code-coordinator 0.5.311__tar.gz → 0.5.312__tar.gz

{code_coordinator-0.5.311 → code_coordinator-0.5.312}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.311
+Version: 0.5.312
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.311 → code_coordinator-0.5.312}/code_coordinator.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.311
+Version: 0.5.312
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.311 → code_coordinator-0.5.312}/code_coordinator.egg-info/scm_version.json

@@ -1,7 +1,7 @@
 {
-  "tag": "0.5.311",
+  "tag": "0.5.312",
   "distance": 0,
-  "node": "g8003167b7c6ac292c1b0e3a06e71cc4dd08761b2",
+  "node": "g809179d4ae62704f319b523abbe2d69427d5a406",
   "dirty": false,
   "branch": "HEAD",
   "node_date": "2026-08-31"

{code_coordinator-0.5.311 → code_coordinator-0.5.312}/coord/commands/lifecycle.py

@@ -24,7 +24,13 @@ def _print_housekeeping_result(resp: dict) -> None:
     archived_a = resp.get("archived_assignments", 0)
     archived_n = resp.get("archived_notifications", 0)
     days = resp.get("retention_days")
-    if not archived_a and not archived_n:
+    # #2974: the confirm-worktree sweep runs on its own age window,
+    # independent of `retention_days` above, and must be reported even when
+    # there was nothing terminal to archive — that used to be the ONLY thing
+    # this sweep did, so a run that only reclaimed leaked worktrees must not
+    # print "nothing to archive" and hide it.
+    removed_wt = resp.get("removed_confirm_worktrees", 0)
+    if not archived_a and not archived_n and not removed_wt:
         click.echo(
             f"housekeeping: nothing to archive (no terminal rows older than {days}d)."
         )
@@ -35,6 +41,12 @@ def _print_housekeeping_result(resp: dict) -> None:
         f"housekeeping: {verb} {archived_a} assignment(s) + "
         f"{archived_n} notification(s) (terminal, older than {days}d).{suffix}"
     )
+    if removed_wt:
+        wt_verb = "would remove" if dry else "removed"
+        click.echo(
+            f"housekeeping: {wt_verb} {removed_wt} stale confirm-worktree(s) "
+            "(#2974)."
+        )
 
 
 @click.command(

{code_coordinator-0.5.311 → code_coordinator-0.5.312}/coord/confirm_test.py

@@ -104,6 +104,7 @@ existed.
 from __future__ import annotations
 
 import os
+import shutil
 import subprocess
 import threading
 import time
@@ -484,6 +485,106 @@ def confirm_lock_path(repo_name: str, branch: str) -> Path:
     return COORD_DIR / "confirm-worktrees" / f"{safe}.lock"
 
 
+#: #2974: default age (hours) a directory under ``confirm-worktrees/`` may sit
+#: unremoved before :func:`sweep_stale_confirm_worktrees` reclaims it outright.
+#: Every entry under that root is throwaway by construction (#561) and
+#: `confirm_branch`'s own `finally` now removes its worktree on every exit —
+#: so anything still here this long survived something worse than an ordinary
+#: failure (a hard kill of the whole process, `coord-agent`/`coord-serve`
+#: restarting mid-run before #2974's `finally` fix ever ran, a full disk
+#: mid-cleanup). Generous relative to :data:`CONFIRM_DEFAULT_TIMEOUT_SECONDS`
+#: (20 min) so this never races a confirmation that is still legitimately
+#: in flight.
+#:
+#: Footgun to remember if either ceiling ever moves: the margin here is
+#: relative, not enforced. `sweep_stale_confirm_worktrees` doesn't know
+#: whether a given `confirm-worktrees/<repo>-<branch>` entry has a
+#: `confirm_branch` call still running against it — it reclaims purely on
+#: directory mtime. If `CONFIRM_DEFAULT_TIMEOUT_SECONDS` (or a future
+#: per-repo override of it) is ever raised to within a few hours of this
+#: constant, a still-in-flight confirmation's worktree (and its `.lock`
+#: file) could be `rmtree`'d out from under it by this sweep. Keep this
+#: comfortably above whatever the longest configured confirmation timeout
+#: is, not just the current default.
+STALE_WORKTREE_MAX_AGE_HOURS = 6.0
+
+
+def sweep_stale_confirm_worktrees(
+    *,
+    max_age_hours: float = STALE_WORKTREE_MAX_AGE_HOURS,
+    dry_run: bool = False,
+    now: float | None = None,
+) -> dict:
+    """Reclaim ``confirm-worktrees/`` entries older than *max_age_hours* (#2974).
+
+    Belt-and-suspenders over the `finally`-based cleanup in
+    :func:`confirm_branch`: that fix stops the leak going forward, but does
+    nothing about the hundreds of directories (189G measured on one host,
+    #2974) a build that never reaches this fix — or any future bug in the
+    cleanup path itself — can still leave behind. This sweep is the backstop
+    that ages them out regardless of cause.
+
+    Deliberately filesystem-only: it reclaims disk with a plain
+    ``shutil.rmtree`` keyed on directory mtime, and does **not** attempt a
+    ``git worktree prune`` in the originating repo's checkout (that would
+    need to map each ``<repo>-<branch>`` directory name back to a configured
+    repo, which is ambiguous when a repo or branch name itself contains a
+    ``-``). The admin metadata that leaves behind in the base checkout's
+    ``.git/worktrees/`` is a few KB per entry — negligible next to the build
+    trees this reclaims — and self-heals the next time :func:`confirm_branch`
+    or :func:`coord.revalidate.revalidate` runs `git worktree prune` for that
+    repo anyway.
+
+    Called from :func:`coord.housekeeping.sweep`'s existing low-cadence
+    daemon tick and ``coord housekeeping``, so it needs no new wiring or
+    schedule of its own. Returns
+    ``{"removed": [names], "dry_run": bool, "max_age_hours": float}`` —
+    ``removed`` lists what was (or, for ``dry_run``, would be) deleted.
+    Silently a no-op if the directory does not exist yet.
+    """
+    from coord.state import COORD_DIR  # noqa: PLC0415
+
+    root = COORD_DIR / "confirm-worktrees"
+    result: dict = {
+        "removed": [],
+        "dry_run": dry_run,
+        "max_age_hours": max_age_hours,
+    }
+    if not root.exists():
+        return result
+
+    cutoff = (now if now is not None else time.time()) - max_age_hours * 3600.0
+    try:
+        entries = sorted(root.iterdir())
+    except OSError:
+        return result
+
+    for entry in entries:
+        # Lock files (`confirm_lock_path`) are tiny and self-explanatory by
+        # name; only the worktree directories themselves are the disk cost
+        # this sweep exists to reclaim. A stray lock with no matching
+        # worktree directory is harmless — the next `confirm_branch` call for
+        # that (repo, branch) simply re-creates and re-locks it.
+        if entry.name.endswith(".lock") or not entry.is_dir():
+            continue
+        try:
+            mtime = entry.stat().st_mtime
+        except OSError:
+            continue
+        if mtime >= cutoff:
+            continue
+        result["removed"].append(entry.name)
+        if dry_run:
+            continue
+        shutil.rmtree(entry, ignore_errors=True)
+        lock_path = root / f"{entry.name}.lock"
+        try:
+            lock_path.unlink(missing_ok=True)
+        except OSError:
+            pass
+    return result
+
+
 def branch_touched_files(repo_dir: Path, branch: str, base_branch: str) -> list[str]:
     """Paths the branch changes vs its merge-base with *base_branch*.
 
@@ -915,9 +1016,9 @@ def confirm_branch(
                 test_command,
             )
 
-        # Green, and observed rather than reported. Clean up: nothing to
-        # inspect.
-        _remove_worktree(repo_dir, wt_path)
+        # Green, and observed rather than reported. Nothing to inspect —
+        # cleanup happens in `finally` below, same as every other exit from
+        # this block.
         return ConfirmationResult(
             kind=KIND_OK,
             reason=(
@@ -928,6 +1029,31 @@ def confirm_branch(
             returncode=0,
         )
     finally:
+        # #2974: EVERY exit from the block above — including KIND_TIMEOUT
+        # (a hung/slow suite), KIND_SIGNAL (a coord-agent/coord-serve restart
+        # landing mid-run, #2527), and a genuine refutation (KIND_BUILD/
+        # KIND_SUITE) — must remove this worktree, not just the green path.
+        #
+        # `coord.revalidate`'s sibling helper deliberately KEEPS a failed
+        # worktree "for inspection" (see its `_remove_worktree` docstring and
+        # `format_failure`'s "worktree kept for inspection" line) because
+        # `coord merge --revalidate` is opt-in, operator-initiated, and rare —
+        # a human is watching and can go look at the tree it names.
+        # `confirm_branch` is the opposite shape: it runs unattended, on every
+        # PASS claim, inside the automatic reap path, keyed by (repo, branch)
+        # — and a branch is rarely revisited, so nothing was ever going to
+        # remove a "kept for inspection" tree here. That is exactly how this
+        # leaked to 189G / 346 dirs on one host in nine days (#2974): the
+        # biggest trees came from the slowest repos, i.e. precisely the
+        # KIND_TIMEOUT/KIND_SIGNAL runs that used to fall through this
+        # `finally` without cleanup.
+        #
+        # Nothing of diagnostic value is lost: the captured output tail
+        # (`ConfirmationResult.output`) is already persisted to
+        # `test_output/<assignment_id>.txt` by `write_confirmation_output`
+        # regardless of outcome — the worktree itself was never the thing an
+        # operator actually inspected.
+        _remove_worktree(repo_dir, wt_path)
         lock.release()
 
 
@@ -942,6 +1068,7 @@ __all__ = [
     "NOTIFY_BASE_CLIENT_TIMEOUT_SECONDS",
     "PERMISSION_DENIED_EXIT",
     "REFUTING_KINDS",
+    "STALE_WORKTREE_MAX_AGE_HOURS",
     "ConfirmationResult",
     "begin_confirmation_pass",
     "branch_touched_files",
@@ -952,6 +1079,7 @@ __all__ = [
     "confirmation_timeout",
     "notify_client_timeout_seconds",
     "spend_confirmation_budget",
+    "sweep_stale_confirm_worktrees",
     "unmet_confirmation_capabilities",
     "write_confirmation_output",
 ]

{code_coordinator-0.5.311 → code_coordinator-0.5.312}/coord/housekeeping.py

@@ -33,6 +33,14 @@ declog. ``coord.merge_queue.merged_issue_keys()`` unions the live table with
 the archive so the "already merged, don't re-enqueue" dedup in
 ``enqueue_approved_work``/``staging_items`` keeps working after a row ages
 out.
+
+#2974: this is also the one existing low-cadence, filesystem-safe hook the
+daemon already calls on a timer (and that ``coord housekeeping`` calls on
+demand) — so it is where :func:`coord.confirm_test.sweep_stale_confirm_worktrees`
+is wired in too, reclaiming ``~/.coord/confirm-worktrees/`` entries that
+outlived ``confirm_branch``'s own per-run cleanup. That is disk hygiene, not
+DB archiving, but reusing this sweep's cadence beats inventing a second timer
+for a second maintenance job.
 """
 
 from __future__ import annotations
@@ -140,12 +148,13 @@ def _move_rows(
 
 def sweep(*, dry_run: bool = False, now: float | None = None) -> dict:
     """Archive stale terminal assignments + their notifications + merged
-    merge_queue entries.
+    merge_queue entries, and reclaim leaked confirm-worktree directories.
 
     Returns ``{"archived_assignments": N, "archived_notifications": M,
-    "archived_merge_queue": K, "dry_run": bool, "retention_days": D}``.
-    ``archived_*`` are the counts that were (or, for ``dry_run``, would be)
-    moved.  A no-op returns zeros.
+    "archived_merge_queue": K, "removed_confirm_worktrees": W, "dry_run": bool,
+    "retention_days": D}``. ``archived_*``/``removed_confirm_worktrees`` are
+    the counts that were (or, for ``dry_run``, would be) moved/deleted.  A
+    no-op returns zeros.
 
     Conservative by construction: nothing active, recent (within the archive
     window), queued-for-merge, latest-of-an-open-issue, or review-linked to any
@@ -153,17 +162,29 @@ def sweep(*, dry_run: bool = False, now: float | None = None) -> dict:
     are in the terminal ``MERGED`` state (#1107 Part 3) — non-terminal /
     conflicted entries are left for ``prune_stale_queue_entries`` or manual
     ``coord merge --drop``.
+
+    #2974: ``removed_confirm_worktrees`` is independent of the DB-archiving
+    ``cutoff``/``retention_days`` above (it has its own, much shorter,
+    :data:`coord.confirm_test.STALE_WORKTREE_MAX_AGE_HOURS` window) and runs
+    even when DB archiving itself is disabled (``COORD_ARCHIVE_RETENTION_DAYS``
+    ``<= 0``) — a disk leak on the daemon host is not something an operator
+    who merely turned off DB archiving meant to also keep.
     """
+    from coord.confirm_test import sweep_stale_confirm_worktrees  # noqa: PLC0415
+
+    swept_worktrees = sweep_stale_confirm_worktrees(dry_run=dry_run, now=now)
+
     cutoff = _archive_cutoff(now)
     result = {
         "archived_assignments": 0,
         "archived_notifications": 0,
         "archived_merge_queue": 0,
+        "removed_confirm_worktrees": len(swept_worktrees["removed"]),
         "dry_run": dry_run,
         "retention_days": _archive_retention_days(),
     }
     if cutoff is None:
-        return result  # archiving disabled
+        return result  # DB archiving disabled; the worktree sweep above still ran
 
     conn = get_connection()
     index = [

{code_coordinator-0.5.311 → code_coordinator-0.5.312}/coord/serve_app.py

@@ -739,7 +739,9 @@ def _audit_housekeeping_sweep(swept: dict) -> None:
             f"housekeeping: archived {swept.get('archived_assignments', 0)} "
             f"assignment(s), {swept.get('archived_notifications', 0)} "
             f"notification(s), {swept.get('archived_merge_queue', 0)} "
-            "merge_queue entry(ies)"
+            "merge_queue entry(ies), removed "
+            f"{swept.get('removed_confirm_worktrees', 0)} stale "
+            "confirm-worktree(s) (#2974)"
         ),
         details=swept,
     )
@@ -9477,13 +9479,16 @@ def build_app(store: CoordStore, config: Config, *, token: str | None = None) ->
                             swept.get("archived_assignments")
                             or swept.get("archived_notifications")
                             or swept.get("archived_merge_queue")
+                            or swept.get("removed_confirm_worktrees")
                         ):
                             log.info(
                                 "housekeeping: archived %d assignment(s), "
-                                "%d notification(s), %d merge_queue entry(ies)",
+                                "%d notification(s), %d merge_queue entry(ies), "
+                                "removed %d stale confirm-worktree(s)",
                                 swept["archived_assignments"],
                                 swept["archived_notifications"],
                                 swept.get("archived_merge_queue", 0),
+                                swept.get("removed_confirm_worktrees", 0),
                             )
                             _audit_housekeeping_sweep(swept)
                     except Exception:  # noqa: BLE001

{code_coordinator-0.5.311 → code_coordinator-0.5.312}/tests/test_board_cap_762.py

@@ -20,6 +20,33 @@ RECENT = NOW - 2 * 86400      # 2 days ago  → inside the 14d board window
 OLD = NOW - 40 * 86400        # 40 days ago → outside both windows
 
 
+@pytest.fixture(autouse=True)
+def _isolated_confirm_worktrees_dir(monkeypatch, tmp_path):
+    """#2974: ``housekeeping.sweep()`` now also calls
+    ``coord.confirm_test.sweep_stale_confirm_worktrees`` on every invocation
+    (even ``dry_run=False`` calls made directly, as most tests below do), and
+    that helper resolves its sweep root from the real, lazily-resolved
+    ``coord.state.COORD_DIR`` (``~/.coord`` on POSIX absent a ``$COORD_DIR``
+    override).  Before this fixture, every test in this file that calls the
+    real (non-dry-run) ``housekeeping.sweep()`` — or drives it through the
+    real ``/housekeeping`` endpoint — would ``shutil.rmtree`` anything under
+    the OPERATOR's real ``~/.coord/confirm-worktrees/`` older than
+    ``coord.confirm_test.STALE_WORKTREE_MAX_AGE_HOURS`` as an untracked side
+    effect of running `pytest`.  Pin ``coord.state.COORD_DIR`` to a private
+    ``tmp_path`` for every test in this module — mirrors
+    ``tests/test_confirm_test.py``'s own ``isolated_coord_dir`` fixture,
+    which the real ``sweep_stale_confirm_worktrees`` call site already
+    trusts (it re-imports ``coord.state.COORD_DIR`` fresh on every call, so
+    a plain ``monkeypatch.setattr`` here is picked up with no further
+    wiring). A file-local autouse fixture (rather than a global one in
+    ``tests/conftest.py``) is deliberate: ``tests/test_platform_paths.py``
+    has real tests that assert ``coord.state.COORD_DIR`` reflects the
+    *actual* default resolution with nothing overriding it, which a global
+    override would break.
+    """
+    monkeypatch.setattr("coord.state.COORD_DIR", tmp_path / "coord-state")
+
+
 def _ins_assignment(
     conn: sqlite3.Connection,
     aid: str,

{code_coordinator-0.5.311 → code_coordinator-0.5.312}/tests/test_confirm_test.py

@@ -25,6 +25,7 @@ behaviour rather than fail every branch in the fleet.
 
 from __future__ import annotations
 
+import os
 import subprocess
 from dataclasses import dataclass
 from pathlib import Path
@@ -547,15 +548,161 @@ class TestConfirmBranch:
             "worktrees piling up in the reap path"
         )
 
-    def test_refuted_run_keeps_its_worktree_for_inspection(
-        self, checkout: Path
+    @pytest.mark.parametrize(
+        "runner_kwargs, why",
+        [
+            (
+                {"default": _FakeProc(1, stdout="FAILED test_x", stderr="")},
+                "a genuine refutation",
+            ),
+            (
+                {
+                    "default": subprocess.TimeoutExpired(
+                        cmd="run-the-suite", timeout=1,
+                    ),
+                },
+                "a timeout",
+            ),
+            (
+                {"default": _FakeProc(-15, stdout="killed")},
+                "an external signal kill (#2527)",
+            ),
+        ],
+    )
+    def test_every_outcome_still_cleans_up_its_worktree(
+        self, checkout: Path, runner_kwargs: dict, why: str,
     ) -> None:
+        """#2974: `confirm_branch` used to keep a failed/timed-out/signal-killed
+        run's worktree "for inspection" — mirroring `coord.revalidate`'s
+        operator-initiated sibling, which really is watched by a human running
+        `coord merge --revalidate` by hand. Nobody watches an unattended
+        reap-path confirmation the same way, so nothing ever removed those
+        directories: 346 of them / 189G on one host after nine days (#2974).
+        Every outcome must clean up now — the captured output tail is already
+        persisted separately via `write_confirmation_output`, so the worktree
+        itself was never the thing actually inspected.
+        """
+        runner = _ScriptedRunner(**runner_kwargs)
         result = ct.confirm_branch(
-            "api", BRANCH, _StubConfig(repo_path=str(checkout)),
-            runner=_ScriptedRunner(default=_FakeProc(1)),
+            "api", BRANCH, _StubConfig(repo_path=str(checkout)), runner=runner,
+        )
+        assert not ct.confirm_worktree_path("api", BRANCH).exists(), (
+            f"{why}: worktree must not survive confirm_branch (#2974) — got "
+            f"kind={result.kind!r}"
         )
-        assert result.worktree is not None
-        assert result.worktree.exists()
+
+
+# ── #2974: the backstop sweep over whatever still leaked ─────────────────────
+#
+# `confirm_branch`'s own `finally` (above) is the fix going forward; this is
+# the belt-and-suspenders reclaim for anything that leaked before that fix
+# existed, or that some future bug in the cleanup path leaves behind again.
+
+
+class TestSweepStaleConfirmWorktrees:
+    def test_no_root_directory_is_a_silent_no_op(self) -> None:
+        result = ct.sweep_stale_confirm_worktrees()
+        assert result == {
+            "removed": [],
+            "dry_run": False,
+            "max_age_hours": ct.STALE_WORKTREE_MAX_AGE_HOURS,
+        }
+
+    def test_removes_only_entries_older_than_max_age(
+        self, isolated_coord_dir: Path,
+    ) -> None:
+        root = isolated_coord_dir / "confirm-worktrees"
+        stale = root / "api-issue-1-old"
+        fresh = root / "api-issue-2-new"
+        for d in (stale, fresh):
+            d.mkdir(parents=True)
+            (d / "marker").write_text("x")
+
+        now = 1_000_000.0
+        old_mtime = now - 10 * 3600.0  # 10h old
+        new_mtime = now - 1 * 3600.0  # 1h old
+        os.utime(stale, (old_mtime, old_mtime))
+        os.utime(fresh, (new_mtime, new_mtime))
+
+        result = ct.sweep_stale_confirm_worktrees(max_age_hours=6.0, now=now)
+
+        assert result["removed"] == [stale.name]
+        assert not stale.exists()
+        assert fresh.exists(), "an entry inside the age window must survive"
+
+    def test_dry_run_reports_without_deleting(
+        self, isolated_coord_dir: Path,
+    ) -> None:
+        root = isolated_coord_dir / "confirm-worktrees"
+        stale = root / "api-issue-1-old"
+        stale.mkdir(parents=True)
+        now = 1_000_000.0
+        os.utime(stale, (now - 10 * 3600.0, now - 10 * 3600.0))
+
+        result = ct.sweep_stale_confirm_worktrees(
+            max_age_hours=6.0, dry_run=True, now=now,
+        )
+
+        assert result["removed"] == [stale.name]
+        assert stale.exists(), "dry-run must not delete anything"
+
+    def test_removes_the_matching_lock_file_too(
+        self, isolated_coord_dir: Path,
+    ) -> None:
+        root = isolated_coord_dir / "confirm-worktrees"
+        stale = root / "api-issue-1-old"
+        stale.mkdir(parents=True)
+        lock = root / f"{stale.name}.lock"
+        lock.write_text("")
+        now = 1_000_000.0
+        os.utime(stale, (now - 10 * 3600.0, now - 10 * 3600.0))
+
+        ct.sweep_stale_confirm_worktrees(max_age_hours=6.0, now=now)
+
+        assert not stale.exists()
+        assert not lock.exists()
+
+    def test_lock_files_themselves_are_never_treated_as_worktrees(
+        self, isolated_coord_dir: Path,
+    ) -> None:
+        """A lock file with no matching worktree directory (the lock survived
+        a run that never got as far as creating one) must not be reported as
+        a removed *worktree* — it is a few bytes, not the disk cost #2974 is
+        about, and the next `confirm_branch` call simply reuses/recreates it.
+        """
+        root = isolated_coord_dir / "confirm-worktrees"
+        root.mkdir(parents=True)
+        lonely_lock = root / "api-issue-9-orphan.lock"
+        lonely_lock.write_text("")
+        now = 1_000_000.0
+        os.utime(lonely_lock, (now - 10 * 3600.0, now - 10 * 3600.0))
+
+        result = ct.sweep_stale_confirm_worktrees(max_age_hours=6.0, now=now)
+
+        assert result["removed"] == []
+        assert lonely_lock.exists()
+
+    def test_wired_into_the_housekeeping_sweep(
+        self, isolated_coord_dir: Path, monkeypatch,
+    ) -> None:
+        """#2974: this must ride the existing daemon/CLI housekeeping cadence
+        rather than needing a new timer of its own."""
+        from coord import housekeeping as hk
+
+        root = isolated_coord_dir / "confirm-worktrees"
+        stale = root / "api-issue-1-old"
+        stale.mkdir(parents=True)
+        now = 1_000_000.0
+        os.utime(stale, (now - 10 * 3600.0, now - 10 * 3600.0))
+
+        # DB archiving disabled — isolate this test to just the worktree sweep.
+        monkeypatch.setenv("COORD_ARCHIVE_RETENTION_DAYS", "0")
+        # Deliberately not stubbing get_connection: with archiving disabled,
+        # `hk.sweep` must return before ever touching the DB.
+        result = hk.sweep(now=now)
+
+        assert result["removed_confirm_worktrees"] == 1
+        assert not stale.exists()
 
 
 # ── locking: two overlapping notify passes must not race on one worktree ──────