diff --git a/README.md b/README.md
index 68b923b..465abc5 100644
--- a/README.md
+++ b/README.md
@@ -221,24 +221,56 @@ These are the things worth knowing up front; the rest is discoverable from
   main worktree. It refuses the primary worktree and honors the same `--force`
   guard.
 - **Bulk-clean stale branches.** `wt prune --all` (`-a`) deletes every local branch
-  you can drop without losing a commit, meaning each of its commits is also on a
-  remote or on the default branch. It also removes worktrees whose work is
-  finished. You can pick the modes one at a time:
+  you can drop without losing work. Each of its commits must be on a remote or on
+  the default branch, or its changes must already be in the default branch under
+  other commits (a squash or rebase merge). It also removes worktrees whose work is
+  finished, including detached-HEAD ones. You can pick the modes one at a time:
   - `--merged`: worktrees and branches merged into the default branch, either the
-    local copy or `origin`'s.
+    local copy or `origin`'s. A branch counts as merged when it is an ancestor of
+    the default branch, or when merging it would change nothing. That covers
+    squash merges, rebase merges, work split across several PRs, and branches made
+    only of merges. A branch whose own commits add up to no change is never
+    merged by content. Custom merge drivers from `.gitattributes` (such as
+    `merge=ours`) are disabled for this check, so a file one governs reads as not
+    merged. `merge=union` files and `merge.default` are merged as plain text.
+    The content check needs git ≥ 2.38. On older git only ancestry counts.
   - `--gone`: worktrees and branches whose upstream was deleted, plus any missing
     worktrees.
-  - `--pushed`: branches (never worktrees) whose every commit is already on a
-    remote, such as an open PR's branch.
+  - `--pushed`: branches without a worktree, and detached worktrees, whose every
+    commit is already on a remote, such as an open PR's branch. A worktree with a
+    branch checked out counts as active work and is left alone.
 
   Every mode deletes matching **local branches that have no worktree**, so a pile of
   old feature branches gets cleaned up too. Under `--all`, the branch of a removed
-  worktree goes with it. A branch holding commits that exist nowhere else is
-  skipped unless you pass `--force`. This includes a `--gone` branch that was never
-  merged. The modes that read remote state (`--gone`, `--pushed`, `--all`) run
-  `git fetch --all --prune` first, so "still on the remote" means the remote now.
-  Pass `--no-fetch` to trust the last fetch. Preview with `--dry-run`. The current
-  and default branches are never touched.
+  worktree goes with it. The modes that read remote state (`--gone`, `--pushed`,
+  `--all`) run `git fetch --all --prune` first, so "still on the remote" means the
+  remote now. Pass `--no-fetch` to trust the last fetch. Preview with `--dry-run`.
+
+  Anything that qualifies but is kept is listed as `skipping <name>: <why>`:
+  - A worktree with uncommitted changes, or a branch or detached worktree whose
+    work exists nowhere else, is skipped unless you pass `--force`. A missing
+    detached worktree counts, because its registration holds its only HEAD.
+    Untracked files always count as uncommitted changes here, whatever
+    `remove.untracked_blocks` says. Ignored files (build output) do not.
+  - A locked worktree is skipped unless you pass `--locked`. Agent harnesses often
+    lock their worktrees.
+  - These are never removed: the worktree you're in, a worktree in the middle of a
+    rebase, merge, cherry-pick, revert, or bisect (and the branch it will return
+    to), and the current and default branches. If a worktree's git directory
+    cannot be found, prune cannot tell which branch it holds, so no branch
+    without a worktree is deleted on that run.
+
+  Prune removes only what it lists. It no longer runs a blanket
+  `git worktree prune`, so a missing worktree that no mode selects stays
+  registered.
+
+  A detached worktree is judged by where its HEAD is now. If you committed in
+  one and then moved HEAD back (say, `git checkout --detach main`), it qualifies,
+  and removing it deletes its HEAD reflog: commits reachable only from that
+  reflog are lost. Branch or tag them first.
+
+  `--json` prints one line per item that would be removed, each with a `reason`
+  (`merged`, `merged by content`, `upstream gone`, `missing`, or `pushed`).
 
 ## Using wt as a library
 
diff --git a/src/cli.rs b/src/cli.rs
index a3dcdd6..c1f0944 100644
--- a/src/cli.rs
+++ b/src/cli.rs
@@ -354,28 +354,37 @@ pub(crate) struct DropArgs {
 /// Arguments for `wt prune`.
 #[derive(Debug, Args)]
 pub(crate) struct PruneArgs {
-    /// Include worktrees and branches merged into the default branch (local or
-    /// its `origin` tracking ref).
+    /// Include worktrees (detached ones too) and branches merged into the default
+    /// branch (local or its `origin` tracking ref), by ancestry or by content — a
+    /// squash or rebase merge counts.
     #[arg(long)]
     pub(crate) merged: bool,
     /// Include worktrees and branches whose upstream is gone, and missing worktrees.
     #[arg(long)]
     pub(crate) gone: bool,
-    /// Include branches (not worktrees) whose every commit is on a remote or the
-    /// default branch.
+    /// Include branches without a worktree, and detached worktrees, whose every
+    /// commit is on a remote or the default branch.
     #[arg(long)]
     pub(crate) pushed: bool,
-    /// Include everything deletable without losing a commit: merged and gone
-    /// worktrees, plus every merged, pushed, or gone branch whose commits survive.
+    /// Include everything deletable without losing work: merged, gone, and pushed
+    /// candidates, where a branch counts as safe when its commits are on a remote
+    /// or its changes are already in the default branch.
     #[arg(short = 'a', long)]
     pub(crate) all: bool,
+    /// Also remove locked worktrees (`git worktree remove --force --force`).
+    /// Without it they are listed and skipped.
+    #[arg(long)]
+    pub(crate) locked: bool,
     /// Trust the last fetch instead of running `git fetch --all --prune` first.
     #[arg(long = "no-fetch")]
     pub(crate) no_fetch: bool,
     /// Report candidates without removing anything.
     #[arg(long = "dry-run")]
     pub(crate) dry_run: bool,
-    /// Include dirty worktrees and force-delete unmerged branches (implies `--yes`).
+    /// Include dirty worktrees, and remove branches and detached worktrees whose
+    /// work exists nowhere else, orphaning those commits (implies `--yes`).
+    /// Never overrides a lock or an in-progress rebase, merge, cherry-pick,
+    /// revert, or bisect.
     #[arg(long)]
     pub(crate) force: bool,
 }
@@ -884,6 +893,10 @@ mod tests {
         assert!(!prune(&["prune", "--merged"]).needs_fetch());
         assert!(!prune(&["prune", "--all", "--no-fetch"]).needs_fetch());
         assert!(!prune(&["prune", "--pushed", "--no-fetch"]).needs_fetch());
+        // `--locked` is its own opt-in, separate from `--force`.
+        let locked = prune(&["prune", "-a", "--locked"]);
+        assert!(locked.locked && !locked.force);
+        assert!(!prune(&["prune", "-a"]).locked);
     }
 
     #[test]
diff --git a/src/commands/mod.rs b/src/commands/mod.rs
index d948181..fd55134 100644
--- a/src/commands/mod.rs
+++ b/src/commands/mod.rs
@@ -37,7 +37,7 @@ use crate::worktree::{CreatedWorktree, HookOutcome, Workspace, WorkspaceParts, b
 
 // Path/template helpers shared with the service layer, re-exported so command
 // modules keep their historical import paths.
-pub(crate) use crate::worktree::{resolve_target, rollback_worktree, run_best_effort, same_path};
+pub(crate) use crate::worktree::{resolve_target, rollback_worktree, same_path};
 
 /// A discovered repository plus its resolved configuration, set up once per
 /// repo-scoped command.
diff --git a/src/commands/prune.rs b/src/commands/prune.rs
deleted file mode 100644
index 36f7ad5..0000000
--- a/src/commands/prune.rs
+++ /dev/null
@@ -1,1090 +0,0 @@
-//! `wt prune` — bulk cleanup of merged or stale worktrees, and the local
-//! branches they leave behind (spec §7/§12).
-
-use std::collections::HashSet;
-use std::path::Path;
-
-use crate::cli::PruneArgs;
-use crate::commands::{Session, candidate_label, confirm, open_session, run_best_effort};
-use crate::config::wtconfig;
-use crate::cx::Cx;
-use crate::error::{Error, Result};
-use crate::git::aheadbehind::is_recoverable;
-use crate::git::cli::GitCli;
-use crate::git::discover::Repo;
-use crate::git::{
-    branch_ref, current_branch, default_branch, default_tracking_ref, is_ancestor, local_branches,
-    ops, resolve_hex, upstream_of,
-};
-use crate::model::Worktree;
-use crate::worktree::{build_worktrees, guard_status, lock_repo};
-
-/// A prune target: an existing worktree (an index into the worktree list) or a
-/// bare local branch — one with no worktree — that qualified for removal.
-enum Candidate {
-    /// An existing worktree, identified by its index in the worktree list.
-    Worktree(usize),
-    /// A local branch with no worktree. `merged` records whether it is an
-    /// ancestor of the default branch; `safe` whether every commit on it is also
-    /// on a remote-tracking ref or the default branch, so deleting it loses
-    /// nothing. An unsafe branch (a gone branch with local-only commits) needs
-    /// `--force`.
-    Branch {
-        name: String,
-        merged: bool,
-        safe: bool,
-    },
-}
-
-/// The refs a branch counts as merged into: the local default branch and, when
-/// `origin/HEAD` is set, its remote-tracking ref — so work merged on the remote
-/// is seen even while the local default lags behind.
-struct MergeTargets {
-    /// The default branch's short name (never itself a prune candidate).
-    default: Option<String>,
-    /// Full refs to test ancestry against, each known to resolve.
-    refs: Vec<String>,
-}
-
-impl MergeTargets {
-    fn resolve(repo: &Repo) -> Self {
-        let default = default_branch(repo.gix());
-        let refs = default
-            .as_deref()
-            .map(branch_ref)
-            .into_iter()
-            .chain(default_tracking_ref(repo.gix()))
-            .filter(|r| resolve_hex(repo.gix(), r).is_some())
-            .collect();
-        MergeTargets { default, refs }
-    }
-
-    /// Whether `branch` is an ancestor of any target. The default branch itself
-    /// is never "merged" (it is trivially its own ancestor).
-    fn is_merged(&self, repo: &Repo, branch: &str) -> bool {
-        self.default.as_deref() != Some(branch)
-            && self
-                .refs
-                .iter()
-                .any(|target| is_ancestor(repo.gix(), &branch_ref(branch), target))
-    }
-
-    /// The local default branch ref, if it resolves — the one non-remote ref
-    /// whose commits count as kept by the recoverability check.
-    fn local_default_ref(&self) -> Option<&str> {
-        let local = branch_ref(self.default.as_deref()?);
-        self.refs.iter().find(|r| **r == local).map(String::as_str)
-    }
-}
-
-/// Selects and removes prune candidates after confirmation (spec §7/§12).
-pub(crate) fn run(cx: &mut Cx, args: &PruneArgs, json: bool) -> Result<u8> {
-    if !args.includes_merged() && !args.includes_gone() && !args.includes_pushed() {
-        return Err(Error::usage(
-            "prune requires --merged, --gone, --pushed, or --all",
-        ));
-    }
-    let git = cx.git.clone();
-    let git = git.as_ref();
-    let session = open_session(cx, git)?;
-    let root = session.primary_root.clone();
-    // "Gone" and "still on the remote" are only as true as the remote-tracking
-    // refs, so the modes that read them refresh them first (dry runs included,
-    // so a preview never promises something the real run would not do).
-    if args.needs_fetch() {
-        fetch_remotes(git, &session.repo, &root)?;
-    }
-    let worktrees = build_worktrees(&session.repo, git)?;
-    let targets = MergeTargets::resolve(&session.repo);
-    let current = current_branch(session.repo.gix());
-
-    let mut candidates: Vec<Candidate> = worktrees
-        .iter()
-        .enumerate()
-        .filter(|(_, w)| !w.is_main && is_candidate(&session.repo, w, args, &targets))
-        .map(|(i, _)| Candidate::Worktree(i))
-        .collect();
-
-    // Branches that keep a worktree (the primary checkout and any branch checked
-    // out elsewhere) are left to the worktree path, so a branch is never counted
-    // — or deleted — twice. Under `--all` the branch of a worktree being removed
-    // is also judged as a bare branch, so one pass clears both.
-    let worktree_branches: HashSet<String> = worktrees
-        .iter()
-        .enumerate()
-        .filter(|(i, _)| {
-            !(args.all
-                && candidates
-                    .iter()
-                    .any(|c| matches!(c, Candidate::Worktree(j) if j == i)))
-        })
-        .filter_map(|(_, w)| w.branch.clone())
-        .collect();
-    candidates.extend(branch_candidates(
-        git,
-        &root,
-        &session.repo,
-        args,
-        &targets,
-        &current,
-        &worktree_branches,
-    )?);
-
-    // The worktree/branch gap is the signal when a prune surprises someone.
-    tracing::debug!(
-        default = ?targets.default,
-        merge_targets = ?targets.refs,
-        worktrees = worktrees.len(),
-        candidates = candidates.len(),
-        local_branches = local_branches(session.repo.gix()).map_or(0, |b| b.len()),
-        "prune: candidate selection",
-    );
-
-    // `--dry-run` (and the `--json` form) only report the candidate set.
-    if args.dry_run || json {
-        // Report the empty case explicitly on stderr (stdout stays clean for
-        // `--json`) so a dry-run that finds nothing is never silently blank.
-        if candidates.is_empty() && !json {
-            cx.err.line("nothing to prune")?;
-        }
-        for candidate in &candidates {
-            if json {
-                cx.out.line(&candidate_json(&worktrees, candidate)?)?;
-            } else {
-                cx.out.line(&format!(
-                    "would remove {}",
-                    candidate_text(&worktrees, candidate)
-                ))?;
-            }
-        }
-        return Ok(0);
-    }
-
-    if candidates.is_empty() {
-        cx.err.line("nothing to prune")?;
-        let _lock = lock_repo(&root)?;
-        ops::worktree_prune(git, &root)?;
-        return Ok(0);
-    }
-
-    // Confirmation prompt (unless --force).
-    if !args.force {
-        cx.err.line("to remove:")?;
-        for candidate in &candidates {
-            cx.err
-                .line(&format!("  {}", candidate_text(&worktrees, candidate)))?;
-        }
-        if !confirm(cx, "Proceed? [y/N] ")? {
-            cx.err.line("aborted")?;
-            return Ok(0);
-        }
-    }
-
-    // Every removal below deletes worktrees, branches, and `wt.*` metadata, so
-    // the whole loop is one mutation region under the advisory repo lock (issue
-    // #99). `prune` runs no hooks, so nothing inside can re-enter `wt`.
-    let lock = lock_repo(&root)?;
-    let mut removed = 0_usize;
-    // Branches whose worktree was skipped (dirty) stay checked out, so their
-    // `--all` branch candidate is skipped too. Worktree candidates come first.
-    let mut kept: HashSet<&str> = HashSet::new();
-    let mut reconciled = false;
-    for candidate in &candidates {
-        // A missing worktree stays registered until Git's worktree metadata is
-        // reconciled, and Git refuses to delete a branch it still sees checked
-        // out — so reconcile once, after the worktrees and before the branches.
-        if !reconciled && matches!(candidate, Candidate::Branch { .. }) {
-            ops::worktree_prune(git, &root)?;
-            reconciled = true;
-        }
-        let pruned = match candidate {
-            Candidate::Worktree(index) => {
-                let worktree = &worktrees[*index];
-                let pruned = remove_worktree(cx, git, &session, &root, worktree, args, &targets)?;
-                if !pruned && let Some(branch) = &worktree.branch {
-                    kept.insert(branch);
-                }
-                pruned
-            }
-            Candidate::Branch { name, .. } if kept.contains(name.as_str()) => false,
-            Candidate::Branch { name, safe, .. } => {
-                remove_branch(cx, git, &root, name, *safe, args.force, &targets)?
-            }
-        };
-        if pruned {
-            removed += 1;
-        }
-    }
-
-    // Reconcile Git's worktree admin metadata (equivalent to `git worktree prune`).
-    ops::worktree_prune(git, &root)?;
-    drop(lock);
-    tracing::debug!(removed, "prune: done");
-    cx.err.line(&format!("pruned {removed} item(s)"))?;
-    Ok(0)
-}
-
-/// Runs `git fetch --all --prune` when the repository has any remote, so the
-/// remote-tracking refs prune reads reflect the remote now. A failed fetch aborts
-/// rather than letting a stale ref vouch for commits the remote no longer has.
-fn fetch_remotes(git: &dyn GitCli, repo: &Repo, root: &Path) -> Result<()> {
-    if repo.gix().remote_names().is_empty() {
-        tracing::debug!("prune: no remotes; skipping fetch");
-        return Ok(());
-    }
-    tracing::debug!("prune: fetching remotes");
-    ops::fetch_all_prune(git, root).map_err(|e| {
-        Error::operation(format!(
-            "cannot fetch remotes: {e}\n(pass --no-fetch to trust the last fetch)"
-        ))
-    })?;
-    Ok(())
-}
-
-/// Selects local branches that have no worktree but qualify for pruning: merged
-/// into the default branch (`--merged`), with a gone upstream (`--gone`), with
-/// every commit on a remote or the default branch (`--pushed`), or any of these
-/// (`--all`). The default branch and the current branch are never selected, and
-/// branches that keep a worktree are left to the worktree path.
-fn branch_candidates(
-    git: &dyn GitCli,
-    root: &Path,
-    repo: &Repo,
-    args: &PruneArgs,
-    targets: &MergeTargets,
-    current: &Option<String>,
-    worktree_branches: &HashSet<String>,
-) -> Result<Vec<Candidate>> {
-    let keep: Vec<&str> = targets.local_default_ref().into_iter().collect();
-    let mut out = Vec::new();
-    for branch in local_branches(repo.gix())? {
-        if worktree_branches.contains(&branch)
-            || targets.default.as_deref() == Some(branch.as_str())
-            || current.as_deref() == Some(branch.as_str())
-        {
-            continue;
-        }
-        let merged = targets.is_merged(repo, &branch);
-        let gone = upstream_of(repo.gix(), &branch).is_some_and(|u| u.is_gone);
-        let by_mode = (args.includes_merged() && merged) || (args.includes_gone() && gone);
-        // The recoverability check costs a subprocess; skip it for a branch no
-        // selected mode could pick.
-        if !by_mode && !args.includes_pushed() {
-            continue;
-        }
-        let safe = branch_is_recoverable(git, root, &branch, &keep);
-        tracing::trace!(branch = %branch, merged, gone, safe, "prune: branch classified");
-        if by_mode || (args.includes_pushed() && safe) {
-            out.push(Candidate::Branch {
-                name: branch,
-                merged,
-                safe,
-            });
-        }
-    }
-    Ok(out)
-}
-
-/// [`is_recoverable`] for a local branch, treating a failed check as unsafe so a
-/// git error can never be the reason a branch is deleted.
-fn branch_is_recoverable(git: &dyn GitCli, root: &Path, branch: &str, keep: &[&str]) -> bool {
-    is_recoverable(git, root, &branch_ref(branch), keep).unwrap_or_else(|e| {
-        tracing::warn!(branch = %branch, error = %e, "prune: recoverability check failed");
-        false
-    })
-}
-
-/// Removes one worktree candidate, returning whether it was removed (a dirty
-/// worktree is skipped unless `--force`). This is the per-worktree body of the
-/// prune loop (spec §12).
-fn remove_worktree(
-    cx: &mut Cx,
-    git: &dyn GitCli,
-    session: &Session,
-    root: &Path,
-    worktree: &Worktree,
-    args: &PruneArgs,
-    targets: &MergeTargets,
-) -> Result<bool> {
-    // Dirty worktrees are skipped unless --force (spec §12).
-    if !args.force && guard_status(worktree, session.config.remove_untracked_blocks).dirty {
-        cx.err.line(&format!(
-            "skipping dirty worktree {}",
-            candidate_label(worktree)
-        ))?;
-        return Ok(false);
-    }
-    if !worktree.is_missing {
-        let path = worktree.path.to_string_lossy();
-        run_best_effort(
-            git,
-            root,
-            &["worktree", "remove", "--force", &path],
-            "prune: worktree remove",
-        );
-    }
-    delete_merged_branch(git, &session.repo, root, worktree, &session.config, targets);
-    if let Some(branch) = &worktree.branch {
-        let _ = wtconfig::clear_meta(git, root, branch);
-    }
-    tracing::debug!(target_wt = %candidate_label(worktree), "prune: removed worktree");
-    Ok(true)
-}
-
-/// Deletes one bare-branch candidate, returning whether it was deleted. A safe
-/// branch — every commit also on a remote or the default branch — is re-checked
-/// under the lock (it may have moved since selection) and then deleted with
-/// `git branch -D`, since `-d` only knows about HEAD and the upstream. An unsafe
-/// branch may hold commits found nowhere else, so it is skipped unless `--force`.
-/// A branch already gone (deleted with its worktree) is skipped quietly, and a
-/// delete failure is reported and skipped rather than aborting the whole prune.
-fn remove_branch(
-    cx: &mut Cx,
-    git: &dyn GitCli,
-    root: &Path,
-    name: &str,
-    safe: bool,
-    force: bool,
-    targets: &MergeTargets,
-) -> Result<bool> {
-    if !branch_exists(git, root, name) {
-        tracing::debug!(branch = %name, "prune: branch already deleted");
-        return Ok(false);
-    }
-    let keep: Vec<&str> = targets.local_default_ref().into_iter().collect();
-    if !force && !(safe && branch_is_recoverable(git, root, name, &keep)) {
-        cx.err.line(&format!(
-            "skipping {name}: branch has commits on no remote or default branch; use --force"
-        ))?;
-        tracing::debug!(branch = %name, "prune: skip unrecoverable branch");
-        return Ok(false);
-    }
-    match ops::delete_branch(git, root, name, true) {
-        Ok(out) if out.success => {
-            let _ = wtconfig::clear_meta(git, root, name);
-            tracing::debug!(branch = %name, safe, "prune: deleted branch");
-            Ok(true)
-        }
-        Ok(out) => {
-            cx.err
-                .line(&format!("could not delete {name}: {}", out.stderr.trim()))?;
-            tracing::warn!(branch = %name, "prune: branch delete failed");
-            Ok(false)
-        }
-        Err(error) => {
-            cx.err.line(&format!("could not delete {name}: {error}"))?;
-            tracing::warn!(branch = %name, "prune: branch delete errored");
-            Ok(false)
-        }
-    }
-}
-
-/// Whether the local branch `name` still exists.
-fn branch_exists(git: &dyn GitCli, root: &Path, name: &str) -> bool {
-    git.run_raw(
-        root,
-        &["rev-parse", "--verify", "--quiet", &branch_ref(name)],
-    )
-    .is_ok_and(|out| out.success)
-}
-
-/// A human label for a prune candidate (worktree or bare branch).
-fn candidate_text(worktrees: &[Worktree], candidate: &Candidate) -> String {
-    match candidate {
-        Candidate::Worktree(index) => candidate_label(&worktrees[*index]),
-        Candidate::Branch { name, .. } => format!("{name} (branch)"),
-    }
-}
-
-/// A machine-readable (`--json`) line for a prune candidate. A worktree emits its
-/// full row; a bare branch emits a small object tagged `"kind": "branch"`.
-fn candidate_json(worktrees: &[Worktree], candidate: &Candidate) -> Result<String> {
-    match candidate {
-        Candidate::Worktree(index) => worktrees[*index].to_json_line(),
-        Candidate::Branch { name, merged, safe } => Ok(serde_json::json!({
-            "branch": name,
-            "kind": "branch",
-            "merged": merged,
-            "safe": safe,
-        })
-        .to_string()),
-    }
-}
-
-/// Whether a worktree is a prune candidate for the given flags.
-fn is_candidate(
-    repo: &crate::git::discover::Repo,
-    worktree: &Worktree,
-    args: &PruneArgs,
-    targets: &MergeTargets,
-) -> bool {
-    // `is_merged` never counts the default branch itself, so a worktree checked
-    // out on the default branch is never pruned as merged.
-    if args.includes_merged()
-        && let Some(branch) = &worktree.branch
-        && targets.is_merged(repo, branch)
-    {
-        return true;
-    }
-    if args.includes_gone() && (worktree.is_missing || upstream_is_gone(repo, worktree)) {
-        return true;
-    }
-    false
-}
-
-/// Whether the worktree's upstream is configured but gone (offline check).
-fn upstream_is_gone(repo: &crate::git::discover::Repo, worktree: &Worktree) -> bool {
-    worktree
-        .branch
-        .as_deref()
-        .and_then(|b| upstream_of(repo.gix(), b))
-        .is_some_and(|u| u.is_gone)
-}
-
-/// Deletes a wt-created branch that is fully merged into the default branch.
-fn delete_merged_branch(
-    git: &dyn GitCli,
-    repo: &crate::git::discover::Repo,
-    root: &Path,
-    worktree: &Worktree,
-    config: &crate::config::Config,
-    targets: &MergeTargets,
-) {
-    let Some(branch) = &worktree.branch else {
-        return;
-    };
-    if !config.remove_delete_merged_branch {
-        return;
-    }
-    let meta = wtconfig::read_meta(repo.gix(), branch);
-    if !meta.created_by_wt {
-        return;
-    }
-    if targets.is_merged(repo, branch) {
-        run_best_effort(
-            git,
-            root,
-            &["branch", "-D", branch],
-            "prune: delete merged branch",
-        );
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use crate::cli::PruneArgs;
-    use crate::error::Error;
-    use crate::git::cli::RealGit;
-    use crate::testutil::{CannedInput, TestRepo, give_upstream, make_wt, wt_dir};
-
-    fn prune_args(merged: bool, gone: bool, dry_run: bool, force: bool) -> PruneArgs {
-        PruneArgs {
-            merged,
-            gone,
-            pushed: false,
-            all: false,
-            no_fetch: false,
-            dry_run,
-            force,
-        }
-    }
-
-    /// `--all` alone (no `--merged`/`--gone`), as a dry run.
-    fn all_dry_run() -> PruneArgs {
-        PruneArgs {
-            all: true,
-            ..prune_args(false, false, true, false)
-        }
-    }
-
-    /// `--pushed` alone, as a dry run.
-    fn pushed_dry_run() -> PruneArgs {
-        PruneArgs {
-            pushed: true,
-            ..prune_args(false, false, true, false)
-        }
-    }
-
-    /// `--all` for real, without `--force` (the confirmation is answered by `-y`).
-    fn all_run() -> PruneArgs {
-        PruneArgs {
-            all: true,
-            ..prune_args(false, false, false, false)
-        }
-    }
-
-    /// Runs prune with `args` and returns stdout (the dry-run report).
-    fn report(repo: &TestRepo, args: &PruneArgs) -> String {
-        let mut t = crate::testutil::test_cx(&[], repo.root().to_str().unwrap());
-        super::run(&mut t.cx, args, false).unwrap();
-        t.out.contents()
-    }
-
-    /// Runs prune with `args`, answering the prompt with `-y`, and returns stderr.
-    fn run_yes(repo: &TestRepo, args: &PruneArgs) -> String {
-        let mut t = crate::testutil::test_cx(&[], repo.root().to_str().unwrap());
-        t.cx.assume_yes = true;
-        super::run(&mut t.cx, args, false).unwrap();
-        t.err.contents()
-    }
-
-    /// Records a remote-tracking ref `refs/remotes/origin/<remote_name>` at
-    /// `name`'s tip, as if the branch had been pushed there.
-    fn push_tip(repo: &TestRepo, name: &str, remote_name: &str) {
-        repo.git(&[
-            "update-ref",
-            &format!("refs/remotes/origin/{remote_name}"),
-            &format!("refs/heads/{name}"),
-        ]);
-    }
-
-    fn has_branch(repo: &TestRepo, name: &str) -> bool {
-        !repo.git(&["branch", "--list", name]).trim().is_empty()
-    }
-
-    /// A branch at the current tip — an ancestor of the default branch (merged),
-    /// with no worktree.
-    fn bare_branch(repo: &TestRepo, name: &str) {
-        repo.git(&["branch", name]);
-    }
-
-    /// A branch carrying its own commit, so it is NOT an ancestor of the default
-    /// branch; leaves the repo back on `main`.
-    fn diverged_branch(repo: &TestRepo, name: &str) {
-        repo.git(&["checkout", "-q", "-b", name]);
-        repo.write(&format!("{name}.txt"), "x\n");
-        repo.commit_all("diverge");
-        repo.git(&["checkout", "-q", "main"]);
-    }
-
-    /// Configures an upstream for `name` whose tracking ref does not exist, so
-    /// `upstream_of(...).is_gone` is true.
-    fn give_gone_upstream(repo: &TestRepo, name: &str) {
-        repo.git(&["config", &format!("branch.{name}.remote"), "origin"]);
-        repo.git(&[
-            "config",
-            &format!("branch.{name}.merge"),
-            &format!("refs/heads/{name}"),
-        ]);
-    }
-
-    /// Creates a worktree on `branch` and commits in it so the branch diverges
-    /// from main — i.e. it is not merged.
-    fn make_unmerged_wt(repo: &TestRepo, branch: &str) {
-        make_wt(repo, branch);
-        let wt = wt_dir(repo, branch);
-        std::fs::write(wt.join("change.txt"), "x\n").unwrap();
-        let dir = wt.to_string_lossy().into_owned();
-        repo.git(&["-C", &dir, "add", "-A"]);
-        repo.git(&["-C", &dir, "commit", "-q", "-m", "unmerged change"]);
-    }
-
-    #[test]
-    fn requires_a_mode_flag() {
-        let repo = TestRepo::init();
-        let mut t = crate::testutil::test_cx(&[], repo.root().to_str().unwrap());
-        let err =
-            super::run(&mut t.cx, &prune_args(false, false, false, false), false).unwrap_err();
-        assert_eq!(err.exit_code(), 2);
-    }
-
-    #[test]
-    fn dry_run_reports_merged_candidates_without_removing() {
-        let repo = TestRepo::init();
-        make_wt(&repo, "merged-wt"); // merged into main (no new commits)
-        let mut t = crate::testutil::test_cx(&[], repo.root().to_str().unwrap());
-        super::run(&mut t.cx, &prune_args(true, false, true, false), false).unwrap();
-        assert!(t.out.contents().contains("would remove merged-wt"));
-        // Still present (dry-run).
-        assert!(repo.git(&["worktree", "list"]).contains("merged-wt"));
-    }
-
-    #[test]
-    fn dry_run_reports_nothing_when_no_candidates() {
-        let repo = TestRepo::init();
-        let mut t = crate::testutil::test_cx(&[], repo.root().to_str().unwrap());
-        super::run(&mut t.cx, &prune_args(true, false, true, false), false).unwrap();
-        // A dry-run that finds nothing says so on stderr; stdout stays empty.
-        assert!(t.err.contents().contains("nothing to prune"));
-        assert!(t.out.contents().is_empty());
-    }
-
-    #[test]
-    fn force_prunes_merged_worktree_and_branch() {
-        let repo = TestRepo::init();
-        make_wt(&repo, "merged-wt");
-        let mut t = crate::testutil::test_cx(&[], repo.root().to_str().unwrap());
-        super::run(&mut t.cx, &prune_args(true, false, false, true), false).unwrap();
-        assert!(!repo.git(&["worktree", "list"]).contains("merged-wt"));
-        assert!(
-            repo.git(&["branch", "--list", "merged-wt"])
-                .trim()
-                .is_empty()
-        );
-    }
-
-    /// Prune's removal loop deletes worktrees, branches, and `wt.*` metadata,
-    /// so it runs under the advisory repo lock (issue #99). A concurrent holder
-    /// blocks it outright rather than letting it interleave — and nothing is
-    /// removed when it does.
-    #[test]
-    fn prune_is_excluded_by_a_concurrent_lock_holder() {
-        let repo = TestRepo::init();
-        make_wt(&repo, "merged-wt");
-        let mut t = crate::testutil::test_cx(&[], repo.root().to_str().unwrap());
-        let ws = crate::worktree::Workspace::discover(repo.root(), &t.cx.env, &RealGit).unwrap();
-        let held = ws.lock().unwrap();
-        let err = super::run(&mut t.cx, &prune_args(true, false, false, true), false).unwrap_err();
-        drop(held);
-        assert!(matches!(err, Error::LockUnavailable { .. }), "{err:?}");
-        assert!(repo.git(&["worktree", "list"]).contains("merged-wt"));
-    }
-
-    #[test]
-    fn confirmation_yes_prunes() {
-        let repo = TestRepo::init();
-        make_wt(&repo, "merged-wt");
-        let mut t = crate::testutil::test_cx(&[], repo.root().to_str().unwrap());
-        t.cx.input = Box::new(CannedInput::new(&["y"]));
-        super::run(&mut t.cx, &prune_args(true, false, false, false), false).unwrap();
-        assert!(t.err.contents().contains("Proceed?"));
-        assert!(!repo.git(&["worktree", "list"]).contains("merged-wt"));
-    }
-
-    /// `--yes` answers the prompt but is not `--force`: a dirty worktree is still
-    /// skipped. Keeping the two separable is what makes `-y` safe in a script.
-    #[test]
-    fn assume_yes_skips_prompt_but_not_the_dirty_guard() {
-        let repo = TestRepo::init();
-        make_wt(&repo, "clean-wt");
-        make_wt(&repo, "dirty-wt");
-        std::fs::write(wt_dir(&repo, "dirty-wt").join("README.md"), "dirty\n").unwrap();
-
-        let mut t = crate::testutil::test_cx(&[], repo.root().to_str().unwrap());
-        t.cx.assume_yes = true;
-        // No CannedInput: reading stdin at all would return "" and abort.
-        super::run(&mut t.cx, &prune_args(true, false, false, false), false).unwrap();
-
-        assert!(t.err.contents().contains("Proceed? [y/N] y (--yes)"));
-        assert!(
-            t.err
-                .contents()
-                .contains("skipping dirty worktree dirty-wt")
-        );
-        let list = repo.git(&["worktree", "list"]);
-        assert!(!list.contains("clean-wt"), "{list}");
-        assert!(list.contains("dirty-wt"), "{list}");
-    }
-
-    #[test]
-    fn confirmation_no_aborts() {
-        let repo = TestRepo::init();
-        make_wt(&repo, "merged-wt");
-        let mut t = crate::testutil::test_cx(&[], repo.root().to_str().unwrap());
-        t.cx.input = Box::new(CannedInput::new(&["n"]));
-        super::run(&mut t.cx, &prune_args(true, false, false, false), false).unwrap();
-        assert!(t.err.contents().contains("aborted"));
-        assert!(repo.git(&["worktree", "list"]).contains("merged-wt"));
-    }
-
-    #[test]
-    fn gone_prunes_missing_worktrees() {
-        let repo = TestRepo::init();
-        make_wt(&repo, "goner");
-        let repo_name = repo.root().file_name().unwrap().to_string_lossy();
-        let wt_path = repo
-            .root()
-            .parent()
-            .unwrap()
-            .join(format!("{repo_name}.worktrees/{repo_name}-goner"));
-        std::fs::remove_dir_all(&wt_path).unwrap();
-        let mut t = crate::testutil::test_cx(&[], repo.root().to_str().unwrap());
-        super::run(&mut t.cx, &prune_args(false, true, false, true), false).unwrap();
-        assert!(!repo.git(&["worktree", "list"]).contains("goner"));
-    }
-
-    #[test]
-    fn json_lists_candidates_without_removing() {
-        let repo = TestRepo::init();
-        make_wt(&repo, "merged-wt");
-        let mut t = crate::testutil::test_cx(&[], repo.root().to_str().unwrap());
-        super::run(&mut t.cx, &prune_args(true, false, false, false), true).unwrap();
-        let out = t.out.contents();
-        assert_eq!(out.lines().count(), 1);
-        let v: serde_json::Value = serde_json::from_str(out.trim()).unwrap();
-        assert_eq!(v["branch"], serde_json::json!("merged-wt"));
-        // --json implies dry-run: still present.
-        assert!(repo.git(&["worktree", "list"]).contains("merged-wt"));
-    }
-
-    #[test]
-    fn merged_bare_branch_is_pruned() {
-        let repo = TestRepo::init();
-        bare_branch(&repo, "old"); // no worktree, merged into main
-        let mut t = crate::testutil::test_cx(&[], repo.root().to_str().unwrap());
-        super::run(&mut t.cx, &prune_args(true, false, false, true), false).unwrap();
-        assert!(repo.git(&["branch", "--list", "old"]).trim().is_empty());
-        // The default/current branch is never touched.
-        assert!(repo.git(&["branch", "--list", "main"]).contains("main"));
-    }
-
-    #[test]
-    fn gone_merged_bare_branch_is_pruned() {
-        let repo = TestRepo::init();
-        bare_branch(&repo, "old");
-        give_gone_upstream(&repo, "old"); // merged AND upstream gone
-        let mut t = crate::testutil::test_cx(&[], repo.root().to_str().unwrap());
-        super::run(&mut t.cx, &prune_args(false, true, false, true), false).unwrap();
-        assert!(repo.git(&["branch", "--list", "old"]).trim().is_empty());
-    }
-
-    #[test]
-    fn gone_unmerged_branch_needs_force() {
-        let repo = TestRepo::init();
-        diverged_branch(&repo, "wip"); // not an ancestor of main
-        give_gone_upstream(&repo, "wip");
-        // Without --force the protected branch is skipped (confirmation says yes).
-        let mut t = crate::testutil::test_cx(&[], repo.root().to_str().unwrap());
-        t.cx.input = Box::new(CannedInput::new(&["y"]));
-        super::run(&mut t.cx, &prune_args(false, true, false, false), false).unwrap();
-        assert!(t.err.contents().contains("use --force"));
-        assert!(repo.git(&["branch", "--list", "wip"]).contains("wip"));
-        // With --force it is force-deleted.
-        let mut t = crate::testutil::test_cx(&[], repo.root().to_str().unwrap());
-        super::run(&mut t.cx, &prune_args(false, true, false, true), false).unwrap();
-        assert!(repo.git(&["branch", "--list", "wip"]).trim().is_empty());
-    }
-
-    #[test]
-    fn all_selects_merged_and_gone() {
-        let repo = TestRepo::init();
-        bare_branch(&repo, "old"); // merged only
-        diverged_branch(&repo, "wip"); // gone only, commits nowhere else
-        give_gone_upstream(&repo, "wip");
-        let all = report(&repo, &all_dry_run());
-        assert!(all.contains("would remove old (branch)"), "{all}");
-        assert!(all.contains("would remove wip (branch)"), "{all}");
-        // Same selection as `--merged --gone` here; each mode alone picks one.
-        assert_eq!(all, report(&repo, &prune_args(true, true, true, false)));
-        assert!(!report(&repo, &prune_args(true, false, true, false)).contains("wip"));
-        assert!(!report(&repo, &prune_args(false, true, true, false)).contains("old"));
-        // Nothing was removed.
-        assert!(has_branch(&repo, "old"));
-        assert!(has_branch(&repo, "wip"));
-        // A real `--all` deletes the merged branch but keeps the gone branch whose
-        // commits exist nowhere else.
-        let err = run_yes(&repo, &all_run());
-        assert!(err.contains("skipping wip"), "{err}");
-        assert!(!has_branch(&repo, "old"));
-        assert!(has_branch(&repo, "wip"));
-    }
-
-    #[test]
-    fn all_selects_merged_and_missing_worktrees() {
-        // `--all` covers both worktree paths: a merged worktree, and a missing
-        // one whose branch is unmerged (so only the `--gone` path selects it).
-        let repo = TestRepo::init();
-        make_wt(&repo, "done");
-        make_unmerged_wt(&repo, "lost");
-        std::fs::remove_dir_all(wt_dir(&repo, "lost")).unwrap();
-        let all = report(&repo, &all_dry_run());
-        assert!(all.contains("would remove done\n"), "{all}");
-        assert!(all.contains("would remove lost\n"), "{all}");
-        assert!(!report(&repo, &prune_args(true, false, true, false)).contains("lost"));
-        assert!(!report(&repo, &prune_args(false, true, true, false)).contains("done"));
-    }
-
-    #[test]
-    fn pushed_branch_is_selected_by_pushed_and_all_only() {
-        // Diverged from main but every commit is on origin: neither merged nor
-        // gone, yet deleting it loses nothing.
-        let repo = TestRepo::init();
-        diverged_branch(&repo, "feat");
-        give_upstream(&repo, "feat");
-        diverged_branch(&repo, "local"); // commits exist only here
-        let pushed = report(&repo, &pushed_dry_run());
-        assert!(pushed.contains("would remove feat (branch)"), "{pushed}");
-        assert!(!pushed.contains("local"), "{pushed}");
-        let all = report(&repo, &all_dry_run());
-        assert!(all.contains("would remove feat (branch)"), "{all}");
-        assert!(!all.contains("local"), "{all}");
-        assert!(!report(&repo, &prune_args(true, true, true, false)).contains("feat"));
-        // Deleted without --force; the local-only branch is untouched.
-        let err = run_yes(&repo, &all_run());
-        assert!(!err.contains("skipping"), "{err}");
-        assert!(!has_branch(&repo, "feat"));
-        assert!(has_branch(&repo, "local"));
-    }
-
-    #[test]
-    fn pushed_branch_without_upstream_is_selected() {
-        // Pushed without `-u`: no upstream, but origin holds the tip.
-        let repo = TestRepo::init();
-        diverged_branch(&repo, "feat");
-        push_tip(&repo, "feat", "feat");
-        let pushed = report(&repo, &pushed_dry_run());
-        assert!(pushed.contains("would remove feat (branch)"), "{pushed}");
-    }
-
-    #[test]
-    fn pushed_branch_that_moved_since_push_is_not_selected() {
-        let repo = TestRepo::init();
-        diverged_branch(&repo, "feat");
-        give_upstream(&repo, "feat");
-        repo.git(&["checkout", "-q", "feat"]);
-        repo.write("more.txt", "x\n");
-        repo.commit_all("unpushed");
-        repo.git(&["checkout", "-q", "main"]);
-        assert!(!report(&repo, &pushed_dry_run()).contains("feat"));
-    }
-
-    #[test]
-    fn merged_counts_the_remote_default_branch() {
-        // Merged on origin while local main lags behind: `--merged` sees it via
-        // origin/HEAD's target.
-        let repo = TestRepo::init();
-        diverged_branch(&repo, "feat");
-        repo.git(&["update-ref", "refs/remotes/origin/main", "refs/heads/feat"]);
-        repo.git(&[
-            "symbolic-ref",
-            "refs/remotes/origin/HEAD",
-            "refs/remotes/origin/main",
-        ]);
-        let merged = report(&repo, &prune_args(true, false, true, false));
-        assert!(merged.contains("would remove feat (branch)"), "{merged}");
-        // Deleted for real without --force.
-        run_yes(&repo, &prune_args(true, false, false, false));
-        assert!(!has_branch(&repo, "feat"));
-        assert!(has_branch(&repo, "main"));
-    }
-
-    #[test]
-    fn gone_branch_whose_commits_survive_needs_no_force() {
-        // Upstream deleted, but the commits live on under another remote ref.
-        let repo = TestRepo::init();
-        diverged_branch(&repo, "shipped");
-        give_gone_upstream(&repo, "shipped");
-        push_tip(&repo, "shipped", "release");
-        let err = run_yes(&repo, &prune_args(false, true, false, false));
-        assert!(!err.contains("skipping"), "{err}");
-        assert!(!has_branch(&repo, "shipped"));
-    }
-
-    #[test]
-    fn all_keeps_the_worktree_of_a_live_pushed_branch() {
-        // Pushed and live (upstream present): the branch is recoverable, but the
-        // checkout is active work, so `--all` touches neither.
-        let repo = TestRepo::init();
-        make_unmerged_wt(&repo, "live");
-        give_upstream(&repo, "live");
-        let all = report(&repo, &all_dry_run());
-        assert!(!all.contains("live"), "{all}");
-    }
-
-    #[test]
-    fn all_removes_a_gone_worktree_and_its_recoverable_branch_in_one_pass() {
-        let repo = TestRepo::init();
-        make_unmerged_wt(&repo, "shipped");
-        give_gone_upstream(&repo, "shipped");
-        push_tip(&repo, "shipped", "release");
-        let all = report(&repo, &all_dry_run());
-        assert!(all.contains("would remove shipped\n"), "{all}");
-        assert!(all.contains("would remove shipped (branch)"), "{all}");
-        // `--gone` alone removes the worktree and keeps the (unmerged) branch.
-        assert!(!report(&repo, &prune_args(false, true, true, false)).contains("(branch)"));
-        let err = run_yes(&repo, &all_run());
-        assert!(err.contains("pruned 2 item(s)"), "{err}");
-        assert!(!repo.git(&["worktree", "list"]).contains("shipped"));
-        assert!(!has_branch(&repo, "shipped"));
-    }
-
-    #[test]
-    fn all_removes_a_merged_worktree_and_branch_without_noise() {
-        // The merged branch goes with its worktree; the branch candidate then
-        // finds it already gone and skips quietly.
-        let repo = TestRepo::init();
-        make_wt(&repo, "done");
-        let err = run_yes(&repo, &all_run());
-        assert!(!err.contains("could not delete"), "{err}");
-        assert!(!repo.git(&["worktree", "list"]).contains("done"));
-        assert!(!has_branch(&repo, "done"));
-    }
-
-    #[test]
-    fn all_deletes_the_branch_of_a_missing_worktree_in_one_pass() {
-        // The missing worktree is still registered until Git reconciles its
-        // metadata; the branch delete must not trip over that.
-        let repo = TestRepo::init();
-        make_wt(&repo, "done");
-        std::fs::remove_dir_all(wt_dir(&repo, "done")).unwrap();
-        let err = run_yes(&repo, &all_run());
-        assert!(!err.contains("could not delete"), "{err}");
-        assert!(!repo.git(&["worktree", "list"]).contains("done"));
-        assert!(!has_branch(&repo, "done"));
-    }
-
-    #[test]
-    fn pushed_alone_never_selects_worktrees() {
-        let repo = TestRepo::init();
-        make_unmerged_wt(&repo, "live");
-        give_upstream(&repo, "live");
-        std::fs::remove_dir_all(wt_dir(&repo, "live")).unwrap(); // even a missing one
-        assert!(!report(&repo, &pushed_dry_run()).contains("live"));
-    }
-
-    #[test]
-    fn all_keeps_the_branch_of_a_skipped_dirty_worktree() {
-        let repo = TestRepo::init();
-        make_unmerged_wt(&repo, "busy");
-        give_gone_upstream(&repo, "busy");
-        push_tip(&repo, "busy", "release");
-        std::fs::write(wt_dir(&repo, "busy").join("README.md"), "dirty\n").unwrap();
-        let err = run_yes(&repo, &all_run());
-        assert!(err.contains("skipping dirty worktree busy"), "{err}");
-        assert!(!err.contains("could not delete"), "{err}");
-        assert!(has_branch(&repo, "busy"));
-    }
-
-    #[test]
-    fn a_failed_recoverability_check_counts_as_unsafe() {
-        let repo = TestRepo::init();
-        // `rev-list` fails on a branch that does not exist; that must never read
-        // as "safe to delete".
-        assert!(!super::branch_is_recoverable(
-            &RealGit,
-            repo.root(),
-            "no-such-branch",
-            &[]
-        ));
-    }
-
-    #[test]
-    fn pushed_alone_satisfies_the_mode_requirement() {
-        let repo = TestRepo::init();
-        let err = run_yes(&repo, &pushed_dry_run());
-        assert!(err.contains("nothing to prune"), "{err}");
-    }
-
-    /// A clone-like repo: `main` and `feat` pushed to a bare `origin`, with
-    /// `feat` tracking `origin/feat`. Returns (local, remote).
-    fn repo_with_remote() -> (TestRepo, TestRepo) {
-        let remote = TestRepo::init_bare();
-        let repo = TestRepo::init();
-        repo.git(&["remote", "add", "origin", remote.root().to_str().unwrap()]);
-        diverged_branch(&repo, "feat");
-        repo.git(&["push", "-q", "-u", "origin", "main", "feat"]);
-        repo.git(&["remote", "set-head", "origin", "main"]);
-        (repo, remote)
-    }
-
-    fn json_branch(repo: &TestRepo, args: &PruneArgs, name: &str) -> Option<serde_json::Value> {
-        let mut t = crate::testutil::test_cx(&[], repo.root().to_str().unwrap());
-        super::run(&mut t.cx, args, true).unwrap();
-        t.out
-            .contents()
-            .lines()
-            .map(|l| serde_json::from_str::<serde_json::Value>(l).unwrap())
-            .find(|v| v["branch"] == serde_json::json!(name))
-    }
-
-    #[test]
-    fn fetch_refreshes_remote_refs_before_judging_safety() {
-        // The branch was deleted on origin since the last fetch. The stale
-        // tracking ref would vouch for its commits; the fetch shows they are
-        // gone, so the branch is no longer safe to delete.
-        let (repo, remote) = repo_with_remote();
-        remote.git(&["branch", "-D", "feat"]);
-        let offline = PruneArgs {
-            no_fetch: true,
-            ..all_dry_run()
-        };
-        let stale = json_branch(&repo, &offline, "feat").expect("selected offline");
-        assert_eq!(stale["safe"], serde_json::json!(true));
-        let fresh = json_branch(&repo, &all_dry_run(), "feat").expect("selected as gone");
-        assert_eq!(fresh["safe"], serde_json::json!(false));
-        assert!(has_branch(&repo, "feat"));
-    }
-
-    #[test]
-    fn failed_fetch_aborts_unless_no_fetch() {
-        let repo = TestRepo::init();
-        repo.git(&[
-            "remote",
-            "add",
-            "origin",
-            "/nonexistent/wt-prune-remote.git",
-        ]);
-        let mut t = crate::testutil::test_cx(&[], repo.root().to_str().unwrap());
-        let err = super::run(&mut t.cx, &all_dry_run(), false).unwrap_err();
-        assert!(err.to_string().contains("--no-fetch"), "{err}");
-        // `--merged` alone reads no remote state, so it never fetches.
-        report(&repo, &prune_args(true, false, true, false));
-        let offline = PruneArgs {
-            no_fetch: true,
-            ..all_dry_run()
-        };
-        report(&repo, &offline);
-    }
-
-    #[test]
-    fn default_and_current_never_deleted() {
-        let repo = TestRepo::init(); // only `main` (default + current)
-        let mut t = crate::testutil::test_cx(&[], repo.root().to_str().unwrap());
-        super::run(&mut t.cx, &prune_args(true, true, false, true), false).unwrap();
-        assert!(t.err.contents().contains("nothing to prune"));
-        assert!(repo.git(&["branch", "--list", "main"]).contains("main"));
-    }
-
-    #[test]
-    fn merged_only_skips_unmerged_worktree() {
-        // A worktree whose branch is not merged into main must never be a
-        // `--merged` prune candidate — a guard against pruning live work.
-        let repo = TestRepo::init();
-        make_unmerged_wt(&repo, "wip");
-        let mut t = crate::testutil::test_cx(&[], repo.root().to_str().unwrap());
-        super::run(&mut t.cx, &prune_args(true, false, true, false), false).unwrap();
-        assert!(t.err.contents().contains("nothing to prune"));
-    }
-
-    #[test]
-    fn dry_run_lists_bare_branch_without_deleting() {
-        let repo = TestRepo::init();
-        bare_branch(&repo, "old");
-        let mut t = crate::testutil::test_cx(&[], repo.root().to_str().unwrap());
-        super::run(&mut t.cx, &prune_args(true, false, true, false), false).unwrap();
-        assert!(t.out.contents().contains("would remove old (branch)"));
-        assert!(repo.git(&["branch", "--list", "old"]).contains("old"));
-    }
-
-    #[test]
-    fn branch_with_worktree_uses_worktree_path() {
-        let repo = TestRepo::init();
-        make_wt(&repo, "merged-wt"); // branch + worktree
-        let mut t = crate::testutil::test_cx(&[], repo.root().to_str().unwrap());
-        super::run(&mut t.cx, &prune_args(true, false, false, true), false).unwrap();
-        // Pruned once via the worktree path — not double-counted as a bare branch.
-        assert!(!repo.git(&["worktree", "list"]).contains("merged-wt"));
-        assert!(
-            repo.git(&["branch", "--list", "merged-wt"])
-                .trim()
-                .is_empty()
-        );
-        assert!(t.err.contents().contains("pruned 1 item(s)"));
-    }
-
-    #[test]
-    fn json_lists_bare_branch() {
-        let repo = TestRepo::init();
-        bare_branch(&repo, "old");
-        let mut t = crate::testutil::test_cx(&[], repo.root().to_str().unwrap());
-        super::run(&mut t.cx, &prune_args(true, false, false, false), true).unwrap();
-        let out = t.out.contents();
-        let v: serde_json::Value = serde_json::from_str(out.trim()).unwrap();
-        assert_eq!(v["branch"], serde_json::json!("old"));
-        assert_eq!(v["kind"], serde_json::json!("branch"));
-        assert_eq!(v["merged"], serde_json::json!(true));
-        assert_eq!(v["safe"], serde_json::json!(true));
-        // --json implies dry-run: still present.
-        assert!(repo.git(&["branch", "--list", "old"]).contains("old"));
-    }
-}
diff --git a/src/commands/prune/assess.rs b/src/commands/prune/assess.rs
new file mode 100644
index 0000000..4e756ec
--- /dev/null
+++ b/src/commands/prune/assess.rs
@@ -0,0 +1,416 @@
+//! Candidate classification for `wt prune`: why each worktree and bare branch
+//! qualifies for removal ([`Reason`]), and what — if anything — keeps it
+//! ([`Block`]).
+//!
+//! Work counts as kept when it survives the removal, by SHA or by content: a
+//! commit reachable from a remote-tracking ref or the default branch, or a change
+//! already in the default branch under another SHA (a squash or rebase merge).
+
+use std::collections::HashSet;
+use std::path::Path;
+
+use crate::cli::PruneArgs;
+use crate::error::Result;
+use crate::git::aheadbehind::is_recoverable;
+use crate::git::cli::GitCli;
+use crate::git::discover::Repo;
+use crate::git::merged::is_content_merged;
+use crate::git::porcelain::RawWorktree;
+use crate::git::worktrees::in_progress_op;
+use crate::git::{
+    branch_ref, default_branch, default_tracking_ref, is_ancestor, is_clean_for_removal,
+    local_branches, resolve_hex, upstream_of,
+};
+use crate::model::Worktree;
+
+/// The refs work counts as merged into: the local default branch and, when
+/// `origin/HEAD` is set, its remote-tracking ref — so work merged on the remote
+/// is seen even while the local default lags behind.
+pub(super) struct MergeTargets {
+    /// The default branch's short name (never itself a prune candidate).
+    pub(super) default: Option<String>,
+    /// Full refs to test against, each known to resolve.
+    pub(super) refs: Vec<String>,
+}
+
+impl MergeTargets {
+    pub(super) fn resolve(repo: &Repo) -> Self {
+        let default = default_branch(repo.gix());
+        let refs = default
+            .as_deref()
+            .map(branch_ref)
+            .into_iter()
+            .chain(default_tracking_ref(repo.gix()))
+            .filter(|r| resolve_hex(repo.gix(), r).is_some())
+            .collect();
+        MergeTargets { default, refs }
+    }
+
+    /// Whether `branch` is the default branch, which is never pruned (it is
+    /// trivially merged into itself).
+    pub(super) fn is_default(&self, branch: &str) -> bool {
+        self.default.as_deref() == Some(branch)
+    }
+
+    /// Whether `tip` (a ref or commit id) is an ancestor of any target.
+    fn has_ancestor_merge(&self, repo: &Repo, tip: &str) -> bool {
+        self.refs
+            .iter()
+            .any(|target| is_ancestor(repo.gix(), tip, target))
+    }
+
+    /// Whether every change on `tip` is already in some target under other SHAs
+    /// (see [`is_content_merged`]).
+    fn has_content_merge(&self, git: &dyn GitCli, root: &Path, tip: &str) -> bool {
+        self.refs
+            .iter()
+            .any(|target| is_content_merged(git, root, tip, target))
+    }
+
+    /// Whether `tip` is merged into some target, by ancestry or by content.
+    pub(super) fn is_merged(&self, git: &dyn GitCli, root: &Path, repo: &Repo, tip: &str) -> bool {
+        self.has_ancestor_merge(repo, tip) || self.has_content_merge(git, root, tip)
+    }
+
+    /// The local default branch ref, if it resolves — the one non-remote ref
+    /// whose commits count as kept by the recoverability check.
+    fn local_default_ref(&self) -> Option<&str> {
+        let local = branch_ref(self.default.as_deref()?);
+        self.refs.iter().find(|r| **r == local).map(String::as_str)
+    }
+}
+
+/// Why a subject qualifies for removal.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(super) enum Reason {
+    /// An ancestor of the default branch.
+    Merged,
+    /// Not an ancestor, but every change is already in the default branch
+    /// (a squash or rebase merge, or work split across several merges).
+    MergedByContent,
+    /// Its branch's upstream was configured and is now gone.
+    UpstreamGone,
+    /// A worktree whose directory is gone.
+    Missing,
+    /// Every commit is on a remote or the default branch.
+    Pushed,
+}
+
+impl Reason {
+    pub(super) fn label(self) -> &'static str {
+        match self {
+            Reason::Merged => "merged",
+            Reason::MergedByContent => "merged by content",
+            Reason::UpstreamGone => "upstream gone",
+            Reason::Missing => "missing",
+            Reason::Pushed => "pushed",
+        }
+    }
+}
+
+/// What keeps a qualifying subject, after the flags that override it
+/// (`--force`, `--locked`) have been applied.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(super) enum Block {
+    /// The worktree the command runs in. Never overridden.
+    Current,
+    /// A rebase, merge, cherry-pick, revert, or bisect is mid-flight. Never
+    /// overridden.
+    InProgress(&'static str),
+    /// The worktree's git state could not be read, so it fails safe. Never
+    /// overridden.
+    Unreadable,
+    /// A bare branch while the named worktrees' rebase or bisect state cannot
+    /// be read, so it may be the branch one of them returns to. Never
+    /// overridden.
+    HolderUnreadable(String),
+    /// Locked, with its reason if one was given. Overridden by `--locked`.
+    Locked(Option<String>),
+    /// Uncommitted changes. Overridden by `--force`.
+    Dirty,
+    /// A branch holding work found on no remote and not in the default branch.
+    /// Overridden by `--force`.
+    Unsafe,
+}
+
+impl Block {
+    /// The explanation printed after `skipping <label>: `.
+    pub(super) fn message(&self) -> String {
+        match self {
+            Block::Current => "it is the current worktree".into(),
+            Block::InProgress(op) => format!("{op} in progress"),
+            Block::Unreadable => "cannot read its git state".into(),
+            Block::HolderUnreadable(worktrees) => {
+                format!("cannot read the rebase or bisect state of {worktrees}")
+            }
+            Block::Locked(Some(reason)) => format!("locked ({reason}); use --locked"),
+            Block::Locked(None) => "locked; use --locked".into(),
+            Block::Dirty => "uncommitted changes; use --force".into(),
+            Block::Unsafe => {
+                "has work on no remote and not in the default branch; use --force".into()
+            }
+        }
+    }
+}
+
+/// What a verdict is about.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(super) enum Subject {
+    /// An existing worktree, by its index in the worktree list. `locked` records
+    /// whether its removal must override a lock (only reachable with `--locked`).
+    /// `head` is a detached worktree's HEAD as assessed, so the removal can
+    /// refuse a worktree that committed since; `None` for a branch worktree,
+    /// whose commits survive on the branch.
+    Worktree {
+        index: usize,
+        locked: bool,
+        head: Option<String>,
+    },
+    /// A local branch with no worktree (or whose worktree is being removed under
+    /// `--all`). `merged` records whether it is merged into the default branch by
+    /// ancestry or content; `safe` whether deleting it loses no work.
+    Branch {
+        name: String,
+        merged: bool,
+        safe: bool,
+    },
+}
+
+/// A subject that qualified for removal, with the reason and any block.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(super) struct Verdict {
+    pub(super) subject: Subject,
+    pub(super) reason: Reason,
+    /// `None` when the subject will be removed; otherwise why it is skipped.
+    pub(super) block: Option<Block>,
+}
+
+/// Classifies worktrees and branches for one prune run.
+pub(super) struct Assessor<'a> {
+    pub(super) git: &'a dyn GitCli,
+    pub(super) root: &'a Path,
+    pub(super) repo: &'a Repo,
+    pub(super) args: &'a PruneArgs,
+    pub(super) targets: &'a MergeTargets,
+}
+
+impl Assessor<'_> {
+    /// The verdict for one worktree, or `None` when no selected mode picks it.
+    /// The primary worktree is never a candidate. `raw` is the worktree's
+    /// porcelain record, which carries the lock and a detached HEAD's commit.
+    pub(super) fn worktree(
+        &self,
+        index: usize,
+        worktree: &Worktree,
+        raw: Option<&RawWorktree>,
+    ) -> Option<Verdict> {
+        if worktree.is_main {
+            return None;
+        }
+        let tip = match &worktree.branch {
+            Some(branch) => Some(branch_ref(branch)),
+            None => raw.and_then(|r| r.head.clone()),
+        };
+        let reason = self.worktree_reason(worktree, tip.as_deref())?;
+        let locked = raw.is_some_and(|r| r.is_locked);
+        let block = self
+            .worktree_block(worktree, raw)
+            .or_else(|| self.detached_unsafe(worktree, tip.as_deref()));
+        tracing::trace!(target_wt = %worktree.path.display(), ?reason, ?block, "prune: worktree classified");
+        let head = if worktree.branch.is_none() { tip } else { None };
+        Some(Verdict {
+            subject: Subject::Worktree {
+                index,
+                locked,
+                head,
+            },
+            reason,
+            block,
+        })
+    }
+
+    /// [`Block::Unsafe`] for a detached worktree whose HEAD is on no remote and
+    /// not in the default branch (without `--force`). Only its own HEAD holds
+    /// those commits, so removing it — even a missing one, whose admin entry is
+    /// that HEAD — orphans them. A branch worktree's commits survive on the
+    /// branch, so it never gets this block.
+    fn detached_unsafe(&self, worktree: &Worktree, tip: Option<&str>) -> Option<Block> {
+        if self.args.force || worktree.branch.is_some() {
+            return None;
+        }
+        let safe = tip.is_some_and(|tip| {
+            self.recoverable(tip) || self.targets.is_merged(self.git, self.root, self.repo, tip)
+        });
+        (!safe).then_some(Block::Unsafe)
+    }
+
+    /// The first selected mode that picks `worktree`, cheapest checks first.
+    /// `tip` is its branch ref or detached commit.
+    fn worktree_reason(&self, worktree: &Worktree, tip: Option<&str>) -> Option<Reason> {
+        let args = self.args;
+        // A worktree on the default branch is never "merged" into itself.
+        let mergeable = tip.filter(|_| {
+            !worktree
+                .branch
+                .as_deref()
+                .is_some_and(|b| self.targets.is_default(b))
+        });
+        if args.includes_merged()
+            && let Some(tip) = mergeable
+            && self.targets.has_ancestor_merge(self.repo, tip)
+        {
+            return Some(Reason::Merged);
+        }
+        if args.includes_gone() {
+            if worktree.is_missing {
+                return Some(Reason::Missing);
+            }
+            if self.upstream_gone(worktree.branch.as_deref()) {
+                return Some(Reason::UpstreamGone);
+            }
+        }
+        if args.includes_merged()
+            && let Some(tip) = mergeable
+            && self.targets.has_content_merge(self.git, self.root, tip)
+        {
+            return Some(Reason::MergedByContent);
+        }
+        // A checked-out branch is active work even when pushed; a detached
+        // worktree has no branch to keep, so it is the only holder of its HEAD.
+        if args.includes_pushed()
+            && worktree.is_detached
+            && let Some(tip) = tip
+            && self.recoverable(tip)
+        {
+            return Some(Reason::Pushed);
+        }
+        None
+    }
+
+    /// What keeps a qualifying worktree, most fundamental first, skipping any
+    /// block a flag overrides.
+    fn worktree_block(&self, worktree: &Worktree, raw: Option<&RawWorktree>) -> Option<Block> {
+        if worktree.is_current {
+            return Some(Block::Current);
+        }
+        // Without its porcelain record the lock and a detached HEAD are unknown.
+        let Some(raw) = raw else {
+            tracing::warn!(target_wt = %worktree.path.display(), "prune: no worktree record");
+            return Some(Block::Unreadable);
+        };
+        if !worktree.is_missing {
+            match in_progress_op(self.git, &worktree.path) {
+                Ok(Some(op)) => return Some(Block::InProgress(op)),
+                Ok(None) => {}
+                Err(error) => {
+                    tracing::warn!(target_wt = %worktree.path.display(), %error, "prune: cannot read worktree state");
+                    return Some(Block::Unreadable);
+                }
+            }
+        }
+        if !self.args.locked && raw.is_locked {
+            return Some(Block::Locked(raw.lock_reason.clone()));
+        }
+        // Untracked files always count, whatever `remove.untracked_blocks` or
+        // the repository's status config says: removal passes `--force`
+        // (submodules and locks need it), so git would otherwise delete them —
+        // and a worktree prune selects on its own is not one the user named.
+        // A missing worktree has nothing on disk to lose.
+        if !self.args.force
+            && !worktree.is_missing
+            && !is_clean_for_removal(self.git, &worktree.path)
+        {
+            return Some(Block::Dirty);
+        }
+        None
+    }
+
+    /// Verdicts for local branches that qualify: every local branch except the
+    /// default, the `current` one, and those in `excluded` (branches that keep a
+    /// worktree, which the worktree path handles).
+    pub(super) fn branches(
+        &self,
+        current: Option<&str>,
+        excluded: &HashSet<String>,
+    ) -> Result<Vec<Verdict>> {
+        let mut out = Vec::new();
+        for name in local_branches(self.repo.gix())? {
+            if excluded.contains(&name)
+                || self.targets.is_default(&name)
+                || current == Some(name.as_str())
+            {
+                continue;
+            }
+            if let Some(verdict) = self.branch(name) {
+                out.push(verdict);
+            }
+        }
+        Ok(out)
+    }
+
+    /// The verdict for one local branch, or `None` when no selected mode picks
+    /// it. Subprocess checks run only when some mode could still pick it.
+    fn branch(&self, name: String) -> Option<Verdict> {
+        let args = self.args;
+        let tip = branch_ref(&name);
+        let ancestor = self.targets.has_ancestor_merge(self.repo, &tip);
+        let gone = self.upstream_gone(Some(&name));
+        let content = !ancestor
+            && args.includes_merged()
+            && self.targets.has_content_merge(self.git, self.root, &tip);
+        let by_mode = if args.includes_merged() && ancestor {
+            Some(Reason::Merged)
+        } else if content {
+            Some(Reason::MergedByContent)
+        } else if args.includes_gone() && gone {
+            Some(Reason::UpstreamGone)
+        } else {
+            None
+        };
+        if by_mode.is_none() && !args.includes_pushed() {
+            return None;
+        }
+        let recoverable = self.recoverable(&tip);
+        let reason = by_mode.or_else(|| recoverable.then_some(Reason::Pushed))?;
+        // The content check above only runs under `--merged`; for a branch picked
+        // otherwise, run it now, so `merged` (reported in `--json`) and safety do
+        // not depend on which flags were passed.
+        let merged = ancestor
+            || content
+            || (!args.includes_merged()
+                && self.targets.has_content_merge(self.git, self.root, &tip));
+        let safe = recoverable || merged;
+        let block = (!safe && !args.force).then_some(Block::Unsafe);
+        tracing::trace!(branch = %name, ?reason, ancestor, content, gone, recoverable, safe, "prune: branch classified");
+        Some(Verdict {
+            subject: Subject::Branch { name, merged, safe },
+            reason,
+            block,
+        })
+    }
+
+    /// Whether deleting local branch `name` loses no work — re-checked under the
+    /// repo lock, since the branch may have moved since selection.
+    pub(super) fn branch_is_safe(&self, name: &str) -> bool {
+        let tip = branch_ref(name);
+        self.recoverable(&tip) || self.targets.is_merged(self.git, self.root, self.repo, &tip)
+    }
+
+    /// Whether `branch`'s upstream is configured but its tracking ref is gone.
+    fn upstream_gone(&self, branch: Option<&str>) -> bool {
+        branch
+            .and_then(|b| upstream_of(self.repo.gix(), b))
+            .is_some_and(|u| u.is_gone)
+    }
+
+    /// [`is_recoverable`] for `tip`, keeping the local default branch, and
+    /// treating a failed check as unrecoverable so a git error can never be the
+    /// reason work is deleted.
+    pub(super) fn recoverable(&self, tip: &str) -> bool {
+        let keep: Vec<&str> = self.targets.local_default_ref().into_iter().collect();
+        is_recoverable(self.git, self.root, tip, &keep).unwrap_or_else(|e| {
+            tracing::warn!(tip, error = %e, "prune: recoverability check failed");
+            false
+        })
+    }
+}
diff --git a/src/commands/prune/mod.rs b/src/commands/prune/mod.rs
new file mode 100644
index 0000000..22cef7a
--- /dev/null
+++ b/src/commands/prune/mod.rs
@@ -0,0 +1,1802 @@
+//! `wt prune` — bulk cleanup of merged or stale worktrees (detached ones
+//! included), and the local branches they leave behind (spec §7/§12).
+//!
+//! Selection lives in [`assess`]: each worktree and branch gets a verdict naming
+//! why it qualifies and what, if anything, keeps it. This module reports those
+//! verdicts and removes the ones nothing keeps.
+
+mod assess;
+
+use std::collections::HashSet;
+use std::path::Path;
+
+use crate::cli::PruneArgs;
+use crate::commands::{Session, candidate_label, confirm, open_session};
+use crate::config::wtconfig;
+use crate::cx::Cx;
+use crate::error::{Error, Result};
+use crate::git::cli::GitCli;
+use crate::git::discover::Repo;
+use crate::git::porcelain::RawWorktree;
+use crate::git::worktrees::{in_progress_branch, in_progress_op};
+use crate::git::{
+    branch_ref, current_branch, enumerate, is_clean_for_removal, local_branches, ops,
+};
+use crate::model::Worktree;
+use crate::worktree::{build_worktrees, lock_repo};
+
+use assess::{Assessor, Block, MergeTargets, Subject, Verdict};
+
+/// Selects and removes prune candidates after confirmation (spec §7/§12).
+pub(crate) fn run(cx: &mut Cx, args: &PruneArgs, json: bool) -> Result<u8> {
+    if !args.includes_merged() && !args.includes_gone() && !args.includes_pushed() {
+        return Err(Error::usage(
+            "prune requires --merged, --gone, --pushed, or --all",
+        ));
+    }
+    let git = cx.git.clone();
+    let git = git.as_ref();
+    let session = open_session(cx, git)?;
+    let root = session.primary_root.clone();
+    // "Gone" and "still on the remote" are only as true as the remote-tracking
+    // refs, so the modes that read them refresh them first (dry runs included,
+    // so a preview never promises something the real run would not do).
+    if args.needs_fetch() {
+        fetch_remotes(git, &session.repo, &root)?;
+    }
+    let worktrees = build_worktrees(&session.repo, git)?;
+    // The porcelain records carry what the rows do not: the lock, and a detached
+    // worktree's HEAD commit.
+    let raws = enumerate(git, &root)?;
+    let targets = MergeTargets::resolve(&session.repo);
+    let current = current_branch(session.repo.gix());
+    let assessor = Assessor {
+        git,
+        root: &root,
+        repo: &session.repo,
+        args,
+        targets: &targets,
+    };
+
+    let mut verdicts: Vec<Verdict> = worktrees
+        .iter()
+        .enumerate()
+        .filter_map(|(i, w)| assessor.worktree(i, w, raw_for(&raws, w)))
+        .collect();
+
+    // Branches that keep a worktree (the primary checkout and any branch checked
+    // out elsewhere) are left to the worktree path, so a branch is never counted
+    // — or deleted — twice. Under `--all` the branch of a worktree being removed
+    // is also judged as a bare branch, so one pass clears both.
+    let removing: HashSet<usize> = verdicts
+        .iter()
+        .filter(|v| v.block.is_none())
+        .filter_map(|v| match v.subject {
+            Subject::Worktree { index, .. } => Some(index),
+            Subject::Branch { .. } => None,
+        })
+        .collect();
+    // A branch being rebased or bisected is in use too, although its worktree
+    // is detached meanwhile and so names no branch. When a worktree's state
+    // cannot be read, the branch it holds is unknown, so every bare branch is
+    // kept rather than trusting git to refuse the one in use.
+    let mut unreadable_holders: Vec<String> = Vec::new();
+    let held: Vec<String> = worktrees
+        .iter()
+        .filter(|w| !w.is_missing)
+        .filter_map(|w| {
+            in_progress_branch(git, &w.path).unwrap_or_else(|error| {
+                tracing::warn!(target_wt = %w.path.display(), %error, "prune: cannot read in-progress branch");
+                unreadable_holders.push(candidate_label(w));
+                None
+            })
+        })
+        .collect();
+    let worktree_branches: HashSet<String> = worktrees
+        .iter()
+        .enumerate()
+        .filter(|(i, _)| !(args.all && removing.contains(i)))
+        .filter_map(|(_, w)| w.branch.clone())
+        .chain(held)
+        .collect();
+    let mut branch_verdicts = assessor.branches(current.as_deref(), &worktree_branches)?;
+    if !unreadable_holders.is_empty() {
+        let holders = unreadable_holders.join(", ");
+        for verdict in &mut branch_verdicts {
+            verdict.block = Some(Block::HolderUnreadable(holders.clone()));
+        }
+    }
+    verdicts.extend(branch_verdicts);
+    let (candidates, skipped): (Vec<Verdict>, Vec<Verdict>) =
+        verdicts.into_iter().partition(|v| v.block.is_none());
+
+    // The worktree/branch gap is the signal when a prune surprises someone.
+    tracing::debug!(
+        default = ?targets.default,
+        merge_targets = ?targets.refs,
+        worktrees = worktrees.len(),
+        candidates = candidates.len(),
+        skipped = skipped.len(),
+        local_branches = local_branches(session.repo.gix()).map_or(0, |b| b.len()),
+        "prune: candidate selection",
+    );
+
+    // Whatever qualified but is kept is always said out loud, on stderr (stdout
+    // stays the candidate list, and clean for `--json`).
+    if !json {
+        for verdict in &skipped {
+            if let Some(block) = &verdict.block {
+                cx.err.line(&format!(
+                    "skipping {}: {}",
+                    verdict_label(&worktrees, verdict),
+                    block.message()
+                ))?;
+            }
+        }
+    }
+
+    // `--dry-run` (and the `--json` form) only report the candidate set.
+    if args.dry_run || json {
+        // Report the empty case explicitly on stderr so a dry-run that finds
+        // nothing is never silently blank.
+        if candidates.is_empty() && !json {
+            cx.err.line("nothing to prune")?;
+        }
+        for verdict in &candidates {
+            if json {
+                cx.out.line(&verdict_json(&worktrees, verdict)?)?;
+            } else {
+                cx.out.line(&format!(
+                    "would remove {}",
+                    verdict_text(&worktrees, verdict)
+                ))?;
+            }
+        }
+        return Ok(0);
+    }
+
+    // Nothing is removed that was not listed: no blanket `git worktree prune`,
+    // which would drop every missing worktree, including the ones kept above.
+    if candidates.is_empty() {
+        cx.err.line("nothing to prune")?;
+        return Ok(0);
+    }
+
+    // Confirmation prompt (unless --force).
+    if !args.force {
+        cx.err.line("to remove:")?;
+        for verdict in &candidates {
+            cx.err
+                .line(&format!("  {}", verdict_text(&worktrees, verdict)))?;
+        }
+        if !confirm(cx, "Proceed? [y/N] ")? {
+            cx.err.line("aborted")?;
+            return Ok(0);
+        }
+    }
+
+    // Every removal below deletes worktrees, branches, and `wt.*` metadata, so
+    // the whole loop is one mutation region under the advisory repo lock (issue
+    // #99). `prune` runs no hooks, so nothing inside can re-enter `wt`.
+    let lock = lock_repo(&root)?;
+    let mut removed = 0_usize;
+    // Branches whose worktree was not removed (it turned dirty, or git refused)
+    // stay checked out, so their `--all` branch candidate is skipped too.
+    // Worktree candidates come first.
+    let mut kept: HashSet<&str> = HashSet::new();
+    for verdict in &candidates {
+        let pruned = match &verdict.subject {
+            Subject::Worktree {
+                index,
+                locked,
+                head,
+            } => {
+                let worktree = &worktrees[*index];
+                let pruned = remove_worktree(
+                    cx,
+                    &assessor,
+                    &session,
+                    worktree,
+                    head.as_deref(),
+                    *locked && args.locked,
+                )?;
+                if !pruned && let Some(branch) = &worktree.branch {
+                    kept.insert(branch);
+                }
+                pruned
+            }
+            Subject::Branch { name, .. } if kept.contains(name.as_str()) => false,
+            Subject::Branch { name, .. } => remove_branch(cx, &assessor, name)?,
+        };
+        if pruned {
+            removed += 1;
+        }
+    }
+
+    drop(lock);
+    tracing::debug!(removed, "prune: done");
+    cx.err.line(&format!("pruned {removed} item(s)"))?;
+    Ok(0)
+}
+
+/// Runs `git fetch --all --prune` when the repository has any remote, so the
+/// remote-tracking refs prune reads reflect the remote now. A failed fetch aborts
+/// rather than letting a stale ref vouch for commits the remote no longer has.
+fn fetch_remotes(git: &dyn GitCli, repo: &Repo, root: &Path) -> Result<()> {
+    if repo.gix().remote_names().is_empty() {
+        tracing::debug!("prune: no remotes; skipping fetch");
+        return Ok(());
+    }
+    tracing::debug!("prune: fetching remotes");
+    ops::fetch_all_prune(git, root).map_err(|e| {
+        Error::operation(format!(
+            "cannot fetch remotes: {e}\n(pass --no-fetch to trust the last fetch)"
+        ))
+    })?;
+    Ok(())
+}
+
+/// The porcelain record for `worktree`, matched by path.
+fn raw_for<'a>(raws: &'a [RawWorktree], worktree: &Worktree) -> Option<&'a RawWorktree> {
+    raws.iter().find(|raw| raw.path == worktree.path)
+}
+
+/// Removes one worktree candidate, returning whether it was removed. `head` is
+/// a detached worktree's HEAD as assessed; `unlock` overrides a lock
+/// (`--locked` on a locked worktree). This is the per-worktree body of the prune
+/// loop (spec §12).
+///
+/// The guards are re-read here, under the repo lock, because the confirmation
+/// prompt may have waited long enough for the worktree to change: new edits, a
+/// new commit on a detached HEAD, or a rebase started. A removal git refuses is
+/// reported and leaves the worktree — and so its branch — in place.
+fn remove_worktree(
+    cx: &mut Cx,
+    assessor: &Assessor<'_>,
+    session: &Session,
+    worktree: &Worktree,
+    head: Option<&str>,
+    unlock: bool,
+) -> Result<bool> {
+    let (git, root) = (assessor.git, assessor.root);
+    let label = candidate_label(worktree);
+    if let Some(why) = changed_since_assessed(assessor, worktree, head) {
+        cx.err.line(&format!("skipping {label}: {why}"))?;
+        return Ok(false);
+    }
+    let path = worktree.path.to_string_lossy();
+    // `--force` because the guards above are the safety decision (untracked
+    // files included): git's own check also refuses a worktree with
+    // submodules, and a lock needs it twice.
+    // For a missing worktree this drops just its admin entry — never a blanket
+    // `git worktree prune`, which would also drop missing worktrees prune chose
+    // to keep.
+    if let Err(error) = ops::worktree_remove(git, root, &path, true, unlock) {
+        cx.err.line(&format!("could not remove {label}: {error}"))?;
+        tracing::warn!(target_wt = %label, "prune: worktree remove failed");
+        return Ok(false);
+    }
+    delete_merged_branch(assessor, worktree, &session.config);
+    if let Some(branch) = &worktree.branch {
+        let _ = wtconfig::clear_meta(git, root, branch);
+    }
+    tracing::debug!(target_wt = %label, "prune: removed worktree");
+    Ok(true)
+}
+
+/// Why a present worktree may no longer be removed although it was a candidate
+/// at selection, or `None` when it is unchanged: an operation now in progress,
+/// a detached HEAD that moved off the assessed commit, or (without `--force`)
+/// new uncommitted changes. A missing worktree cannot change.
+fn changed_since_assessed(
+    assessor: &Assessor<'_>,
+    worktree: &Worktree,
+    head: Option<&str>,
+) -> Option<String> {
+    if worktree.is_missing {
+        // `git worktree remove --force` deletes whatever is at the path, so a
+        // directory that came back (a remounted drive) — or one that cannot be
+        // checked — must not be treated as gone.
+        return match std::fs::symlink_metadata(&worktree.path) {
+            Err(e) if e.kind() == std::io::ErrorKind::NotFound => None,
+            Ok(_) => Some("reappeared since it was assessed; run prune again".into()),
+            Err(_) => Some(Block::Unreadable.message()),
+        };
+    }
+    match in_progress_op(assessor.git, &worktree.path) {
+        Ok(None) => {}
+        Ok(Some(op)) => return Some(Block::InProgress(op).message()),
+        Err(_) => return Some(Block::Unreadable.message()),
+    }
+    let moved = "HEAD moved since it was assessed; run prune again";
+    if let Some(head) = head {
+        let now = assessor.git.run(
+            &worktree.path,
+            &["rev-parse", "--verify", "--quiet", "HEAD"],
+        );
+        if now.map(|h| h.trim().to_string()).ok().as_deref() != Some(head) {
+            return Some(moved.into());
+        }
+    }
+    // A branch worktree must still be on its branch: one that detached and
+    // committed meanwhile holds that commit in its HEAD alone.
+    if let Some(branch) = &worktree.branch {
+        let now = assessor
+            .git
+            .run(&worktree.path, &["symbolic-ref", "--quiet", "HEAD"]);
+        if now.map(|r| r.trim().to_string()).ok() != Some(branch_ref(branch)) {
+            return Some(moved.into());
+        }
+    }
+    if !assessor.args.force && !still_clean(assessor, worktree) {
+        return Some(Block::Dirty.message());
+    }
+    None
+}
+
+/// Whether a present worktree is still clean by the same rule as the selection
+/// guard (untracked files included). A failed status read counts as dirty, so
+/// the guard fails safe.
+fn still_clean(assessor: &Assessor<'_>, worktree: &Worktree) -> bool {
+    is_clean_for_removal(assessor.git, &worktree.path)
+}
+
+/// Deletes one bare-branch candidate, returning whether it was deleted. Its
+/// safety — every commit on a remote or the default branch, or every change in
+/// the default branch — is re-checked under the lock (it may have moved since
+/// selection), and the branch is then deleted with `git branch -D`, since `-d`
+/// only knows about HEAD and the upstream. Without `--force` an unsafe branch is
+/// skipped. A branch already gone (deleted with its worktree) is skipped
+/// quietly, and a delete failure is reported and skipped rather than aborting
+/// the whole prune.
+fn remove_branch(cx: &mut Cx, assessor: &Assessor<'_>, name: &str) -> Result<bool> {
+    let (git, root) = (assessor.git, assessor.root);
+    if !branch_exists(git, root, name) {
+        tracing::debug!(branch = %name, "prune: branch already deleted");
+        return Ok(false);
+    }
+    if !assessor.args.force && !assessor.branch_is_safe(name) {
+        cx.err.line(&format!(
+            "skipping {name} (branch): {}",
+            Block::Unsafe.message()
+        ))?;
+        tracing::debug!(branch = %name, "prune: skip unsafe branch");
+        return Ok(false);
+    }
+    match ops::delete_branch(git, root, name, true) {
+        Ok(out) if out.success => {
+            let _ = wtconfig::clear_meta(git, root, name);
+            tracing::debug!(branch = %name, "prune: deleted branch");
+            Ok(true)
+        }
+        Ok(out) => {
+            cx.err
+                .line(&format!("could not delete {name}: {}", out.stderr.trim()))?;
+            tracing::warn!(branch = %name, "prune: branch delete failed");
+            Ok(false)
+        }
+        Err(error) => {
+            cx.err.line(&format!("could not delete {name}: {error}"))?;
+            tracing::warn!(branch = %name, "prune: branch delete errored");
+            Ok(false)
+        }
+    }
+}
+
+/// Whether the local branch `name` still exists.
+fn branch_exists(git: &dyn GitCli, root: &Path, name: &str) -> bool {
+    git.run_raw(
+        root,
+        &["rev-parse", "--verify", "--quiet", &branch_ref(name)],
+    )
+    .is_ok_and(|out| out.success)
+}
+
+/// A human label for a verdict's subject (worktree or bare branch).
+fn verdict_label(worktrees: &[Worktree], verdict: &Verdict) -> String {
+    match &verdict.subject {
+        Subject::Worktree { index, .. } => candidate_label(&worktrees[*index]),
+        Subject::Branch { name, .. } => format!("{name} (branch)"),
+    }
+}
+
+/// A candidate's label followed by why it qualifies, e.g. `feat (branch):
+/// merged by content`.
+fn verdict_text(worktrees: &[Worktree], verdict: &Verdict) -> String {
+    format!(
+        "{}: {}",
+        verdict_label(worktrees, verdict),
+        verdict.reason.label()
+    )
+}
+
+/// A machine-readable (`--json`) line for a prune candidate. A worktree emits its
+/// full row plus a `reason`; a bare branch emits a small object tagged
+/// `"kind": "branch"`.
+fn verdict_json(worktrees: &[Worktree], verdict: &Verdict) -> Result<String> {
+    match &verdict.subject {
+        Subject::Worktree { index, .. } => {
+            let mut row = serde_json::to_value(&worktrees[*index])?;
+            if let Some(fields) = row.as_object_mut() {
+                fields.insert("reason".into(), verdict.reason.label().into());
+            }
+            Ok(row.to_string())
+        }
+        Subject::Branch { name, merged, safe } => Ok(serde_json::json!({
+            "branch": name,
+            "kind": "branch",
+            "merged": merged,
+            "safe": safe,
+            "reason": verdict.reason.label(),
+        })
+        .to_string()),
+    }
+}
+
+/// Deletes the branch of a removed worktree when `wt` created it, the config
+/// allows it, and it is merged into the default branch by ancestry or content.
+/// Best-effort: a branch left behind is reported as a later branch candidate
+/// under `--all`, or simply kept.
+fn delete_merged_branch(
+    assessor: &Assessor<'_>,
+    worktree: &Worktree,
+    config: &crate::config::Config,
+) {
+    let Some(branch) = &worktree.branch else {
+        return;
+    };
+    if !config.remove_delete_merged_branch || assessor.targets.is_default(branch) {
+        return;
+    }
+    let meta = wtconfig::read_meta(assessor.repo.gix(), branch);
+    if !meta.created_by_wt {
+        return;
+    }
+    if !assessor.targets.is_merged(
+        assessor.git,
+        assessor.root,
+        assessor.repo,
+        &branch_ref(branch),
+    ) {
+        return;
+    }
+    match ops::delete_branch(assessor.git, assessor.root, branch, true) {
+        Ok(out) if !out.success => {
+            tracing::debug!(branch = %branch, stderr = %out.stderr.trim(), "prune: delete merged branch failed");
+        }
+        Err(error) => {
+            tracing::debug!(branch = %branch, %error, "prune: delete merged branch could not run");
+        }
+        Ok(_) => {}
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::cli::PruneArgs;
+    use crate::error::Error;
+    use crate::git::cli::RealGit;
+    use crate::testutil::{CannedInput, TestRepo, give_upstream, make_wt, wt_dir};
+
+    fn prune_args(merged: bool, gone: bool, dry_run: bool, force: bool) -> PruneArgs {
+        PruneArgs {
+            merged,
+            gone,
+            pushed: false,
+            all: false,
+            locked: false,
+            no_fetch: false,
+            dry_run,
+            force,
+        }
+    }
+
+    /// `--all` alone (no `--merged`/`--gone`), as a dry run.
+    fn all_dry_run() -> PruneArgs {
+        PruneArgs {
+            all: true,
+            ..prune_args(false, false, true, false)
+        }
+    }
+
+    /// `--pushed` alone, as a dry run.
+    fn pushed_dry_run() -> PruneArgs {
+        PruneArgs {
+            pushed: true,
+            ..prune_args(false, false, true, false)
+        }
+    }
+
+    /// `--all` for real, without `--force` (the confirmation is answered by `-y`).
+    fn all_run() -> PruneArgs {
+        PruneArgs {
+            all: true,
+            ..prune_args(false, false, false, false)
+        }
+    }
+
+    /// Runs prune with `args` and returns stdout (the dry-run report).
+    fn report(repo: &TestRepo, args: &PruneArgs) -> String {
+        let mut t = crate::testutil::test_cx(&[], repo.root().to_str().unwrap());
+        super::run(&mut t.cx, args, false).unwrap();
+        t.out.contents()
+    }
+
+    /// Runs prune with `args` and returns (stdout, stderr).
+    fn report_both(repo: &TestRepo, args: &PruneArgs) -> (String, String) {
+        let mut t = crate::testutil::test_cx(&[], repo.root().to_str().unwrap());
+        super::run(&mut t.cx, args, false).unwrap();
+        (t.out.contents(), t.err.contents())
+    }
+
+    /// Runs prune with `args`, answering the prompt with `-y`, and returns stderr.
+    fn run_yes(repo: &TestRepo, args: &PruneArgs) -> String {
+        let mut t = crate::testutil::test_cx(&[], repo.root().to_str().unwrap());
+        t.cx.assume_yes = true;
+        super::run(&mut t.cx, args, false).unwrap();
+        t.err.contents()
+    }
+
+    /// Records a remote-tracking ref `refs/remotes/origin/<remote_name>` at
+    /// `name`'s tip, as if the branch had been pushed there.
+    fn push_tip(repo: &TestRepo, name: &str, remote_name: &str) {
+        repo.git(&[
+            "update-ref",
+            &format!("refs/remotes/origin/{remote_name}"),
+            &format!("refs/heads/{name}"),
+        ]);
+    }
+
+    fn has_branch(repo: &TestRepo, name: &str) -> bool {
+        !repo.git(&["branch", "--list", name]).trim().is_empty()
+    }
+
+    /// A branch at the current tip — an ancestor of the default branch (merged),
+    /// with no worktree.
+    fn bare_branch(repo: &TestRepo, name: &str) {
+        repo.git(&["branch", name]);
+    }
+
+    /// A branch carrying its own commit, so it is NOT an ancestor of the default
+    /// branch; leaves the repo back on `main`.
+    fn diverged_branch(repo: &TestRepo, name: &str) {
+        repo.git(&["checkout", "-q", "-b", name]);
+        repo.write(&format!("{name}.txt"), "x\n");
+        repo.commit_all("diverge");
+        repo.git(&["checkout", "-q", "main"]);
+    }
+
+    /// Configures an upstream for `name` whose tracking ref does not exist, so
+    /// `upstream_of(...).is_gone` is true.
+    fn give_gone_upstream(repo: &TestRepo, name: &str) {
+        repo.git(&["config", &format!("branch.{name}.remote"), "origin"]);
+        repo.git(&[
+            "config",
+            &format!("branch.{name}.merge"),
+            &format!("refs/heads/{name}"),
+        ]);
+    }
+
+    /// Creates a worktree on `branch` and commits in it so the branch diverges
+    /// from main — i.e. it is not merged.
+    fn make_unmerged_wt(repo: &TestRepo, branch: &str) {
+        make_wt(repo, branch);
+        let wt = wt_dir(repo, branch);
+        std::fs::write(wt.join("change.txt"), "x\n").unwrap();
+        let dir = wt.to_string_lossy().into_owned();
+        repo.git(&["-C", &dir, "add", "-A"]);
+        repo.git(&["-C", &dir, "commit", "-q", "-m", "unmerged change"]);
+    }
+
+    #[test]
+    fn requires_a_mode_flag() {
+        let repo = TestRepo::init();
+        let mut t = crate::testutil::test_cx(&[], repo.root().to_str().unwrap());
+        let err =
+            super::run(&mut t.cx, &prune_args(false, false, false, false), false).unwrap_err();
+        assert_eq!(err.exit_code(), 2);
+    }
+
+    #[test]
+    fn dry_run_reports_merged_candidates_without_removing() {
+        let repo = TestRepo::init();
+        make_wt(&repo, "merged-wt"); // merged into main (no new commits)
+        let mut t = crate::testutil::test_cx(&[], repo.root().to_str().unwrap());
+        super::run(&mut t.cx, &prune_args(true, false, true, false), false).unwrap();
+        assert!(t.out.contents().contains("would remove merged-wt"));
+        // Still present (dry-run).
+        assert!(repo.git(&["worktree", "list"]).contains("merged-wt"));
+    }
+
+    #[test]
+    fn dry_run_reports_nothing_when_no_candidates() {
+        let repo = TestRepo::init();
+        let mut t = crate::testutil::test_cx(&[], repo.root().to_str().unwrap());
+        super::run(&mut t.cx, &prune_args(true, false, true, false), false).unwrap();
+        // A dry-run that finds nothing says so on stderr; stdout stays empty.
+        assert!(t.err.contents().contains("nothing to prune"));
+        assert!(t.out.contents().is_empty());
+    }
+
+    #[test]
+    fn force_prunes_merged_worktree_and_branch() {
+        let repo = TestRepo::init();
+        make_wt(&repo, "merged-wt");
+        let mut t = crate::testutil::test_cx(&[], repo.root().to_str().unwrap());
+        super::run(&mut t.cx, &prune_args(true, false, false, true), false).unwrap();
+        assert!(!repo.git(&["worktree", "list"]).contains("merged-wt"));
+        assert!(
+            repo.git(&["branch", "--list", "merged-wt"])
+                .trim()
+                .is_empty()
+        );
+    }
+
+    /// Prune's removal loop deletes worktrees, branches, and `wt.*` metadata,
+    /// so it runs under the advisory repo lock (issue #99). A concurrent holder
+    /// blocks it outright rather than letting it interleave — and nothing is
+    /// removed when it does.
+    #[test]
+    fn prune_is_excluded_by_a_concurrent_lock_holder() {
+        let repo = TestRepo::init();
+        make_wt(&repo, "merged-wt");
+        let mut t = crate::testutil::test_cx(&[], repo.root().to_str().unwrap());
+        let ws = crate::worktree::Workspace::discover(repo.root(), &t.cx.env, &RealGit).unwrap();
+        let held = ws.lock().unwrap();
+        let err = super::run(&mut t.cx, &prune_args(true, false, false, true), false).unwrap_err();
+        drop(held);
+        assert!(matches!(err, Error::LockUnavailable { .. }), "{err:?}");
+        assert!(repo.git(&["worktree", "list"]).contains("merged-wt"));
+    }
+
+    #[test]
+    fn confirmation_yes_prunes() {
+        let repo = TestRepo::init();
+        make_wt(&repo, "merged-wt");
+        let mut t = crate::testutil::test_cx(&[], repo.root().to_str().unwrap());
+        t.cx.input = Box::new(CannedInput::new(&["y"]));
+        super::run(&mut t.cx, &prune_args(true, false, false, false), false).unwrap();
+        assert!(t.err.contents().contains("Proceed?"));
+        assert!(!repo.git(&["worktree", "list"]).contains("merged-wt"));
+    }
+
+    /// `--yes` answers the prompt but is not `--force`: a dirty worktree is still
+    /// skipped. Keeping the two separable is what makes `-y` safe in a script.
+    #[test]
+    fn assume_yes_skips_prompt_but_not_the_dirty_guard() {
+        let repo = TestRepo::init();
+        make_wt(&repo, "clean-wt");
+        make_wt(&repo, "dirty-wt");
+        std::fs::write(wt_dir(&repo, "dirty-wt").join("README.md"), "dirty\n").unwrap();
+
+        let mut t = crate::testutil::test_cx(&[], repo.root().to_str().unwrap());
+        t.cx.assume_yes = true;
+        // No CannedInput: reading stdin at all would return "" and abort.
+        super::run(&mut t.cx, &prune_args(true, false, false, false), false).unwrap();
+
+        assert!(t.err.contents().contains("Proceed? [y/N] y (--yes)"));
+        assert!(
+            t.err
+                .contents()
+                .contains("skipping dirty-wt: uncommitted changes; use --force")
+        );
+        let list = repo.git(&["worktree", "list"]);
+        assert!(!list.contains("clean-wt"), "{list}");
+        assert!(list.contains("dirty-wt"), "{list}");
+    }
+
+    #[test]
+    fn confirmation_no_aborts() {
+        let repo = TestRepo::init();
+        make_wt(&repo, "merged-wt");
+        let mut t = crate::testutil::test_cx(&[], repo.root().to_str().unwrap());
+        t.cx.input = Box::new(CannedInput::new(&["n"]));
+        super::run(&mut t.cx, &prune_args(true, false, false, false), false).unwrap();
+        assert!(t.err.contents().contains("aborted"));
+        assert!(repo.git(&["worktree", "list"]).contains("merged-wt"));
+    }
+
+    #[test]
+    fn gone_prunes_missing_worktrees() {
+        let repo = TestRepo::init();
+        make_wt(&repo, "goner");
+        let repo_name = repo.root().file_name().unwrap().to_string_lossy();
+        let wt_path = repo
+            .root()
+            .parent()
+            .unwrap()
+            .join(format!("{repo_name}.worktrees/{repo_name}-goner"));
+        std::fs::remove_dir_all(&wt_path).unwrap();
+        let mut t = crate::testutil::test_cx(&[], repo.root().to_str().unwrap());
+        super::run(&mut t.cx, &prune_args(false, true, false, true), false).unwrap();
+        assert!(!repo.git(&["worktree", "list"]).contains("goner"));
+    }
+
+    #[test]
+    fn json_lists_candidates_without_removing() {
+        let repo = TestRepo::init();
+        make_wt(&repo, "merged-wt");
+        let mut t = crate::testutil::test_cx(&[], repo.root().to_str().unwrap());
+        super::run(&mut t.cx, &prune_args(true, false, false, false), true).unwrap();
+        let out = t.out.contents();
+        assert_eq!(out.lines().count(), 1);
+        let v: serde_json::Value = serde_json::from_str(out.trim()).unwrap();
+        assert_eq!(v["branch"], serde_json::json!("merged-wt"));
+        assert_eq!(v["reason"], serde_json::json!("merged"));
+        assert_eq!(v["schema_version"], serde_json::json!(1));
+        // --json implies dry-run: still present.
+        assert!(repo.git(&["worktree", "list"]).contains("merged-wt"));
+    }
+
+    #[test]
+    fn merged_bare_branch_is_pruned() {
+        let repo = TestRepo::init();
+        bare_branch(&repo, "old"); // no worktree, merged into main
+        let mut t = crate::testutil::test_cx(&[], repo.root().to_str().unwrap());
+        super::run(&mut t.cx, &prune_args(true, false, false, true), false).unwrap();
+        assert!(repo.git(&["branch", "--list", "old"]).trim().is_empty());
+        // The default/current branch is never touched.
+        assert!(repo.git(&["branch", "--list", "main"]).contains("main"));
+    }
+
+    #[test]
+    fn gone_merged_bare_branch_is_pruned() {
+        let repo = TestRepo::init();
+        bare_branch(&repo, "old");
+        give_gone_upstream(&repo, "old"); // merged AND upstream gone
+        let mut t = crate::testutil::test_cx(&[], repo.root().to_str().unwrap());
+        super::run(&mut t.cx, &prune_args(false, true, false, true), false).unwrap();
+        assert!(repo.git(&["branch", "--list", "old"]).trim().is_empty());
+    }
+
+    #[test]
+    fn gone_unmerged_branch_needs_force() {
+        let repo = TestRepo::init();
+        diverged_branch(&repo, "wip"); // not an ancestor of main
+        give_gone_upstream(&repo, "wip");
+        // Without --force the protected branch is skipped (confirmation says yes).
+        let mut t = crate::testutil::test_cx(&[], repo.root().to_str().unwrap());
+        t.cx.input = Box::new(CannedInput::new(&["y"]));
+        super::run(&mut t.cx, &prune_args(false, true, false, false), false).unwrap();
+        assert!(t.err.contents().contains("use --force"));
+        assert!(repo.git(&["branch", "--list", "wip"]).contains("wip"));
+        // With --force it is force-deleted.
+        let mut t = crate::testutil::test_cx(&[], repo.root().to_str().unwrap());
+        super::run(&mut t.cx, &prune_args(false, true, false, true), false).unwrap();
+        assert!(repo.git(&["branch", "--list", "wip"]).trim().is_empty());
+    }
+
+    #[test]
+    fn all_selects_merged_and_gone() {
+        let repo = TestRepo::init();
+        bare_branch(&repo, "old"); // merged only
+        diverged_branch(&repo, "wip"); // gone only, commits nowhere else
+        give_gone_upstream(&repo, "wip");
+        let (all, skips) = report_both(&repo, &all_dry_run());
+        assert!(all.contains("would remove old (branch): merged"), "{all}");
+        // The gone branch qualifies, but its commits exist nowhere else: the
+        // preview says it will be skipped rather than promising its removal.
+        assert!(!all.contains("wip"), "{all}");
+        assert!(
+            skips.contains("skipping wip (branch): has work on no remote"),
+            "{skips}"
+        );
+        // Same selection as `--merged --gone` here; each mode alone picks one.
+        assert_eq!(all, report(&repo, &prune_args(true, true, true, false)));
+        assert!(!report(&repo, &prune_args(true, false, true, false)).contains("wip"));
+        assert!(!report(&repo, &prune_args(false, true, true, false)).contains("old"));
+        // Nothing was removed.
+        assert!(has_branch(&repo, "old"));
+        assert!(has_branch(&repo, "wip"));
+        // A real `--all` deletes the merged branch but keeps the gone branch whose
+        // commits exist nowhere else.
+        let err = run_yes(&repo, &all_run());
+        assert!(err.contains("skipping wip"), "{err}");
+        assert!(!has_branch(&repo, "old"));
+        assert!(has_branch(&repo, "wip"));
+    }
+
+    #[test]
+    fn all_selects_merged_and_missing_worktrees() {
+        // `--all` covers both worktree paths: a merged worktree, and a missing
+        // one whose branch is unmerged (so only the `--gone` path selects it).
+        let repo = TestRepo::init();
+        make_wt(&repo, "done");
+        make_unmerged_wt(&repo, "lost");
+        std::fs::remove_dir_all(wt_dir(&repo, "lost")).unwrap();
+        let all = report(&repo, &all_dry_run());
+        assert!(all.contains("would remove done: merged\n"), "{all}");
+        assert!(all.contains("would remove lost: missing\n"), "{all}");
+        assert!(!report(&repo, &prune_args(true, false, true, false)).contains("lost"));
+        assert!(!report(&repo, &prune_args(false, true, true, false)).contains("done"));
+    }
+
+    #[test]
+    fn pushed_branch_is_selected_by_pushed_and_all_only() {
+        // Diverged from main but every commit is on origin: neither merged nor
+        // gone, yet deleting it loses nothing.
+        let repo = TestRepo::init();
+        diverged_branch(&repo, "feat");
+        give_upstream(&repo, "feat");
+        diverged_branch(&repo, "local"); // commits exist only here
+        let pushed = report(&repo, &pushed_dry_run());
+        assert!(pushed.contains("would remove feat (branch)"), "{pushed}");
+        assert!(!pushed.contains("local"), "{pushed}");
+        let all = report(&repo, &all_dry_run());
+        assert!(all.contains("would remove feat (branch)"), "{all}");
+        assert!(!all.contains("local"), "{all}");
+        assert!(!report(&repo, &prune_args(true, true, true, false)).contains("feat"));
+        // Deleted without --force; the local-only branch is untouched.
+        let err = run_yes(&repo, &all_run());
+        assert!(!err.contains("skipping"), "{err}");
+        assert!(!has_branch(&repo, "feat"));
+        assert!(has_branch(&repo, "local"));
+    }
+
+    #[test]
+    fn pushed_branch_without_upstream_is_selected() {
+        // Pushed without `-u`: no upstream, but origin holds the tip.
+        let repo = TestRepo::init();
+        diverged_branch(&repo, "feat");
+        push_tip(&repo, "feat", "feat");
+        let pushed = report(&repo, &pushed_dry_run());
+        assert!(pushed.contains("would remove feat (branch)"), "{pushed}");
+    }
+
+    #[test]
+    fn pushed_branch_that_moved_since_push_is_not_selected() {
+        let repo = TestRepo::init();
+        diverged_branch(&repo, "feat");
+        give_upstream(&repo, "feat");
+        repo.git(&["checkout", "-q", "feat"]);
+        repo.write("more.txt", "x\n");
+        repo.commit_all("unpushed");
+        repo.git(&["checkout", "-q", "main"]);
+        assert!(!report(&repo, &pushed_dry_run()).contains("feat"));
+    }
+
+    #[test]
+    fn merged_counts_the_remote_default_branch() {
+        // Merged on origin while local main lags behind: `--merged` sees it via
+        // origin/HEAD's target.
+        let repo = TestRepo::init();
+        diverged_branch(&repo, "feat");
+        repo.git(&["update-ref", "refs/remotes/origin/main", "refs/heads/feat"]);
+        repo.git(&[
+            "symbolic-ref",
+            "refs/remotes/origin/HEAD",
+            "refs/remotes/origin/main",
+        ]);
+        let merged = report(&repo, &prune_args(true, false, true, false));
+        assert!(merged.contains("would remove feat (branch)"), "{merged}");
+        // Deleted for real without --force.
+        run_yes(&repo, &prune_args(true, false, false, false));
+        assert!(!has_branch(&repo, "feat"));
+        assert!(has_branch(&repo, "main"));
+    }
+
+    #[test]
+    fn gone_branch_whose_commits_survive_needs_no_force() {
+        // Upstream deleted, but the commits live on under another remote ref.
+        let repo = TestRepo::init();
+        diverged_branch(&repo, "shipped");
+        give_gone_upstream(&repo, "shipped");
+        push_tip(&repo, "shipped", "release");
+        let err = run_yes(&repo, &prune_args(false, true, false, false));
+        assert!(!err.contains("skipping"), "{err}");
+        assert!(!has_branch(&repo, "shipped"));
+    }
+
+    #[test]
+    fn all_keeps_the_worktree_of_a_live_pushed_branch() {
+        // Pushed and live (upstream present): the branch is recoverable, but the
+        // checkout is active work, so `--all` touches neither.
+        let repo = TestRepo::init();
+        make_unmerged_wt(&repo, "live");
+        give_upstream(&repo, "live");
+        let all = report(&repo, &all_dry_run());
+        assert!(!all.contains("live"), "{all}");
+    }
+
+    #[test]
+    fn all_removes_a_gone_worktree_and_its_recoverable_branch_in_one_pass() {
+        let repo = TestRepo::init();
+        make_unmerged_wt(&repo, "shipped");
+        give_gone_upstream(&repo, "shipped");
+        push_tip(&repo, "shipped", "release");
+        let all = report(&repo, &all_dry_run());
+        assert!(
+            all.contains("would remove shipped: upstream gone\n"),
+            "{all}"
+        );
+        assert!(
+            all.contains("would remove shipped (branch): upstream gone"),
+            "{all}"
+        );
+        // `--gone` alone removes the worktree and keeps the (unmerged) branch.
+        assert!(!report(&repo, &prune_args(false, true, true, false)).contains("(branch)"));
+        let err = run_yes(&repo, &all_run());
+        assert!(err.contains("pruned 2 item(s)"), "{err}");
+        assert!(!repo.git(&["worktree", "list"]).contains("shipped"));
+        assert!(!has_branch(&repo, "shipped"));
+    }
+
+    #[test]
+    fn all_removes_a_merged_worktree_and_branch_without_noise() {
+        // The merged branch goes with its worktree; the branch candidate then
+        // finds it already gone and skips quietly.
+        let repo = TestRepo::init();
+        make_wt(&repo, "done");
+        let err = run_yes(&repo, &all_run());
+        assert!(!err.contains("could not delete"), "{err}");
+        assert!(!repo.git(&["worktree", "list"]).contains("done"));
+        assert!(!has_branch(&repo, "done"));
+    }
+
+    #[test]
+    fn all_deletes_the_branch_of_a_missing_worktree_in_one_pass() {
+        // The missing worktree is still registered until Git reconciles its
+        // metadata; the branch delete must not trip over that.
+        let repo = TestRepo::init();
+        make_wt(&repo, "done");
+        std::fs::remove_dir_all(wt_dir(&repo, "done")).unwrap();
+        let err = run_yes(&repo, &all_run());
+        assert!(!err.contains("could not delete"), "{err}");
+        assert!(!repo.git(&["worktree", "list"]).contains("done"));
+        assert!(!has_branch(&repo, "done"));
+    }
+
+    #[test]
+    fn pushed_alone_never_selects_worktrees() {
+        let repo = TestRepo::init();
+        make_unmerged_wt(&repo, "live");
+        give_upstream(&repo, "live");
+        std::fs::remove_dir_all(wt_dir(&repo, "live")).unwrap(); // even a missing one
+        assert!(!report(&repo, &pushed_dry_run()).contains("live"));
+    }
+
+    #[test]
+    fn all_keeps_the_branch_of_a_skipped_dirty_worktree() {
+        let repo = TestRepo::init();
+        make_unmerged_wt(&repo, "busy");
+        give_gone_upstream(&repo, "busy");
+        push_tip(&repo, "busy", "release");
+        std::fs::write(wt_dir(&repo, "busy").join("README.md"), "dirty\n").unwrap();
+        let err = run_yes(&repo, &all_run());
+        assert!(err.contains("skipping busy: uncommitted changes"), "{err}");
+        assert!(!err.contains("could not delete"), "{err}");
+        assert!(has_branch(&repo, "busy"));
+    }
+
+    #[test]
+    fn a_failed_recoverability_check_counts_as_unsafe() {
+        let repo = TestRepo::init();
+        // `rev-list` fails on a branch that does not exist; that must never read
+        // as "safe to delete".
+        let args = all_dry_run();
+        with_assessor(&repo, &args, |assessor| {
+            assert!(!assessor.recoverable("refs/heads/no-such-branch"));
+            assert!(!assessor.branch_is_safe("no-such-branch"));
+        });
+    }
+
+    /// Runs `f` with an [`super::Assessor`] over `repo` for `args`.
+    fn with_assessor(repo: &TestRepo, args: &PruneArgs, f: impl FnOnce(&super::Assessor<'_>)) {
+        with_assessor_git(repo, args, &RealGit, f);
+    }
+
+    fn with_assessor_git(
+        repo: &TestRepo,
+        args: &PruneArgs,
+        git: &dyn crate::git::cli::GitCli,
+        f: impl FnOnce(&super::Assessor<'_>),
+    ) {
+        let r = crate::git::discover::Repo::discover(repo.root()).unwrap();
+        let targets = super::MergeTargets::resolve(&r);
+        let assessor = super::Assessor {
+            git,
+            root: repo.root(),
+            repo: &r,
+            args,
+            targets: &targets,
+        };
+        f(&assessor);
+    }
+
+    #[test]
+    fn pushed_alone_satisfies_the_mode_requirement() {
+        let repo = TestRepo::init();
+        let err = run_yes(&repo, &pushed_dry_run());
+        assert!(err.contains("nothing to prune"), "{err}");
+    }
+
+    /// A clone-like repo: `main` and `feat` pushed to a bare `origin`, with
+    /// `feat` tracking `origin/feat`. Returns (local, remote).
+    fn repo_with_remote() -> (TestRepo, TestRepo) {
+        let remote = TestRepo::init_bare();
+        let repo = TestRepo::init();
+        repo.git(&["remote", "add", "origin", remote.root().to_str().unwrap()]);
+        diverged_branch(&repo, "feat");
+        repo.git(&["push", "-q", "-u", "origin", "main", "feat"]);
+        repo.git(&["remote", "set-head", "origin", "main"]);
+        (repo, remote)
+    }
+
+    fn json_branch(repo: &TestRepo, args: &PruneArgs, name: &str) -> Option<serde_json::Value> {
+        let mut t = crate::testutil::test_cx(&[], repo.root().to_str().unwrap());
+        super::run(&mut t.cx, args, true).unwrap();
+        t.out
+            .contents()
+            .lines()
+            .map(|l| serde_json::from_str::<serde_json::Value>(l).unwrap())
+            .find(|v| v["branch"] == serde_json::json!(name))
+    }
+
+    #[test]
+    fn fetch_refreshes_remote_refs_before_judging_safety() {
+        // The branch was deleted on origin since the last fetch. The stale
+        // tracking ref would vouch for its commits; the fetch shows they are
+        // gone, so the branch is no longer safe to delete.
+        let (repo, remote) = repo_with_remote();
+        remote.git(&["branch", "-D", "feat"]);
+        let offline = PruneArgs {
+            no_fetch: true,
+            ..all_dry_run()
+        };
+        let stale = json_branch(&repo, &offline, "feat").expect("selected offline");
+        assert_eq!(stale["safe"], serde_json::json!(true));
+        assert_eq!(stale["reason"], serde_json::json!("pushed"));
+        // Fresh, it is gone and unsafe: `--json` lists only what would be
+        // removed, so it drops out, and the text preview says why.
+        assert!(json_branch(&repo, &all_dry_run(), "feat").is_none());
+        let (_, skips) = report_both(&repo, &all_dry_run());
+        assert!(
+            skips.contains("skipping feat (branch): has work on no remote"),
+            "{skips}"
+        );
+        // With --force it would be removed, and says it is unsafe.
+        let forced = PruneArgs {
+            force: true,
+            ..all_dry_run()
+        };
+        let fresh = json_branch(&repo, &forced, "feat").expect("selected as gone");
+        assert_eq!(fresh["safe"], serde_json::json!(false));
+        assert_eq!(fresh["reason"], serde_json::json!("upstream gone"));
+        assert!(has_branch(&repo, "feat"));
+    }
+
+    #[test]
+    fn failed_fetch_aborts_unless_no_fetch() {
+        let repo = TestRepo::init();
+        repo.git(&[
+            "remote",
+            "add",
+            "origin",
+            "/nonexistent/wt-prune-remote.git",
+        ]);
+        let mut t = crate::testutil::test_cx(&[], repo.root().to_str().unwrap());
+        let err = super::run(&mut t.cx, &all_dry_run(), false).unwrap_err();
+        assert!(err.to_string().contains("--no-fetch"), "{err}");
+        // `--merged` alone reads no remote state, so it never fetches.
+        report(&repo, &prune_args(true, false, true, false));
+        let offline = PruneArgs {
+            no_fetch: true,
+            ..all_dry_run()
+        };
+        report(&repo, &offline);
+    }
+
+    #[test]
+    fn default_and_current_never_deleted() {
+        let repo = TestRepo::init(); // only `main` (default + current)
+        let mut t = crate::testutil::test_cx(&[], repo.root().to_str().unwrap());
+        super::run(&mut t.cx, &prune_args(true, true, false, true), false).unwrap();
+        assert!(t.err.contents().contains("nothing to prune"));
+        assert!(repo.git(&["branch", "--list", "main"]).contains("main"));
+    }
+
+    #[test]
+    fn merged_only_skips_unmerged_worktree() {
+        // A worktree whose branch is not merged into main must never be a
+        // `--merged` prune candidate — a guard against pruning live work.
+        let repo = TestRepo::init();
+        make_unmerged_wt(&repo, "wip");
+        let mut t = crate::testutil::test_cx(&[], repo.root().to_str().unwrap());
+        super::run(&mut t.cx, &prune_args(true, false, true, false), false).unwrap();
+        assert!(t.err.contents().contains("nothing to prune"));
+    }
+
+    #[test]
+    fn dry_run_lists_bare_branch_without_deleting() {
+        let repo = TestRepo::init();
+        bare_branch(&repo, "old");
+        let mut t = crate::testutil::test_cx(&[], repo.root().to_str().unwrap());
+        super::run(&mut t.cx, &prune_args(true, false, true, false), false).unwrap();
+        assert!(t.out.contents().contains("would remove old (branch)"));
+        assert!(repo.git(&["branch", "--list", "old"]).contains("old"));
+    }
+
+    #[test]
+    fn branch_with_worktree_uses_worktree_path() {
+        let repo = TestRepo::init();
+        make_wt(&repo, "merged-wt"); // branch + worktree
+        let mut t = crate::testutil::test_cx(&[], repo.root().to_str().unwrap());
+        super::run(&mut t.cx, &prune_args(true, false, false, true), false).unwrap();
+        // Pruned once via the worktree path — not double-counted as a bare branch.
+        assert!(!repo.git(&["worktree", "list"]).contains("merged-wt"));
+        assert!(
+            repo.git(&["branch", "--list", "merged-wt"])
+                .trim()
+                .is_empty()
+        );
+        assert!(t.err.contents().contains("pruned 1 item(s)"));
+    }
+
+    #[test]
+    fn json_lists_bare_branch() {
+        let repo = TestRepo::init();
+        bare_branch(&repo, "old");
+        let mut t = crate::testutil::test_cx(&[], repo.root().to_str().unwrap());
+        super::run(&mut t.cx, &prune_args(true, false, false, false), true).unwrap();
+        let out = t.out.contents();
+        let v: serde_json::Value = serde_json::from_str(out.trim()).unwrap();
+        assert_eq!(v["branch"], serde_json::json!("old"));
+        assert_eq!(v["kind"], serde_json::json!("branch"));
+        assert_eq!(v["merged"], serde_json::json!(true));
+        assert_eq!(v["safe"], serde_json::json!(true));
+        assert_eq!(v["reason"], serde_json::json!("merged"));
+        // --json implies dry-run: still present.
+        assert!(repo.git(&["branch", "--list", "old"]).contains("old"));
+    }
+
+    /// Adds a detached worktree named `detached-<name>` (beside the repo) at
+    /// `rev`, returning its path.
+    fn detached_wt(repo: &TestRepo, name: &str, rev: &str) -> std::path::PathBuf {
+        let path = repo
+            .root()
+            .parent()
+            .unwrap()
+            .join(format!("detached-{name}"));
+        repo.git(&[
+            "worktree",
+            "add",
+            "-q",
+            "--detach",
+            path.to_str().unwrap(),
+            rev,
+        ]);
+        path
+    }
+
+    /// Commits a new file in the worktree at `path`, returning the new HEAD.
+    fn commit_in(repo: &TestRepo, path: &std::path::Path, file: &str) -> String {
+        std::fs::write(path.join(file), "x\n").unwrap();
+        let dir = path.to_string_lossy().into_owned();
+        repo.git(&["-C", &dir, "add", "-A"]);
+        repo.git(&["-C", &dir, "commit", "-q", "-m", file]);
+        repo.git(&["-C", &dir, "rev-parse", "HEAD"])
+            .trim()
+            .to_string()
+    }
+
+    fn worktree_listed(repo: &TestRepo, needle: &str) -> bool {
+        repo.git(&["worktree", "list"]).contains(needle)
+    }
+
+    /// Squash-merges `branch` into `main` (checked out in the primary worktree).
+    fn squash_into_main(repo: &TestRepo, branch: &str) {
+        repo.git(&["merge", "-q", "--squash", branch]);
+        repo.git(&["commit", "-q", "-m", &format!("squash {branch}")]);
+    }
+
+    #[test]
+    fn a_detached_worktree_on_merged_work_is_pruned_as_merged() {
+        let repo = TestRepo::init();
+        detached_wt(&repo, "merged", "main");
+        let merged = report(&repo, &prune_args(true, false, true, false));
+        assert!(merged.contains("detached-merged: merged\n"), "{merged}");
+        run_yes(&repo, &prune_args(true, false, false, false));
+        assert!(!worktree_listed(&repo, "detached-merged"));
+    }
+
+    #[test]
+    fn a_detached_worktree_is_pushed_only_when_its_head_is_on_a_remote() {
+        let repo = TestRepo::init();
+        let pushed = detached_wt(&repo, "pushed", "main");
+        let head = commit_in(&repo, &pushed, "pr.txt");
+        repo.git(&["update-ref", "refs/remotes/origin/pr-head", &head]);
+        let local = detached_wt(&repo, "local", "main");
+        commit_in(&repo, &local, "wip.txt");
+
+        let report_pushed = report(&repo, &pushed_dry_run());
+        assert!(
+            report_pushed.contains("detached-pushed: pushed\n"),
+            "{report_pushed}"
+        );
+        assert!(!report_pushed.contains("detached-local"), "{report_pushed}");
+        // Not merged, so `--merged` leaves both.
+        assert!(!report(&repo, &prune_args(true, false, true, false)).contains("detached-"));
+        let err = run_yes(&repo, &all_run());
+        assert!(err.contains("pruned 1 item(s)"), "{err}");
+        assert!(!worktree_listed(&repo, "detached-pushed"));
+        assert!(worktree_listed(&repo, "detached-local"));
+    }
+
+    #[test]
+    fn a_dirty_detached_worktree_is_skipped_and_says_so() {
+        let repo = TestRepo::init();
+        let path = detached_wt(&repo, "dirty", "main");
+        std::fs::write(path.join("README.md"), "edited\n").unwrap();
+        let (out, err) = report_both(&repo, &all_dry_run());
+        assert!(!out.contains("detached-dirty"), "{out}");
+        assert!(err.contains("detached-dirty: uncommitted changes"), "{err}");
+        run_yes(&repo, &all_run());
+        assert!(worktree_listed(&repo, "detached-dirty"));
+    }
+
+    #[test]
+    fn a_worktree_mid_rebase_is_kept_even_with_force() {
+        // Mid-rebase a worktree is detached and may look merged; the rebase is
+        // still someone's work in flight.
+        let repo = TestRepo::init();
+        let path = detached_wt(&repo, "rebasing", "main");
+        let admin = repo.git(&[
+            "-C",
+            path.to_str().unwrap(),
+            "rev-parse",
+            "--absolute-git-dir",
+        ]);
+        std::fs::create_dir(std::path::Path::new(admin.trim()).join("rebase-merge")).unwrap();
+        let forced = PruneArgs {
+            all: true,
+            ..prune_args(false, false, false, true)
+        };
+        let mut t = crate::testutil::test_cx(&[], repo.root().to_str().unwrap());
+        super::run(&mut t.cx, &forced, false).unwrap();
+        let err = t.err.contents();
+        assert!(
+            err.contains("detached-rebasing: rebase in progress"),
+            "{err}"
+        );
+        assert!(worktree_listed(&repo, "detached-rebasing"));
+    }
+
+    #[test]
+    fn a_squash_merged_worktree_with_a_live_upstream_is_merged_by_content() {
+        // Pushed, upstream still present, and its work squashed into main under
+        // another SHA: no ancestry, not gone, and `--pushed` skips checkouts.
+        let repo = TestRepo::init();
+        make_unmerged_wt(&repo, "chore");
+        give_upstream(&repo, "chore");
+        squash_into_main(&repo, "chore");
+        let merged = report(&repo, &prune_args(true, false, true, false));
+        assert!(
+            merged.contains("would remove chore: merged by content"),
+            "{merged}"
+        );
+        assert!(!report(&repo, &pushed_dry_run()).contains("chore"));
+        let err = run_yes(&repo, &all_run());
+        assert!(!err.contains("skipping"), "{err}");
+        assert!(!err.contains("could not"), "{err}");
+        assert!(!worktree_listed(&repo, "chore"));
+        assert!(!has_branch(&repo, "chore"));
+    }
+
+    #[test]
+    fn a_merge_only_branch_without_upstream_is_merged_by_content() {
+        // An integration branch never pushed, holding only merges of work that
+        // later reached main through squashes: its SHAs exist nowhere else, its
+        // content is all in main.
+        let repo = TestRepo::init();
+        diverged_branch(&repo, "x");
+        diverged_branch(&repo, "y");
+        repo.git(&["checkout", "-q", "-b", "integration"]);
+        repo.git(&["merge", "-q", "--no-ff", "-m", "merge x", "x"]);
+        repo.git(&["merge", "-q", "--no-ff", "-m", "merge y", "y"]);
+        repo.git(&["checkout", "-q", "main"]);
+        assert!(!report(&repo, &all_dry_run()).contains("integration"));
+        squash_into_main(&repo, "x");
+        squash_into_main(&repo, "y");
+        let all = report(&repo, &all_dry_run());
+        assert!(
+            all.contains("would remove integration (branch): merged by content"),
+            "{all}"
+        );
+        let err = run_yes(&repo, &all_run());
+        assert!(!err.contains("skipping"), "{err}");
+        assert!(!has_branch(&repo, "integration"));
+    }
+
+    #[test]
+    fn a_gone_branch_whose_changes_landed_needs_no_force() {
+        // `--gone` alone never ran the content check for selection, but safety
+        // still counts a squash-merged branch as losing nothing.
+        let repo = TestRepo::init();
+        diverged_branch(&repo, "shipped");
+        give_gone_upstream(&repo, "shipped");
+        squash_into_main(&repo, "shipped");
+        let err = run_yes(&repo, &prune_args(false, true, false, false));
+        assert!(!err.contains("skipping"), "{err}");
+        assert!(!has_branch(&repo, "shipped"));
+    }
+
+    #[test]
+    fn the_current_worktree_is_never_pruned() {
+        let repo = TestRepo::init();
+        // Like a clone: without `origin/HEAD` the default branch falls back to
+        // the current one, which inside the worktree would be `here` itself.
+        repo.git(&["update-ref", "refs/remotes/origin/main", "refs/heads/main"]);
+        repo.git(&[
+            "symbolic-ref",
+            "refs/remotes/origin/HEAD",
+            "refs/remotes/origin/main",
+        ]);
+        make_wt(&repo, "here");
+        let inside = wt_dir(&repo, "here");
+        let mut t = crate::testutil::test_cx(&[], inside.to_str().unwrap());
+        super::run(&mut t.cx, &prune_args(true, false, false, true), false).unwrap();
+        let err = t.err.contents();
+        assert!(
+            err.contains("skipping here: it is the current worktree"),
+            "{err}"
+        );
+        assert!(worktree_listed(&repo, "here"));
+        assert!(has_branch(&repo, "here"));
+    }
+
+    #[test]
+    fn a_locked_worktree_is_skipped_unless_locked_is_passed() {
+        let repo = TestRepo::init();
+        make_wt(&repo, "agent");
+        let path = wt_dir(&repo, "agent");
+        repo.git(&[
+            "worktree",
+            "lock",
+            "--reason",
+            "claimed by agent",
+            path.to_str().unwrap(),
+        ]);
+        let (out, err) = report_both(&repo, &all_dry_run());
+        assert!(!out.contains("agent"), "{out}");
+        assert!(
+            err.contains("skipping agent: locked (claimed by agent); use --locked"),
+            "{err}"
+        );
+        // `--force` is not an override for a lock.
+        let forced = PruneArgs {
+            all: true,
+            ..prune_args(false, false, false, true)
+        };
+        run_yes(&repo, &forced);
+        assert!(worktree_listed(&repo, "agent"));
+        assert!(has_branch(&repo, "agent"));
+        let unlocked = PruneArgs {
+            locked: true,
+            ..all_run()
+        };
+        let err = run_yes(&repo, &unlocked);
+        assert!(!err.contains("could not"), "{err}");
+        assert!(!worktree_listed(&repo, "agent"));
+        assert!(!has_branch(&repo, "agent"));
+    }
+
+    #[test]
+    fn a_missing_locked_worktree_is_reconciled_with_locked() {
+        let repo = TestRepo::init();
+        make_wt(&repo, "ghost");
+        let path = wt_dir(&repo, "ghost");
+        repo.git(&["worktree", "lock", path.to_str().unwrap()]);
+        std::fs::remove_dir_all(&path).unwrap();
+        let err = run_yes(&repo, &all_run());
+        assert!(
+            err.contains("skipping ghost: locked; use --locked"),
+            "{err}"
+        );
+        assert!(worktree_listed(&repo, "ghost"));
+        let unlocked = PruneArgs {
+            locked: true,
+            ..all_run()
+        };
+        run_yes(&repo, &unlocked);
+        assert!(!worktree_listed(&repo, "ghost"));
+        assert!(!has_branch(&repo, "ghost"));
+    }
+
+    /// Real git, except `worktree remove` is refused.
+    struct RefusesRemove;
+    impl crate::git::cli::GitCli for RefusesRemove {
+        fn run_raw(
+            &self,
+            repo: &std::path::Path,
+            args: &[&str],
+        ) -> crate::error::Result<crate::git::cli::GitOutput> {
+            if args.starts_with(&["worktree", "remove"]) {
+                return Ok(crate::git::cli::GitOutput {
+                    success: false,
+                    stdout: String::new(),
+                    stderr: "fatal: refused".into(),
+                });
+            }
+            RealGit.run_raw(repo, args)
+        }
+    }
+
+    #[test]
+    fn a_refused_worktree_removal_is_reported_and_not_counted() {
+        let repo = TestRepo::init();
+        make_wt(&repo, "stuck");
+        let mut t = crate::testutil::test_cx_with_git(
+            &[],
+            repo.root().to_str().unwrap(),
+            std::sync::Arc::new(RefusesRemove),
+        );
+        t.cx.assume_yes = true;
+        super::run(&mut t.cx, &all_run(), false).unwrap();
+        let err = t.err.contents();
+        assert!(err.contains("could not remove stuck: "), "{err}");
+        assert!(err.contains("fatal: refused"), "{err}");
+        assert!(err.contains("pruned 0 item(s)"), "{err}");
+        // Its branch stays with it rather than failing a "checked out" delete.
+        assert!(!err.contains("could not delete"), "{err}");
+        assert!(worktree_listed(&repo, "stuck"));
+        assert!(has_branch(&repo, "stuck"));
+    }
+
+    #[test]
+    fn a_worktree_dirtied_after_the_prompt_is_kept() {
+        let repo = TestRepo::init();
+        make_wt(&repo, "late");
+        let path = wt_dir(&repo, "late");
+        // Stands in for an edit made while the prompt waited: selection saw it
+        // clean, the removal re-reads it.
+        let row = row_for(&repo, "late");
+        let args = all_run();
+        with_assessor(&repo, &args, |assessor| {
+            assert_eq!(super::changed_since_assessed(assessor, &row, None), None);
+        });
+        std::fs::write(path.join("README.md"), "late edit\n").unwrap();
+        with_assessor(&repo, &args, |assessor| {
+            let why = super::changed_since_assessed(assessor, &row, None).unwrap();
+            assert!(why.contains("uncommitted changes"), "{why}");
+        });
+    }
+
+    #[test]
+    fn an_untracked_file_added_after_the_prompt_keeps_the_worktree() {
+        let repo = TestRepo::init();
+        make_wt(&repo, "late-new");
+        let path = wt_dir(&repo, "late-new");
+        let row = row_for(&repo, "late-new");
+        let args = all_run();
+        std::fs::write(path.join("new.rs"), "fn main() {}\n").unwrap();
+        with_assessor(&repo, &args, |assessor| {
+            let why = super::changed_since_assessed(assessor, &row, None).unwrap();
+            assert!(why.contains("uncommitted changes"), "{why}");
+        });
+    }
+
+    #[test]
+    fn untracked_files_keep_a_selected_worktree_whatever_the_config() {
+        // `remove.untracked_blocks` defaults to false, but removal passes
+        // `--force`: prune's own guard is the only thing between git and these
+        // files, for every way a worktree can qualify. The repository also
+        // hides untracked files from `git status`, which must not matter.
+        let repo = TestRepo::init();
+        repo.git(&["config", "status.showUntrackedFiles", "no"]);
+        let detached = detached_wt(&repo, "fresh", "main");
+        std::fs::write(detached.join("newfile.rs"), "wip\n").unwrap();
+        make_unmerged_wt(&repo, "squashed");
+        give_upstream(&repo, "squashed");
+        squash_into_main(&repo, "squashed");
+        std::fs::write(wt_dir(&repo, "squashed").join("notes.md"), "wip\n").unwrap();
+        make_wt(&repo, "held");
+        let held = wt_dir(&repo, "held");
+        std::fs::write(held.join("scratch.txt"), "wip\n").unwrap();
+        repo.git(&["worktree", "lock", held.to_str().unwrap()]);
+
+        let (out, err) = report_both(
+            &repo,
+            &PruneArgs {
+                locked: true,
+                ..all_dry_run()
+            },
+        );
+        for name in ["detached-fresh", "squashed", "held"] {
+            assert!(!out.contains(name), "{out}");
+            assert!(
+                err.contains(&format!("{name}: uncommitted changes")),
+                "{err}"
+            );
+        }
+        let unlocked = PruneArgs {
+            locked: true,
+            ..all_run()
+        };
+        run_yes(&repo, &unlocked);
+        assert!(detached.join("newfile.rs").exists());
+        assert!(wt_dir(&repo, "squashed").join("notes.md").exists());
+        assert!(held.join("scratch.txt").exists());
+
+        // `--force` is the explicit override.
+        let forced = PruneArgs {
+            all: true,
+            locked: true,
+            ..prune_args(false, false, false, true)
+        };
+        run_yes(&repo, &forced);
+        assert!(!worktree_listed(&repo, "detached-fresh"));
+        assert!(!worktree_listed(&repo, "squashed"));
+        assert!(!worktree_listed(&repo, "held"));
+    }
+
+    /// The worktree row whose path ends with `suffix`.
+    fn row_for(repo: &TestRepo, suffix: &str) -> crate::model::Worktree {
+        crate::worktree::build_worktrees(
+            &crate::git::discover::Repo::discover(repo.root()).unwrap(),
+            &RealGit,
+        )
+        .unwrap()
+        .into_iter()
+        .find(|w| w.path.to_string_lossy().ends_with(suffix))
+        .unwrap()
+    }
+
+    #[test]
+    fn a_missing_worktree_that_reappeared_after_the_prompt_is_kept() {
+        // Assessed while its drive was unmounted; back by the time removal runs.
+        // `worktree remove --force` would delete it, uncommitted edits and all.
+        let repo = TestRepo::init();
+        make_wt(&repo, "remounted");
+        let path = wt_dir(&repo, "remounted");
+        let mut row = row_for(&repo, "remounted");
+        row.is_missing = true;
+        let args = all_run();
+        with_assessor(&repo, &args, |assessor| {
+            let why = super::changed_since_assessed(assessor, &row, None).unwrap();
+            assert!(why.contains("reappeared"), "{why}");
+        });
+        std::fs::remove_dir_all(&path).unwrap();
+        with_assessor(&repo, &args, |assessor| {
+            assert_eq!(super::changed_since_assessed(assessor, &row, None), None);
+        });
+    }
+
+    #[test]
+    fn a_branch_worktree_that_detached_after_the_prompt_is_kept() {
+        let repo = TestRepo::init();
+        make_wt(&repo, "hopper");
+        let path = wt_dir(&repo, "hopper");
+        let row = row_for(&repo, "hopper");
+        let dir = path.to_string_lossy().into_owned();
+        repo.git(&["-C", &dir, "checkout", "-q", "--detach"]);
+        commit_in(&repo, &path, "stray.txt");
+        let args = all_run();
+        with_assessor(&repo, &args, |assessor| {
+            let why = super::changed_since_assessed(assessor, &row, None).unwrap();
+            assert!(why.contains("HEAD moved"), "{why}");
+        });
+    }
+
+    #[test]
+    fn a_detached_worktree_that_committed_after_the_prompt_is_kept() {
+        // Clean both times, but its HEAD — the only holder of the new commit —
+        // moved off the commit that was judged safe.
+        let repo = TestRepo::init();
+        let path = detached_wt(&repo, "busy-agent", "main");
+        let assessed = repo.git(&["rev-parse", "main"]).trim().to_string();
+        let row = row_for(&repo, "detached-busy-agent");
+        let args = all_run();
+        with_assessor(&repo, &args, |assessor| {
+            assert_eq!(
+                super::changed_since_assessed(assessor, &row, Some(&assessed)),
+                None
+            );
+        });
+        commit_in(&repo, &path, "late.txt");
+        with_assessor(&repo, &args, |assessor| {
+            let why = super::changed_since_assessed(assessor, &row, Some(&assessed)).unwrap();
+            assert!(why.contains("HEAD moved"), "{why}");
+        });
+    }
+
+    #[test]
+    fn a_worktree_that_started_a_rebase_after_the_prompt_is_kept() {
+        let repo = TestRepo::init();
+        make_wt(&repo, "rebasing");
+        let row = row_for(&repo, "rebasing");
+        let admin = repo.git(&[
+            "-C",
+            wt_dir(&repo, "rebasing").to_str().unwrap(),
+            "rev-parse",
+            "--absolute-git-dir",
+        ]);
+        std::fs::create_dir(std::path::Path::new(admin.trim()).join("rebase-merge")).unwrap();
+        let args = all_run();
+        with_assessor(&repo, &args, |assessor| {
+            let why = super::changed_since_assessed(assessor, &row, None).unwrap();
+            assert_eq!(why, "rebase in progress");
+        });
+    }
+
+    #[test]
+    fn a_missing_detached_worktree_holding_the_only_copy_needs_force() {
+        let repo = TestRepo::init();
+        let path = detached_wt(&repo, "orphan", "main");
+        commit_in(&repo, &path, "only-here.txt");
+        std::fs::remove_dir_all(&path).unwrap();
+        let err = run_yes(&repo, &all_run());
+        assert!(
+            err.contains("detached-orphan: has work on no remote"),
+            "{err}"
+        );
+        assert!(worktree_listed(&repo, "detached-orphan"));
+        let forced = PruneArgs {
+            all: true,
+            ..prune_args(false, false, false, true)
+        };
+        run_yes(&repo, &forced);
+        assert!(!worktree_listed(&repo, "detached-orphan"));
+    }
+
+    #[test]
+    fn a_missing_worktree_no_mode_selected_is_left_registered() {
+        // `--merged` does not select a missing, unmerged worktree, and prune no
+        // longer runs a blanket `git worktree prune` that would drop it anyway.
+        let repo = TestRepo::init();
+        make_unmerged_wt(&repo, "offline");
+        std::fs::remove_dir_all(wt_dir(&repo, "offline")).unwrap();
+        make_wt(&repo, "done"); // one real candidate, so the removal loop runs
+        let err = run_yes(&repo, &prune_args(true, false, false, false));
+        assert!(err.contains("pruned 1 item(s)"), "{err}");
+        assert!(worktree_listed(&repo, "offline"));
+        // The empty case is just as hands-off.
+        run_yes(&repo, &prune_args(true, false, false, false));
+        assert!(worktree_listed(&repo, "offline"));
+    }
+
+    #[test]
+    fn a_missing_detached_worktree_whose_head_survives_is_pruned() {
+        let repo = TestRepo::init();
+        let path = detached_wt(&repo, "spent", "main");
+        std::fs::remove_dir_all(&path).unwrap();
+        let err = run_yes(&repo, &all_run());
+        assert!(!err.contains("skipping"), "{err}");
+        assert!(!worktree_listed(&repo, "detached-spent"));
+    }
+
+    /// Real git, except that a worktree whose path ends in `blind` cannot
+    /// resolve its admin directory — its in-progress state is unreadable.
+    struct BlindAdminDir;
+    impl crate::git::cli::GitCli for BlindAdminDir {
+        fn run_raw(
+            &self,
+            repo: &std::path::Path,
+            args: &[&str],
+        ) -> crate::error::Result<crate::git::cli::GitOutput> {
+            if args == ["rev-parse", "--absolute-git-dir"]
+                && repo.to_string_lossy().ends_with("blind")
+            {
+                return Ok(crate::git::cli::GitOutput {
+                    success: false,
+                    stdout: String::new(),
+                    stderr: "fatal: unreadable".into(),
+                });
+            }
+            RealGit.run_raw(repo, args)
+        }
+    }
+
+    #[test]
+    fn a_worktree_whose_state_turns_unreadable_after_the_prompt_is_kept() {
+        let repo = TestRepo::init();
+        make_wt(&repo, "blind");
+        let row = row_for(&repo, "blind");
+        let args = all_run();
+        with_assessor(&repo, &args, |assessor| {
+            assert_eq!(super::changed_since_assessed(assessor, &row, None), None);
+        });
+        with_assessor_git(&repo, &args, &BlindAdminDir, |assessor| {
+            let why = super::changed_since_assessed(assessor, &row, None);
+            assert_eq!(why, Some(super::Block::Unreadable.message()));
+        });
+    }
+
+    #[test]
+    fn a_missing_worktree_whose_path_cannot_be_checked_is_kept() {
+        // `git worktree remove --force` would delete whatever is at the path,
+        // so a path whose existence cannot be read is not treated as gone.
+        let repo = TestRepo::init();
+        make_wt(&repo, "offline");
+        let mut row = row_for(&repo, "offline");
+        let scratch = TestRepo::init();
+        let parent = scratch.root().join("mount");
+        row.path = parent.join("offline");
+        row.is_missing = true;
+        let args = all_run();
+        with_assessor(&repo, &args, |assessor| {
+            assert_eq!(super::changed_since_assessed(assessor, &row, None), None);
+        });
+        // A file where a directory should be: the lookup fails with ENOTDIR,
+        // not NotFound (and unlike a permission error, even for root).
+        std::fs::write(&parent, "not a directory\n").unwrap();
+        with_assessor(&repo, &args, |assessor| {
+            assert_eq!(
+                super::changed_since_assessed(assessor, &row, None),
+                Some(super::Block::Unreadable.message())
+            );
+        });
+    }
+
+    #[test]
+    fn an_unreadable_worktree_keeps_every_bare_branch() {
+        // The branch its rebase or bisect would return to is unknown, so no
+        // bare branch is deleted on the strength of git refusing the held one.
+        let repo = TestRepo::init();
+        make_wt(&repo, "blind");
+        repo.git(&["branch", "done"]);
+        let mut t = crate::testutil::test_cx_with_git(
+            &[],
+            repo.root().to_str().unwrap(),
+            std::sync::Arc::new(BlindAdminDir),
+        );
+        t.cx.assume_yes = true;
+        super::run(&mut t.cx, &all_run(), false).unwrap();
+        let err = t.err.contents();
+        assert!(
+            err.contains("skipping done (branch): cannot read the rebase or bisect state of blind"),
+            "{err}"
+        );
+        assert!(has_branch(&repo, "done"));
+        assert!(worktree_listed(&repo, "blind"));
+    }
+
+    #[test]
+    fn a_worktree_without_a_porcelain_record_is_unreadable() {
+        let repo = TestRepo::init();
+        make_wt(&repo, "unlisted");
+        let row = row_for(&repo, "unlisted");
+        let args = all_dry_run();
+        with_assessor(&repo, &args, |assessor| {
+            let verdict = assessor.worktree(1, &row, None).expect("merged");
+            assert_eq!(verdict.block, Some(super::Block::Unreadable));
+        });
+    }
+
+    #[test]
+    fn a_branch_being_rebased_is_not_a_bare_candidate() {
+        // Mid-rebase its worktree is detached and names no branch, but the
+        // branch is still in use: deleting it would strand the rebase.
+        let repo = TestRepo::init();
+        make_unmerged_wt(&repo, "feat");
+        give_upstream(&repo, "feat"); // pushed, so `--pushed` would pick it bare
+        repo.write("change.txt", "main\n");
+        repo.commit_all("main conflicts");
+        let dir = wt_dir(&repo, "feat").to_string_lossy().into_owned();
+        let out = crate::git::cli::GitCli::run_raw(
+            &RealGit,
+            std::path::Path::new(&dir),
+            &["rebase", "main"],
+        )
+        .unwrap();
+        assert!(!out.success, "the rebase should stop on the conflict");
+        let (all, _) = report_both(&repo, &all_dry_run());
+        assert!(!all.contains("feat (branch)"), "{all}");
+        run_yes(&repo, &all_run());
+        assert!(has_branch(&repo, "feat"));
+    }
+
+    #[test]
+    fn merged_is_reported_the_same_whatever_the_mode() {
+        // A pushed branch whose work was squashed into main: `--pushed` picks it,
+        // and still reports it merged.
+        let repo = TestRepo::init();
+        diverged_branch(&repo, "feat");
+        give_upstream(&repo, "feat");
+        squash_into_main(&repo, "feat");
+        let pushed = json_branch(&repo, &pushed_dry_run(), "feat").expect("pushed");
+        assert_eq!(pushed["reason"], serde_json::json!("pushed"));
+        assert_eq!(pushed["merged"], serde_json::json!(true));
+        let all = json_branch(&repo, &all_dry_run(), "feat").expect("merged");
+        assert_eq!(all["merged"], serde_json::json!(true));
+    }
+}
diff --git a/src/config/schema.rs b/src/config/schema.rs
index 8dc1c17..8085ab2 100644
--- a/src/config/schema.rs
+++ b/src/config/schema.rs
@@ -194,7 +194,8 @@ pub struct Config {
     pub editor: Option<String>,
     /// Delete a wt-created branch on `remove` if fully merged.
     pub remove_delete_merged_branch: bool,
-    /// Whether untracked files count as dirty for remove/prune guards.
+    /// Whether untracked files count as dirty for the remove guard. Prune always
+    /// counts them.
     pub remove_untracked_blocks: bool,
     /// Remote used for PR fetches.
     pub pr_default_remote: String,
diff --git a/src/git/merged.rs b/src/git/merged.rs
new file mode 100644
index 0000000..b6d9ee3
--- /dev/null
+++ b/src/git/merged.rs
@@ -0,0 +1,431 @@
+//! Content-level merge detection: whether every change on a commit is already in
+//! a target branch even when its SHAs are not — a squash merge, a rebase merge,
+//! work split across several pull requests, or a branch of merge commits whose
+//! parents all landed. `wt prune` falls back to this when ancestry says "not
+//! merged".
+//!
+//! The check fails safe: an error, a conflict, or an older `git` reads as "not
+//! merged", so a failed check can never be the reason work is deleted.
+
+use std::path::Path;
+
+use crate::git::cli::GitCli;
+
+/// Whether every change `tip` introduces is already in `target`, run in `dir`:
+/// merging `tip` into `target` would leave `target`'s tree unchanged
+/// (`git merge-tree --write-tree`, git ≥ 2.38). Meant for a `tip` that is *not*
+/// an ancestor of `target` — ancestry is the cheaper, stronger test and callers
+/// try it first.
+///
+/// This is a tree test, not a patch test, on purpose: a patch-equivalence check
+/// (`git cherry`) still matches a change the target later reverted, which would
+/// make reverted work look safe to delete. The cost is that a change the target
+/// has since edited on the same lines conflicts and reads as "not merged" — the
+/// safe direction to be wrong in.
+///
+/// A branch whose final tree equals its merge base's — nothing but empty
+/// commits, or work it added and then backed out itself — also merges as a
+/// no-op, yet its commits may hold work found nowhere else. It reads as "not
+/// merged", so only a branch that actually changes something can be judged
+/// merged by content.
+///
+/// `merge-tree` writes the merged tree to the object store; it creates no ref,
+/// so the object is garbage-collected like any other unreachable one. A conflict,
+/// unrelated histories, or a `git` without `merge-tree --write-tree` returns
+/// `false`.
+#[cfg_attr(not(feature = "cli"), allow(dead_code))]
+pub(crate) fn is_content_merged(git: &dyn GitCli, dir: &Path, tip: &str, target: &str) -> bool {
+    let target_tree = format!("{target}^{{tree}}");
+    let Ok(expected) = git.run(dir, &["rev-parse", "--verify", "--quiet", &target_tree]) else {
+        return false;
+    };
+    if !changes_anything(git, dir, tip, target) {
+        return false;
+    }
+    let Some(overrides) = driver_overrides(git, dir) else {
+        tracing::debug!(
+            tip,
+            target,
+            "merge drivers unreadable: content check skipped"
+        );
+        return false;
+    };
+    let mut argv: Vec<&str> = Vec::new();
+    for o in &overrides {
+        argv.extend(["-c", o.as_str()]);
+    }
+    argv.extend(["merge-tree", "--write-tree", "--no-messages", target, tip]);
+    match git.run_raw(dir, &argv) {
+        Ok(out) if out.success => out.stdout.lines().next().map(str::trim) == Some(expected.trim()),
+        Ok(out) => {
+            // Exit 1 is a conflict; anything else (an old git, unrelated
+            // histories, an unknown ref) is logged so a surprising "not merged"
+            // is traceable.
+            tracing::debug!(tip, target, stderr = %out.stderr.trim(), "merge-tree: not a clean no-op");
+            false
+        }
+        Err(error) => {
+            tracing::debug!(tip, target, %error, "merge-tree could not run");
+            false
+        }
+    }
+}
+
+/// `-c` overrides for the content check's `merge-tree`: every custom merge
+/// driver configured for `dir` made to fail, the built-in `union` driver made
+/// a plain text merge, and `merge.default` pinned to `text`. `None` when the
+/// configuration cannot be read (which the caller treats as "not merged").
+///
+/// A custom driver decides a file's merge however it likes — `merge=ours` keeps
+/// the target's side outright — so it can make work that never landed merge as
+/// a no-op. Failing it turns every file it governs into a conflict: "not
+/// merged", the safe direction. The built-in `union` driver keeps both sides of
+/// a conflict and can hide a deletion the same way, whether a `merge=union`
+/// attribute or `merge.default=union` selects it. It has no config key to find,
+/// but git looks up a configured `merge.union.driver` before its built-ins, so
+/// it is always overridden — with `git merge-file`, git's own text merge, so a
+/// conflict still conflicts while a `union` file (typically a changelog) whose
+/// edits both sides made cleanly still merges. It comes after any user
+/// `merge.union.driver` found above, so it wins. `merge.default` is pinned as
+/// well. `text` must stay usable, and `binary` already conflicts.
+fn driver_overrides(git: &dyn GitCli, dir: &Path) -> Option<Vec<String>> {
+    let out = git
+        .run_raw(
+            dir,
+            &[
+                "config",
+                "-z",
+                "--name-only",
+                "--get-regexp",
+                r"^merge\..+\.driver$",
+            ],
+        )
+        .ok()?;
+    // Exit 1 with no output is "no such key"; anything else is a read failure.
+    if !out.success && !(out.stdout.is_empty() && out.stderr.trim().is_empty()) {
+        return None;
+    }
+    // A driver name git's `-c` would split wrongly cannot be overridden, so
+    // one fails the whole check.
+    let mut overrides: Vec<String> = out
+        .stdout
+        .split('\0')
+        .filter(|key| !key.is_empty())
+        .map(|key| (!key.contains('=')).then(|| format!("{key}=exit 1")))
+        .collect::<Option<_>>()?;
+    overrides.push("merge.union.driver=git merge-file --marker-size=%L %A %O %B".into());
+    overrides.push("merge.default=text".into());
+    Some(overrides)
+}
+
+/// Whether `tip`'s tree differs from the tree of its merge base with `target`
+/// — i.e. the branch's net effect is not empty. Any failure (no merge base
+/// included) reads as `false`, which the caller treats as "not merged".
+fn changes_anything(git: &dyn GitCli, dir: &Path, tip: &str, target: &str) -> bool {
+    let Ok(base) = git.run(dir, &["merge-base", target, tip]) else {
+        return false;
+    };
+    let tree_of = |rev: &str| {
+        git.run(
+            dir,
+            &[
+                "rev-parse",
+                "--verify",
+                "--quiet",
+                &format!("{rev}^{{tree}}"),
+            ],
+        )
+        .ok()
+        .map(|t| t.trim().to_string())
+    };
+    match (tree_of(base.trim()), tree_of(tip)) {
+        (Some(base_tree), Some(tip_tree)) => base_tree != tip_tree,
+        _ => false,
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::git::cli::RealGit;
+    use crate::testutil::TestRepo;
+
+    fn merged(repo: &TestRepo, tip: &str) -> bool {
+        is_content_merged(&RealGit, repo.root(), tip, "refs/heads/main")
+    }
+
+    /// Creates `name` off the current `main`, commits `files` on it (one commit
+    /// per file), and returns to `main`.
+    fn topic(repo: &TestRepo, name: &str, files: &[(&str, &str)]) {
+        repo.git(&["checkout", "-q", "-b", name]);
+        for (path, content) in files {
+            repo.write(path, content);
+            repo.commit_all(&format!("add {path}"));
+        }
+        repo.git(&["checkout", "-q", "main"]);
+    }
+
+    /// Squash-merges `name` into `main` as one new commit.
+    fn squash(repo: &TestRepo, name: &str) {
+        repo.git(&["merge", "-q", "--squash", name]);
+        repo.git(&["commit", "-q", "-m", &format!("squash {name}")]);
+    }
+
+    #[test]
+    fn a_squash_merged_branch_is_merged() {
+        let repo = TestRepo::init();
+        topic(&repo, "feat", &[("a.txt", "a\n"), ("b.txt", "b\n")]);
+        assert!(!merged(&repo, "feat"));
+        squash(&repo, "feat");
+        assert!(merged(&repo, "feat"));
+    }
+
+    #[test]
+    fn a_rebase_merged_branch_is_merged() {
+        let repo = TestRepo::init();
+        topic(&repo, "feat", &[("a.txt", "a\n"), ("b.txt", "b\n")]);
+        repo.write("other.txt", "o\n");
+        repo.commit_all("main moves on");
+        repo.git(&["cherry-pick", "main..feat"]);
+        assert!(merged(&repo, "feat"));
+    }
+
+    #[test]
+    fn work_split_across_several_squashes_is_merged() {
+        // The branch's two changes reach main through two separate "PRs".
+        let repo = TestRepo::init();
+        topic(&repo, "combo", &[("a.txt", "a\n"), ("b.txt", "b\n")]);
+        topic(&repo, "part-a", &[("a.txt", "a\n")]);
+        squash(&repo, "part-a");
+        assert!(!merged(&repo, "combo"));
+        topic(&repo, "part-b", &[("b.txt", "b\n")]);
+        squash(&repo, "part-b");
+        assert!(merged(&repo, "combo"));
+    }
+
+    #[test]
+    fn a_merge_only_branch_whose_parents_landed_is_merged() {
+        // An integration branch: nothing but merges of branches main later took.
+        let repo = TestRepo::init();
+        topic(&repo, "x", &[("x.txt", "x\n")]);
+        topic(&repo, "y", &[("y.txt", "y\n")]);
+        repo.git(&["checkout", "-q", "-b", "integration"]);
+        repo.git(&["merge", "-q", "--no-ff", "-m", "merge x", "x"]);
+        repo.git(&["merge", "-q", "--no-ff", "-m", "merge y", "y"]);
+        repo.git(&["checkout", "-q", "main"]);
+        assert!(!merged(&repo, "integration"));
+        squash(&repo, "x");
+        squash(&repo, "y");
+        assert!(merged(&repo, "integration"));
+    }
+
+    #[test]
+    fn a_change_main_reverted_is_not_merged() {
+        // The patch is still in main's history, but its effect is not.
+        let repo = TestRepo::init();
+        topic(&repo, "feat", &[("a.txt", "a\n")]);
+        squash(&repo, "feat");
+        repo.git(&["revert", "--no-edit", "HEAD"]);
+        assert!(!merged(&repo, "feat"));
+    }
+
+    #[test]
+    fn a_change_main_edited_since_is_not_merged() {
+        // Conservative by design: main took the change, then rewrote the line.
+        let repo = TestRepo::init();
+        topic(&repo, "feat", &[("a.txt", "one\n")]);
+        squash(&repo, "feat");
+        repo.write("a.txt", "two\n");
+        repo.commit_all("main edits a");
+        assert!(!merged(&repo, "feat"));
+    }
+
+    #[test]
+    fn a_branch_with_unlanded_work_is_not_merged() {
+        let repo = TestRepo::init();
+        topic(&repo, "feat", &[("a.txt", "a\n"), ("b.txt", "b\n")]);
+        repo.git(&["cherry-pick", "feat~1"]); // only the first commit lands
+        assert!(!merged(&repo, "feat"));
+    }
+
+    #[test]
+    fn a_branch_that_backed_out_its_own_work_is_not_merged() {
+        // Its net effect is empty, so merging it changes nothing — but the
+        // added file lives only in its history.
+        let repo = TestRepo::init();
+        topic(&repo, "exp", &[("s.txt", "big work\n")]);
+        repo.git(&["checkout", "-q", "exp"]);
+        repo.git(&["rm", "-q", "s.txt"]);
+        repo.git(&["commit", "-q", "-m", "move away"]);
+        repo.git(&["checkout", "-q", "main"]);
+        repo.write("other.txt", "o\n");
+        repo.commit_all("main moves on");
+        assert!(!merged(&repo, "exp"));
+    }
+
+    #[test]
+    fn a_branch_of_empty_commits_is_not_merged() {
+        let repo = TestRepo::init();
+        repo.git(&["checkout", "-q", "-b", "empty"]);
+        repo.git(&["commit", "-q", "--allow-empty", "-m", "note to self"]);
+        repo.git(&["checkout", "-q", "main"]);
+        repo.write("other.txt", "o\n");
+        repo.commit_all("main moves on");
+        assert!(!merged(&repo, "empty"));
+    }
+
+    /// Configures an `ours` merge driver for `CHANGELOG.md`, the documented
+    /// "keep my side" recipe.
+    fn keep_ours_changelog(repo: &TestRepo) {
+        repo.git(&["config", "merge.ours.driver", "true"]);
+        repo.write(".gitattributes", "CHANGELOG.md merge=ours\n");
+        repo.write("CHANGELOG.md", "# Changelog\n");
+        repo.commit_all("changelog");
+    }
+
+    #[test]
+    fn a_custom_merge_driver_cannot_make_unlanded_work_merged() {
+        // The driver resolves the branch's CHANGELOG edit to main's side, so a
+        // plain merge-tree writes main's tree — though the notes are nowhere
+        // in main.
+        let repo = TestRepo::init();
+        keep_ours_changelog(&repo);
+        topic(&repo, "notes", &[("CHANGELOG.md", "# Changelog\nnotes\n")]);
+        repo.write("CHANGELOG.md", "# Changelog\nmain\n");
+        repo.commit_all("main edits the changelog");
+        assert!(!merged(&repo, "notes"));
+    }
+
+    #[test]
+    fn a_custom_driver_on_untouched_paths_leaves_real_merges_alone() {
+        let repo = TestRepo::init();
+        keep_ours_changelog(&repo);
+        topic(&repo, "feat", &[("a.txt", "a\n")]);
+        squash(&repo, "feat");
+        assert!(merged(&repo, "feat"));
+    }
+
+    #[test]
+    fn a_union_default_cannot_make_unlanded_work_merged() {
+        // `union` keeps both sides of a conflict: main's edit of `b` plus
+        // nothing from the branch's deletion of it, which is main's own tree.
+        let repo = TestRepo::init();
+        repo.git(&["config", "merge.default", "union"]);
+        repo.write("f.txt", "a\nb\nc\n");
+        repo.commit_all("f");
+        topic(&repo, "del", &[("f.txt", "a\nc\n")]);
+        repo.write("f.txt", "a\nB\nc\n");
+        repo.commit_all("main edits b");
+        assert!(!merged(&repo, "del"));
+    }
+
+    #[test]
+    fn a_union_attribute_cannot_make_unlanded_work_merged() {
+        // The built-in `union` driver, picked by `.gitattributes` rather than
+        // config, resolves main's edit of `b` against the branch's deletion of
+        // it to main's own tree.
+        let repo = TestRepo::init();
+        repo.write(".gitattributes", "f.txt merge=union\n");
+        repo.write("f.txt", "a\nb\nc\n");
+        repo.commit_all("f");
+        topic(&repo, "del", &[("f.txt", "a\nc\n")]);
+        repo.write("f.txt", "a\nB\nc\n");
+        repo.commit_all("main edits b");
+        assert!(!merged(&repo, "del"));
+    }
+
+    #[test]
+    fn a_union_attribute_on_untouched_paths_leaves_real_merges_alone() {
+        let repo = TestRepo::init();
+        repo.write(".gitattributes", "CHANGELOG.md merge=union\n");
+        repo.commit_all("attributes");
+        topic(&repo, "feat", &[("a.txt", "a\n")]);
+        squash(&repo, "feat");
+        assert!(merged(&repo, "feat"));
+    }
+
+    #[test]
+    fn a_union_file_both_sides_edited_cleanly_is_merged() {
+        // The usual `union` changelog: the branch's entry was squashed in,
+        // then main added another elsewhere. A text merge is clean and a
+        // no-op, so the branch still counts as merged.
+        let repo = TestRepo::init();
+        repo.write(".gitattributes", "CHANGELOG.md merge=union\n");
+        repo.write("CHANGELOG.md", "# log\n\none\n\ntwo\n\nthree\n");
+        repo.commit_all("changelog");
+        topic(
+            &repo,
+            "feat",
+            &[("CHANGELOG.md", "# log\nfeat\n\none\n\ntwo\n\nthree\n")],
+        );
+        squash(&repo, "feat");
+        repo.write(
+            "CHANGELOG.md",
+            "# log\nfeat\n\none\n\ntwo\n\nthree\nlater\n",
+        );
+        repo.commit_all("main adds an entry");
+        assert!(merged(&repo, "feat"));
+    }
+
+    #[test]
+    fn a_user_union_driver_is_still_overridden() {
+        // A configured `merge.union.driver` is found by the scan and set to
+        // fail, then replaced by the text merge; either way the deletion
+        // conflicts.
+        let repo = TestRepo::init();
+        repo.git(&["config", "merge.union.driver", "true"]);
+        repo.write(".gitattributes", "f.txt merge=union\n");
+        repo.write("f.txt", "a\nb\nc\n");
+        repo.commit_all("f");
+        topic(&repo, "del", &[("f.txt", "a\nc\n")]);
+        repo.write("f.txt", "a\nB\nc\n");
+        repo.commit_all("main edits b");
+        assert!(!merged(&repo, "del"));
+    }
+
+    #[test]
+    fn unreadable_driver_config_is_not_merged() {
+        // A config git refuses to parse fails the check rather than skipping
+        // the driver overrides.
+        let repo = TestRepo::init();
+        topic(&repo, "feat", &[("a.txt", "a\n")]);
+        squash(&repo, "feat");
+        assert!(merged(&repo, "feat"));
+        let config = repo.root().join(".git/config");
+        let mut text = std::fs::read_to_string(&config).unwrap();
+        text.push_str("[broken\n");
+        std::fs::write(&config, text).unwrap();
+        assert!(!merged(&repo, "feat"));
+    }
+
+    #[test]
+    fn a_driver_name_that_cannot_be_overridden_fails_safe() {
+        let repo = TestRepo::init();
+        repo.git(&["config", "merge.a=b.driver", "true"]);
+        topic(&repo, "feat", &[("a.txt", "a\n")]);
+        squash(&repo, "feat");
+        assert!(!merged(&repo, "feat"));
+    }
+
+    #[test]
+    fn unrelated_histories_are_not_merged() {
+        let repo = TestRepo::init();
+        repo.git(&["checkout", "-q", "--orphan", "stray"]);
+        repo.write("stray.txt", "s\n");
+        repo.commit_all("unrelated root");
+        repo.git(&["checkout", "-q", "main"]);
+        assert!(!merged(&repo, "stray"));
+    }
+
+    #[test]
+    fn an_unknown_ref_is_not_merged() {
+        let repo = TestRepo::init();
+        assert!(!merged(&repo, "no-such-branch"));
+        assert!(!is_content_merged(
+            &RealGit,
+            repo.root(),
+            "main",
+            "refs/heads/no-such-target"
+        ));
+    }
+}
diff --git a/src/git/mod.rs b/src/git/mod.rs
index 93c29b5..11c2e70 100644
--- a/src/git/mod.rs
+++ b/src/git/mod.rs
@@ -2,6 +2,7 @@
 //! network operations. Submodules:
 //!
 //! - [`cli`] — the [`GitCli`] subprocess trait + [`RealGit`].
+//! - `merged` — content-level merge detection (squash and rebase merges).
 //! - `ops` — verb-named wrappers over [`GitCli`] for shared mutations.
 //! - [`discover`] — repository discovery and identity via `gix`.
 //! - [`porcelain`] — pure parsers for `git` porcelain output.
@@ -12,6 +13,7 @@ pub mod aheadbehind;
 pub mod cli;
 pub mod commit;
 pub mod discover;
+pub(crate) mod merged;
 pub(crate) mod ops;
 pub mod porcelain;
 pub mod refs;
@@ -36,5 +38,8 @@ pub(crate) use refs::{
 // Only the TUI reaches for this.
 #[cfg(feature = "tui")]
 pub(crate) use refs::origin_head_branch;
+// Only prune reaches for this.
+#[cfg(feature = "cli")]
+pub(crate) use status::is_clean_for_removal;
 pub(crate) use status::status_of;
 pub(crate) use worktrees::enumerate;
diff --git a/src/git/ops.rs b/src/git/ops.rs
index ffd1e4c..31c9501 100644
--- a/src/git/ops.rs
+++ b/src/git/ops.rs
@@ -63,9 +63,14 @@ pub(crate) fn worktree_remove(
     root: &Path,
     path: &str,
     force: bool,
+    unlock: bool,
 ) -> Result<String> {
     let mut argv = vec!["worktree", "remove"];
-    if force {
+    if force || unlock {
+        argv.push("--force");
+    }
+    // Git refuses a locked worktree unless `--force` is given twice.
+    if unlock {
         argv.push("--force");
     }
     argv.push(path);
@@ -260,12 +265,27 @@ mod tests {
     #[test]
     fn worktree_remove_adds_force_flag_only_when_asked() {
         let git = RecordingGit::new();
-        worktree_remove(&git, &root(), "/wt/x", false).unwrap();
+        worktree_remove(&git, &root(), "/wt/x", false, false).unwrap();
         assert_eq!(git.last(), ["worktree", "remove", "/wt/x"]);
-        worktree_remove(&git, &root(), "/wt/x", true).unwrap();
+        worktree_remove(&git, &root(), "/wt/x", true, false).unwrap();
         assert_eq!(git.last(), ["worktree", "remove", "--force", "/wt/x"]);
     }
 
+    #[test]
+    fn worktree_remove_forces_twice_to_override_a_lock() {
+        let git = RecordingGit::new();
+        worktree_remove(&git, &root(), "/wt/x", false, true).unwrap();
+        assert_eq!(
+            git.last(),
+            ["worktree", "remove", "--force", "--force", "/wt/x"]
+        );
+        worktree_remove(&git, &root(), "/wt/x", true, true).unwrap();
+        assert_eq!(
+            git.last(),
+            ["worktree", "remove", "--force", "--force", "/wt/x"]
+        );
+    }
+
     #[test]
     fn worktree_prune_builds_prune() {
         let git = RecordingGit::new();
diff --git a/src/git/porcelain.rs b/src/git/porcelain.rs
index 67af03c..a35a959 100644
--- a/src/git/porcelain.rs
+++ b/src/git/porcelain.rs
@@ -20,6 +20,8 @@ pub(crate) struct RawWorktree {
     pub(crate) is_detached: bool,
     /// Whether the worktree is locked.
     pub(crate) is_locked: bool,
+    /// The reason given when the worktree was locked, if any.
+    pub(crate) lock_reason: Option<String>,
     /// Whether Git considers the worktree prunable.
     pub(crate) is_prunable: bool,
     /// Whether this is the main (first) worktree.
@@ -38,6 +40,7 @@ impl RawWorktree {
             is_bare: false,
             is_detached: false,
             is_locked: false,
+            lock_reason: None,
             is_prunable: false,
             is_main: false,
             is_missing: false,
@@ -92,6 +95,7 @@ pub(crate) fn parse_worktree_list(porcelain: &str) -> Vec<RawWorktree> {
             "locked" => {
                 if let Some(wt) = current.as_mut() {
                     wt.is_locked = true;
+                    wt.lock_reason = rest.map(str::to_string).filter(|r| !r.is_empty());
                 }
             }
             "prunable" => {
@@ -263,7 +267,9 @@ mod tests {
         assert!(wts[1].is_detached);
         assert!(wts[1].branch.is_none());
         assert!(wts[2].is_locked);
+        assert_eq!(wts[2].lock_reason.as_deref(), Some("being used"));
         assert_eq!(wts[2].branch.as_deref(), Some("x"));
+        assert!(!wts[1].is_locked && wts[1].lock_reason.is_none());
         assert!(wts[3].is_prunable);
     }
 
diff --git a/src/git/status.rs b/src/git/status.rs
index c5b0c8b..0c6c93b 100644
--- a/src/git/status.rs
+++ b/src/git/status.rs
@@ -70,6 +70,26 @@ pub(crate) fn status_of(git: &dyn GitCli, worktree_dir: &Path) -> Result<StatusS
     Ok(parse_status_porcelain(&output))
 }
 
+/// Whether the worktree at `worktree_dir` has no tracked changes and no
+/// untracked files, read with the flags pinned so the repository's own config
+/// (`status.showUntrackedFiles`, `diff.ignoreSubmodules`, a submodule's
+/// `ignore`) cannot hide either. For guards that decide whether a forced
+/// removal may delete the directory; a failed read counts as not clean.
+#[cfg_attr(not(feature = "cli"), allow(dead_code))]
+pub(crate) fn is_clean_for_removal(git: &dyn GitCli, worktree_dir: &Path) -> bool {
+    git.run(
+        worktree_dir,
+        &[
+            "status",
+            "--porcelain=v1",
+            "-z",
+            "--untracked-files=normal",
+            "--ignore-submodules=none",
+        ],
+    )
+    .is_ok_and(|out| out.is_empty())
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -153,4 +173,21 @@ mod tests {
         assert!(s.dirty);
         assert!(s.has_untracked);
     }
+
+    #[test]
+    fn clean_for_removal_ignores_config_that_hides_untracked_files() {
+        let repo = TestRepo::init();
+        assert!(is_clean_for_removal(&RealGit, repo.root()));
+        repo.git(&["config", "status.showUntrackedFiles", "no"]);
+        repo.write("scratch.txt", "x\n");
+        assert!(!is_clean_for_removal(&RealGit, repo.root()));
+        repo.write(".gitignore", "scratch.txt\n");
+        repo.commit_all("ignore scratch");
+        // Ignored files are not the guard's concern.
+        assert!(is_clean_for_removal(&RealGit, repo.root()));
+        assert!(!is_clean_for_removal(
+            &RealGit,
+            &repo.root().join("no-such-dir")
+        ));
+    }
 }
diff --git a/src/git/worktrees.rs b/src/git/worktrees.rs
index 091b386..e264b48 100644
--- a/src/git/worktrees.rs
+++ b/src/git/worktrees.rs
@@ -1,7 +1,7 @@
 //! Worktree enumeration via `git worktree list --porcelain` (spec §4 sanctioned
 //! subprocess read) plus missing-directory detection.
 
-use std::path::Path;
+use std::path::{Path, PathBuf};
 
 use crate::error::Result;
 use crate::git::cli::GitCli;
@@ -21,6 +21,60 @@ pub(crate) fn enumerate(git: &dyn GitCli, dir: &Path) -> Result<Vec<RawWorktree>
     Ok(worktrees)
 }
 
+/// Marker files in a worktree's admin directory that mean an operation is
+/// mid-flight, paired with its name. A worktree mid-rebase or mid-bisect is
+/// usually detached, so without this it would look like idle, finished work.
+const IN_PROGRESS_MARKERS: [(&str, &str); 7] = [
+    ("rebase-merge", "rebase"),
+    ("rebase-apply", "rebase"),
+    ("MERGE_HEAD", "merge"),
+    ("CHERRY_PICK_HEAD", "cherry-pick"),
+    ("REVERT_HEAD", "revert"),
+    // A multi-commit cherry-pick or revert stopped between commits.
+    ("sequencer", "cherry-pick or revert"),
+    ("BISECT_LOG", "bisect"),
+];
+
+/// Files naming the branch an in-progress operation will return to: the branch
+/// being rebased (`refs/heads/<name>`), or the one a bisect started from.
+const IN_PROGRESS_BRANCH_FILES: [&str; 3] = [
+    "rebase-merge/head-name",
+    "rebase-apply/head-name",
+    "BISECT_START",
+];
+
+/// The absolute admin directory (`$GIT_DIR`) of the worktree at `worktree`.
+fn admin_dir(git: &dyn GitCli, worktree: &Path) -> Result<PathBuf> {
+    let git_dir = git.run(worktree, &["rev-parse", "--absolute-git-dir"])?;
+    Ok(PathBuf::from(git_dir.trim()))
+}
+
+/// The operation in progress in the worktree at `worktree` (a rebase, merge,
+/// cherry-pick, revert, or bisect), or `None` when it is idle. Errors when the
+/// worktree's admin directory cannot be resolved, so a caller can fail safe.
+#[cfg_attr(not(feature = "cli"), allow(dead_code))]
+pub(crate) fn in_progress_op(git: &dyn GitCli, worktree: &Path) -> Result<Option<&'static str>> {
+    let git_dir = admin_dir(git, worktree)?;
+    Ok(IN_PROGRESS_MARKERS
+        .iter()
+        .find(|(marker, _)| git_dir.join(marker).exists())
+        .map(|(_, op)| *op))
+}
+
+/// The local branch an in-progress rebase or bisect in the worktree at
+/// `worktree` will return to, if any. Mid-operation the worktree is detached,
+/// so `git worktree list` no longer names that branch — yet it is still in use.
+#[cfg_attr(not(feature = "cli"), allow(dead_code))]
+pub(crate) fn in_progress_branch(git: &dyn GitCli, worktree: &Path) -> Result<Option<String>> {
+    let git_dir = admin_dir(git, worktree)?;
+    Ok(IN_PROGRESS_BRANCH_FILES.iter().find_map(|file| {
+        let name = std::fs::read_to_string(git_dir.join(file)).ok()?;
+        let name = name.trim();
+        let name = name.strip_prefix("refs/heads/").unwrap_or(name);
+        (!name.is_empty()).then(|| name.to_string())
+    }))
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -55,6 +109,74 @@ mod tests {
         assert!(missing.is_missing);
     }
 
+    #[test]
+    fn in_progress_op_names_each_marker_in_a_linked_worktree() {
+        let repo = TestRepo::init();
+        repo.add_worktree("busy", "../wt-busy");
+        let linked = repo.root().parent().unwrap().join("wt-busy");
+        assert_eq!(in_progress_op(&RealGit, &linked).unwrap(), None);
+        let admin = RealGit
+            .run(&linked, &["rev-parse", "--absolute-git-dir"])
+            .unwrap();
+        let admin = Path::new(admin.trim());
+        for (marker, op) in IN_PROGRESS_MARKERS {
+            let path = admin.join(marker);
+            std::fs::write(&path, "").unwrap();
+            assert_eq!(in_progress_op(&RealGit, &linked).unwrap(), Some(op));
+            std::fs::remove_file(&path).unwrap();
+        }
+        // The primary worktree's own state is separate.
+        assert_eq!(in_progress_op(&RealGit, repo.root()).unwrap(), None);
+    }
+
+    #[test]
+    fn in_progress_op_detects_a_real_rebase_stop() {
+        let repo = TestRepo::init();
+        repo.git(&["checkout", "-q", "-b", "topic"]);
+        repo.write("a.txt", "topic\n");
+        repo.commit_all("topic a");
+        repo.git(&["checkout", "-q", "main"]);
+        repo.write("a.txt", "main\n");
+        repo.commit_all("main a");
+        repo.git(&["checkout", "-q", "topic"]);
+        // Conflicts, leaving the rebase stopped mid-flight.
+        let out = RealGit.run_raw(repo.root(), &["rebase", "main"]).unwrap();
+        assert!(!out.success);
+        assert_eq!(
+            in_progress_op(&RealGit, repo.root()).unwrap(),
+            Some("rebase")
+        );
+        // The rebased branch is still in use although HEAD is detached.
+        assert_eq!(
+            in_progress_branch(&RealGit, repo.root())
+                .unwrap()
+                .as_deref(),
+            Some("topic")
+        );
+    }
+
+    #[test]
+    fn in_progress_branch_names_the_branch_a_bisect_started_from() {
+        let repo = TestRepo::init();
+        repo.write("a.txt", "1\n");
+        repo.commit_all("c1");
+        assert_eq!(in_progress_branch(&RealGit, repo.root()).unwrap(), None);
+        repo.git(&["bisect", "start", "HEAD", "HEAD~1"]);
+        assert_eq!(
+            in_progress_branch(&RealGit, repo.root())
+                .unwrap()
+                .as_deref(),
+            Some("main")
+        );
+        assert!(in_progress_branch(&RealGit, Path::new("/nonexistent/wt")).is_err());
+    }
+
+    #[test]
+    fn in_progress_op_errors_outside_a_repository() {
+        let dir = tempfile::tempdir().unwrap();
+        assert!(in_progress_op(&RealGit, dir.path()).is_err());
+    }
+
     #[test]
     fn single_worktree_repo() {
         let repo = TestRepo::init();
diff --git a/src/worktree/mod.rs b/src/worktree/mod.rs
index 9f7ae50..2c223d0 100644
--- a/src/worktree/mod.rs
+++ b/src/worktree/mod.rs
@@ -54,5 +54,5 @@ pub use service::{
 #[cfg(feature = "cli")]
 pub(crate) use service::{
     WorkspaceParts, apply_meta, create_in, lock_repo, preview_target, remove_in, resolve_base,
-    resolve_target, rollback_worktree, run_best_effort, same_path,
+    resolve_target, rollback_worktree, same_path,
 };
diff --git a/src/worktree/service.rs b/src/worktree/service.rs
index a2aa011..350db77 100644
--- a/src/worktree/service.rs
+++ b/src/worktree/service.rs
@@ -958,6 +958,7 @@ pub(crate) fn remove_in(
         ws.root,
         &path,
         options.force_remove || needs_submodule_force,
+        false,
     )?;
 
     let branch_deleted = maybe_delete_branch(ws, git, worktree, &meta, options, &default);