fix(cb-7suc): the worktree pruner removes finished trees in a repo with submodules or squash merges

[rmstdope]

Bead cb-7suc (P0 bug). Seen on neser: 80 trees, 442 GB, the pruner removing nothing.

Both faults live in scripts/worktree-safety.sh, which prune-worktrees.sh and the fleet view's tidy (release-bead --worktree) share, so one fix covers both callers.

• Squash merges. cerebro_worktree_landed now asks, after ancestry and before merged_check, whether a commit on origin/main names the tree's bead, through scripts/bead-delivery.sh, the same test that calls a bead delivered. It needs no network, so a gh that cannot answer no longer keeps a delivered tree for ever. The tree's name is tried as it stands, then less a -mockup or -2 suffix, since a bead id ends in -<word> itself.
• Submodules. git worktree remove refuses any tree containing a populated submodule. cerebro_worktree_remove now, on a refusal, deletes a tree that carries .gitmodules and is not locked directly and prunes the registration; the caller's clean-and-landed tests already hold, and a locked tree is still refused.

Tests first in tests/worktree-safety.sh: a squash-merged bead's tree is landed with gh answering no, the -2 and -mockup names are judged by their bead, an undelivered bead is still kept, and a tree with an initialised submodule that git refuses is removed with its branch and registration gone. Every bash suite green. docs/agent-workflow.md's pruner paragraph says what the pruner now does.

🤖 Generated with Claude Code

https://claude.ai/code/session_01GKiLr59caM9f6DxkrsDYR8

[Copilot]

Copilot review overview

🔵 Needs a closer look

It performs destructive rm -rf removals and broadens the "landed" heuristic in shared, all-consumer worktree-janitor logic, which warrants final human review.

Review effort: Balanced
Findings: 1

Open (1)

• Wrong numeric-suffix stripping for assign-bead worktree names · New

What changed in this PR

This PR fixes bead cb-7suc (P0): the shared worktree-pruning safety logic in scripts/worktree-safety.sh (used by both prune-worktrees.sh and release-bead --worktree) was leaving finished worktrees behind on consumers that squash-merge or use submodules, causing large disk buildup (reported: 80 trees, 442 GB). It addresses two independent faults with one change to the shared file, so both callers benefit.

Changes:

• Adds a network-free "delivered" test: cerebro_worktree_landed now also treats a tree as landed when a commit on origin/<base> names the tree's bead (via scripts/bead-delivery.sh), mapping the directory name to candidate bead ids (raw, then minus a -mockup or numeric suffix).
• Makes cerebro_worktree_remove delete a tree that git worktree remove refuses solely because it contains a populated submodule (guarded by a new cerebro_worktree_locked check and the presence of .gitmodules), then prunes the registration.
• Adds tests for squash-merge landing, suffix-name mapping, an undelivered bead still kept, and submodule-tree removal; updates the pruner paragraph in docs/agent-workflow.md.

File	Description
scripts/​worktree-safety.sh	New cerebro_worktree_bead/cerebro_worktree_delivered/cerebro_worktree_locked helpers; landed gains the delivery-commit test; remove deletes submodule-containing trees git refuses.
tests/​worktree-safety.sh	Adds coverage for squash-merged/suffixed/undelivered trees and for removing a clean, landed tree containing an initialised submodule.
docs/​agent-workflow.md	Rewrites the pruner paragraph to describe the bead-name delivery check and direct submodule-tree removal.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[rmstdope]

Right: the directory is always the bead, the suffix goes on the branch. The numeric case is dropped; the candidates are the name as it stands, less -mockup, or less -retro (the verifier's retrospective tree). The test now asserts sq-1 yields only itself.