refactor: raise the worktree seam to one lifecycle module; age-guard orphan cleanup

[Tryanks]

Architecture round, candidate C1 — the hottest churn area in the repo (both recent Windows CI breakages were path-identity facts leaking across this seam).

Problem — the worktree cluster in git.rs was deep but its interface sat below the lifecycle: every caller derived and preserved four correlated identities (root, path, branch, base) and re-read the actual branch afterwards. Draft creation and orchestrate dispatch each assembled that independently.

Change

• New services/worktree.rs: provision(root, session_id) -> ProvisionedWorktree{path, branch, seed_summary} owns root validation, base resolution, path/branch derivation + collision suffixing, git worktree add, .worktreeinclude seeding, and rollback; merge_back / remove / cleanup_orphans move with unchanged semantics; porcelain parsing + canonical path identity (incl. macOS /var ↔ /private/var) exist exactly once.
• git.rs: 1,883 → 912 lines (keeps diff/branch/status plumbing). sessions.rs worktree prep 82→67 lines; orchestrate resolver 48→28 — runtime keeps only policy (opt-in, fallback, warnings).
• Bug fix (found via concurrent test runs): orphan cleanup deleted other processes' live worktrees — any entry whose session id isn't in this store looked orphaned. Cleanup now applies a documented ORPHAN_MIN_AGE (1 h) presumption-of-life to fresh entries (decision is a deterministic seam taking now/threshold — the test ages entries without sleeping), and TCODE_WORKTREES_DIR gives tests isolated roots so parallel runs never touch ~/.tcode/worktrees.

Wins — leverage: one interface, both call sites; locality: identity bugs concentrate in one module; dispatch prep became deterministic and directly testable; a cross-process data-loss class is closed.

Tests: all worktree lifecycle tests migrated to the module; new caller-free provision-identity test; fresh-preserved/old-removed age-guard test; dispatch regression on an isolated root. Workspace: 853 passed.

Gates: fmt / clippy -D warnings / full workspace tests — green locally.

🤖 Generated with Claude Code

[Tryanks]

Architecture round, candidate C1 — the hottest churn area in the repo (both recent Windows CI breakages were path-identity facts leaking across this seam).

Problem — the worktree cluster in git.rs was deep but its interface sat below the lifecycle: every caller derived and preserved four correlated identities (root, path, branch, base) and re-read the actual branch afterwards. Draft creation and orchestrate dispatch each assembled that independently.

Change

• New services/worktree.rs: provision(root, session_id) -> ProvisionedWorktree{path, branch, seed_summary} owns root validation, base resolution, path/branch derivation + collision suffixing, git worktree add, .worktreeinclude seeding, and rollback; merge_back / remove / cleanup_orphans move with unchanged semantics; porcelain parsing + canonical path identity (incl. macOS /var ↔ /private/var) exist exactly once.
• git.rs: 1,883 → 912 lines (keeps diff/branch/status plumbing). sessions.rs worktree prep 82→67 lines; orchestrate resolver 48→28 — runtime keeps only policy (opt-in, fallback, warnings).
• Bug fix (found via concurrent test runs): orphan cleanup deleted other processes' live worktrees — any entry whose session id isn't in this store looked orphaned. Cleanup now applies a documented ORPHAN_MIN_AGE (1 h) presumption-of-life to fresh entries (decision is a deterministic seam taking now/threshold — the test ages entries without sleeping), and TCODE_WORKTREES_DIR gives tests isolated roots so parallel runs never touch ~/.tcode/worktrees.

Wins — leverage: one interface, both call sites; locality: identity bugs concentrate in one module; dispatch prep became deterministic and directly testable; a cross-process data-loss class is closed.

Tests: all worktree lifecycle tests migrated to the module; new caller-free provision-identity test; fresh-preserved/old-removed age-guard test; dispatch regression on an isolated root. Workspace: 853 passed.

Gates: fmt / clippy -D warnings / full workspace tests — green locally.

🤖 Generated with Claude Code

[Tryanks]

Architecture round, candidate C1 — the hottest churn area in the repo (both recent Windows CI breakages were path-identity facts leaking across this seam).

Problem — the worktree cluster in git.rs was deep but its interface sat below the lifecycle: every caller derived and preserved four correlated identities (root, path, branch, base) and re-read the actual branch afterwards. Draft creation and orchestrate dispatch each assembled that independently.

Change

• New services/worktree.rs: provision(root, session_id) -> ProvisionedWorktree{path, branch, seed_summary} owns root validation, base resolution, path/branch derivation + collision suffixing, git worktree add, .worktreeinclude seeding, and rollback; merge_back / remove / cleanup_orphans move with unchanged semantics; porcelain parsing + canonical path identity (incl. macOS /var ↔ /private/var) exist exactly once.
• git.rs: 1,883 → 912 lines (keeps diff/branch/status plumbing). sessions.rs worktree prep 82→67 lines; orchestrate resolver 48→28 — runtime keeps only policy (opt-in, fallback, warnings).
• Bug fix (found via concurrent test runs): orphan cleanup deleted other processes' live worktrees — any entry whose session id isn't in this store looked orphaned. Cleanup now applies a documented ORPHAN_MIN_AGE (1 h) presumption-of-life to fresh entries (decision is a deterministic seam taking now/threshold — the test ages entries without sleeping), and TCODE_WORKTREES_DIR gives tests isolated roots so parallel runs never touch ~/.tcode/worktrees.

Wins — leverage: one interface, both call sites; locality: identity bugs concentrate in one module; dispatch prep became deterministic and directly testable; a cross-process data-loss class is closed.

Tests: all worktree lifecycle tests migrated to the module; new caller-free provision-identity test; fresh-preserved/old-removed age-guard test; dispatch regression on an isolated root. Workspace: 853 passed.

Gates: fmt / clippy -D warnings / full workspace tests — green locally.

🤖 Generated with Claude Code

[Tryanks]

Architecture round, candidate C1 — the hottest churn area in the repo (both recent Windows CI breakages were path-identity facts leaking across this seam).

Problem — the worktree cluster in git.rs was deep but its interface sat below the lifecycle: every caller derived and preserved four correlated identities (root, path, branch, base) and re-read the actual branch afterwards. Draft creation and orchestrate dispatch each assembled that independently.

Change

• New services/worktree.rs: provision(root, session_id) -> ProvisionedWorktree{path, branch, seed_summary} owns root validation, base resolution, path/branch derivation + collision suffixing, git worktree add, .worktreeinclude seeding, and rollback; merge_back / remove / cleanup_orphans move with unchanged semantics; porcelain parsing + canonical path identity (incl. macOS /var ↔ /private/var) exist exactly once.
• git.rs: 1,883 → 912 lines (keeps diff/branch/status plumbing). sessions.rs worktree prep 82→67 lines; orchestrate resolver 48→28 — runtime keeps only policy (opt-in, fallback, warnings).
• Bug fix (found via concurrent test runs): orphan cleanup deleted other processes' live worktrees — any entry whose session id isn't in this store looked orphaned. Cleanup now applies a documented ORPHAN_MIN_AGE (1 h) presumption-of-life to fresh entries (decision is a deterministic seam taking now/threshold — the test ages entries without sleeping), and TCODE_WORKTREES_DIR gives tests isolated roots so parallel runs never touch ~/.tcode/worktrees.

Wins — leverage: one interface, both call sites; locality: identity bugs concentrate in one module; dispatch prep became deterministic and directly testable; a cross-process data-loss class is closed.

Tests: all worktree lifecycle tests migrated to the module; new caller-free provision-identity test; fresh-preserved/old-removed age-guard test; dispatch regression on an isolated root. Workspace: 853 passed.

Gates: fmt / clippy -D warnings / full workspace tests — green locally.

🤖 Generated with Claude Code

[Tryanks]

Architecture round, candidate C1 — the hottest churn area in the repo (both recent Windows CI breakages were path-identity facts leaking across this seam).

Problem — the worktree cluster in git.rs was deep but its interface sat below the lifecycle: every caller derived and preserved four correlated identities (root, path, branch, base) and re-read the actual branch afterwards. Draft creation and orchestrate dispatch each assembled that independently.

Change

• New services/worktree.rs: provision(root, session_id) -> ProvisionedWorktree{path, branch, seed_summary} owns root validation, base resolution, path/branch derivation + collision suffixing, git worktree add, .worktreeinclude seeding, and rollback; merge_back / remove / cleanup_orphans move with unchanged semantics; porcelain parsing + canonical path identity (incl. macOS /var ↔ /private/var) exist exactly once.
• git.rs: 1,883 → 912 lines (keeps diff/branch/status plumbing). sessions.rs worktree prep 82→67 lines; orchestrate resolver 48→28 — runtime keeps only policy (opt-in, fallback, warnings).
• Bug fix (found via concurrent test runs): orphan cleanup deleted other processes' live worktrees — any entry whose session id isn't in this store looked orphaned. Cleanup now applies a documented ORPHAN_MIN_AGE (1 h) presumption-of-life to fresh entries (decision is a deterministic seam taking now/threshold — the test ages entries without sleeping), and TCODE_WORKTREES_DIR gives tests isolated roots so parallel runs never touch ~/.tcode/worktrees.

Wins — leverage: one interface, both call sites; locality: identity bugs concentrate in one module; dispatch prep became deterministic and directly testable; a cross-process data-loss class is closed.

Tests: all worktree lifecycle tests migrated to the module; new caller-free provision-identity test; fresh-preserved/old-removed age-guard test; dispatch regression on an isolated root. Workspace: 853 passed.

Gates: fmt / clippy -D warnings / full workspace tests — green locally.

🤖 Generated with Claude Code

[Tryanks]

Architecture round, candidate C1 — the hottest churn area in the repo (both recent Windows CI breakages were path-identity facts leaking across this seam).

Problem — the worktree cluster in git.rs was deep but its interface sat below the lifecycle: every caller derived and preserved four correlated identities (root, path, branch, base) and re-read the actual branch afterwards. Draft creation and orchestrate dispatch each assembled that independently.

Change

• New services/worktree.rs: provision(root, session_id) -> ProvisionedWorktree{path, branch, seed_summary} owns root validation, base resolution, path/branch derivation + collision suffixing, git worktree add, .worktreeinclude seeding, and rollback; merge_back / remove / cleanup_orphans move with unchanged semantics; porcelain parsing + canonical path identity (incl. macOS /var ↔ /private/var) exist exactly once.
• git.rs: 1,883 → 912 lines (keeps diff/branch/status plumbing). sessions.rs worktree prep 82→67 lines; orchestrate resolver 48→28 — runtime keeps only policy (opt-in, fallback, warnings).
• Bug fix (found via concurrent test runs): orphan cleanup deleted other processes' live worktrees — any entry whose session id isn't in this store looked orphaned. Cleanup now applies a documented ORPHAN_MIN_AGE (1 h) presumption-of-life to fresh entries (decision is a deterministic seam taking now/threshold — the test ages entries without sleeping), and TCODE_WORKTREES_DIR gives tests isolated roots so parallel runs never touch ~/.tcode/worktrees.

Wins — leverage: one interface, both call sites; locality: identity bugs concentrate in one module; dispatch prep became deterministic and directly testable; a cross-process data-loss class is closed.

Tests: all worktree lifecycle tests migrated to the module; new caller-free provision-identity test; fresh-preserved/old-removed age-guard test; dispatch regression on an isolated root. Workspace: 853 passed.

Gates: fmt / clippy -D warnings / full workspace tests — green locally.

🤖 Generated with Claude Code

[Tryanks]

Architecture round, candidate C1 — the hottest churn area in the repo (both recent Windows CI breakages were path-identity facts leaking across this seam).

Problem — the worktree cluster in git.rs was deep but its interface sat below the lifecycle: every caller derived and preserved four correlated identities (root, path, branch, base) and re-read the actual branch afterwards. Draft creation and orchestrate dispatch each assembled that independently.

Change

• New services/worktree.rs: provision(root, session_id) -> ProvisionedWorktree{path, branch, seed_summary} owns root validation, base resolution, path/branch derivation + collision suffixing, git worktree add, .worktreeinclude seeding, and rollback; merge_back / remove / cleanup_orphans move with unchanged semantics; porcelain parsing + canonical path identity (incl. macOS /var ↔ /private/var) exist exactly once.
• git.rs: 1,883 → 912 lines (keeps diff/branch/status plumbing). sessions.rs worktree prep 82→67 lines; orchestrate resolver 48→28 — runtime keeps only policy (opt-in, fallback, warnings).
• Bug fix (found via concurrent test runs): orphan cleanup deleted other processes' live worktrees — any entry whose session id isn't in this store looked orphaned. Cleanup now applies a documented ORPHAN_MIN_AGE (1 h) presumption-of-life to fresh entries (decision is a deterministic seam taking now/threshold — the test ages entries without sleeping), and TCODE_WORKTREES_DIR gives tests isolated roots so parallel runs never touch ~/.tcode/worktrees.

Wins — leverage: one interface, both call sites; locality: identity bugs concentrate in one module; dispatch prep became deterministic and directly testable; a cross-process data-loss class is closed.

Tests: all worktree lifecycle tests migrated to the module; new caller-free provision-identity test; fresh-preserved/old-removed age-guard test; dispatch regression on an isolated root. Workspace: 853 passed.

Gates: fmt / clippy -D warnings / full workspace tests — green locally.

🤖 Generated with Claude Code

[Tryanks]

Architecture round, candidate C1 — the hottest churn area in the repo (both recent Windows CI breakages were path-identity facts leaking across this seam).

Problem — the worktree cluster in git.rs was deep but its interface sat below the lifecycle: every caller derived and preserved four correlated identities (root, path, branch, base) and re-read the actual branch afterwards. Draft creation and orchestrate dispatch each assembled that independently.

Change

• New services/worktree.rs: provision(root, session_id) -> ProvisionedWorktree{path, branch, seed_summary} owns root validation, base resolution, path/branch derivation + collision suffixing, git worktree add, .worktreeinclude seeding, and rollback; merge_back / remove / cleanup_orphans move with unchanged semantics; porcelain parsing + canonical path identity (incl. macOS /var ↔ /private/var) exist exactly once.
• git.rs: 1,883 → 912 lines (keeps diff/branch/status plumbing). sessions.rs worktree prep 82→67 lines; orchestrate resolver 48→28 — runtime keeps only policy (opt-in, fallback, warnings).
• Bug fix (found via concurrent test runs): orphan cleanup deleted other processes' live worktrees — any entry whose session id isn't in this store looked orphaned. Cleanup now applies a documented ORPHAN_MIN_AGE (1 h) presumption-of-life to fresh entries (decision is a deterministic seam taking now/threshold — the test ages entries without sleeping), and TCODE_WORKTREES_DIR gives tests isolated roots so parallel runs never touch ~/.tcode/worktrees.

Wins — leverage: one interface, both call sites; locality: identity bugs concentrate in one module; dispatch prep became deterministic and directly testable; a cross-process data-loss class is closed.

Tests: all worktree lifecycle tests migrated to the module; new caller-free provision-identity test; fresh-preserved/old-removed age-guard test; dispatch regression on an isolated root. Workspace: 853 passed.

Gates: fmt / clippy -D warnings / full workspace tests — green locally.

🤖 Generated with Claude Code