fix: stop the fleet prune from destroying the worktrees it cannot remove

`git worktree remove` is sandbox-denied, and unlike `git worktree add` it
fails DESTRUCTIVELY. Removal deletes the working tree first and only then
unlinks `.git/worktrees/<name>` -- and that unlink is the denied one:

    error: failed to delete '.../worktrees/backlogger': Operation not permitted
    error: failed to delete '.git/worktrees/backlogger': Operation not permitted

By then ~393 tracked files are gone. It does not roll back. What is left is a
carcass: a registered worktree whose `git status` is a few hundred ` D` lines
and nothing else. Both prune loops read that as "uncommitted tracked changes"
and correctly refuse to auto-delete it -- so the failure makes the worktree
permanently unprunable BY ITSELF. Re-running hits the no-`--force` refusal;
`--force` re-hits the denial. `git worktree prune` performs the same unlink,
so it cannot clear the wreckage either.

13 carcasses accumulated across three sweeps (#568, #596, #597, #600, #601,
#603, #609, #612, #617, #629, #633, #634, #641) before anyone read the diff.
The last sweep reported them back as "a real backlog of stranded edits worth
reviewing" -- they were its own wreckage from the previous runs, and not one
byte of real work was in them.

Because the filename set is identical in every worktree, so is APFS's readdir
order, so every carcass loses the SAME ~393 paths (`core/`, `frontend/`,
`bess_manager/`, `pyproject.toml`, ...). Identical damage across many
worktrees is the signature, not a coincidence.

- Both prune loops now report `PRUNE` and emit one `!`-prefixed command for
  the maintainer to run unsandboxed, instead of removing anything themselves.
- Both classify a dirty set that is entirely ` D` as `CARCASS`, distinct from
  real edits. The predicate anchors on `^ D ` (unstaged deletions only), so a
  STAGED deletion still reads as intentional work.
- `local-agent-environment.md` gains the `remove`/`prune` half of the
  `.git/worktrees` denial, next to the `add` half it already documented.

`verify-sandbox.sh:88` predicted this in a parenthetical ("a stray directory
when `git worktree remove` then fails"); nothing acted on it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014FQA38o22RkHZJ4zEHDZS3

Author: johanzander

.claude/skills/implement-issue/SKILL.md

@@ -250,18 +250,35 @@ git worktree list | awk 'NR>1 {print $1}' | while read -r wt; do
   b=$(git -C "$wt" branch --show-current 2>/dev/null)
   [ -n "$b" ] || continue                                   # detached: leave alone
   echo "$merged" | grep -qx "$b" || continue                # not merged: leave alone
-  if [ -n "$(git -C "$wt" status --porcelain -uno)" ]; then # tracked edits: never auto-delete
-    echo "KEEP (uncommitted changes): $wt"; continue
+  dirty=$(git -C "$wt" status --porcelain -uno)
+  if [ -n "$dirty" ]; then                                  # tracked edits: never auto-delete
+    if [ -z "$(printf '%s\n' "$dirty" | grep -v '^ D ')" ]; then
+      echo "CARCASS (failed prune, deletions only): $wt"    # see below -- not real edits
+    else
+      echo "KEEP (uncommitted changes): $wt"
+    fi
+    continue
   fi
-  git worktree remove "$wt" && git branch -D "$b"
+  echo "PRUNE: $wt  ($b)"                                   # report; do NOT remove here
 done
 git fetch origin --prune
 ```
 
-Two guards that matter: never remove a worktree with **uncommitted tracked
+**Report the `PRUNE` list; do not act on it from here.** `git worktree remove`
+is sandbox-denied — it deletes the working tree *first* and then fails on the
+`.git/worktrees/<name>` unlink, destroying ~393 tracked files and leaving a
+carcass that no later prune can clear (`git worktree prune` is denied too).
+Emit one `!`-prefixed command covering every `PRUNE` and `CARCASS` for the
+maintainer to paste, exactly as `sweep-prs` Step 3 does. See
+`docs/agents/local-agent-environment.md`, "git worktree remove is denied too".
+
+Three guards that matter: never remove a worktree with **uncommitted tracked
 changes** — report it and let a human decide (one such worktree held a
-375-line module that existed nowhere else) — and never touch a **detached or
-locked** worktree, which is usually another agent's live session.
+375-line module that existed nowhere else); never touch a **detached or
+locked** worktree, which is usually another agent's live session; and never
+mistake a **carcass** for either. A dirty set that is *entirely* ` D` lines is
+this bug's own wreckage, not someone's work — 13 of them accumulated before
+anyone read the diff.
 
 Then `git fetch origin main` — `using-git-worktrees`' git fallback branches
 from the current local `HEAD`, not `origin/main`, so a stale local checkout
@@ -780,8 +797,11 @@ net is upstream, not this section.
    something's wrong.
 
 2. Remove the worktree — via `ExitWorktree action=remove discard_changes=true`
-   if the session is still in it, or `git worktree remove <path>` from the
-   main repo root for a `.worktrees/`-created one.
+   if the session is still in it. That is the harness doing it, so it is not
+   sandboxed and it works. If the session has already left, **hand the
+   `git worktree remove --force <path>` to the maintainer to paste with `!`**
+   rather than running it: from a sandboxed Bash it half-deletes the worktree
+   and then fails (see Step 4).
 
 3. Force-delete the local branch and prune stale remote refs:
 

.claude/skills/sweep-prs/SKILL.md

@@ -96,8 +96,18 @@ git worktree list | awk 'NR>1 {print $1}' | while read -r wt; do
   if echo "$owned" | grep -qF "$wt"; then
     echo "SKIP (live session): $b"; continue
   fi
-  if [ -n "$(git -C "$wt" status --porcelain -uno)" ]; then
-    echo "SKIP (uncommitted changes): $b"; continue
+  dirty=$(git -C "$wt" status --porcelain -uno)
+  if [ -n "$dirty" ]; then
+    # A worktree whose dirty set is ENTIRELY deletions is not someone's work
+    # in progress -- it is a carcass left by a `git worktree remove` that the
+    # sandbox killed halfway (see below). Say so, or the sweep reports its own
+    # wreckage back as a backlog of stranded edits.
+    if [ -z "$(printf '%s\n' "$dirty" | grep -v '^ D ')" ]; then
+      echo "CARCASS (failed prune, $(printf '%s\n' "$dirty" | grep -c .) deletions): $b"
+    else
+      echo "SKIP (uncommitted changes): $b"
+    fi
+    continue
   fi
   if echo "$merged" | grep -qx "$b"; then
     echo "PRUNE: $b"; continue
@@ -124,15 +134,37 @@ done
 
 ### 3. Act
 
-**`PRUNE`** — the PR merged:
+**`PRUNE`** — the PR merged. **Do not run `git worktree remove` yourself.**
+The sandbox denies the `.git/worktrees/<name>` unlink that removal ends with,
+and removal deletes the working tree *before* it gets there, so a run from
+here does not fail cleanly — it destroys ~393 tracked files and leaves a
+carcass that can never be pruned again. `git worktree prune` is denied for the
+same reason, so there is no in-sandbox recovery either. This is not a
+hypothetical: three sweeps did exactly that to 13 worktrees before it was
+diagnosed. See `docs/agents/local-agent-environment.md`, "git worktree remove
+is denied too".
+
+Collect every `PRUNE` and `CARCASS` branch instead, and emit **one** command
+for the maintainer to paste with a `!` prefix, which runs unsandboxed:
 
 ```bash
-git worktree remove "$wt" && git branch -D "$b"
+# Emit this; do not execute it.
+cd /Users/johanzander/GitHub/bess-manager && for wt in <names>; do
+  b=$(git -C ".claude/worktrees/$wt" symbolic-ref --short HEAD 2>/dev/null)
+  git worktree remove --force ".claude/worktrees/$wt" && git branch -D "$b"
+done; git worktree list | wc -l
 ```
 
-Force-delete is expected, not a warning sign: squash-merge means the
-branch's commits never become reachable from `main`, so `git branch -d`'s
-ancestry check always refuses.
+`--force` is required for a `CARCASS` (its own damage reads as uncommitted
+changes) and harmless for a clean `PRUNE`. Force-deleting the *branch* is
+expected too, and is a separate thing: squash-merge means the branch's commits
+never become reachable from `main`, so `git branch -d`'s ancestry check always
+refuses.
+
+Before listing a `CARCASS`, confirm its branch is genuinely spent — the PR
+merged, and any commits past the merged head are already in `origin/main`.
+A carcass has no recoverable working-tree content by definition (deletions
+only), but the *branch* may still hold commits that never landed.
 
 **`OPEN`** — in report-only mode (the default), print the row from the table
 below that this PR matches and take no action. In `--all` mode, or when the

docs/agents/local-agent-environment.md

@@ -326,6 +326,35 @@ primitive for writes (reads have one, which is why `allowRead` differs), so no
 - **Create worktrees with `EnterWorktree`, never `git worktree add` from Bash** —
   the harness is not sandboxed; the Bash form writes `.git/config` and
   `.git/worktrees`, both denied. *(measured)*
+- **`git worktree remove` is denied too, and unlike `add` it fails
+  DESTRUCTIVELY.** Removal deletes the working tree *first*, then unlinks
+  `.git/worktrees/<name>` — and that unlink is the denied one:
+
+  ```
+  error: failed to delete '.../.claude/worktrees/backlogger': Operation not permitted
+  error: failed to delete '.git/worktrees/backlogger': Operation not permitted
+  ```
+
+  By then it has already deleted several hundred tracked files. It does not
+  roll back. What is left is a **carcass**: a registered worktree whose
+  `git status` is a few hundred ` D` lines and nothing else. That reads as
+  "uncommitted changes" to every later prune, so the worktree is now
+  permanently unprunable *by the failure itself* — re-running the removal
+  hits the no-`--force` refusal instead, and `--force` re-hits the denial.
+
+  Because the filename set is identical in every worktree, so is APFS's
+  readdir order, so every carcass loses the **same** ~393 paths (`core/`,
+  `frontend/`, `bess_manager/`, `pyproject.toml`, `Dockerfile`, …). Identical
+  damage across many worktrees is the signature — do not read it as a
+  coincidence or as real edits. *(measured — 13 carcasses accumulated over
+  three sweeps before anyone noticed)*
+
+  `git worktree prune` performs the same `.git/worktrees/<name>` unlink and is
+  denied for the same reason, so it cannot clear the wreckage either. **There
+  is no in-sandbox path to removing a worktree.** It has to run unsandboxed —
+  the maintainer pastes it with a `!` prefix, or the harness does it via
+  `ExitWorktree` (which only ever covers the session's own `EnterWorktree`
+  worktree, not a pre-existing one).
 - **`git checkout -b <branch> origin/<branch>` fails**, because recording the
   upstream writes `.git/config` — and it fails *after* creating the branch, so
   the branch exists while the command reports an error and leaves you on the