From 5036c4fae7188a56a20932bf1cd74b71288393c1 Mon Sep 17 00:00:00 2001
From: Lexus2016 <lexus@cdzv.com>
Date: Sat, 3 Oct 2026 13:00:42 +0200
Subject: [PATCH 1/2] fix(sessions): expiry goes through the one session
 teardown, and stops leaking worktrees

SESSION_TTL_DAYS ran a bare `DELETE FROM sessions`. Every expired session's git
worktree and ccs/session-* branch stayed in data/worktrees with no row left to own
it, and its queued_messages (no FK) were restored at every boot. Reported by a
third-party Docker image that had to prune the trees in its own entrypoint.

The three doors that delete sessions (DELETE, bulk delete, expiry) each carried
their own copy, and they had drifted: the single delete never killed the terminal
pane either. teardownSessions(rows, { deleteTasks }) is now the only code that
deletes a session; sessionHasUnmergedWork() is the one gate the doors ask first.

Expiry is unattended, so it skips a running session, a live terminal pane and a
worktree holding unmerged or uncommitted work (an unreadable tree counts as work),
and keeps the chat's Kanban cards (deleteTasks: false; the FK unlinks them).

WM.pruneOrphanWorktrees() reconciles the trees earlier versions leaked: only trees
no sessions/tasks/task_chains row owns, older than an hour, clean and merged, and
removed without --force. It checks for data/worktrees before probing git, so an
install with no worktrees spawns nothing at boot.

test/session-expiry.test.js boots a real server twice against one APP_DIR and ages
sessions in SQLite between the boots; reverting expiry to the bare DELETE fails 6
of its 17 checks.
---
 CLAUDE.md                      |  34 ++++-
 package.json                   |   2 +-
 server.js                      | 263 +++++++++++++++++++--------------
 test/queue-persistence.test.js |  14 +-
 test/session-expiry.test.js    | 163 ++++++++++++++++++++
 test/worktree-manager.test.js  |  73 +++++++--
 worktree-manager.js            |  57 ++++++-
 7 files changed, 470 insertions(+), 136 deletions(-)
 create mode 100644 test/session-expiry.test.js

diff --git a/CLAUDE.md b/CLAUDE.md
index e48cd05d..8a7c6632 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -31,7 +31,7 @@ npm run release <patch|minor|major|x.y.z>  # bump, commit, tag, push → GitHub
 npm run release:mac                         # on the Mac with the cert: build, notarize, verify, upload, bump the cask
 ```
 
-No linting and no build step configured. `npm test` chains 87 test files under `test/`: 19 DOM-less render/UI-logic tests (`test/render/*.test.mjs`, run through `node --test`) plus 68 plain-`node` suites in `test/` covering the overload detector, env load order, multi-agent results, terminals, bots, telegram, updates, kanban scheduling, the Kanban card's run-settings badges (`kanban-run-badges.test.js` pins the card's model/effort/engine chain against the one `startTask` actually resolves — the two live in different files and the card silently lies when they drift), the board-only `create_task` status (`task-backlog.test.js`), the external agents' model/effort catalogs (`agent-catalog.test.js` — #123: the Settings form and `POST /api/external-agents` both carry them, and the browser's comma parser is RUN against the server sanitiser so the two cannot drift), the Kanban group form (`kanban-group-button.test.js` RUNS the real `buildChainForm` in a `vm` context so a stray free variable in its template throws there instead of silently killing the modal — see #115 — and parses every inline `<script>` of the board), the on-screen terminal keys (`terminal-keys.test.js` runs the real #117 block from `index.html` in a `vm`: the Esc/Tab/arrow bytes including SS3 under DECCKM, a ONE-SHOT Ctrl that applies to the next key from either the row or the phone keyboard, and that a tap never takes focus — a focused button closes Gboard on every key), i18n completeness, the config precedence resolver plus its secret masking, usage-limit detection, authentication-failure classification (`auth-errors.test.js`, which pins that the detector runs BEFORE the auto-continue in all three agent loops — a reorder there silently restores #86), the filesystem path guard (including the SVG sandbox header and the symlink rule on the `@`-mention search endpoints) plus the tunnel-blocks-terminal rule, WS session re-subscription, the SSH remote CLI-session import, the live engine pane / interactive-prompt watchdog, the subscription engine's spawn command (`engine-spawn-cmd.test.js` starts a real tmux session with a 40 KB system prompt and asserts the child's argv byte-identical — the tmux command may never carry the prompt inline, see #96), the cross-project global workspace aggregation, the add-project-from-Git-URL endpoint (`git-clone.test.js` boots a server whose `PATH` holds a fake `git` and pins the transport allowlist, the `--` argv shape and the failure cleanup — see #94), the rule that an SSH credential never leaves the server process, the macOS release config (`mac-signing.test.js` — the Apple Events entitlement, arm64-only targets, and that CI never builds macOS) and the local mac release (`release-mac.test.js` — nothing is uploaded until spctl says `Notarized Developer ID` about the app and the app inside the dmg), the Windows command-quoting oracle, the auth token lifecycle, the multi-agent dependency scheduler (waves, plan sanitising, and the rule that a failure warning must survive dep-context truncation), the SSH stream parser's three guards, the SSH run's termination guarantee (`ssh-termination.test.js` drives `ClaudeSSH.send()` through a fake ssh2 `Client` in `require.cache` and asserts `onDone` fires EXACTLY once on every ending — a missed one hangs the chat forever, a doubled one re-emits stderr) and the recovery contract of "Restart Session" (`session-restart.test.js` boots a real server against a fake `claude` that never exits, then pins that a restart ABORTS that turn and releases the session instead of refusing), the remote non-interactive shell environment (`remote-env.test.js`, which runs the generated prelude through real `bash -lc`: it must parse, print nothing on stdout, and never end on a false test — the caller chains `&& claude …` behind it), the remote CLI-list framing parser, the bot inbox's SQL seam (`bot-inbox.test.js` pins that `from_bot AS "from"` keeps the exact key `planInboxDelivery` reads — rename one without the other and every letter is silently retired as malformed), the one-time config/.env migration onto CCS_CONFIG_PATH and the mid-task clarification delivery contract on the subscription engine (`interrupt-delivery.test.js` — pins that the tmux injection block sits BEFORE the poll loop's completion `break`, that draining does not imply delivery, that a failed paste is re-queued and warns non-terminally, and that the task runner passes the same callbacks the chat path does), the CLAUDE.md / AGENTS.md discovery rules (`agents-md.test.js`, which also pins that AGENTS.md reaches the subprocess as `--append-system-prompt` and never as `--system-prompt`), and the remote file browser's three guard layers (`remote-files.test.js` runs the generated POSIX script through a real `/bin/sh` against a temp tree that contains symlinks OUT of the project; `remote-files-api.test.js` boots a server against a fake remote via `CCS_REMOTE_EXEC_HOOK` and drives `/api/files` the way the SPA does), the editor deep links (`editor-links.test.js` pins the two URI shapes literally — the browser link puts `vscode-remote` in the AUTHORITY and the CLI argument puts it in the SCHEME, and collapsing the two silently breaks one path; `editor-open-api.test.js` boots a real server with `PATH` pointed at an EMPTY directory, which both makes the `opened:'client'` fallback deterministic and guarantees the suite never launches an editor window on a developer's desktop), and the new-chat defaults chain (`chat-defaults.test.js` pins the pure resolver — the built-ins are asserted to be exactly what the SPA hardcoded before #58, and the choice lists to be exactly the toolbar's `data-v` sets and `MODEL_MAP`'s aliases; `chat-defaults-api.test.js` boots a real server in a throwaway `APP_DIR` and pins that a project writes back a SPARSE override object — a five-key snapshot passes every other assertion in that file and still breaks the feature). On the render side, `tables.test.mjs` also pins the ReDoS bound in renderMd step 3.4, `xss.test.mjs` runs 24 adversarial payloads end-to-end, and `forged-tokens.test.mjs` covers the case where user text contains the renderer's own placeholder control bytes, and `pane-font.test.mjs` pins the clamp DIRECTION of `_fitEnginePaneFont` (a wide engine pane may only shrink; a narrow split pane must be allowed to grow). `script-scope.test.mjs` pins which `<script>` block a helper is declared in — declarations hoist only within their own block, so a helper used by `loadSess()` must not live in the terminal block at the bottom of the file. Note the glob: a file under `test/render/` whose name does not end in `.test.mjs` is NEVER run — `_load.selftest.mjs` sat there unexecuted until it was renamed to `loader.test.mjs`. It runs serially and aborts on the first failing file. `.github/workflows/ci.yml` runs it on every push and PR to `main` (tmux installed, so the five tmux-dependent suites do not self-skip).
+No linting and no build step configured. `npm test` chains 88 test files under `test/`: 19 DOM-less render/UI-logic tests (`test/render/*.test.mjs`, run through `node --test`) plus 69 plain-`node` suites in `test/` covering the overload detector, env load order, multi-agent results, terminals, bots, telegram, updates, kanban scheduling, the Kanban card's run-settings badges (`kanban-run-badges.test.js` pins the card's model/effort/engine chain against the one `startTask` actually resolves — the two live in different files and the card silently lies when they drift), the board-only `create_task` status (`task-backlog.test.js`), session expiry (`session-expiry.test.js` boots a real server TWICE against one `APP_DIR`, ages sessions in SQLite between the boots, and pins that expiry removes the worktree, branch and queued messages of a clean session while keeping one with uncommitted work, its Kanban cards, and an orphan tree younger than an hour), the external agents' model/effort catalogs (`agent-catalog.test.js` — #123: the Settings form and `POST /api/external-agents` both carry them, and the browser's comma parser is RUN against the server sanitiser so the two cannot drift), the Kanban group form (`kanban-group-button.test.js` RUNS the real `buildChainForm` in a `vm` context so a stray free variable in its template throws there instead of silently killing the modal — see #115 — and parses every inline `<script>` of the board), the on-screen terminal keys (`terminal-keys.test.js` runs the real #117 block from `index.html` in a `vm`: the Esc/Tab/arrow bytes including SS3 under DECCKM, a ONE-SHOT Ctrl that applies to the next key from either the row or the phone keyboard, and that a tap never takes focus — a focused button closes Gboard on every key), i18n completeness, the config precedence resolver plus its secret masking, usage-limit detection, authentication-failure classification (`auth-errors.test.js`, which pins that the detector runs BEFORE the auto-continue in all three agent loops — a reorder there silently restores #86), the filesystem path guard (including the SVG sandbox header and the symlink rule on the `@`-mention search endpoints) plus the tunnel-blocks-terminal rule, WS session re-subscription, the SSH remote CLI-session import, the live engine pane / interactive-prompt watchdog, the subscription engine's spawn command (`engine-spawn-cmd.test.js` starts a real tmux session with a 40 KB system prompt and asserts the child's argv byte-identical — the tmux command may never carry the prompt inline, see #96), the cross-project global workspace aggregation, the add-project-from-Git-URL endpoint (`git-clone.test.js` boots a server whose `PATH` holds a fake `git` and pins the transport allowlist, the `--` argv shape and the failure cleanup — see #94), the rule that an SSH credential never leaves the server process, the macOS release config (`mac-signing.test.js` — the Apple Events entitlement, arm64-only targets, and that CI never builds macOS) and the local mac release (`release-mac.test.js` — nothing is uploaded until spctl says `Notarized Developer ID` about the app and the app inside the dmg), the Windows command-quoting oracle, the auth token lifecycle, the multi-agent dependency scheduler (waves, plan sanitising, and the rule that a failure warning must survive dep-context truncation), the SSH stream parser's three guards, the SSH run's termination guarantee (`ssh-termination.test.js` drives `ClaudeSSH.send()` through a fake ssh2 `Client` in `require.cache` and asserts `onDone` fires EXACTLY once on every ending — a missed one hangs the chat forever, a doubled one re-emits stderr) and the recovery contract of "Restart Session" (`session-restart.test.js` boots a real server against a fake `claude` that never exits, then pins that a restart ABORTS that turn and releases the session instead of refusing), the remote non-interactive shell environment (`remote-env.test.js`, which runs the generated prelude through real `bash -lc`: it must parse, print nothing on stdout, and never end on a false test — the caller chains `&& claude …` behind it), the remote CLI-list framing parser, the bot inbox's SQL seam (`bot-inbox.test.js` pins that `from_bot AS "from"` keeps the exact key `planInboxDelivery` reads — rename one without the other and every letter is silently retired as malformed), the one-time config/.env migration onto CCS_CONFIG_PATH and the mid-task clarification delivery contract on the subscription engine (`interrupt-delivery.test.js` — pins that the tmux injection block sits BEFORE the poll loop's completion `break`, that draining does not imply delivery, that a failed paste is re-queued and warns non-terminally, and that the task runner passes the same callbacks the chat path does), the CLAUDE.md / AGENTS.md discovery rules (`agents-md.test.js`, which also pins that AGENTS.md reaches the subprocess as `--append-system-prompt` and never as `--system-prompt`), and the remote file browser's three guard layers (`remote-files.test.js` runs the generated POSIX script through a real `/bin/sh` against a temp tree that contains symlinks OUT of the project; `remote-files-api.test.js` boots a server against a fake remote via `CCS_REMOTE_EXEC_HOOK` and drives `/api/files` the way the SPA does), the editor deep links (`editor-links.test.js` pins the two URI shapes literally — the browser link puts `vscode-remote` in the AUTHORITY and the CLI argument puts it in the SCHEME, and collapsing the two silently breaks one path; `editor-open-api.test.js` boots a real server with `PATH` pointed at an EMPTY directory, which both makes the `opened:'client'` fallback deterministic and guarantees the suite never launches an editor window on a developer's desktop), and the new-chat defaults chain (`chat-defaults.test.js` pins the pure resolver — the built-ins are asserted to be exactly what the SPA hardcoded before #58, and the choice lists to be exactly the toolbar's `data-v` sets and `MODEL_MAP`'s aliases; `chat-defaults-api.test.js` boots a real server in a throwaway `APP_DIR` and pins that a project writes back a SPARSE override object — a five-key snapshot passes every other assertion in that file and still breaks the feature). On the render side, `tables.test.mjs` also pins the ReDoS bound in renderMd step 3.4, `xss.test.mjs` runs 24 adversarial payloads end-to-end, and `forged-tokens.test.mjs` covers the case where user text contains the renderer's own placeholder control bytes, and `pane-font.test.mjs` pins the clamp DIRECTION of `_fitEnginePaneFont` (a wide engine pane may only shrink; a narrow split pane must be allowed to grow). `script-scope.test.mjs` pins which `<script>` block a helper is declared in — declarations hoist only within their own block, so a helper used by `loadSess()` must not live in the terminal block at the bottom of the file. Note the glob: a file under `test/render/` whose name does not end in `.test.mjs` is NEVER run — `_load.selftest.mjs` sat there unexecuted until it was renamed to `loader.test.mjs`. It runs serially and aborts on the first failing file. `.github/workflows/ci.yml` runs it on every push and PR to `main` (tmux installed, so the five tmux-dependent suites do not self-skip).
 
 ## Architecture
 
@@ -992,6 +992,36 @@ Four reports that all reduce to "the UI moved or stopped listening". Pinned by
   key, and the text and the CR go in ONE frame so a prompt that echoes and submits on
   the same tick cannot split them.
 
+### One session teardown (session expiry leaked worktrees)
+
+Three doors delete sessions — `DELETE /api/sessions/:id`, bulk delete and expiry
+(`cleanOldSessions`, `SESSION_TTL_DAYS`) — and each carried its own copy. Expiry's was
+a bare `DELETE FROM sessions`: every expired session's worktree and `ccs/session-*`
+branch stayed in `data/worktrees` with no row to own it, and its `queued_messages`
+(no FK) came back at boot. Found by a third-party Docker image that had to prune the
+trees in its entrypoint. The single delete had drifted too: it never killed the
+terminal pane.
+
+- **`teardownSessions(rows, { deleteTasks })` is the only thing that deletes a session.**
+  Callers decide WHETHER a session may go; it decides what deleting one means. A new
+  door that open-codes `deleteSession.run` is the regression —
+  `worktree-manager.test.js` counts the doors.
+- **`deleteTasks` is a policy, not a shortcut.** A user-confirmed delete removes the
+  chat's one-off tasks (the UI asks via `/tasks-count` first); expiry is unattended
+  and must not empty Kanban columns because a chat went quiet, so it passes `false`
+  and the FK unlinks the cards.
+- **Expiry skips what a user would have been asked about:** a running session, a live
+  terminal pane, and a worktree with unmerged or uncommitted work. Those keep their
+  row — which keeps an owner for the tree — and an unreadable tree counts as work
+  (`sessionHasUnmergedWork(row, { failSafe: true })`): nobody is there to retry.
+- **`WM.pruneOrphanWorktrees()` reconciles what earlier versions leaked**, on every
+  maintenance pass. It is more cautious than `removeWorktree(force:true)`: a tree
+  younger than an hour is kept (creation writes the tree before its row), so is one
+  with work or one whose repository cannot be read, and the removal runs WITHOUT
+  `--force`. It checks for `data/worktrees` before probing git, so an install that
+  never minted a worktree spawns nothing at boot (`git-clone.test.js` counts every
+  `git` call its fake binary sees).
+
 ### A remote run must always end (issue #67)
 
 `runSshSingle()` awaits a promise that resolves **only** from `onDone`. `ClaudeSSH.send()`
@@ -1078,7 +1108,7 @@ Developer ID signed, notarized, **arm64 only**. Pinned by `test/mac-signing.test
 
 ## How to Verify Changes
 
-`npm test` runs 87 test files under `test/` (19 `test/render/*.test.mjs` + 68 `test/*.test.js`), and `.github/workflows/ci.yml` runs the same command on every push and PR to `main`. Nothing covers the live browser/WebSocket path, so also verify that manually:
+`npm test` runs 88 test files under `test/` (19 `test/render/*.test.mjs` + 69 `test/*.test.js`), and `.github/workflows/ci.yml` runs the same command on every push and PR to `main`. Nothing covers the live browser/WebSocket path, so also verify that manually:
 
 ```bash
 # 1. Start server
diff --git a/package.json b/package.json
index d0bf0a86..db81f4c9 100644
--- a/package.json
+++ b/package.json
@@ -8,7 +8,7 @@
   "scripts": {
     "start": "node server.js",
     "dev": "node --watch server.js",
-    "test": "node --test test/render/*.test.mjs && node test/overload-detector.test.js && node test/usage-limit.test.js && node test/auth-errors.test.js && node test/env-load-order.test.js && node test/multi-agent-result.test.js && node test/terminal-session.test.js && node test/terminal-schema.test.js && node test/bots.test.js && node test/bot-inbox.test.js && node test/bots-api.test.js && node test/running-sessions.test.js && node test/session-liveness.test.js && node test/terminal-bridge.integration.test.js && node test/tmux-composite.test.js && node test/engine-spawn-cmd.test.js && node test/telegram-format.test.js && node test/telegram-behaviour.test.js && node test/ask-user-question.test.js && node test/delegate-terminal.test.js && node test/agent-catalog.test.js && node test/update-flow.test.js && node test/kanban-schedule.test.js && node test/kanban-run-badges.test.js && node test/task-backlog.test.js && node test/i18n-completeness.test.js && node test/config-resolve.test.js && node test/chat-defaults.test.js && node test/chat-defaults-api.test.js && node test/run-continuation.test.js && node test/worktree-manager.test.js && node test/setup-gate.test.js && node test/path-guard.test.js && node test/subscribe-nocatchup.test.js && node test/cli-import-remote.test.js && node test/remote-list-parse.test.js && node test/config-migrate.test.js && node test/engine-pane.test.js && node test/global-workspace.test.js && node test/ssh-secret.test.js && node test/agent-dag.test.js && node test/ssh-parser.test.js && node test/ssh-termination.test.js && node test/session-restart.test.js && node test/remote-env.test.js && node test/remote-files.test.js && node test/remote-files-api.test.js && node test/auth-token.test.js && node test/cmd-model.test.js && node test/origin-guard.test.js && node test/interrupted-recovery.test.js && node test/queue-persistence.test.js && node test/interrupt-idle-config.test.js && node test/agents-md.test.js && node test/editor-links.test.js && node test/editor-open-api.test.js && node test/interrupt-delivery.test.js && node test/terminal-pane-guard.integration.test.js && node test/composer-terminal.test.js && node test/claude-cli-status.test.js && node test/asar-helpers.test.js && node test/mac-signing.test.js && node test/release-mac.test.js && node test/task-workers.test.js && node test/git-clone.test.js && node test/responsive-ui.test.js && node test/kanban-delegation.test.js && node test/kanban-group-button.test.js && node test/terminal-keys.test.js",
+    "test": "node --test test/render/*.test.mjs && node test/overload-detector.test.js && node test/usage-limit.test.js && node test/auth-errors.test.js && node test/env-load-order.test.js && node test/multi-agent-result.test.js && node test/terminal-session.test.js && node test/terminal-schema.test.js && node test/bots.test.js && node test/bot-inbox.test.js && node test/bots-api.test.js && node test/running-sessions.test.js && node test/session-liveness.test.js && node test/terminal-bridge.integration.test.js && node test/tmux-composite.test.js && node test/engine-spawn-cmd.test.js && node test/telegram-format.test.js && node test/telegram-behaviour.test.js && node test/ask-user-question.test.js && node test/delegate-terminal.test.js && node test/agent-catalog.test.js && node test/update-flow.test.js && node test/kanban-schedule.test.js && node test/kanban-run-badges.test.js && node test/task-backlog.test.js && node test/i18n-completeness.test.js && node test/config-resolve.test.js && node test/chat-defaults.test.js && node test/chat-defaults-api.test.js && node test/run-continuation.test.js && node test/worktree-manager.test.js && node test/session-expiry.test.js && node test/setup-gate.test.js && node test/path-guard.test.js && node test/subscribe-nocatchup.test.js && node test/cli-import-remote.test.js && node test/remote-list-parse.test.js && node test/config-migrate.test.js && node test/engine-pane.test.js && node test/global-workspace.test.js && node test/ssh-secret.test.js && node test/agent-dag.test.js && node test/ssh-parser.test.js && node test/ssh-termination.test.js && node test/session-restart.test.js && node test/remote-env.test.js && node test/remote-files.test.js && node test/remote-files-api.test.js && node test/auth-token.test.js && node test/cmd-model.test.js && node test/origin-guard.test.js && node test/interrupted-recovery.test.js && node test/queue-persistence.test.js && node test/interrupt-idle-config.test.js && node test/agents-md.test.js && node test/editor-links.test.js && node test/editor-open-api.test.js && node test/interrupt-delivery.test.js && node test/terminal-pane-guard.integration.test.js && node test/composer-terminal.test.js && node test/claude-cli-status.test.js && node test/asar-helpers.test.js && node test/mac-signing.test.js && node test/release-mac.test.js && node test/task-workers.test.js && node test/git-clone.test.js && node test/responsive-ui.test.js && node test/kanban-delegation.test.js && node test/kanban-group-button.test.js && node test/terminal-keys.test.js",
     "postinstall": "node scripts/install-hooks.js",
     "release": "node scripts/release.js",
     "release:mac": "node scripts/release-mac.js",
diff --git a/server.js b/server.js
index 49a42824..3c940cc0 100644
--- a/server.js
+++ b/server.js
@@ -546,29 +546,75 @@ const CLEANUP_INTERVAL_HOURS = parseInt(process.env.CLEANUP_INTERVAL_HOURS || '2
 // ============================================
 
 /**
- * Delete sessions older than SESSION_TTL_DAYS.
- * Messages are auto-deleted via ON DELETE CASCADE.
+ * Delete sessions older than SESSION_TTL_DAYS, through the same teardownSessions()
+ * the delete buttons use — so an expired session's worktree, terminal pane and
+ * queued messages go with it instead of outliving the row that owned them.
+ *
+ * Expiry is unattended, so it skips what a user would have been asked about: a
+ * session that is running right now, one with a live terminal pane, and one whose
+ * worktree holds unmerged or uncommitted work. Those keep their row — and with it an
+ * owner for the tree — and are counted in the log rather than discarded. Its Kanban
+ * tasks are kept as well (deleteTasks: false); the FK unlinks them.
  */
 function cleanOldSessions() {
   try {
-    // Archive dashboard stats before deletion (ON DELETE CASCADE removes messages)
-    const toDelete = db.prepare(`SELECT id FROM sessions WHERE updated_at < datetime('now', '-' || ? || ' days')`).all(SESSION_TTL_DAYS);
-    if (toDelete.length > 0) {
-      archiveSessionStats(toDelete.map(r => r.id));
-      // Best-effort: kill interactive tmux sessions tied to expiring studio sessions
-      for (const r of toDelete) { try { killInteractiveTmux(r.id); } catch {} }
-    }
-    const result = db.prepare(`DELETE FROM sessions WHERE updated_at < datetime('now', '-' || ? || ' days')`).run(SESSION_TTL_DAYS);
-    if (result.changes > 0) {
-      log.info(`[cleanup] Deleted ${result.changes} sessions older than ${SESSION_TTL_DAYS} days`);
-    }
-    return result.changes;
+    const expired = db.prepare(`SELECT * FROM sessions WHERE updated_at < datetime('now', '-' || ? || ' days')`).all(SESSION_TTL_DAYS);
+    const kept = { running: 0, terminal: 0, unmerged: 0 };
+    const doomed = expired.filter(s => {
+      if (activeTasks.has(s.id) || activeChatSessions.has(s.id)) { kept.running++; return false; }
+      let live = false;
+      try { live = termBridge.tmuxAvailable() && termBridge.hasSession(tmuxNameFor(s.id)); } catch {}
+      if (live) { kept.terminal++; return false; }
+      if (sessionHasUnmergedWork(s, { failSafe: true })) { kept.unmerged++; return false; }
+      return true;
+    });
+    teardownSessions(doomed, { deleteTasks: false });
+    if (doomed.length > 0) {
+      log.info(`[cleanup] Deleted ${doomed.length} sessions older than ${SESSION_TTL_DAYS} days`);
+    }
+    if (kept.running + kept.terminal + kept.unmerged > 0) {
+      log.info('[cleanup] expired sessions kept', { ...kept, ttlDays: SESSION_TTL_DAYS });
+    }
+    pruneOrphanWorktrees();
+    return doomed.length;
   } catch (err) {
     log.error('[cleanup] Failed to clean old sessions:', err.message);
     return 0;
   }
 }
 
+/**
+ * Remove worktrees no row owns — the ones expiry leaked before it went through
+ * teardownSessions(). Every table that stores a unit's workdir counts as an owner;
+ * the cautious rules (age, unmerged work, no --force) live in worktree-manager.
+ */
+function pruneOrphanWorktrees() {
+  // Directory first: an install that never minted a worktree must not spawn git here.
+  if (!fs.existsSync(path.join(APP_DIR, 'data', 'worktrees')) || !WM.gitAvailable()) return;
+  let owned;
+  try {
+    owned = new Set();
+    for (const t of ['sessions', 'tasks', 'task_chains']) {
+      for (const r of db.prepare(`SELECT DISTINCT workdir FROM ${t} WHERE workdir IS NOT NULL`).all()) {
+        owned.add(path.resolve(r.workdir));
+        try { owned.add(fs.realpathSync(r.workdir)); } catch {}
+      }
+    }
+  } catch (e) {
+    // Fail SAFE: without the owner list every tree would read as an orphan.
+    log.warn('[cleanup] orphan worktree scan skipped — owner list unreadable', { err: e?.message });
+    return;
+  }
+  const isReferenced = (dir) => {
+    if (owned.has(path.resolve(dir))) return true;
+    try { return owned.has(fs.realpathSync(dir)); } catch { return false; }
+  };
+  const { removed, kept } = WM.pruneOrphanWorktrees({ appDir: APP_DIR, isReferenced });
+  if (removed.length) log.info(`[cleanup] Removed ${removed.length} orphan worktrees`);
+  const unmerged = kept.filter(k => k.reason === 'unmerged or uncommitted work');
+  if (unmerged.length) log.info('[cleanup] orphan worktrees kept — they hold work', { dirs: unmerged.map(k => k.dir) });
+}
+
 /**
  * Run WAL checkpoint to merge WAL file into main database.
  * Prevents unbounded WAL growth and keeps DB file compact.
@@ -8597,70 +8643,48 @@ ${transcript}`;
 });
 
 app.get('/api/sessions/:id/tasks-count', (req,res) => { res.json(stmts.countTasksBySession.get(req.params.id)); });
-app.delete('/api/sessions/:id', (req,res) => {
-  const sid = req.params.id;
-  const sessRow = stmts.getSession.get(sid);
-  // Deleting a session whose worktree still has unmerged commits or uncommitted
-  // changes silently discards real work — same guard as archiving in the design
-  // (there is no separate archive state in this app; delete is the one action).
-  // ?force=1 / body.force bypasses it, same convention as other confirm-to-proceed actions.
-  const force = req.query.force === '1' || req.body?.force === true;
-  if (sessRow && sessRow.git_root && sessRow.workdir && !force) {
-    let unmerged = false;
-    try {
-      unmerged = WM.hasUnmergedWork({ worktreeDir: sessRow.workdir, projectDir: sessRow.git_root, defaultBranch: WM.getDefaultBranch(sessRow.git_root), branch: sessRow.git_branch });
-    } catch { /* worktree already gone — nothing to lose */ }
-    if (unmerged) return res.status(409).json({ error: 'session has unmerged or uncommitted changes', code: 'UNMERGED_WORK' });
-  }
-  // Abort any running Claude subprocess for this session before deleting
-  const active = activeTasks.get(sid);
-  if (active) {
-    try { active.abortController.abort(); } catch {}
-    if (active.cleanupTimer) clearTimeout(active.cleanupTimer);
-    activeTasks.delete(sid);
-  }
-  chatBuffers.delete(sid);
-  // Archive dashboard stats before deletion (ON DELETE CASCADE removes messages)
-  archiveSessionStats([sid]);
-  // Best-effort: kill the interactive tmux session tied to this studio session
-  try { killInteractiveTmux(sid); } catch {}
-  // Unlink recurring tasks from session (preserve the schedule), delete the rest
-  db.prepare(`UPDATE tasks SET session_id=NULL WHERE session_id=? AND recurrence IS NOT NULL`).run(sid);
-  stmts.deleteTasksBySession.run(sid);
-  // Worktree removal comes AFTER the cascade above, deliberately. Read before it, the
-  // count still saw the task rows this delete is about to remove, and answered "in use"
-  // for a tree nothing would own a line later — a leak instead of a stranding.
-  // Never a bare rm -rf: always through git, so .git/worktrees/<name> never goes stale.
-  if (sessRow && sessRow.git_root && sessRow.workdir) {
-    if (_worktreeStillInUse(sessRow.workdir, { exceptSession: sid })) {
-      log.info('worktree kept — still in use by another unit', { sid, workdir: sessRow.workdir });
-    } else {
-      try { WM.removeWorktree({ projectDir: sessRow.git_root, worktreeDir: sessRow.workdir, branch: sessRow.git_branch, force: true }); } catch (e) { log.warn('removeWorktree failed on session delete', { sid, err: e.message }); }
-    }
-  }
-  stmts.deleteSession.run(sid);
-  // queued_messages has no FK to sessions, so the cascade never reaches it. Bulk delete
-  // already does this; the single-session path did not, and boot-restore then resurrected
-  // rows belonging to a chat that no longer exists — forever, since nothing else deletes them.
-  try { stmts.delQueuedBySession.run(sid); } catch {}
-  sessionQueues.delete(sid);
-  res.json({ok:true});
-});
-app.post('/api/sessions/bulk-delete', (req,res) => {
-  // Array.isArray alone is not enough: better-sqlite3 treats a plain object bound as a
-  // parameter as a NAMED-parameter set and throws "Unknown named parameter" — a 500.
-  const ids = (Array.isArray(req.body?.ids) ? req.body.ids : []).filter(x => typeof x === 'string' && x);
-  if (ids.length === 0) return res.status(400).json({ error: 'no ids' });
-  const sessRows = ids.map(id => stmts.getSession.get(id)).filter(Boolean);
-  const force = req.body?.force === true;
-  if (!force) {
-    const blocked = sessRows.filter(s => {
-      if (!s.git_root || !s.workdir) return false;
-      try { return WM.hasUnmergedWork({ worktreeDir: s.workdir, projectDir: s.git_root, defaultBranch: WM.getDefaultBranch(s.git_root), branch: s.git_branch }); } catch { return false; }
-    }).map(s => s.id);
-    if (blocked.length > 0) return res.status(409).json({ error: 'some sessions have unmerged or uncommitted changes', code: 'UNMERGED_WORK', blocked });
-  }
-  // Abort running subprocesses before deleting
+
+/** Would deleting this session's worktree discard work? The one gate every delete
+ *  door asks before teardownSessions().
+ *
+ *  `failSafe` is what an unreadable tree means. A user-confirmed delete reads it as
+ *  "nothing to lose" (the tree is usually already gone, and the user can retry with
+ *  force); unattended expiry reads it as "keep it" — nobody is there to retry, and a
+ *  stale row costs nothing while a deleted tree cannot be brought back. */
+function sessionHasUnmergedWork(row, { failSafe = false } = {}) {
+  if (!row?.git_root || !row?.workdir) return false;
+  try {
+    return WM.hasUnmergedWork({ worktreeDir: row.workdir, projectDir: row.git_root, defaultBranch: WM.getDefaultBranch(row.git_root), branch: row.git_branch });
+  } catch { return failSafe; }
+}
+
+/** Delete sessions and everything that hangs off them — the ONE teardown.
+ *
+ *  Three doors delete sessions: DELETE /api/sessions/:id, bulk delete and expiry
+ *  (cleanOldSessions). Each used to carry its own copy, and the copies had drifted:
+ *  the single delete never killed the terminal pane, and expiry did nothing but
+ *  `DELETE FROM sessions` — every expired session's git worktree stayed on disk with
+ *  no row left to own it, and its queued_messages (no FK) came back at boot.
+ *
+ *  Callers decide WHETHER a session may go (the unmerged-work guard, what is still
+ *  running); this decides only what deleting one means. The one real difference is a
+ *  policy, so it is a parameter: a user-confirmed delete removes the chat's one-off
+ *  tasks (the UI asks with /tasks-count first), while expiry is unattended and must
+ *  not empty Kanban columns because a chat went quiet — its tasks keep their cards and
+ *  the FK sets session_id to NULL.
+ *
+ *  Worktree removal runs AFTER the row cascade: read before it, the in-use count still
+ *  sees the task rows this delete is about to remove and keeps a tree nobody owns a
+ *  moment later. The whole batch is excluded from that count, not one row at a time —
+ *  delete an origin and its compact together and each would otherwise keep the other's
+ *  tree alive, then both vanish. A tree is removed ONCE however many holders it had.
+ *  Never a bare rm -rf: always through git, so .git/worktrees/<name> never goes stale.
+ *  @param {object[]} rows  session rows (stmts.getSession shape)
+ *  @param {{deleteTasks: boolean}} opts
+ */
+function teardownSessions(rows, { deleteTasks }) {
+  const ids = rows.map(r => r.id);
+  if (ids.length === 0) return;
   for (const id of ids) {
     const active = activeTasks.get(id);
     if (active) {
@@ -8672,49 +8696,66 @@ app.post('/api/sessions/bulk-delete', (req,res) => {
   }
   // Archive dashboard stats before deletion (ON DELETE CASCADE removes messages)
   archiveSessionStats(ids);
-  // Best-effort: kill interactive tmux sessions tied to these studio sessions
-  for (const id of ids) { try { killInteractiveTmux(id); } catch {} }
-  // Terminal sessions live under their own tmux prefix and need their own cleanup,
-  // plus the scrollback file the reaper may have left behind.
   for (const id of ids) {
+    try { killInteractiveTmux(id); } catch {}
+    // Terminal sessions live under their own tmux prefix and need their own cleanup,
+    // plus the scrollback file the reaper may have left behind.
     try { termBridge.killSession(tmuxNameFor(id)); } catch {}
     try { fs.unlinkSync(path.join(os.tmpdir(), `ccsterm-sb-${id}.txt`)); } catch {}
   }
-  const del = db.transaction(() => {
+  db.transaction(() => {
     for (const id of ids) {
-      // Unlink recurring tasks from session (preserve the schedule), delete the rest
-      db.prepare(`UPDATE tasks SET session_id=NULL WHERE session_id=? AND recurrence IS NOT NULL`).run(id);
-      stmts.deleteTasksBySession.run(id); stmts.deleteSession.run(id); sessionQueues.delete(id);
+      if (deleteTasks) {
+        // Unlink recurring tasks from session (preserve the schedule), delete the rest
+        db.prepare(`UPDATE tasks SET session_id=NULL WHERE session_id=? AND recurrence IS NOT NULL`).run(id);
+        stmts.deleteTasksBySession.run(id);
+      }
+      stmts.deleteSession.run(id);
+      // queued_messages has no FK to sessions, so the cascade never reaches it.
       try { stmts.delQueuedBySession.run(id); } catch {}
     }
-  });
-  del();
-  // Runs AFTER the cascade above, for the same reason the single delete does: read
-  // before it, the count still sees the task rows the cascade is about to remove and
-  // keeps a tree nobody owns a moment later. Recurring tasks are UNLINKED rather than
-  // deleted there, so they still count — correctly: their auto-merge is skipped and
-  // that tree is their live cwd.
-  // Never a bare rm -rf — always through git so .git/worktrees/<name> never goes stale.
-  //
-  // Excluding only the row being processed is wrong for a BATCH: delete an origin and
-  // its compact together and each one sees the other still present, both answer "in
-  // use", and the tree survives with nobody left to own it. The whole batch is excluded
-  // instead, and a tree is removed ONCE however many of its holders are in the batch.
-  const _bulkIds = new Set(sessRows.map(r => r.id));
-  const _bulkDone = new Set();
-  for (const s of sessRows) {
-    if (s.git_root && s.workdir) {
-      if (_bulkDone.has(s.workdir)) {
-        // already handled for an earlier holder in this same batch
-      } else if (_worktreeStillInUseExcluding(s.workdir, _bulkIds)) {
-        log.info('worktree kept on bulk delete — still in use', { sid: s.id, workdir: s.workdir });
-      } else {
-        _bulkDone.add(s.workdir);
-        try { WM.removeWorktree({ projectDir: s.git_root, worktreeDir: s.workdir, branch: s.git_branch, force: true }); } catch (e) { log.warn('removeWorktree failed on bulk delete', { sid: s.id, err: e.message }); }
-      }
+  })();
+  for (const id of ids) sessionQueues.delete(id);
+  const batch = new Set(ids);
+  const done = new Set();
+  for (const s of rows) {
+    if (!s.git_root || !s.workdir || done.has(s.workdir)) continue;
+    if (_worktreeStillInUseExcluding(s.workdir, batch)) {
+      log.info('worktree kept — still in use by another unit', { sid: s.id, workdir: s.workdir });
+      continue;
     }
+    done.add(s.workdir);
+    try { WM.removeWorktree({ projectDir: s.git_root, worktreeDir: s.workdir, branch: s.git_branch, force: true }); }
+    catch (e) { log.warn('removeWorktree failed on session delete', { sid: s.id, err: e.message }); }
   }
+}
 
+app.delete('/api/sessions/:id', (req,res) => {
+  const sid = req.params.id;
+  const sessRow = stmts.getSession.get(sid);
+  // Deleting a session whose worktree still has unmerged commits or uncommitted
+  // changes silently discards real work — same guard as archiving in the design
+  // (there is no separate archive state in this app; delete is the one action).
+  // ?force=1 / body.force bypasses it, same convention as other confirm-to-proceed actions.
+  const force = req.query.force === '1' || req.body?.force === true;
+  if (sessRow && !force && sessionHasUnmergedWork(sessRow)) {
+    return res.status(409).json({ error: 'session has unmerged or uncommitted changes', code: 'UNMERGED_WORK' });
+  }
+  if (sessRow) teardownSessions([sessRow], { deleteTasks: true });
+  res.json({ok:true});
+});
+app.post('/api/sessions/bulk-delete', (req,res) => {
+  // Array.isArray alone is not enough: better-sqlite3 treats a plain object bound as a
+  // parameter as a NAMED-parameter set and throws "Unknown named parameter" — a 500.
+  const ids = (Array.isArray(req.body?.ids) ? req.body.ids : []).filter(x => typeof x === 'string' && x);
+  if (ids.length === 0) return res.status(400).json({ error: 'no ids' });
+  const sessRows = ids.map(id => stmts.getSession.get(id)).filter(Boolean);
+  const force = req.body?.force === true;
+  if (!force) {
+    const blocked = sessRows.filter(s => sessionHasUnmergedWork(s)).map(s => s.id);
+    if (blocked.length > 0) return res.status(409).json({ error: 'some sessions have unmerged or uncommitted changes', code: 'UNMERGED_WORK', blocked });
+  }
+  teardownSessions(sessRows, { deleteTasks: true });
   res.json({ ok: true, deleted: ids.length });
 });
 app.get('/api/sessions/:id/git-status', (req, res) => {
diff --git a/test/queue-persistence.test.js b/test/queue-persistence.test.js
index f4a8a827..f5fc4934 100644
--- a/test/queue-persistence.test.js
+++ b/test/queue-persistence.test.js
@@ -322,12 +322,16 @@ console.log('\nwiring + the invariant the schema promises:');
     /if \(!msg \|\| !row\.session_id\) \{ try \{ stmts\.delQueuedMsg\.run\(row\.id\)/.test(SRC), true);
   // Every statement that can remove a row must be used somewhere — an unused one means a
   // path went back to memory-only.
-  // delQueuedBySession has THREE call sites: `stop` (tested above) and BOTH session-delete
-  // paths. The single-session DELETE was missing it — queued_messages has no FK, so
+  // delQueuedBySession has TWO call sites: `stop` (tested above) and teardownSessions(),
+  // the one session teardown every delete door goes through. The single-session DELETE
+  // was once missing it, and expiry never had it — queued_messages has no FK, so
   // boot-restore resurrected rows of a deleted chat on every restart, forever.
-  check('deleting a session drops its queued rows', /deleteSession[\s\S]{0,4000}?stmts\.delQueuedBySession\.run\(id\)/.test(SRC), true);
-  check('the single-session DELETE purges the queue too', /deleteSession\.run\(sid\)[\s\S]{0,600}?stmts\.delQueuedBySession\.run\(sid\)/.test(SRC), true);
-  for (const [name, count] of [['delQueuedMsg', 4], ['delQueuedBySession', 3], ['updQueuedMsg', 1]]) {
+  // test/session-expiry.test.js checks the expiry half against a real server.
+  const td = SRC.slice(SRC.indexOf('function teardownSessions('));
+  const tdBody = td.slice(0, td.indexOf('\n}\n') + 3);
+  check('deleting a session drops its queued rows', /deleteSession\.run\(id\)[\s\S]{0,400}?stmts\.delQueuedBySession\.run\(id\)/.test(tdBody), true);
+  check('the single-session DELETE goes through that teardown', /teardownSessions\(\[sessRow\]/.test(SRC), true);
+  for (const [name, count] of [['delQueuedMsg', 4], ['delQueuedBySession', 2], ['updQueuedMsg', 1]]) {
     const uses = (SRC.match(new RegExp(`stmts\\.${name}\\.run\\(`, 'g')) || []).length;
     check(`stmts.${name} is used at ${count} call site(s)`, uses, count);
   }
diff --git a/test/session-expiry.test.js b/test/session-expiry.test.js
new file mode 100644
index 00000000..09845265
--- /dev/null
+++ b/test/session-expiry.test.js
@@ -0,0 +1,163 @@
+// Session expiry goes through the same teardown as the delete buttons.
+//
+// SESSION_TTL_DAYS used to run a bare `DELETE FROM sessions`. Every expired
+// session's git worktree (and its `ccs/session-*` branch) stayed on disk with no
+// row left to own it, so data/worktrees grew without bound — first reported by a
+// third-party Docker image that had to prune them in its entrypoint. Its
+// queued_messages (no FK) came back at every boot too.
+//
+// This boots a REAL server twice against one APP_DIR. Boot 1 creates isolated
+// sessions; between boots the test ages some of them in SQLite; boot 2 runs expiry
+// at startup (runDatabaseMaintenance), and the test checks what is left on disk:
+//   - a clean expired session: row, tree, branch and queued message all gone;
+//   - an expired session with UNCOMMITTED work: kept, row and tree — nobody was
+//     asked, so nothing is discarded;
+//   - an expired session holding a Kanban card: session gone, card kept, unlinked;
+//   - a fresh session: untouched;
+//   - an orphan tree no row owns, older than an hour: removed; a fresh one: kept.
+// Then the delete buttons are driven once each, because they now share the code.
+//
+// Run: node test/session-expiry.test.js
+'use strict';
+const assert = require('assert');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { spawn, execFileSync } = require('child_process');
+const Database = require('better-sqlite3');
+
+let pass = 0, fail = 0;
+function check(label, actual, expected) {
+  try { assert.deepStrictEqual(actual, expected); pass++; console.log(`  ok   ${label}`); }
+  catch { fail++; console.error(`  FAIL ${label} — expected ${JSON.stringify(expected)}, got ${JSON.stringify(actual)}`); }
+}
+const sleep = ms => new Promise(r => setTimeout(r, ms));
+
+const PORT = Number(process.env.TEST_PORT || 4553);
+const BASE = `http://127.0.0.1:${PORT}`;
+
+const APP_DIR  = fs.mkdtempSync(path.join(os.tmpdir(), 'ccs-expiry-app-'));
+const HOME_DIR = fs.mkdtempSync(path.join(os.tmpdir(), 'ccs-expiry-home-'));
+process.on('exit', () => { for (const d of [APP_DIR, HOME_DIR]) { try { fs.rmSync(d, { recursive: true, force: true }); } catch {} } });
+fs.mkdirSync(path.join(APP_DIR, 'data'), { recursive: true });
+fs.writeFileSync(path.join(APP_DIR, 'config.json'), JSON.stringify({ mcpServers: {}, skills: {} }));
+const WORKDIR = path.join(APP_DIR, 'workspace');
+const PROJ = path.join(WORKDIR, 'proj');
+fs.mkdirSync(PROJ, { recursive: true });
+
+const ID = ['-c', 'user.email=ci-test-noreply', '-c', 'user.name=Test'];
+const git = (args, cwd) => execFileSync('git', args, { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] }).trim();
+git(['init', '-q'], PROJ);
+fs.writeFileSync(path.join(PROJ, 'README.md'), 'x\n');
+git(['add', '.'], PROJ);
+git([...ID, 'commit', '-qm', 'init'], PROJ);
+const branches = () => git(['branch', '--format=%(refname:short)'], PROJ).split('\n').filter(Boolean);
+
+let child = null, srvLog = '';
+function boot() {
+  srvLog = '';
+  child = spawn(process.execPath, [path.join(__dirname, '..', 'server.js')], {
+    env: { ...process.env, PORT: String(PORT), CCS_DESKTOP: '1', APP_DIR, WORKDIR, HOME: HOME_DIR, SESSION_TTL_DAYS: '30' },
+    stdio: ['ignore', 'pipe', 'pipe'],
+  });
+  child.exited = false;
+  child.on('exit', () => { child.exited = true; });
+  child.stdout.on('data', d => { srvLog += d; });
+  child.stderr.on('data', d => { srvLog += d; });
+}
+async function up() {
+  for (let i = 0; i < 80 && !child.exited; i++) {
+    try { if ((await fetch(BASE + '/api/health')).ok) break; } catch {}
+    await sleep(250);
+  }
+  if (child.exited || !srvLog.includes('server started')) die(`server on ${PORT} did not start`);
+}
+async function stop() {
+  if (!child || child.exited) return;
+  child.kill('SIGTERM');
+  for (let i = 0; i < 40 && !child.exited; i++) await sleep(100);
+  if (!child.exited) { child.kill('SIGKILL'); await sleep(200); }
+}
+process.on('exit', () => { if (child && !child.exited) try { child.kill('SIGKILL'); } catch {} });
+function die(msg) { console.error(msg); if (srvLog) console.error(srvLog.slice(-2000)); if (child) try { child.kill('SIGKILL'); } catch {} process.exit(1); }
+
+async function api(method, url, body) {
+  const res = await fetch(BASE + url, {
+    method,
+    headers: body !== undefined ? { 'content-type': 'application/json' } : undefined,
+    body: body !== undefined ? JSON.stringify(body) : undefined,
+  });
+  const text = await res.text();
+  let json = null; try { json = JSON.parse(text); } catch {}
+  return { status: res.status, json, text };
+}
+
+(async () => {
+  boot(); await up();
+  if ((await api('POST', '/api/projects', { name: 'proj', workdir: PROJ })).status !== 200) die('could not register the project');
+  const ids = {};
+  for (const k of ['clean', 'dirty', 'card', 'fresh']) {
+    const r = await api('POST', '/api/sessions', { title: k, workdir: PROJ });
+    if (r.status !== 200 || !r.json?.id) die(`could not create session ${k}: ${r.text}`);
+    ids[k] = r.json.id;
+  }
+  await stop();
+
+  const db = new Database(path.join(APP_DIR, 'data', 'chats.db'));
+  const tree = {};
+  for (const [k, id] of Object.entries(ids)) tree[k] = db.prepare('SELECT workdir FROM sessions WHERE id=?').get(id).workdir;
+  if (!Object.values(tree).every(d => d && fs.existsSync(d) && d.startsWith(path.join(APP_DIR, 'data', 'worktrees')))) {
+    die(`sessions were not worktree-isolated: ${JSON.stringify(tree)}`);
+  }
+  const age = db.prepare(`UPDATE sessions SET updated_at=datetime('now','-40 days') WHERE id=?`);
+  for (const k of ['clean', 'dirty', 'card']) age.run(ids[k]);
+  db.prepare(`INSERT INTO queued_messages (session_id, payload) VALUES (?, ?)`).run(ids.clean, JSON.stringify({ type: 'chat', text: 'queued' }));
+  db.prepare(`INSERT INTO tasks (id, title, status, session_id) VALUES ('card-1', 'a card', 'backlog', ?)`).run(ids.card);
+  db.close();
+  fs.writeFileSync(path.join(tree.dirty, 'work-in-progress.txt'), 'not committed\n');
+
+  // Two trees no row owns, next to the sessions' own.
+  const slugDir = path.dirname(tree.clean);
+  const orphanOld = path.join(slugDir, 'session-orphan-old');
+  const orphanNew = path.join(slugDir, 'session-orphan-new');
+  git(['worktree', 'add', '-q', orphanOld, '-b', 'ccs/session-orphan-old'], PROJ);
+  git(['worktree', 'add', '-q', orphanNew, '-b', 'ccs/session-orphan-new'], PROJ);
+  const twoHoursAgo = (Date.now() - 2 * 3600 * 1000) / 1000;
+  fs.utimesSync(orphanOld, twoHoursAgo, twoHoursAgo);
+
+  boot(); await up();   // expiry runs at startup
+  const db2 = new Database(path.join(APP_DIR, 'data', 'chats.db'), { readonly: true });
+  const row = id => db2.prepare('SELECT id FROM sessions WHERE id=?').get(id) || null;
+
+  console.log('\n— an expired clean session goes with everything it owned —');
+  check('the session row is gone', row(ids.clean), null);
+  check('its worktree is gone', fs.existsSync(tree.clean), false);
+  check('its branch is gone', branches().includes(`ccs/session-${ids.clean}`), false);
+  check('its queued message does not come back at boot',
+    db2.prepare('SELECT COUNT(*) c FROM queued_messages WHERE session_id=?').get(ids.clean).c, 0);
+
+  console.log('\n— expiry is unattended, so it discards nothing anyone would be asked about —');
+  check('a session with uncommitted work keeps its row', !!row(ids.dirty), true);
+  check('…and its worktree, with the work in it', fs.existsSync(path.join(tree.dirty, 'work-in-progress.txt')), true);
+  check('a Kanban card outlives its expired chat', db2.prepare(`SELECT session_id FROM tasks WHERE id='card-1'`).get(), { session_id: null });
+  check('…while that chat and its tree are gone', [row(ids.card), fs.existsSync(tree.card)], [null, false]);
+  check('a fresh session is untouched', [!!row(ids.fresh), fs.existsSync(tree.fresh)], [true, true]);
+
+  console.log('\n— trees leaked by earlier versions are reconciled —');
+  check('an orphan older than an hour is removed', fs.existsSync(orphanOld), false);
+  check('…through git, branch included', branches().includes('ccs/session-orphan-old'), false);
+  check('a fresh orphan is kept (its row may be a moment away)', fs.existsSync(orphanNew), true);
+  db2.close();
+
+  console.log('\n— the delete buttons share that teardown —');
+  check('DELETE refuses a session with uncommitted work', (await api('DELETE', `/api/sessions/${ids.dirty}`)).status, 409);
+  check('DELETE removes a clean one', (await api('DELETE', `/api/sessions/${ids.fresh}`)).status, 200);
+  check('…and its worktree', fs.existsSync(tree.fresh), false);
+  check('bulk delete with force removes the dirty one',
+    (await api('POST', '/api/sessions/bulk-delete', { ids: [ids.dirty], force: true })).json?.ok, true);
+  check('…and its worktree', fs.existsSync(tree.dirty), false);
+
+  await stop();
+  console.log(`\n${pass} passed, ${fail} failed`);
+  process.exit(fail ? 1 : 0);
+})().catch(e => die(e.stack || String(e)));
diff --git a/test/worktree-manager.test.js b/test/worktree-manager.test.js
index 3b20131c..d537e77e 100644
--- a/test/worktree-manager.test.js
+++ b/test/worktree-manager.test.js
@@ -355,7 +355,7 @@ console.log('\na shared worktree is not removed while another session uses it:')
   // force:true means a removal that should not have happened reports no error at all,
   // so the guard has to come BEFORE the call rather than being cleaned up after.
   check('the delete path asks whether the worktree is still in use',
-    /_worktreeStillInUse\(sessRow\.workdir/.test(win), true);
+    /_worktreeStillInUseExcluding\(s\.workdir, batch\)/.test(win), true);
   check('and asks before removeWorktree, not after',
     win.indexOf('_worktreeStillInUse(') < win.indexOf('WM.removeWorktree'), true);
 }
@@ -434,8 +434,8 @@ console.log('\nno worktree is removed while another unit lives in it:');
   // the other as a holder — both keep the tree, then both vanish.
   check('the single-unit rule exists once', (SRV.match(/function _worktreeStillInUse\(/g) || []).length, 1);
   check('and the batch rule exists once', (SRV.match(/function _worktreeStillInUseExcluding\(/g) || []).length, 1);
-  check('bulk delete uses the batch rule', /_worktreeStillInUseExcluding\(s\.workdir, _bulkIds\)/.test(SRV), true);
-  check('and removes a shared tree only once per batch', /_bulkDone\.has\(s\.workdir\)/.test(SRV), true);
+  check('session teardown uses the batch rule', /_worktreeStillInUseExcluding\(s\.workdir, batch\)/.test(SRV), true);
+  check('and removes a shared tree only once per batch', /done\.has\(s\.workdir\)/.test(SRV), true);
   const h = SRV.slice(SRV.indexOf('function _worktreeStillInUse('));
   const hBody = h.slice(0, h.indexOf('\n}\n') + 3);
   // Counting only sessions missed the case that destroys work: a RECURRING task
@@ -446,11 +446,12 @@ console.log('\nno worktree is removed while another unit lives in it:');
   // FOUR removal sites, not three. The auto-merge in startTask was missed in the
   // first pass and the count of 4 (1 def + 3 uses) made the gap look complete —
   // the task's own sidecar session, and any compact of it, live in that same tree.
-  // 1 definition + 3 call sites: task auto-merge, task delete, session delete. Bulk
-  // uses the batch variant, and a COMPLETED CHAIN uses its own — the plain refcount
-  // counts the chain's own members and session, so it answered "in use" forever and
-  // the tree was never removed while the next cycle minted another.
-  check('the single-unit rule guards three sites', (SRV.match(/_worktreeStillInUse\(/g) || []).length, 4);
+  // 1 definition + 2 call sites: task auto-merge and task delete. Every SESSION
+  // delete — single, bulk and expiry — goes through teardownSessions(), which uses the
+  // batch variant (a batch of one is the single delete), and a COMPLETED CHAIN uses its
+  // own — the plain refcount counts the chain's own members and session, so it answered
+  // "in use" forever and the tree was never removed while the next cycle minted another.
+  check('the single-unit rule guards the two task sites', (SRV.match(/_worktreeStillInUse\(/g) || []).length, 3);
   check('a completed chain uses the chain-aware variant',
     /_chainWorktreeStillInUse\(chain, allChainTasks\)/.test(SRV), true);
   check('which exists once', (SRV.match(/function _chainWorktreeStillInUse\(/g) || []).length, 1);
@@ -460,14 +461,22 @@ console.log('\nno worktree is removed while another unit lives in it:');
   check('a failed check keeps the tree, never removes it',
     /catch \(e\) \{[\s\S]*?return true;\s*\}/.test(hBody) && !/catch[\s\S]*?return false;/.test(hBody), true);
   // Read before the cascade, the count still saw rows this delete is about to remove.
-  check('session delete counts AFTER its cascade',
-    SRV.indexOf('stmts.deleteTasksBySession.run(sid);') < SRV.indexOf('_worktreeStillInUse(sessRow.workdir'), true);
-  // The single delete was fixed first and the bulk one was left behind — this pin
-  // did not cover it, so the ordering bug looked closed while it was still live on
-  // the batch path. Both are pinned now.
-  check('bulk delete removes AFTER its cascade runs',
-    SRV.indexOf('del();') < SRV.indexOf('_worktreeStillInUseExcluding(s.workdir, _bulkIds)'), true);
-  check('and the cascade runs exactly once', (SRV.match(/^\s*del\(\);/gm) || []).length, 1);
+  // The single delete was fixed first and the bulk one was left behind, and expiry
+  // never removed a tree at all — three copies drift. There is one teardown now, and
+  // these pins are what keep it one.
+  const td = SRV.slice(SRV.indexOf('function teardownSessions('));
+  const tdBody = td.slice(0, td.indexOf('\n}\n') + 3);
+  check('session teardown counts AFTER its cascade',
+    tdBody.indexOf('stmts.deleteTasksBySession.run(id);') > 0 &&
+    tdBody.indexOf('})();') < tdBody.indexOf('_worktreeStillInUseExcluding(s.workdir, batch)'), true);
+  check('the teardown is defined once', (SRV.match(/function teardownSessions\(/g) || []).length, 1);
+  check('and all three doors use it — delete, bulk delete, expiry',
+    [/teardownSessions\(\[sessRow\], \{ deleteTasks: true \}\)/, /teardownSessions\(sessRows, \{ deleteTasks: true \}\)/,
+     /teardownSessions\(doomed, \{ deleteTasks: false \}\)/].map(re => re.test(SRV)), [true, true, true]);
+  check('no other code path removes a session worktree',
+    (SRV.match(/removeWorktree failed on (session|bulk) delete/g) || []).length, 1);
+  check('expiry never deletes sessions behind the teardown\'s back',
+    /DELETE FROM sessions WHERE updated_at/.test(SRV), false);
 }
 
 // ── A chain shares ONE tree and merges ONCE ────────────────────────────────
@@ -588,6 +597,38 @@ console.log('\na failed commit stops the merge and the removal:');
     (SRV.match(/git_root \|\| \w+\.workdir \|\| null\) !== \(task\.git_root/g) || []).length, 2);
 }
 
+// ── pruneOrphanWorktrees: the reconciliation behind session expiry ──────────
+// The end-to-end half (expiry at boot, a dirty tree, a fresh orphan) lives in
+// test/session-expiry.test.js. These are the cases it does not reach.
+{
+  console.log('\n— pruneOrphanWorktrees —');
+  const app = tmpDir('orph-app');
+  const proj = tmpDir('orph-proj');
+  initTestIdentity(proj);
+  fs.writeFileSync(path.join(proj, 'f.txt'), 'x\n');
+  git(['add', '.'], proj); git(['commit', '-qm', 'init'], proj);
+  const slug = path.join(app, 'data', 'worktrees', 'p1');
+  const mk = (name) => { const d = path.join(slug, name); git(['worktree', 'add', '-q', d, '-b', `ccs/${name}`], proj); return d; };
+  const owned = mk('session-owned');
+  const merged = mk('session-merged');
+  const ahead = mk('session-ahead');
+  initTestIdentity(ahead);
+  fs.writeFileSync(path.join(ahead, 'new.txt'), 'y\n');
+  git(['add', '.'], ahead); git(['commit', '-qm', 'unmerged work'], ahead);
+  const notGit = path.join(slug, 'session-notgit'); fs.mkdirSync(notGit);
+  const later = Date.now() + 2 * 3600 * 1000;   // everything reads as old
+  const r = WM.pruneOrphanWorktrees({ appDir: app, isReferenced: d => d === owned, now: later });
+  const reason = d => (r.kept.find(k => k.dir === d) || {}).reason || null;
+  check('a tree a row owns is not even inspected', [fs.existsSync(owned), reason(owned)], [true, null]);
+  check('a clean, merged orphan is removed', [r.removed.includes(merged), fs.existsSync(merged)], [true, false]);
+  check('…and its branch with it', git(['branch', '--list', 'ccs/session-merged'], proj), '');
+  check('an orphan with COMMITTED but unmerged work is kept', [fs.existsSync(ahead), reason(ahead)], [true, 'unmerged or uncommitted work']);
+  check('…and so is its branch', git(['branch', '--list', 'ccs/session-ahead'], proj).replace(/^[*+ ]+/, ''), 'ccs/session-ahead');
+  check('a directory that is not a worktree is kept, not rm -rf\'d', [fs.existsSync(notGit), reason(notGit)], [true, 'not a git worktree']);
+  check('no worktrees directory at all is not an error',
+    WM.pruneOrphanWorktrees({ appDir: tmpDir('orph-empty'), isReferenced: () => false }), { removed: [], kept: [] });
+}
+
 console.log(`\n${fail === 0 ? 'PASS' : 'FAIL'} — ${pass} passed, ${fail} failed`);
 process.exit(fail === 0 ? 0 : 1);
 }
diff --git a/worktree-manager.js b/worktree-manager.js
index 795fa80f..294c308b 100644
--- a/worktree-manager.js
+++ b/worktree-manager.js
@@ -199,6 +199,61 @@ function hasUnmergedWork({ worktreeDir, projectDir, defaultBranch, branch }) {
   } catch { return false; }
 }
 
+/**
+ * Remove every unit worktree under `<appDir>/data/worktrees` that no database row
+ * owns any more — the trees that leaked before session expiry learned to remove its
+ * own (SESSION_TTL_DAYS deleted the row and left the tree). The caller supplies
+ * `isReferenced(dir)`; this module does not read the database.
+ *
+ * Deliberately more cautious than removeWorktree(force:true), because nobody is
+ * watching and nobody confirmed anything:
+ *   - a tree younger than `minAgeMs` is kept — creation writes the tree first and
+ *     the owning row a moment later, and a clean fresh tree looks exactly like an
+ *     orphan in between;
+ *   - a tree with uncommitted changes, or commits its project's current branch does
+ *     not have, is kept and reported, never discarded;
+ *   - a tree whose project or branch cannot be read is kept (fail safe);
+ *   - removal is `git worktree remove` WITHOUT --force, so git itself refuses a tree
+ *     that changed between the check and the call.
+ * @returns {{ removed: string[], kept: Array<{dir: string, reason: string}> }}
+ */
+function pruneOrphanWorktrees({ appDir, isReferenced, minAgeMs = 60 * 60 * 1000, now = Date.now() }) {
+  const out = { removed: [], kept: [] };
+  const root = path.join(appDir, 'data', 'worktrees');
+  let projects;
+  try { projects = fs.readdirSync(root, { withFileTypes: true }).filter(d => d.isDirectory()); }
+  catch { return out; }   // no worktrees directory yet
+  for (const proj of projects) {
+    const projDir = path.join(root, proj.name);
+    let units;
+    try { units = fs.readdirSync(projDir, { withFileTypes: true }).filter(d => d.isDirectory()); }
+    catch { continue; }
+    for (const unit of units) {
+      const dir = path.join(projDir, unit.name);
+      const keep = (reason) => out.kept.push({ dir, reason });
+      if (isReferenced(dir)) continue;
+      try { if (now - fs.statSync(dir).mtimeMs < minAgeMs) { keep('recent'); continue; } }
+      catch { continue; }
+      let projectDir, branch;
+      try {
+        // A linked worktree's common dir is the main repository's `.git`.
+        projectDir = path.dirname(path.resolve(dir, _git(['rev-parse', '--git-common-dir'], dir)));
+        branch = _git(['branch', '--show-current'], dir);
+      } catch { keep('not a git worktree'); continue; }
+      if (!branch) { keep('detached HEAD'); continue; }
+      try {
+        if (hasUnmergedWork({ worktreeDir: dir, projectDir, defaultBranch: getDefaultBranch(projectDir), branch })) {
+          keep('unmerged or uncommitted work'); continue;
+        }
+        removeWorktree({ projectDir, worktreeDir: dir, branch, force: false });
+        out.removed.push(dir);
+      } catch (e) { keep(`git refused: ${String(e?.stderr || e?.message || e).trim().split('\n')[0]}`); }
+    }
+    try { fs.rmdirSync(projDir); } catch { /* not empty — still holds live trees */ }
+  }
+  return out;
+}
+
 /**
  * green/amber/red only — a merge CONFLICT happens in the shared project
  * root (projectDir), not in this worktree, so 'purple' is not derivable
@@ -255,6 +310,6 @@ module.exports = {
   gitAvailable, _resetGitAvailableCache,
   hasGitRepo, ensureGitInitialized, getDefaultBranch,
   branchNameFor, worktreePath,
-  ensureWorktree, removeWorktree, hasUnmergedWork,
+  ensureWorktree, removeWorktree, hasUnmergedWork, pruneOrphanWorktrees,
   getStatus, commitAll, mergeBranch,
 };

From 46c9a8a8d8fb45fc3a5f3d25d2b6ae8cf47e31eb Mon Sep 17 00:00:00 2001
From: Lexus2016 <lexus@cdzv.com>
Date: Sat, 3 Oct 2026 13:16:25 +0200
Subject: [PATCH 2/2] fix(sessions): a chain owns its tree, and owners compare
 in on-disk letter case

Found by an adversarial review of the expiry teardown: an expiring chain session
could take a live chain's tree (task_chains was not counted as a holder), and on a
case-insensitive disk a row stored under a differently-cased path read as an orphan.
Both are pinned in test/session-expiry.test.js and fail when reverted.
---
 CLAUDE.md                   |  6 ++++++
 server.js                   | 15 ++++++++++++---
 test/session-expiry.test.js | 22 ++++++++++++++++++++--
 3 files changed, 38 insertions(+), 5 deletions(-)

diff --git a/CLAUDE.md b/CLAUDE.md
index 8a7c6632..875a9b85 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -1021,6 +1021,12 @@ terminal pane.
   `--force`. It checks for `data/worktrees` before probing git, so an install that
   never minted a worktree spawns nothing at boot (`git-clone.test.js` counts every
   `git` call its fake binary sees).
+- **Two owners are easy to miss, and a review caught both.** A CHAIN owns its tree
+  before any member carries it, so `_worktreeStillInUseExcluding` counts `task_chains`
+  too. And the owner list is compared through `fs.realpathSync.native`: the JS
+  `realpathSync` keeps the caller's letter case, so on macOS/Windows a row spelled
+  `/Users/x` and a scan of `/users/x` are one directory that compares unequal — and an
+  owned tree reads as an orphan.
 
 ### A remote run must always end (issue #67)
 
diff --git a/server.js b/server.js
index 3c940cc0..b97b585c 100644
--- a/server.js
+++ b/server.js
@@ -597,7 +597,7 @@ function pruneOrphanWorktrees() {
     for (const t of ['sessions', 'tasks', 'task_chains']) {
       for (const r of db.prepare(`SELECT DISTINCT workdir FROM ${t} WHERE workdir IS NOT NULL`).all()) {
         owned.add(path.resolve(r.workdir));
-        try { owned.add(fs.realpathSync(r.workdir)); } catch {}
+        try { owned.add(fs.realpathSync.native(r.workdir)); } catch {}
       }
     }
   } catch (e) {
@@ -605,9 +605,13 @@ function pruneOrphanWorktrees() {
     log.warn('[cleanup] orphan worktree scan skipped — owner list unreadable', { err: e?.message });
     return;
   }
+  // `.native`, not plain realpathSync: the JS one keeps the caller's LETTER CASE, so on
+  // a case-insensitive disk (macOS, Windows) a row stored as /Users/x and a scan of
+  // /users/x name one tree and still compare unequal — and an owned tree reads as an
+  // orphan. The native call returns the on-disk spelling for both sides.
   const isReferenced = (dir) => {
     if (owned.has(path.resolve(dir))) return true;
-    try { return owned.has(fs.realpathSync(dir)); } catch { return false; }
+    try { return owned.has(fs.realpathSync.native(dir)); } catch { return true; }   // unreadable: keep
   };
   const { removed, kept } = WM.pruneOrphanWorktrees({ appDir: APP_DIR, isReferenced });
   if (removed.length) log.info(`[cleanup] Removed ${removed.length} orphan worktrees`);
@@ -3966,7 +3970,12 @@ function _worktreeStillInUseExcluding(workdir, ids) {
     const rows = db.prepare(`SELECT id FROM sessions WHERE workdir=?`).all(workdir).map(r => r.id);
     if (rows.some(id => !ids.has(id))) return true;
     const t = db.prepare(`SELECT COUNT(*) c FROM tasks WHERE workdir=?`).get(workdir).c;
-    return t > 0;
+    // A chain owns its tree before any member carries it (setupChainWorktree writes the
+    // chain row first), so a chain's session expiring must not take the tree with it.
+    // A COMPLETED chain's tree is removed by its own rule; a stale path here only keeps
+    // a tree that is already gone.
+    const c = db.prepare(`SELECT COUNT(*) c FROM task_chains WHERE workdir=?`).get(workdir).c;
+    return t + c > 0;
   } catch (e) {
     log.warn('worktree in-use check failed — keeping the tree', { workdir, err: e?.message });
     return true;
diff --git a/test/session-expiry.test.js b/test/session-expiry.test.js
index 09845265..0159f957 100644
--- a/test/session-expiry.test.js
+++ b/test/session-expiry.test.js
@@ -96,7 +96,7 @@ async function api(method, url, body) {
   boot(); await up();
   if ((await api('POST', '/api/projects', { name: 'proj', workdir: PROJ })).status !== 200) die('could not register the project');
   const ids = {};
-  for (const k of ['clean', 'dirty', 'card', 'fresh']) {
+  for (const k of ['clean', 'dirty', 'card', 'fresh', 'chained']) {
     const r = await api('POST', '/api/sessions', { title: k, workdir: PROJ });
     if (r.status !== 200 || !r.json?.id) die(`could not create session ${k}: ${r.text}`);
     ids[k] = r.json.id;
@@ -110,9 +110,11 @@ async function api(method, url, body) {
     die(`sessions were not worktree-isolated: ${JSON.stringify(tree)}`);
   }
   const age = db.prepare(`UPDATE sessions SET updated_at=datetime('now','-40 days') WHERE id=?`);
-  for (const k of ['clean', 'dirty', 'card']) age.run(ids[k]);
+  for (const k of ['clean', 'dirty', 'card', 'chained']) age.run(ids[k]);
   db.prepare(`INSERT INTO queued_messages (session_id, payload) VALUES (?, ?)`).run(ids.clean, JSON.stringify({ type: 'chat', text: 'queued' }));
   db.prepare(`INSERT INTO tasks (id, title, status, session_id) VALUES ('card-1', 'a card', 'backlog', ?)`).run(ids.card);
+  // A chain owns its tree before any member does — its session expiring must not take it.
+  db.prepare(`INSERT INTO task_chains (id, workdir, session_id) VALUES ('chain-1', ?, ?)`).run(tree.chained, ids.chained);
   db.close();
   fs.writeFileSync(path.join(tree.dirty, 'work-in-progress.txt'), 'not committed\n');
 
@@ -124,6 +126,19 @@ async function api(method, url, body) {
   git(['worktree', 'add', '-q', orphanNew, '-b', 'ccs/session-orphan-new'], PROJ);
   const twoHoursAgo = (Date.now() - 2 * 3600 * 1000) / 1000;
   fs.utimesSync(orphanOld, twoHoursAgo, twoHoursAgo);
+  // An OWNED old tree whose row spells the path in a different letter case. On a
+  // case-insensitive disk (macOS, Windows) that is the same directory, and a
+  // case-preserving compare would read it as an orphan.
+  const caseTree = path.join(slugDir, 'task-casecheck');
+  git(['worktree', 'add', '-q', caseTree, '-b', 'ccs/task-casecheck'], PROJ);
+  fs.utimesSync(caseTree, twoHoursAgo, twoHoursAgo);
+  const caseRow = caseTree.replace(/task-casecheck$/, 'TASK-CASECHECK');
+  const caseInsensitive = fs.existsSync(caseRow);
+  if (caseInsensitive) {
+    const dbc = new Database(path.join(APP_DIR, 'data', 'chats.db'));
+    dbc.prepare(`INSERT INTO tasks (id, title, status, workdir) VALUES ('case-1', 'case', 'backlog', ?)`).run(caseRow);
+    dbc.close();
+  }
 
   boot(); await up();   // expiry runs at startup
   const db2 = new Database(path.join(APP_DIR, 'data', 'chats.db'), { readonly: true });
@@ -147,6 +162,9 @@ async function api(method, url, body) {
   check('an orphan older than an hour is removed', fs.existsSync(orphanOld), false);
   check('…through git, branch included', branches().includes('ccs/session-orphan-old'), false);
   check('a fresh orphan is kept (its row may be a moment away)', fs.existsSync(orphanNew), true);
+  check('an expired chain session goes, its chain keeps the tree', [row(ids.chained), fs.existsSync(tree.chained)], [null, true]);
+  if (caseInsensitive) check('a tree owned under a differently-cased path is not an orphan', fs.existsSync(caseTree), true);
+  else console.log('  skip case-insensitive path check (this filesystem is case-sensitive)');
   db2.close();
 
   console.log('\n— the delete buttons share that teardown —');