise.all(
+        worktrees.map(
+          (wt) => limit(async () => {
+            const oid = tips.get(wt.branch);
+            if (!oid) return;
+            await this.gitService.recordRemoteTip(wt.path, wt.branch, oid).catch(
+              (error) => this.logger.warn(`  - \u26A0\uFE0F Could not record remote tip for '${wt.branch}': ${getErrorMessage(error)}`)
+            );
+          })
+        )
+      );
+    } catch (error) {
+      this.logger.warn(`\u26A0\uFE0F Could not record remote branch tips: ${getErrorMessage(error)}`);
+    }
+  }
+  // A removal authorized only by the fully-pushed proof must stay reversible:
+  // without trash it would be a permanent delete of commits whose remote
+  // branch may have been deleted unmerged.
+  blockedByDisabledTrash(status) {
+    return status.fullyPushedUpstreamDeleted && !this.trashService.isEnabled();
+  }
   async pruneOldWorktreesWithTiming(actions, phaseTimer, outcome) {
     const maxConcurrent = this.config.parallelism?.maxStatusChecks ?? DEFAULT_CONFIG.PARALLELISM.MAX_STATUS_CHECKS;
     phaseTimer.startPhase("Phase 3: Prune", maxConcurrent);
@@ -4208,7 +5600,18 @@ var WorktreeModeSyncRunner = class {
         if (result.status === "fulfilled") {
           const { branchName, worktreePath, status } = result.value;
           if (status.canRemove) {
-            toRemove.push({ branchName, worktreePath });
+            if (this.blockedByDisabledTrash(status)) {
+              this.logger.warn(
+                `  - \u26A0\uFE0F '${branchName}' was fully pushed before its remote branch was deleted, but trash is disabled \u2014 keeping worktree. Enable trash for reversible auto-removal, or remove manually.`
+              );
+              outcome.recordSkipped("worktree", "fully_pushed_trash_disabled", {
+                branch: branchName,
+                path: worktreePath,
+                message: "fully pushed before upstream deletion; trash disabled"
+              });
+            } else {
+              toRemove.push({ branchName, worktreePath });
+            }
           } else {
             toSkip.push({ branchName, worktreePath, status });
           }
@@ -4231,7 +5634,7 @@ var WorktreeModeSyncRunner = class {
             ({ branchName, worktreePath }) => removeLimit(async () => {
               try {
                 const recheck = await this.gitService.getFullWorktreeStatus(worktreePath, false);
-                if (!recheck.canRemove) {
+                if (!recheck.canRemove || this.blockedByDisabledTrash(recheck)) {
                   this.logger.warn(
                     `  \u26A0\uFE0F Skipping removal of '${branchName}' - status changed since initial check: ${recheck.reasons.join(", ")}`
                   );
@@ -4242,10 +5645,76 @@ var WorktreeModeSyncRunner = class {
                   });
                   return;
                 }
-                await this.gitService.removeWorktree(worktreePath);
-                this.logger.info(`  \u2705 Removed worktree for '${branchName}'`);
-                outcome.recordRemoved(branchName, worktreePath);
+                try {
+                  await this.removalAudit.record({
+                    action: "prune_remove",
+                    result: "attempt",
+                    path: worktreePath,
+                    branch: branchName,
+                    status: recheck
+                  });
+                } catch (auditError) {
+                  this.logger.warn(
+                    `  \u26A0\uFE0F Skipping removal of '${branchName}' - cannot write removal audit log: ${getErrorMessage(auditError)}`
+                  );
+                  outcome.recordSkipped("worktree", "audit_log_unavailable", {
+                    branch: branchName,
+                    path: worktreePath,
+                    message: getErrorMessage(auditError)
+                  });
+                  return;
+                }
+                if (await probePathExists(worktreePath) === "missing") {
+                  await this.gitService.removeWorktree(worktreePath, { force: true });
+                  this.logger.info(`  \u2705 Cleared dangling registration for '${branchName}' (directory already gone)`);
+                  outcome.recordRemoved(branchName, worktreePath);
+                  await this.removalAudit.record({ action: "prune_remove", result: "success", path: worktreePath, branch: branchName }).catch(
+                    (auditError) => this.logger.warn(`  \u26A0\uFE0F Failed to write removal audit record: ${getErrorMessage(auditError)}`)
+                  );
+                  return;
+                }
+                let refWarning;
+                if (this.trashService.isEnabled()) {
+                  const { entry, branchRefError } = await this.trashService.trashAndUnregisterWorktree({
+                    dirPath: worktreePath,
+                    branch: branchName,
+                    reason: "prune",
+                    keepPinOnReap: recheck.fullyPushedUpstreamDeleted
+                  });
+                  if (branchRefError !== void 0) {
+                    refWarning = `leftover_branch_ref: could not delete branch ref '${branchName}': ${branchRefError}`;
+                  }
+                  const pushedNote = recheck.fullyPushedUpstreamDeleted ? " \u2014 was fully pushed before its remote branch was deleted" : "";
+                  this.logger.info(
+                    `  \u2705 Moved worktree for '${branchName}' to trash (id: ${entry.manifest.id})${pushedNote}`
+                  );
+                } else {
+                  await this.gitService.removeWorktree(worktreePath);
+                  this.logger.info(`  \u2705 Removed worktree for '${branchName}'`);
+                }
+                outcome.recordRemoved(branchName, worktreePath, refWarning);
+                await this.removalAudit.record({ action: "prune_remove", result: "success", path: worktreePath, branch: branchName }).catch(
+                  (auditError) => this.logger.warn(`  \u26A0\uFE0F Failed to write removal audit record: ${getErrorMessage(auditError)}`)
+                );
               } catch (error) {
+                if (error instanceof WorktreeNotCleanError) {
+                  this.logger.warn(`  \u26A0\uFE0F Skipping removal of '${branchName}' - git refused: ${getErrorMessage(error)}`);
+                  outcome.recordSkipped("worktree", "git_refused_removal", {
+                    branch: branchName,
+                    path: worktreePath,
+                    message: getErrorMessage(error)
+                  });
+                  return;
+                }
+                if (error instanceof TrashOperationError) {
+                  this.logger.warn(`  \u26A0\uFE0F Skipping removal of '${branchName}' - ${getErrorMessage(error)}`);
+                  outcome.recordSkipped("worktree", "trash_failed", {
+                    branch: branchName,
+                    path: worktreePath,
+                    message: getErrorMessage(error)
+                  });
+                  return;
+                }
                 this.logger.error(`  \u274C Failed to remove worktree for '${branchName}':`, getErrorMessage(error));
                 outcome.recordFailed("worktree", getErrorMessage(error), {
                   reason: "remove_failed",
@@ -4371,12 +5840,12 @@ var WorktreeModeSyncRunner = class {
   }
   async updateExistingWorktrees(actions, outcome) {
     this.logger.info("Step 4: Checking for worktrees that need updates...");
-    const divergedDir = path13.join(this.config.worktreeDir, GIT_CONSTANTS.DIVERGED_DIR_NAME);
+    const divergedDir = path19.join(this.config.worktreeDir, GIT_CONSTANTS.DIVERGED_DIR_NAME);
     try {
-      const diverged = await fs9.readdir(divergedDir);
+      const diverged = await fs16.readdir(divergedDir);
       if (diverged.length > 0) {
         this.logger.info(
-          `\u{1F4E6} Note: ${diverged.length} diverged worktree(s) in ${path13.relative(process.cwd(), divergedDir)}`
+          `\u{1F4E6} Note: ${diverged.length} diverged worktree(s) in ${path19.relative(process.cwd(), divergedDir)}`
         );
       }
     } catch {
@@ -4388,7 +5857,7 @@ var WorktreeModeSyncRunner = class {
         (action) => limit(async () => {
           const worktree = { path: action.path, branch: action.branch };
           try {
-            await fs9.access(worktree.path);
+            await fs16.access(worktree.path);
           } catch {
             return { action: "skip", worktree, reason: "missing_worktree_path" };
           }
@@ -4528,13 +5997,13 @@ var WorktreeModeSyncRunner = class {
   }
   async cleanupOrphanedDirectories(worktrees) {
     try {
-      const worktreeRelativePaths = worktrees.map((w) => path13.relative(this.config.worktreeDir, w.path));
-      const allDirs = await fs9.readdir(this.config.worktreeDir);
+      const worktreeRelativePaths = worktrees.map((w) => path19.relative(this.config.worktreeDir, w.path));
+      const allDirs = await fs16.readdir(this.config.worktreeDir);
       const regularDirs = allDirs.filter((dir) => !dir.startsWith("."));
       const orphanedDirs = [];
       for (const dir of regularDirs) {
         const isPartOfWorktree = worktreeRelativePaths.some((worktreePath) => {
-          return worktreePath === dir || worktreePath.startsWith(dir + path13.sep);
+          return worktreePath === dir || worktreePath.startsWith(dir + path19.sep);
         });
         if (!isPartOfWorktree) {
           orphanedDirs.push(dir);
@@ -4543,13 +6012,46 @@ var WorktreeModeSyncRunner = class {
       if (orphanedDirs.length > 0) {
         this.logger.info(`Found ${orphanedDirs.length} orphaned directories: ${orphanedDirs.join(", ")}`);
         for (const dir of orphanedDirs) {
-          const dirPath = path13.join(this.config.worktreeDir, dir);
+          const dirPath = path19.join(this.config.worktreeDir, dir);
           try {
-            const stat4 = await fs9.stat(dirPath);
-            if (stat4.isDirectory()) {
-              await fs9.rm(dirPath, { recursive: true, force: true });
-              this.logger.info(`  - Removed orphaned directory: ${dir}`);
+            const stat4 = await fs16.stat(dirPath);
+            if (!stat4.isDirectory()) {
+              continue;
+            }
+            const gitProbe = await probePathExists(path19.join(dirPath, PATH_CONSTANTS.GIT_DIR));
+            if (gitProbe === "unknown") {
+              this.logger.warn(`  - \u26A0\uFE0F Skipping orphaned directory ${dir}: cannot verify it is not a live checkout`);
+              continue;
+            }
+            if (this.trashService.isEnabled()) {
+              try {
+                const entry = await this.trashService.trashDirectory({ dirPath, reason: "orphan" });
+                this.logger.info(`  - Moved orphaned directory '${dir}' to trash (id: ${entry.manifest.id})`);
+              } catch (trashError) {
+                this.logger.warn(`  - \u26A0\uFE0F Skipping orphaned directory ${dir} - ${getErrorMessage(trashError)}`);
+              }
+              continue;
             }
+            if (gitProbe === "exists") {
+              const quarantinePath = await quarantineDirectory(dirPath);
+              this.logger.warn(
+                `  - \u26A0\uFE0F Orphaned directory ${dir} contains a .git; quarantined to '${quarantinePath}' instead of deleting.`
+              );
+              await this.removalAudit.record({ action: "orphan_quarantine", result: "success", path: dirPath, quarantinePath }).catch(
+                (auditError) => this.logger.warn(`  \u26A0\uFE0F Failed to write removal audit record: ${getErrorMessage(auditError)}`)
+              );
+              continue;
+            }
+            try {
+              await this.removalAudit.record({ action: "orphan_delete", result: "attempt", path: dirPath });
+            } catch (auditError) {
+              this.logger.warn(
+                `  - \u26A0\uFE0F Skipping orphaned directory ${dir} - cannot write removal audit log: ${getErrorMessage(auditError)}`
+              );
+              continue;
+            }
+            await fs16.rm(dirPath, { recursive: true, force: true });
+            this.logger.info(`  - Removed orphaned directory: ${dir}`);
           } catch (error) {
             this.logger.error(`  - Failed to remove orphaned directory ${dir}:`, error);
           }
@@ -4578,14 +6080,37 @@ var WorktreeModeSyncRunner = class {
         outcome.recordUpdated(worktree.branch, worktree.path, "reset_no_local_changes");
       } else {
         this.logger.info(`\u{1F512} Branch '${worktree.branch}' has diverged with local changes. Moving to diverged...`);
-        const divergedPath = await this.divergeWorktree(worktree.path, worktree.branch);
-        const relativePath = path13.relative(process.cwd(), divergedPath);
+        let keepRef = null;
+        if (!this.trashService.isEnabled()) {
+          const localCommit = (await this.gitService.getCurrentCommit(worktree.path)).trim();
+          keepRef = `${GIT_CONSTANTS.KEEP_REF_PREFIX}diverged-${Date.now().toString(36)}-${this.pathResolution.sanitizeBranchName(worktree.branch)}`;
+          await this.gitService.updateRef(keepRef, localCommit);
+        }
+        const { divergedPath, manifest } = await this.divergeWorktree(worktree.path, worktree.branch);
+        const relativePath = path19.relative(process.cwd(), divergedPath);
         outcome.recordPreservedDiverged(worktree.branch, worktree.path, divergedPath);
         this.logger.info(`   Moved to: ${relativePath}`);
         this.logger.info(`   Your local changes are preserved. To review:`);
         this.logger.info(`     cd ${relativePath}`);
         this.logger.info(`     git diff origin/${worktree.branch}`);
-        await this.gitService.removeWorktree(worktree.path);
+        await this.gitService.removeWorktree(worktree.path, { force: true });
+        if (manifest !== null) {
+          await this.trashService.deleteTrashedBranchRef(manifest);
+        } else {
+          await this.gitService.deleteLocalBranch(worktree.branch);
+          this.logger.info(
+            `   Never-pushed commits remain recoverable at '${keepRef}' \u2014 recover with: git branch <name> ${keepRef}`
+          );
+        }
+        await this.removalAudit.record({
+          action: "diverged_replace",
+          result: "success",
+          path: worktree.path,
+          branch: worktree.branch,
+          quarantinePath: divergedPath
+        }).catch(
+          (auditError) => this.logger.warn(`  \u26A0\uFE0F Failed to write removal audit record: ${getErrorMessage(auditError)}`)
+        );
         await this.gitService.addWorktree(worktree.branch, worktree.path);
         this.logger.info(`   Created fresh worktree from upstream at: ${worktree.path}`);
       }
@@ -4604,42 +6129,55 @@ var WorktreeModeSyncRunner = class {
     }
   }
   async divergeWorktree(worktreePath, branchName) {
-    const divergedBaseDir = path13.join(this.config.worktreeDir, GIT_CONSTANTS.DIVERGED_DIR_NAME);
+    if (this.trashService.isEnabled()) {
+      const entry = await this.trashService.trashDirectory({
+        dirPath: worktreePath,
+        branch: branchName,
+        reason: "diverged-replace",
+        keepPinOnReap: true
+      });
+      await this.writeDivergedInfoFile(entry.payloadPath, worktreePath, branchName, entry.manifest.headOid);
+      return { divergedPath: entry.payloadPath, manifest: entry.manifest };
+    }
+    const divergedBaseDir = path19.join(this.config.worktreeDir, GIT_CONSTANTS.DIVERGED_DIR_NAME);
     const timestamp = (/* @__PURE__ */ new Date()).toISOString().split("T")[0];
     const uniqueSuffix = Date.now().toString(36) + Math.random().toString(36).substring(2, 7);
     const safeBranchName = this.pathResolution.sanitizeBranchName(branchName);
     const divergedName = `${timestamp}-${safeBranchName}-${uniqueSuffix}`;
-    const divergedPath = path13.join(divergedBaseDir, divergedName);
-    await fs9.mkdir(divergedBaseDir, { recursive: true });
+    const divergedPath = path19.join(divergedBaseDir, divergedName);
+    await fs16.mkdir(divergedBaseDir, { recursive: true });
     try {
-      await fs9.rename(worktreePath, divergedPath);
+      await fs16.rename(worktreePath, divergedPath);
     } catch (err) {
       if (err.code === ERROR_MESSAGES.EXDEV) {
-        await fs9.cp(worktreePath, divergedPath, { recursive: true });
-        await fs9.rm(worktreePath, { recursive: true, force: true });
+        await fs16.cp(worktreePath, divergedPath, { recursive: true });
+        await fs16.rm(worktreePath, { recursive: true, force: true });
       } else {
         throw err;
       }
     }
+    await this.writeDivergedInfoFile(divergedPath, worktreePath, branchName, null);
+    return { divergedPath, manifest: null };
+  }
+  async writeDivergedInfoFile(preservedPath, originalPath, branchName, knownLocalCommit) {
     const metadata = {
       originalBranch: branchName,
       divergedAt: (/* @__PURE__ */ new Date()).toISOString(),
       reason: METADATA_CONSTANTS.DIVERGED_REASON,
-      originalPath: worktreePath,
-      localCommit: await this.gitService.getCurrentCommit(divergedPath),
+      originalPath,
+      localCommit: knownLocalCommit ?? await this.gitService.getCurrentCommit(preservedPath),
       remoteCommit: await this.gitService.getRemoteCommit(`origin/${branchName}`),
       instruction: `To preserve your changes:
   1. Review: git diff origin/${branchName}
   2. Keep changes: git push --force-with-lease origin ${branchName}
   3. Discard changes: rm -rf this directory
 
-  Original worktree location: ${worktreePath}`
+  Original worktree location: ${originalPath}`
     };
-    await fs9.writeFile(
-      path13.join(divergedPath, METADATA_CONSTANTS.DIVERGED_INFO_FILE),
+    await fs16.writeFile(
+      path19.join(preservedPath, METADATA_CONSTANTS.DIVERGED_INFO_FILE),
       JSON.stringify(metadata, null, 2)
     );
-    return divergedPath;
   }
 };
 
@@ -4650,12 +6188,26 @@ var WorktreeSyncService = class {
     this.logger = config.logger ?? Logger.createDefault(void 0, config.debug);
     this.gitService = new GitService(config, this.logger, (event) => this.emitProgress(event));
     this.repoOperationLock = new RepoOperationLock(config, this.gitService, this.logger);
+    this.maintenanceService = new GitMaintenanceService(config, this.gitService, this.logger);
     this.retryPolicy = new SyncRetryPolicy(config, this.gitService, this.logger);
+    const removalAudit = new RemovalAuditService(getRemovalAuditLogPath(config));
+    this.trashService = new TrashService(config, this.gitService, this.logger, removalAudit);
+    this.trashReaper = new TrashReaperService(config, this.trashService, this.logger, removalAudit, this.gitService);
+    this.trashMigration = new TrashMigrationService(config, this.trashService, this.logger);
+    if (this.trashService.isEnabled()) {
+      this.gitService.setStaleDirectoryTrasher(
+        async (dirPath) => (await this.trashService.trashDirectory({ dirPath, reason: "orphan" })).payloadPath
+      );
+    }
     this.worktreeModeSyncRunner = new WorktreeModeSyncRunner(
       config,
       this.gitService,
       this.logger,
-      this.progressEmitter
+      this.progressEmitter,
+      {
+        trashService: this.trashService,
+        removalAudit
+      }
     );
     if (resolveMode(config) === REPOSITORY_MODES.CLONE) {
       this.cloneSyncService = new CloneSyncService(config, this.gitService, this.logger, {
@@ -4677,8 +6229,12 @@ var WorktreeSyncService = class {
   repoMutex = pLimit2(1);
   progressEmitter = new ProgressEmitter();
   repoOperationLock;
+  maintenanceService;
   retryPolicy;
   worktreeModeSyncRunner;
+  trashService;
+  trashReaper;
+  trashMigration;
   skipsAccumulator = [];
   lastOutcome = null;
   getRecordedSkips() {
@@ -4702,6 +6258,18 @@ var WorktreeSyncService = class {
     }
     return this.gitService.getWorktrees();
   }
+  async getRemoteBranches() {
+    if (this.cloneSyncService) {
+      return this.cloneSyncService.getRemoteBranches();
+    }
+    return this.gitService.getRemoteBranches();
+  }
+  async checkoutBranch(branchName, options = {}) {
+    if (!this.cloneSyncService) {
+      throw new ConfigError("checkoutBranch is only available for clone-mode repositories", "CLONE_MODE_REQUIRED");
+    }
+    await this.cloneSyncService.checkoutBranch(branchName, options);
+  }
   async initialize() {
     if (this.isInitialized()) return;
     const result = await this.runExclusiveRepoOperation(() => this.initializeUnlocked());
@@ -4731,6 +6299,23 @@ var WorktreeSyncService = class {
   getGitService() {
     return this.gitService;
   }
+  // Restore must hold the repo lock: the reaper, prune, and gc all mutate the
+  // same trash entries and refs at the tail of a sync. wait:true queues behind
+  // an in-flight sync instead of failing fast — restores are explicit user
+  // actions, not periodic work.
+  async restoreFromTrash(id) {
+    const result = await this.runExclusiveRepoOperation(() => this.trashService.restore(id), { wait: true });
+    if (!result.started) {
+      throw new TrashOperationError(
+        "restore",
+        `cannot restore trash entry '${id}': another process holds the repo lock`
+      );
+    }
+    return result.value;
+  }
+  async listTrashEntries() {
+    return this.trashService.listEntries();
+  }
   updateLogger(logger) {
     this.logger = logger;
     this.gitService.updateLogger(logger);
@@ -4738,6 +6323,37 @@ var WorktreeSyncService = class {
     this.retryPolicy.updateLogger(logger);
     this.worktreeModeSyncRunner.updateLogger(logger);
     this.repoOperationLock.updateLogger(logger);
+    this.maintenanceService.updateLogger(logger);
+    this.trashService.updateLogger(logger);
+    this.trashReaper.updateLogger(logger);
+    this.trashMigration.updateLogger(logger);
+  }
+  // Runs git gc when due, inside the already-held repo lock (mirrors
+  // initializeUnlocked — must NOT re-acquire runExclusiveRepoOperation or it
+  // would self-deadlock/skip). Skipped under NODE_ENV=test so unit suites don't
+  // shell out to real git; GitMaintenanceService is covered by its own tests.
+  async runMaintenanceIfDueUnlocked() {
+    if (process.env.NODE_ENV === ENV_CONSTANTS.NODE_ENV_TEST) {
+      return;
+    }
+    await this.maintenanceService.runIfDueUnlocked();
+  }
+  // Same contract as runMaintenanceIfDueUnlocked: tail of a successful sync,
+  // inside the held lock, never fails the sync. Runs before gc so freshly
+  // reaped pin refs can be collected in the same maintenance window.
+  async runTrashMaintenanceUnlocked() {
+    if (process.env.NODE_ENV === ENV_CONSTANTS.NODE_ENV_TEST) {
+      return;
+    }
+    if (this.cloneSyncService) {
+      return;
+    }
+    try {
+      await this.trashMigration.migrateLegacyUnlocked();
+      await this.trashReaper.reapExpiredUnlocked();
+    } catch (error) {
+      this.logger.warn(`\u26A0\uFE0F Trash maintenance failed: ${getErrorMessage(error)}`);
+    }
   }
   onProgress(listener) {
     return this.progressEmitter.onProgress(listener);
@@ -4773,6 +6389,7 @@ var WorktreeSyncService = class {
   }
   async sync() {
     const result = await this.runExclusiveRepoOperation(async () => {
+      this.clearRecordedSkips();
       const totalTimer = new Timer();
       const phaseTimer = new PhaseTimer();
       const outcome = new SyncOutcomeAccumulator({
@@ -4821,7 +6438,9 @@ var WorktreeSyncService = class {
           const repoName = this.config.name;
           this.logger.table(formatTimingTable(durationMs, phaseResults, repoName));
         }
+        await this.runTrashMaintenanceUnlocked();
       }
+      await this.runMaintenanceIfDueUnlocked();
       return this.lastOutcome ?? outcome.toOutcome(durationMs);
     });
     return result.started ? { started: true, outcome: result.value } : result;
@@ -4837,7 +6456,6 @@ function emptyCapabilities(reason) {
     listWorktrees: { ...state },
     getStatus: { ...state },
     createWorktree: { ...state },
-    removeWorktree: { ...state },
     updateWorktree: { ...state },
     sync: { ...state },
     initialize: { ...state }
@@ -4876,16 +6494,19 @@ var RepositoryContext = class {
   discoveryCache = /* @__PURE__ */ new Map();
   launchCwd;
   constructor(options = {}) {
-    this.launchCwd = path14.resolve(options.launchCwd ?? process.cwd());
+    this.launchCwd = path20.resolve(options.launchCwd ?? process.cwd());
   }
   getLaunchCwd() {
     return this.launchCwd;
   }
+  async findConfigUpward(startDir) {
+    return this.configLoader.findConfigUpward(startDir);
+  }
   async loadConfig(configPath, options = {}) {
     const setDefaultCurrent = options.setDefaultCurrent ?? true;
-    const absolutePath = path14.resolve(configPath);
+    const absolutePath = path20.resolve(configPath);
     const configFile = await this.configLoader.loadConfigFile(absolutePath);
-    const configDir = path14.dirname(absolutePath);
+    const configDir = path20.dirname(absolutePath);
     const globalDefaults = configFile.defaults;
     const resolvedAll = [];
     for (const repo of configFile.repositories) {
@@ -4922,7 +6543,7 @@ var RepositoryContext = class {
     return configFile.repositories;
   }
   async detectFromPath(dirPath) {
-    const absolutePath = path14.resolve(dirPath);
+    const absolutePath = path20.resolve(dirPath);
     const cached = this.discoveryCache.get(absolutePath);
     if (cached && await this.isCacheFresh(cached)) {
       return cached.result;
@@ -4941,8 +6562,8 @@ var RepositoryContext = class {
     const { result, adminDir } = await this.detectFromPathUncached(absolutePath);
     if (result.isWorktree && result.bareRepoPath && adminDir) {
       const [worktreeHeadMtimeMs, worktreesDirMtimeMs] = await Promise.all([
-        safeMtimeMs(path14.join(adminDir, "HEAD")),
-        safeMtimeMs(path14.join(result.bareRepoPath, "worktrees"))
+        safeMtimeMs(path20.join(adminDir, "HEAD")),
+        safeMtimeMs(path20.join(result.bareRepoPath, "worktrees"))
       ]);
       this.discoveryCache.set(absolutePath, {
         result,
@@ -4982,7 +6603,7 @@ var RepositoryContext = class {
     const results = /* @__PURE__ */ new Map();
     const byName = (a, b) => a.name.localeCompare(b.name);
     const configCandidates = Array.from(this.repos.values()).filter((entry) => entry.source === "config" && !!entry.config.bareRepoDir).map((entry) => {
-      const bareRepoPath = path14.resolve(entry.config.bareRepoDir);
+      const bareRepoPath = path20.resolve(entry.config.bareRepoDir);
       return { entry, bareRepoPath, foldedBare: normalizePathForCompare(bareRepoPath) };
     }).filter((c) => c.foldedBare !== currentBare);
     const configPresence = await Promise.all(configCandidates.map((c) => isDirectory(c.bareRepoPath)));
@@ -4990,7 +6611,7 @@ var RepositoryContext = class {
       const sibling = {
         name: entry.name,
         bareRepoPath,
-        worktreeDir: path14.resolve(entry.config.worktreeDir),
+        worktreeDir: path20.resolve(entry.config.worktreeDir),
         repoUrl: entry.config.repoUrl,
         present: configPresence[i],
         configMatched: true
@@ -5000,24 +6621,24 @@ var RepositoryContext = class {
       }
       results.set(foldedBare, sibling);
     });
-    const repoDir = path14.dirname(currentBareRepoPath);
-    const workspaceRoot = path14.dirname(repoDir);
+    const repoDir = path20.dirname(currentBareRepoPath);
+    const workspaceRoot = path20.dirname(repoDir);
     if (workspaceRoot === repoDir) {
       return Array.from(results.values()).sort(byName);
     }
     let entries;
     try {
-      entries = await fs10.readdir(workspaceRoot);
+      entries = await fs17.readdir(workspaceRoot);
     } catch {
       return Array.from(results.values()).sort(byName);
     }
     const configBares = new Map(configCandidates.map((c) => [c.foldedBare, c.entry.name]));
     await Promise.all(
       entries.map(async (entry) => {
-        const candidate = path14.join(workspaceRoot, entry);
-        const bareCandidate = path14.join(candidate, GIT_CONSTANTS.BARE_DIR_NAME);
+        const candidate = path20.join(workspaceRoot, entry);
+        const bareCandidate = path20.join(candidate, GIT_CONSTANTS.BARE_DIR_NAME);
         if (!await isDirectory(bareCandidate)) return;
-        const resolvedBare = path14.resolve(bareCandidate);
+        const resolvedBare = path20.resolve(bareCandidate);
         const foldedBare = normalizePathForCompare(resolvedBare);
         if (foldedBare === currentBare || results.has(foldedBare)) return;
         const matchedName = configBares.get(foldedBare);
@@ -5043,8 +6664,8 @@ var RepositoryContext = class {
     if (Date.now() - cached.cachedAt >= DISCOVERY_CACHE_TTL_MS) return false;
     if (!cached.worktreeAdminDir || !cached.result.bareRepoPath) return true;
     const [currentHeadMtime, currentWorktreesDirMtime] = await Promise.all([
-      safeMtimeMs(path14.join(cached.worktreeAdminDir, "HEAD")),
-      safeMtimeMs(path14.join(cached.result.bareRepoPath, "worktrees"))
+      safeMtimeMs(path20.join(cached.worktreeAdminDir, "HEAD")),
+      safeMtimeMs(path20.join(cached.result.bareRepoPath, "worktrees"))
     ]);
     return currentHeadMtime === cached.worktreeHeadMtimeMs && currentWorktreesDirMtime === cached.worktreesDirMtimeMs;
   }
@@ -5092,18 +6713,18 @@ var RepositoryContext = class {
       return unsupported("Invalid .git file format (missing gitdir line)");
     }
     const gitdir = gitdirMatch[1].trim();
-    const resolvedGitdir = path14.isAbsolute(gitdir) ? gitdir : path14.resolve(worktreeRoot, gitdir);
+    const resolvedGitdir = path20.isAbsolute(gitdir) ? gitdir : path20.resolve(worktreeRoot, gitdir);
     const worktreesMatch = resolvedGitdir.match(/^(.+?)[/\\]worktrees[/\\][^/\\]+$/);
     if (!worktreesMatch) {
       return unsupported("gitdir does not follow worktree structure (missing /worktrees/<name>)");
     }
-    const bareRepoPath = path14.resolve(worktreesMatch[1]);
-    const adminDir = path14.resolve(resolvedGitdir);
+    const bareRepoPath = path20.resolve(worktreesMatch[1]);
+    const adminDir = path20.resolve(resolvedGitdir);
     let repoUrl = null;
     let worktrees = [];
     let currentBranch = null;
     try {
-      const bareGit = simpleGit6(bareRepoPath);
+      const bareGit = simpleGit7(bareRepoPath);
       try {
         const remoteResult = await bareGit.remote(["get-url", "origin"]);
         const urlStr = typeof remoteResult === "string" ? remoteResult.trim() : "";
@@ -5139,13 +6760,12 @@ var RepositoryContext = class {
         adminDir
       };
     }
-    const worktreeDir = path14.dirname(worktreeRoot);
+    const worktreeDir = path20.dirname(worktreeRoot);
     const noUrlReason = "no remote origin URL detected";
     const capabilities = {
       listWorktrees: { available: true },
       getStatus: { available: true },
       createWorktree: repoUrl !== null ? { available: true } : { available: false, reason: noUrlReason },
-      removeWorktree: { available: true },
       updateWorktree: { available: true },
       sync: { available: false, reason: "no config and no remote URL" },
       initialize: { available: false, reason: "no config and no remote URL" }
@@ -5175,7 +6795,7 @@ var RepositoryContext = class {
         cronSchedule: DEFAULT_CONFIG.CRON_SCHEDULE,
         runOnce: true
       };
-      const detectedKey = `${AUTO_DETECT_PREFIX}${path14.basename(bareRepoPath)}@${bareRepoPath}`;
+      const detectedKey = `${AUTO_DETECT_PREFIX}${path20.basename(bareRepoPath)}@${bareRepoPath}`;
       if (!this.repos.has(detectedKey)) {
         this.repos.set(detectedKey, {
           name: detectedKey,
@@ -5362,9 +6982,9 @@ var RepositoryContext = class {
       const mode = resolveMode(entry.config);
       const isCurrent = entry.name === currentRepo;
       if (mode === REPOSITORY_MODES.CLONE) {
-        return { name: entry.name, mode: "clone", checkoutPath: path14.resolve(entry.config.worktreeDir), isCurrent };
+        return { name: entry.name, mode: "clone", checkoutPath: path20.resolve(entry.config.worktreeDir), isCurrent };
       }
-      return { name: entry.name, mode: "worktree", worktreeDir: path14.resolve(entry.config.worktreeDir), isCurrent };
+      return { name: entry.name, mode: "worktree", worktreeDir: path20.resolve(entry.config.worktreeDir), isCurrent };
     };
     if (!options.detailed) {
       return entries.map(buildLean);
@@ -5389,7 +7009,7 @@ var RepositoryContext = class {
             return summary;
           }
           if (entry.config.bareRepoDir) {
-            summary.bareRepoDir = path14.resolve(entry.config.bareRepoDir);
+            summary.bareRepoDir = path20.resolve(entry.config.bareRepoDir);
             summary.localReady = await isDirectory(summary.bareRepoDir);
           } else {
             summary.localReady = false;
@@ -5433,27 +7053,27 @@ var RepositoryContext = class {
       return this.readConfiguredCloneWorktree(entry, currentWorktreePath);
     }
     if (entry.source !== "config" || !entry.config.bareRepoDir) return { worktrees: [] };
-    const bareRepoPath = path14.resolve(entry.config.bareRepoDir);
+    const bareRepoPath = path20.resolve(entry.config.bareRepoDir);
     if (!await isDirectory(bareRepoPath)) return { worktrees: [] };
     try {
-      const output = await simpleGit6(bareRepoPath).raw(["worktree", "list", "--porcelain"]);
+      const output = await simpleGit7(bareRepoPath).raw(["worktree", "list", "--porcelain"]);
       return { worktrees: parseWorktreeList(output, currentWorktreePath) };
     } catch (err) {
       return { worktrees: [], error: err instanceof Error ? err.message : String(err) };
     }
   }
   findConfiguredCloneEntry(worktreeRoot) {
-    const foldedRoot = normalizePathForCompare(path14.resolve(worktreeRoot));
+    const foldedRoot = normalizePathForCompare(path20.resolve(worktreeRoot));
     for (const entry of this.repos.values()) {
       if (entry.source !== "config" || resolveMode(entry.config) !== REPOSITORY_MODES.CLONE) continue;
-      if (normalizePathForCompare(path14.resolve(entry.config.worktreeDir)) === foldedRoot) {
+      if (normalizePathForCompare(path20.resolve(entry.config.worktreeDir)) === foldedRoot) {
         return entry;
       }
     }
     return null;
   }
   async buildCloneModeContext(entry, worktreeRoot, notes) {
-    const resolvedRoot = path14.resolve(worktreeRoot);
+    const resolvedRoot = path20.resolve(worktreeRoot);
     let currentBranch = null;
     try {
       currentBranch = await readCurrentBranch(resolvedRoot);
@@ -5466,7 +7086,6 @@ var RepositoryContext = class {
       listWorktrees: { available: true },
       getStatus: { available: true },
       createWorktree: { available: false, reason: cloneModeReason },
-      removeWorktree: { available: false, reason: cloneModeReason },
       updateWorktree: { available: false, reason: cloneModeReason },
       sync: { available: true },
       initialize: { available: true }
@@ -5491,7 +7110,7 @@ var RepositoryContext = class {
     return discovered;
   }
   async readConfiguredCloneWorktree(entry, currentWorktreePath) {
-    const worktreePath = path14.resolve(entry.config.worktreeDir);
+    const worktreePath = path20.resolve(entry.config.worktreeDir);
     if (!await isDirectory(worktreePath) || !await hasGitMetadata(worktreePath)) {
       return { worktrees: [] };
     }
@@ -5515,7 +7134,7 @@ function parseWorktreeList(output, currentPath) {
   const foldedCurrent = currentPath ? normalizePathForCompare(currentPath) : null;
   const results = [];
   for (const wt of parseWorktreeListPorcelain(output)) {
-    const resolved = path14.resolve(wt.path);
+    const resolved = path20.resolve(wt.path);
     const branch = wt.branch ?? (wt.detached ? `(detached ${(wt.head ?? "").slice(0, 7)})` : null);
     if (!branch) continue;
     results.push({
@@ -5528,7 +7147,7 @@ function parseWorktreeList(output, currentPath) {
 }
 async function safeMtimeMs(filePath) {
   try {
-    const stat4 = await fs10.stat(filePath);
+    const stat4 = await fs17.stat(filePath);
     return stat4.mtimeMs;
   } catch {
     return null;
@@ -5536,7 +7155,7 @@ async function safeMtimeMs(filePath) {
 }
 async function isDirectory(filePath) {
   try {
-    const stat4 = await fs10.stat(filePath);
+    const stat4 = await fs17.stat(filePath);
     return stat4.isDirectory();
   } catch {
     return false;
@@ -5544,7 +7163,7 @@ async function isDirectory(filePath) {
 }
 async function hasGitMetadata(worktreePath) {
   try {
-    await fs10.stat(path14.join(worktreePath, ".git"));
+    await fs17.stat(path20.join(worktreePath, ".git"));
     return true;
   } catch {
     return false;
@@ -5553,14 +7172,14 @@ async function hasGitMetadata(worktreePath) {
 async function isGitCheckout(checkoutPath) {
   if (!await isDirectory(checkoutPath)) return false;
   try {
-    const inside = (await simpleGit6(checkoutPath).raw(["rev-parse", "--is-inside-work-tree"])).trim();
+    const inside = (await simpleGit7(checkoutPath).raw(["rev-parse", "--is-inside-work-tree"])).trim();
     return inside === "true";
   } catch {
     return false;
   }
 }
 async function readCurrentBranch(worktreePath) {
-  const git = simpleGit6(worktreePath);
+  const git = simpleGit7(worktreePath);
   const branch = (await git.raw(["rev-parse", "--abbrev-ref", "HEAD"])).trim();
   if (branch && branch !== "HEAD") {
     return branch;
@@ -5569,12 +7188,12 @@ async function readCurrentBranch(worktreePath) {
   return head ? `(detached ${head})` : "(detached)";
 }
 async function findWorktreeRoot(startPath) {
-  let current = path14.resolve(startPath);
-  const root = path14.parse(current).root;
+  let current = path20.resolve(startPath);
+  const root = path20.parse(current).root;
   while (true) {
-    const gitPath = path14.join(current, ".git");
+    const gitPath = path20.join(current, ".git");
     try {
-      const content = await fs10.readFile(gitPath, "utf-8");
+      const content = await fs17.readFile(gitPath, "utf-8");
       return { kind: "worktree-file", worktreeRoot: current, gitFileContent: content };
     } catch (err) {
       const code = err.code;
@@ -5586,7 +7205,7 @@ async function findWorktreeRoot(startPath) {
       }
     }
     if (current === root) return null;
-    const parent = path14.dirname(current);
+    const parent = path20.dirname(current);
     if (parent === current) return null;
     current = parent;
   }
@@ -5597,27 +7216,9 @@ import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { z } from "zod";
 
 // src/mcp/handlers.ts
-import * as path15 from "path";
+import * as path21 from "path";
 import pLimit4 from "p-limit";
 
-// src/utils/disk-space.ts
-import fastFolderSize from "fast-folder-size";
-async function calculateDirectorySize(dirPath) {
-  return new Promise((resolve11, reject) => {
-    fastFolderSize(dirPath, (err, bytes) => {
-      if (err) {
-        reject(err);
-        return;
-      }
-      if (bytes === void 0) {
-        reject(new Error(`fast-folder-size returned no bytes for ${dirPath}`));
-        return;
-      }
-      resolve11(bytes);
-    });
-  });
-}
-
 // src/utils/git-validation.ts
 function isValidGitBranchName(name) {
   if (!name.trim()) {
@@ -5727,14 +7328,18 @@ function wrapHandler(fn) {
 }
 
 // src/mcp/worktree-summary.ts
-import simpleGit7 from "simple-git";
+import simpleGit8 from "simple-git";
 function deriveLabel(status, isCurrent) {
   if (isCurrent) return "current";
-  if (!status.isClean || status.hasUnpushedCommits || status.hasStashedChanges) return "dirty";
-  if (status.upstreamGone) return "stale";
+  const unpushedBlocks = status.hasUnpushedCommits && !status.fullyPushedUpstreamDeleted;
+  if (!status.isClean || unpushedBlocks || status.hasStashedChanges) return "dirty";
+  if (status.upstreamGone || status.fullyPushedUpstreamDeleted) return "stale";
   return "clean";
 }
 function deriveSafeToRemove(status) {
+  if (status.canRemove && status.fullyPushedUpstreamDeleted) {
+    return { safe: true, reason: "fully pushed before its remote branch was deleted" };
+  }
   if (status.canRemove && !status.upstreamGone) {
     return { safe: true, reason: "clean tree, no unpushed commits" };
   }
@@ -5748,7 +7353,7 @@ function deriveSafeToRemove(status) {
 }
 async function getDivergence(worktreePath) {
   try {
-    const git = simpleGit7(worktreePath);
+    const git = simpleGit8(worktreePath);
     const output = await git.raw(["rev-list", "--left-right", "--count", "HEAD...@{upstream}"]);
     const [aheadStr, behindStr] = output.trim().split(/\s+/);
     return { ahead: parseInt(aheadStr, 10), behind: parseInt(behindStr, 10) };
@@ -5796,7 +7401,7 @@ async function runExclusiveRepoOperation(ctx, repoName, service, operation) {
 }
 async function ensureRepoWorktreePath(ctx, params, service, git) {
   await ensurePathBelongsToRepo(ctx, params.path, params.repoName, service, git);
-  return path15.resolve(params.path);
+  return path21.resolve(params.path);
 }
 async function ensurePathBelongsToRepo(ctx, targetPath, repoName, service, git) {
   const discovered = ctx.getDiscoveredContext(repoName);
@@ -5887,12 +7492,8 @@ async function handleListWorktrees(ctx, params, _extra) {
       configuredRepoNames.map(
         (repoName) => limit(async () => {
           try {
-            return [
-              repoName,
-              {
-                worktrees: await listWorktreesForRepo(ctx, repoName, params.includeSize, statusLimit)
-              }
-            ];
+            const worktrees2 = await listWorktreesForRepo(ctx, repoName, params.includeSize, statusLimit);
+            return [repoName, { worktrees: worktrees2 }];
           } catch (err) {
             return [
               repoName,
@@ -5907,8 +7508,8 @@ async function handleListWorktrees(ctx, params, _extra) {
     );
     return formatToolResponse({ repositories: Object.fromEntries(repositories) });
   }
-  const results = await listWorktreesForRepo(ctx, params.repoName, params.includeSize);
-  return formatToolResponse({ worktrees: results });
+  const worktrees = await listWorktreesForRepo(ctx, params.repoName, params.includeSize);
+  return formatToolResponse({ worktrees });
 }
 async function listWorktreesForRepo(ctx, repoName, includeSize, limit = pLimit4(DEFAULT_CONFIG.PARALLELISM.MAX_STATUS_CHECKS)) {
   const { discovered, service, git } = await getReadyService(ctx, repoName, {
@@ -5929,7 +7530,7 @@ async function listWorktreesForRepo(ctx, repoName, includeSize, limit = pLimit4(
   const results = await Promise.all(
     worktrees.map(
       (wt) => limit(async () => {
-        const resolvedPath = path15.resolve(wt.path);
+        const resolvedPath = path21.resolve(wt.path);
         const isCurrent = currentPath !== null && pathsEqual(wt.path, currentPath);
         const [status, divergence, metadata, sizeBytes] = await Promise.all([
           git.getFullWorktreeStatus(wt.path, false).catch(() => null),
@@ -6013,37 +7614,12 @@ async function handleCreateWorktree(ctx, params, _extra) {
     return formatToolResponse({
       success: true,
       branchName,
-      worktreePath: path15.resolve(worktreePath),
+      worktreePath: path21.resolve(worktreePath),
       created,
       pushed
     });
   });
 }
-async function handleRemoveWorktree(ctx, params, _extra) {
-  const { service, git } = await getReadyService(ctx, params.repoName, {
-    capability: "removeWorktree",
-    toolName: "remove_worktree"
-  });
-  ensureWorktreeModeService(service, "remove_worktree");
-  return runExclusiveRepoOperation(ctx, params.repoName, service, async () => {
-    if (!service.isInitialized()) {
-      await service.initializeUnlocked();
-    }
-    const removedPath = await ensureRepoWorktreePath(ctx, params, service, git);
-    if (!params.force) {
-      const status = await git.getFullWorktreeStatus(params.path, false);
-      if (!status.canRemove) {
-        throw new Error(`Cannot remove worktree: ${status.reasons.join(", ")}. Use force=true to override.`);
-      }
-    }
-    await git.removeWorktree(params.path);
-    ctx.invalidateDiscovered();
-    return formatToolResponse({
-      success: true,
-      removedPath
-    });
-  });
-}
 async function handleSync(ctx, params, extra) {
   const { service } = await getReadyService(ctx, params.repoName, {
     capability: "sync",
@@ -6052,7 +7628,6 @@ async function handleSync(ctx, params, extra) {
   const dispose = attachProgressReporter(service, extra);
   try {
     const start = Date.now();
-    service.clearRecordedSkips();
     const result = await service.sync();
     if (!result.started) {
       throw new SyncInProgressError(ctx.getEntry(params.repoName)?.name ?? params.repoName ?? "unknown");
@@ -6123,17 +7698,28 @@ async function handleInitialize(ctx, params, extra) {
   }
 }
 async function handleLoadConfig(ctx, params, _extra) {
-  const configPath = params.configPath ?? process.env.SYNC_WORKTREES_CONFIG;
+  const configPath = params.configPath ?? process.env.SYNC_WORKTREES_CONFIG ?? ctx.getConfigPath() ?? await detectConfigFromLaunchCwd(ctx);
   if (!configPath) {
-    throw new Error("configPath required (or set SYNC_WORKTREES_CONFIG env var)");
+    throw new Error(
+      "configPath required (or set SYNC_WORKTREES_CONFIG env var, call detect_context with a path, or launch from a sync-worktrees workspace)"
+    );
   }
   await ctx.loadConfig(configPath);
   return formatToolResponse({
-    configPath: path15.resolve(configPath),
+    configPath: path21.resolve(configPath),
     currentRepository: ctx.getCurrentRepo(),
     repositories: ctx.getRepositoryList()
   });
 }
+async function detectConfigFromLaunchCwd(ctx) {
+  try {
+    const discovered = await ctx.detectFromPath(ctx.getLaunchCwd());
+    if (discovered.configPath) return discovered.configPath;
+    return await ctx.findConfigUpward(ctx.getLaunchCwd());
+  } catch {
+    return null;
+  }
+}
 async function handleSetCurrentRepository(ctx, params, _extra) {
   ctx.setCurrentRepo(params.repoName);
   return formatToolResponse({
@@ -6229,7 +7815,7 @@ function createServer(context, snapshot) {
         detailed: z.boolean().optional().default(false).describe("Expand configuredRepositories with repoUrl, branch, sparseCheckout, localReady, bareRepoDir."),
         includeAllWorktrees: z.boolean().optional().describe("Include allWorktreesByRepo + allWorktreeErrorsByRepo for each configured repo. Default: false."),
         includeStatus: z.boolean().optional().describe(
-          "Enrich entries with label, divergence, staleHint. Adds 1 git status + rev-list per worktree. Default: false."
+          "Enrich entries with label, divergence, staleHint. Adds 1 git status + rev-list per worktree. Labels here are metadata-blind (no sync metadata is loaded), so a fully-pushed branch whose remote was deleted shows 'dirty'; list_worktrees gives the authoritative label/safeToRemove. Default: false."
         )
       },
       annotations: {
@@ -6300,25 +7886,6 @@ function createServer(context, snapshot) {
     },
     wrapHandler((params, extra) => handleCreateWorktree(context, params, extra))
   );
-  server.registerTool(
-    "remove_worktree",
-    {
-      description: "Remove worktree. Safety checks reject if dirty, unpushed commits, stashes, or op in progress (merge/rebase/cherry-pick/revert/bisect). force=true: `git worktree remove --force` DELETES uncommitted/untracked files in dir; branch ref + stashes + remote preserved. Returns: {success, removedPath}.",
-      inputSchema: {
-        path: z.string().describe(`Worktree path to remove. ${PATH_DESCRIBE_SUFFIX}`),
-        force: z.boolean().optional().describe("Skip safety checks; deletes uncommitted/untracked files. Branch ref preserved. Default: false."),
-        repoName: z.string().optional().describe(REPO_NAME_DESCRIBE)
-      },
-      annotations: {
-        title: "Remove worktree",
-        readOnlyHint: false,
-        destructiveHint: true,
-        idempotentHint: false,
-        openWorldHint: false
-      }
-    },
-    wrapHandler((params, extra) => handleRemoveWorktree(context, params, extra))
-  );
   server.registerTool(
     "sync",
     {
@@ -6374,9 +7941,11 @@ function createServer(context, snapshot) {
   server.registerTool(
     "load_config",
     {
-      description: "Load/reload sync-worktrees JS config into session. Replaces previously loaded repos. Call before sync/initialize/create_worktree in config-driven workflow. Returns: {configPath, currentRepository, repositories: [{name, repoUrl, worktreeDir, source}]}.",
+      description: "Load/reload sync-worktrees JS config into session. Replaces previously loaded repos. Uses configPath, SYNC_WORKTREES_CONFIG, an already detected config, or a launch-CWD auto-detect fallback. For first discovery from an arbitrary project path, call detect_context with path. Returns: {configPath, currentRepository, repositories: [{name, repoUrl, worktreeDir, source}]}.",
       inputSchema: {
-        configPath: z.string().optional().describe("Config file path. Falls back to SYNC_WORKTREES_CONFIG env var. Errors if neither set.")
+        configPath: z.string().optional().describe(
+          "Config file path. Falls back to SYNC_WORKTREES_CONFIG, an already detected config, or launch-CWD auto-detect."
+        )
       },
       annotations: {
         title: "Load sync-worktrees config",