## Summary
- Centralize fail-closed cleanliness validation in the shared
`removeWorktree` path for every automatic cleanup reason: pool prune,
idle/cap sweeps, self-healing reclaim/conflict/stale-branch cleanup,
merger cleanup, and step-session cleanup.
- Preserve tracked, untracked, ignored, or unverifiable checkout
content; native Git revalidates without `--force` at the deletion
boundary and never falls through to recursive deletion for defensive
callers.
- Keep explicit destructive teardown reasons on their legacy forced
path.
- Replace recursive removal of unregistered worktree directories with
non-recursive `rmdir`.
- Preserve `.env` when cleanup is refused; prune only metadata for
defensive registrations whose path already disappeared.
- Use argv-based `execFileSync` in the real-worktree test fixture and
provide labeled release metadata.
## Why this replaces #3461#3461 accumulated quarantine, recovery, generated-residue
classification, and race-repair machinery while addressing successive
bot reviews. This replacement keeps one essential invariant in one
shared path:
> Automatic cleanup removes a worktree only when cleanliness can be
proven; otherwise it preserves the checkout.
### Original-review requirements retained
- Real Git regressions exercise dirty, clean, ignored `dist/manual.txt`,
probe-failure, missing-path, and backend-routing paths.
- Every automatic reclaim reason uses the same defensive guard.
- Failed status probes and dangling/unregistered content fail closed.
- Native defensive removal never uses the recursive fallback.
- Worktrunk receives `--force` only from explicit caller intent.
- A refused reclaim does not pre-delete the managed environment file.
### Deliberate simplifications
- No pathname heuristics for `node_modules`, `dist`, or build output.
- No quarantine, recovery directory, pointer stash, or restoration
lifecycle.
- No destructive reclamation of corrupt/dangling metadata when safety
cannot be proven.
These omissions prefer a recoverable disk leak over possible user-data
loss. Add targeted reclamation only if operational evidence shows the
conservative behavior is insufficient.
## Verification
- `worktree-backend.test.ts`: 64 passed
- `worktree-defensive-removal-preservation.real-git.test.ts`: 13 passed
- `self-healing-tempdir-sweep.test.ts`: 26 passed
- `worktree-pool.test.ts`: 60 passed
- `worktree-pool-secrets-env-cleanup.test.ts`: 2 passed
- `worktrunk-worktree-removal.test.ts`: 2 passed
- `worktree-acquisition.test.ts`: 47 passed
- Engine typecheck passed
- ESLint passed
- Changeset status passed
- `git diff --check` passed
## Scope
Worktree cleanup safety only.
Supersedes #3461.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Worktree cleanup now preserves directories containing uncommitted,
ignored, unverifiable, or user-created files.
* Cleanup fails safely when worktree status cannot be verified.
* Clean worktrees continue to be removed normally, while selected forced
teardown scenarios retain their existing behavior.
* Dangling or orphaned worktree directories are preserved instead of
being deleted unexpectedly.
* **Tests**
* Added coverage for defensive removal, orphan preservation, and clean
worktree pruning.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
f082398be1