From c6041d218127779ecd48b8c6840827804886ef75 Mon Sep 17 00:00:00 2001
From: Maximilian Roos <m@maxroos.com>
Date: Fri, 3 Jul 2026 16:54:19 -0700
Subject: [PATCH 1/5] WIP: prune bench, fixture helpers, removal trace spans

Session in progress on wt-remove; committed to hand the fixture fix to a
dispatched session.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 Cargo.toml                        |   4 +
 benches/CLAUDE.md                 |  70 +++++++++++
 benches/prune.rs                  | 178 +++++++++++++++++++++++++++
 src/commands/process.rs           |   7 ++
 src/commands/step/prune.rs        |  12 +-
 src/git/fsmonitor.rs              |  10 ++
 tests/helpers/wt-perf/src/lib.rs  | 195 ++++++++++++++++++++++++++++++
 tests/helpers/wt-perf/src/main.rs |  40 +++---
 8 files changed, 499 insertions(+), 17 deletions(-)
 create mode 100644 benches/prune.rs

diff --git a/Cargo.toml b/Cargo.toml
index a791d4b400..23e50fdc91 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -341,6 +341,10 @@ harness = false
 name = "remove"
 harness = false
 
+[[bench]]
+name = "prune"
+harness = false
+
 [[bench]]
 name = "picker_preview"
 harness = false
diff --git a/benches/CLAUDE.md b/benches/CLAUDE.md
index f00966c0cd..e30b0f82cc 100644
--- a/benches/CLAUDE.md
+++ b/benches/CLAUDE.md
@@ -23,6 +23,10 @@ cargo bench --bench list
 cargo bench --bench time_to_first_output         # all commands
 cargo bench --bench time_to_first_output remove  # just remove
 
+# wt step prune (scan + removal on the squash-merged fixture)
+cargo bench --bench prune                        # all variants
+cargo bench --bench prune dry_run                # scan-only variants
+
 # Picker preview pre-compute (wt switch preview workload)
 cargo bench --bench picker_preview               # all variants
 cargo bench --bench picker_preview warm          # warm only
@@ -57,6 +61,12 @@ startup latency without output rendering or post-output work (mismatch warnings,
 
 Supported commands: `switch`, `remove`, `list`.
 
+`wt step prune` deliberately has no `WORKTRUNK_FIRST_OUTPUT` hook: its first
+output is data-dependent (the dry-run path collects and sorts every check
+result before printing anything, so e2e ≈ time-to-first-output already; the
+live path streams whichever check lands first). Use `benches/prune.rs` for
+cadence-tracked numbers and the `prune-*` spans (below) for phase attribution.
+
 ## WORKTRUNK_PREVIEW_BENCH
 
 Setting `WORKTRUNK_PREVIEW_BENCH=1` runs `wt switch`'s interactive picker prelude
@@ -119,6 +129,7 @@ setup).
 |---------|------------|-------|
 | `wt list` | Yes | Post-skeleton tasks. Exits early under `WORKTRUNK_SKELETON_ONLY=1` / `WORKTRUNK_FIRST_OUTPUT=1` — those skip the writing phase. |
 | `wt remove` | Yes | `prepare_worktree_removal` → `compute_integration_lazy` writes `is-ancestor` / `has-added-changes` / `merge-add-probe` whenever `BranchDeletionMode` is not `ForceDelete` (CLI `--force` is `force_worktree`, not `--force-delete`). |
+| `wt step prune` | Yes | Every scanned worktree/branch runs `integration_reason` → the same probe writes as `wt remove`. First scan after new commits is cold; re-runs are warm (`prune_e2e/dry_run_cold` vs `dry_run_warm`). |
 | `wt switch <branch>` | No | No sha_cache writers on the direct-switch path. |
 | `wt switch` (picker) | Yes | Preview pre-compute writes `picker-preview/{log,branch-diff,upstream-diff}-…` entries. Exercised under `WORKTRUNK_PREVIEW_BENCH=1` / `WORKTRUNK_PICKER_DRY_RUN=1`. |
 | `wt` (completion via `COMPLETE=$SHELL`) | No | Only `for-each-ref` + worktree list. |
@@ -146,6 +157,63 @@ worth measuring at CI cadence.
 - Cold cache penalty: ~4x slower for single worktree
 - Scaling: Warm cache shows superlinear degradation, cold cache scales better
 
+## Recording `wt remove` / `wt step prune` staging
+
+The removal commands interleave serial per-target work with parallel scans and
+detached background processes; a single e2e number hides which phase moved.
+Record them in two layers:
+
+**Criterion cadence** — `benches/remove.rs` and `benches/prune.rs`. Expected
+numbers on an M-series Mac (`prune-4-8` fixture: 4 squash-merged worktrees +
+4 squash-merged branches as candidates, 8 unmerged worktrees + 8 unmerged
+branches as backdrop, 200 commits, 100 files):
+
+| Variant | Expected | What it measures |
+|---------|----------|------------------|
+| `prune_e2e/dry_run_cold` | ~153 ms | full parallel scan, integration probes uncached |
+| `prune_e2e/dry_run_warm` | ~87 ms | steady-state re-scan, probes hit sha_cache |
+| `prune_e2e/live` | ~670 ms | cold scan + serial removal of the 8 candidates (~60 ms each, under the scan write lock) |
+| `remove_e2e/first_output` | ~86 ms | single-target validation up to first output |
+
+Cold prune benches pair `invalidate_caches_auto` with `restore_worktree_indexes`:
+deleting a worktree's index makes `git status` report every tracked file as a
+staged deletion, which flips prune's clean-worktree removability gate and
+silently drops all worktree candidates from the run. The dry-run variants
+assert the listed candidate count so that degradation can't come back
+unnoticed.
+
+**Phase attribution** — `wt-perf timeline` plus the removal spans. Prune emits
+`prune-gather` (worktree+branch enumeration), `prune-scan` (the whole parallel
+check region), one `prune-check:<ref>` per scanned item, and one
+`prune-remove:<label>` per removed candidate; `wt remove` emits
+`internal-sweep` around its end-of-command janitor. The `prune-remove` spans
+sit *inside* the `prune-scan` window on the live path — each removal takes the
+scan lock's write side, so a span covers the wait for in-flight checks to
+drain *plus* the removal itself: read it as "how long this removal stalled the
+run", not as pure removal work.
+
+```bash
+cargo run -p wt-perf -- setup prune-4-8 --path /tmp/prune-repo --persist
+# A freshly built fixture is already probe-cold (empty sha_cache); don't use
+# `timeline --cold` here — it deletes worktree indexes, which flips prune's
+# clean-worktree gate and drops the worktree candidates from the run.
+cargo run -p wt-perf -- timeline -- -C /tmp/prune-repo step prune --dry-run --min-age 0s
+cargo run -p wt-perf -- timeline -- -C /tmp/prune-repo step prune --min-age 0s
+```
+
+**The `wt remove` exit-delay is machine-dependent and invisible to benches.**
+After its last message, `wt remove` runs an in-process sweep
+(`run_internal_sweep`) that enumerates `git fsmonitor--daemon` processes
+*machine-wide* and resolves each one's socket with a ~50 ms `lsof` call —
+sequential, before exit, while the shell wrapper waits on the process. On a
+machine with N live daemons that appends roughly `N × 50 ms` of post-output
+latency (measured: 115 daemons → 5.8 s after 0.4 s of actual removal output);
+on daemon-free bench/CI machines it costs nothing, so `remove_e2e` never sees
+it. To observe it, run `wt-perf timeline -- remove <branch>` on a real machine
+and read the `internal-sweep` span and its `lsof -a -p …` children; the
+`fsmonitor sweep: resolving sockets for N daemon(s)` debug line gives the
+count.
+
 ## Output Locations
 
 - Results: `target/criterion/`
@@ -168,6 +236,8 @@ cargo run -p wt-perf -- setup typical-8 --persist
 #   branches-N-M    - N branches, M commits each
 #   divergent       - 200 branches × 20 commits (GH #461 scenario)
 #   mixed-W-B       - W worktrees + B branches in varied states (the `full` fixture)
+#   prune-M-U       - M squash-merged candidates + U unmerged worktrees/branches
+#                     (the `wt step prune` workload; see benches/prune.rs)
 #   picker-test     - Config for wt switch interactive picker testing
 
 # Invalidate caches for cold run
diff --git a/benches/prune.rs b/benches/prune.rs
new file mode 100644
index 0000000000..05466f7f20
--- /dev/null
+++ b/benches/prune.rs
@@ -0,0 +1,178 @@
+// Benchmarks for `wt step prune` end-to-end performance
+//
+// Prune has two cost centers with different shapes:
+//
+//   1. The scan — one integration check per worktree and per local branch,
+//      parallel on the rayon pool. Dominated by the merge-tree/merge-base
+//      probes, whose results persist in `.git/wt/cache/` (sha_cache), so the
+//      first scan after new commits is cold and later scans are warm.
+//   2. The removals — each integrated candidate runs the full removal chain
+//      (pre-remove re-checks, fsmonitor stop, rename-to-trash, branch CAS
+//      delete) serially under the write side of the scan lock.
+//
+// The fixture is `wt_perf::create_prune_repo_at`: squash-merged candidates
+// (integrated by content — the expensive probe path, the post-PR-squash shape
+// prune typically removes) against a backdrop of unmerged worktrees and
+// branches that are scanned every run but never removed.
+//
+// Benchmark variants:
+//   - prune_e2e/dry_run_cold — full scan, sha_cache invalidated per iteration
+//   - prune_e2e/dry_run_warm — full scan, caches warm (steady-state re-run)
+//   - prune_e2e/live        — scan + removal of the squash-merged candidates,
+//                             which are re-created before every iteration
+//
+// Run examples:
+//   cargo bench --bench prune                # All variants
+//   cargo bench --bench prune dry_run        # Both dry-run variants
+//
+// For phase attribution (scan vs per-candidate removal), trace one invocation
+// instead: `wt-perf setup prune-4-8 --path /tmp/prune-repo --persist`, then
+// `wt-perf timeline -- -C /tmp/prune-repo step prune --dry-run --min-age 0s`
+// and read the `prune-gather` / `prune-scan` / `prune-check:*` /
+// `prune-remove:*` spans.
+
+use std::cell::Cell;
+use std::path::Path;
+use std::process::Command;
+
+use criterion::{Criterion, criterion_group, criterion_main};
+use worktrunk::testing::isolate_subprocess_env;
+use wt_perf::{
+    add_squash_merged, create_prune_repo_at, invalidate_caches_auto, restore_worktree_indexes,
+};
+
+/// Squash-merged candidates per population (worktrees and orphan branches) —
+/// what the live variant removes and re-creates every iteration.
+const MERGED: usize = 4;
+/// Unmerged worktrees and orphan branches — scanned every run, never removed.
+const UNMERGED: usize = 8;
+
+/// One invocation shape for both dry-run variants, so cold and warm can never
+/// silently benchmark different commands.
+const DRY_RUN_ARGS: &[&str] = &[
+    "step",
+    "prune",
+    "--dry-run",
+    "--min-age",
+    "0s",
+    "--format",
+    "json",
+];
+const LIVE_ARGS: &[&str] = &["step", "prune", "--min-age", "0s", "--format", "json"];
+
+fn bench_prune_e2e(c: &mut Criterion) {
+    let mut group = c.benchmark_group("prune_e2e");
+    let binary = Path::new(env!("CARGO_BIN_EXE_wt"));
+
+    let make_cmd = |repo: &Path, args: &[&str]| {
+        let mut cmd = Command::new(binary);
+        cmd.args(args).current_dir(repo);
+        isolate_subprocess_env(&mut cmd, None);
+        cmd
+    };
+    let run = |repo: &Path, args: &[&str], label: &str| -> Vec<u8> {
+        let output = make_cmd(repo, args).output().unwrap();
+        assert!(
+            output.status.success(),
+            "{label} failed:\nstderr: {}",
+            String::from_utf8_lossy(&output.stderr)
+        );
+        output.stdout
+    };
+    // Guard against silently measuring a degraded scan: every run must list
+    // exactly the fixture's candidates (MERGED worktrees + MERGED branches)
+    // as planned (dry run) or removed (live). This is what caught the
+    // invalidated-index state flipping the removability gate, and on the live
+    // variant it fails the offending iteration directly instead of the next
+    // iteration's re-creation tripping over a leftover branch.
+    let assert_candidates = |stdout: &[u8], label: &str| {
+        let items: serde_json::Value = serde_json::from_slice(stdout).unwrap();
+        let found = items.as_array().unwrap().len();
+        assert_eq!(
+            found,
+            MERGED * 2,
+            "{label}: expected {} candidates, run listed {found}",
+            MERGED * 2
+        );
+    };
+
+    // Dry-run repo: candidates present but never removed, so the fixture is
+    // reusable across iterations without re-setup.
+    let temp_dry = tempfile::tempdir().unwrap();
+    let repo_dry = temp_dry.path().join("repo");
+    create_prune_repo_at(MERGED, UNMERGED, &repo_dry);
+
+    // Cold: every iteration re-pays the integration probes that sha_cache
+    // would otherwise absorb — the "first prune after fetching main" cost.
+    // `BatchSize::PerIteration` so the invalidation runs before every
+    // measured iter (under `SmallInput`, only iter 1 per batch is cold).
+    // The index restore is load-bearing: without it the invalidated indexes
+    // make every worktree read dirty and prune's removability gate silently
+    // drops the worktree candidates (see `restore_worktree_indexes`).
+    group.bench_function("dry_run_cold", |b| {
+        b.iter_batched(
+            || {
+                invalidate_caches_auto(&repo_dry);
+                restore_worktree_indexes(&repo_dry);
+            },
+            |_| {
+                let stdout = run(&repo_dry, DRY_RUN_ARGS, "dry_run_cold");
+                assert_candidates(&stdout, "dry_run_cold");
+            },
+            criterion::BatchSize::PerIteration,
+        );
+    });
+
+    // Warm: the steady-state re-scan where every probe hits sha_cache.
+    group.bench_function("dry_run_warm", |b| {
+        b.iter(|| {
+            let stdout = run(&repo_dry, DRY_RUN_ARGS, "dry_run_warm");
+            assert_candidates(&stdout, "dry_run_warm");
+        });
+    });
+
+    // Live: scan + removal. The repo starts with no candidates (merged = 0);
+    // each iteration's setup adds a fresh round of squash-merged worktrees
+    // and branches, and the measured run removes them. `round` uniquifies the
+    // committed content — re-using a round's files would make the squash
+    // merge empty and the setup commit fail.
+    //
+    // Re-creation right after removal is safe without waiting for the
+    // detached `rm -rf`: prune stages the worktree into `.git/wt/trash/`
+    // (rename), prunes metadata, and CAS-deletes the branch synchronously
+    // before it exits, so path and branch name are free; the background rm
+    // only ever touches the staged trash entry. (Contrast with
+    // `benches/remove.rs`, which removes the *current* worktree — that path
+    // leaves a placeholder directory plus a background `rmdir` that would
+    // race the recreation.)
+    let temp_live = tempfile::tempdir().unwrap();
+    let repo_live = temp_live.path().join("repo");
+    create_prune_repo_at(0, UNMERGED, &repo_live);
+    let round = Cell::new(0usize);
+
+    group.bench_function("live", |b| {
+        b.iter_batched(
+            || {
+                add_squash_merged(&repo_live, MERGED, round.get());
+                round.set(round.get() + 1);
+            },
+            |_| {
+                let stdout = run(&repo_live, LIVE_ARGS, "live");
+                assert_candidates(&stdout, "live");
+            },
+            criterion::BatchSize::PerIteration,
+        );
+    });
+
+    group.finish();
+}
+
+criterion_group! {
+    name = benches;
+    config = Criterion::default()
+        .sample_size(10)
+        .measurement_time(std::time::Duration::from_secs(20))
+        .warm_up_time(std::time::Duration::from_secs(3));
+    targets = bench_prune_e2e
+}
+criterion_main!(benches);
diff --git a/src/commands/process.rs b/src/commands/process.rs
index 0ad69504c5..3682635f8f 100644
--- a/src/commands/process.rs
+++ b/src/commands/process.rs
@@ -491,6 +491,12 @@ fn spawn_detached_exec_windows(
 /// step is best-effort and additive — failures log at debug level and the
 /// `wt remove` operation proceeds regardless.
 ///
+/// It DOES delay process exit — the shell wrapper waits on it. The daemon
+/// reap enumerates fsmonitor daemons machine-wide with one sequential ~50ms
+/// `lsof` per daemon (measured: 115 daemons → ~5.8s of post-output latency;
+/// see the `internal-sweep` / `enumerate-fsmonitor-daemons` trace spans and
+/// benches/CLAUDE.md § Recording `wt remove` / `wt step prune` staging).
+///
 /// Steps:
 ///
 /// 1. [`sweep_stale_trash`] — delete stale `.git/wt/trash/` entries left by
@@ -501,6 +507,7 @@ fn spawn_detached_exec_windows(
 ///    (plain `git worktree remove`, manual `rm -rf`, a crashed `wt`); the
 ///    `wt remove` source itself stops the daemon synchronously.
 pub fn run_internal_sweep(repo: &Repository) {
+    let _span = worktrunk::trace::Span::new("internal-sweep");
     sweep_stale_trash(repo);
     worktrunk::git::fsmonitor::reap_orphan_fsmonitor_daemons(repo);
 }
diff --git a/src/commands/step/prune.rs b/src/commands/step/prune.rs
index 87c9ab1ea5..602aecf4d2 100644
--- a/src/commands/step/prune.rs
+++ b/src/commands/step/prune.rs
@@ -19,6 +19,7 @@ use worktrunk::path::format_path_for_display;
 use worktrunk::styling::{
     eprintln, format_with_gutter, hint_message, info_message, println, success_message,
 };
+use worktrunk::trace::Span;
 
 use super::super::hook_plan::{ApprovedHookPlan, HookPlan, HookPlanBuilder};
 use super::super::hooks::HookAnnouncer;
@@ -189,6 +190,7 @@ struct RemovalContext<'a> {
 /// Try to remove a candidate immediately. Returns Ok(true) if removed,
 /// Ok(false) if skipped (preparation error), Err on execution error.
 fn try_remove(candidate: &Candidate, ctx: &RemovalContext<'_>) -> anyhow::Result<bool> {
+    let _span = Span::new(format!("prune-remove:{}", candidate.label));
     // The guard protects `()` — there is no shared state to corrupt, so a
     // poisoned lock is meaningless here. Recover the guard rather than
     // `.expect()`-ing: a panic elsewhere should surface as itself, not as a
@@ -278,6 +280,7 @@ fn check_one(
     min_age_duration: Duration,
     now_secs: u64,
 ) -> anyhow::Result<CheckOutcome> {
+    let _span = Span::new(format!("prune-check:{}", item.integration_ref));
     let (effective_target, reason) =
         repo.integration_reason(snapshot, &item.integration_ref, integration_target)?;
     if reason.is_none() {
@@ -702,7 +705,10 @@ pub fn step_prune(
     // Broad set of things that might be prunable. The parallel pass below
     // narrows this down via integration + removability + age, leaving the
     // exact worktrees prune will attempt to remove for the hook approval gate.
-    let check_items = gather_check_items(&repo, worktrees, default_branch.as_deref())?;
+    let check_items = {
+        let _span = Span::new("prune-gather");
+        gather_check_items(&repo, worktrees, default_branch.as_deref())?
+    };
 
     let mut skipped_young: Vec<String> = Vec::new();
 
@@ -710,6 +716,7 @@ pub fn step_prune(
     // sorted for deterministic output. No removals, no approval — just print.
     if dry_run {
         let check_lock = RwLock::new(());
+        let scan_span = Span::new("prune-scan");
         let mut dry_run_info: Vec<(Candidate, DryRunInfo)> = std::thread::scope(|s| {
             let (tx, rx) = chan::unbounded::<(usize, anyhow::Result<CheckOutcome>)>();
             // Pre-shadow with references so `move` on s.spawn moves only `tx`
@@ -779,6 +786,7 @@ pub fn step_prune(
             }
             anyhow::Ok(info)
         })?;
+        drop(scan_span);
         dry_run_info.sort_by_key(|(c, _)| c.check_idx);
         return render_dry_run(dry_run_info, skipped_young, min_age, format);
     }
@@ -879,6 +887,7 @@ pub fn step_prune(
     // each result as it arrives — print "Skipped (younger than X)" or call
     // `try_remove` immediately for positives. The current worktree is the one
     // exception: its removal cd's to the primary, so defer it until last.
+    let scan_span = Span::new("prune-scan");
     let (removed, deferred_current) =
         std::thread::scope(|s| -> anyhow::Result<(Vec<Candidate>, Option<Candidate>)> {
             let (tx, rx) = chan::unbounded::<(usize, anyhow::Result<CheckOutcome>)>();
@@ -981,6 +990,7 @@ pub fn step_prune(
             }
             Ok((removed, deferred_current))
         })?;
+    drop(scan_span);
 
     let mut removed = removed;
     // Remove deferred current worktree last (cd-to-primary happens here)
diff --git a/src/git/fsmonitor.rs b/src/git/fsmonitor.rs
index 2920d529a6..55ea44ea8e 100644
--- a/src/git/fsmonitor.rs
+++ b/src/git/fsmonitor.rs
@@ -307,6 +307,7 @@ impl ProcessSignaller for NixSignaller {
 fn enumerate_daemons() -> Vec<DaemonProcess> {
     use crate::shell_exec::Cmd;
 
+    let _span = crate::trace::Span::new("enumerate-fsmonitor-daemons");
     let timeout = std::time::Duration::from_secs(5);
 
     let Ok(output) = Cmd::new("pgrep")
@@ -324,6 +325,15 @@ fn enumerate_daemons() -> Vec<DaemonProcess> {
         .lines()
         .filter_map(|l| l.trim().parse::<u32>().ok())
         .collect();
+    // The per-PID `lsof` resolution below is the expensive part of the whole
+    // sweep (~50ms each on macOS), and it scales with the MACHINE-wide daemon
+    // count, not this repo — surface the count so a slow sweep is explainable
+    // from the trace.
+    tracing::debug!(
+        count = pids.len(),
+        "fsmonitor sweep: resolving sockets for {} daemon(s) via lsof",
+        pids.len()
+    );
 
     pids.into_iter()
         .filter_map(|pid| {
diff --git a/tests/helpers/wt-perf/src/lib.rs b/tests/helpers/wt-perf/src/lib.rs
index 18a2d4ffc9..7639131d4c 100644
--- a/tests/helpers/wt-perf/src/lib.rs
+++ b/tests/helpers/wt-perf/src/lib.rs
@@ -388,6 +388,35 @@ pub fn invalidate_caches_auto(repo_path: &Path) {
     }
 }
 
+/// Rebuild every worktree's index after [`invalidate_caches_auto`].
+///
+/// Deleting an index doesn't model a cold cache — git treats a missing index
+/// as empty, so `git status` reports every tracked file as a staged deletion.
+/// That is a *different repo state*, and it flips any clean-worktree gate:
+/// `wt step prune`'s removability check drops all worktree candidates against
+/// such a worktree. Benches that exercise those gates call this after
+/// invalidation; `git reset -q` rewrites the index from HEAD, leaving the
+/// integration probes cold but the working trees reading clean again.
+///
+/// This is deliberately NOT folded into `invalidate_caches_auto`: `git reset
+/// --mixed` discards staged-but-uncommitted index state, which the mixed
+/// fixture plants on purpose (worktree state 2) and which a real repo — the
+/// `wt-perf invalidate` / `timeline --cold` targets — may hold as the user's
+/// work in progress. Only pair it with fixtures whose dirt is untracked files.
+pub fn restore_worktree_indexes(repo_path: &Path) {
+    let output = git_command()
+        .args(["worktree", "list", "--porcelain"])
+        .current_dir(repo_path)
+        .output()
+        .unwrap();
+    assert!(output.status.success(), "git worktree list failed");
+    for line in String::from_utf8_lossy(&output.stdout).lines() {
+        if let Some(path) = line.strip_prefix("worktree ") {
+            run_git(Path::new(path), &["reset", "-q"]);
+        }
+    }
+}
+
 /// Resolve git's common directory for `repo_path` from the filesystem.
 ///
 /// - Normal repo: `<repo>/.git` is a directory — use it directly.
@@ -717,6 +746,117 @@ pub fn create_mixed_repo_at(worktrees: usize, branches: usize, repo: &Path) {
     }
 }
 
+/// Create a repo shaped like a `wt step prune` workload at `base_path`.
+///
+/// `wt step prune` integration-checks every linked worktree and local branch,
+/// then removes the integrated ones. Two populations drive its cost:
+///
+/// - **Candidates** (`merged` of each): squash-merged worktrees
+///   (`merged-wt-N`) and squash-merged orphan branches (`merged-br-N`). Each
+///   carries its own commits whose content also landed on main as a single
+///   squash commit, so it is integrated *by content* (the `merge-tree` probes),
+///   not by ancestry — the post-PR-squash shape prune typically removes.
+/// - **Backdrop** (`unmerged` of each): linked worktrees ahead of main with
+///   uncommitted files, and orphan branches with their own commits. Scanned on
+///   every run, never removed — the steady state that dominates scan cost.
+///
+/// The main history is mature (200 commits, 100 files) so `git status` and the
+/// integration probes pay realistic per-worktree costs.
+pub fn create_prune_repo_at(merged: usize, unmerged: usize, base_path: &Path) {
+    let config = RepoConfig {
+        commits_on_main: 200,
+        files: 100,
+        branches: unmerged,
+        commits_per_branch: 2,
+        worktrees: unmerged + 1,
+        worktree_commits_ahead: 5,
+        worktree_uncommitted_files: 2,
+    };
+    create_repo_at(&config, base_path);
+    add_squash_merged(base_path, merged, 0);
+    // The squash commits advanced main past the fake remote ref written by
+    // `create_repo_at`; refresh so origin/main tracks the final tip.
+    setup_fake_remote(base_path);
+}
+
+/// Add `count` squash-merged worktrees (`merged-wt-N`) and `count`
+/// squash-merged orphan branches (`merged-br-N`) to an existing repo.
+///
+/// Each branch gets its own commits, then main takes the same content as one
+/// `git merge --squash` commit — integrated by content, so `wt step prune`
+/// detects it via the merge-tree probes and removes it.
+///
+/// `round` uniquifies the committed file names. A live-prune benchmark removes
+/// these candidates every iteration and re-creates them with an incremented
+/// `round`; reusing a round's file names would make the squash merge empty
+/// (the content is already on main) and the `git commit` fail. Branch names
+/// intentionally do NOT carry the round: prune deletes them each iteration,
+/// and a name collision on re-creation fails loudly — surfacing a prune run
+/// that didn't remove what the benchmark expected.
+pub fn add_squash_merged(repo_path: &Path, count: usize, round: usize) {
+    let repo_name = repo_path.file_name().unwrap().to_str().unwrap();
+    let parent_dir = repo_path.parent().unwrap();
+
+    // Two commits in `dir`, each adding a round-uniquified file (the branch
+    // name already carries the candidate index).
+    let commit_branch_content = |dir: &Path, branch: &str| {
+        for j in 0..2 {
+            let file = dir.join(format!("{}_{round}_{j}.rs", branch.replace('-', "_")));
+            std::fs::write(&file, format!("// {branch} {round}/{j}\n")).unwrap();
+            run_git(dir, &["add", "."]);
+            run_git(
+                dir,
+                &[
+                    "commit",
+                    "-q",
+                    "-m",
+                    &format!("{branch} commit {j} (round {round})"),
+                ],
+            );
+        }
+    };
+    // Land the branch's content on main as a single squash commit.
+    let squash_into_main = |branch: &str| {
+        run_git(repo_path, &["merge", "--squash", "-q", branch]);
+        run_git(
+            repo_path,
+            &[
+                "commit",
+                "-q",
+                "-m",
+                &format!("Squash-merge {branch} (round {round})"),
+            ],
+        );
+    };
+
+    for i in 0..count {
+        let branch = format!("merged-wt-{i}");
+        let wt_path = parent_dir.join(format!("{repo_name}.{branch}"));
+        run_git(
+            repo_path,
+            &[
+                "worktree",
+                "add",
+                "-q",
+                "-b",
+                &branch,
+                wt_path.to_str().unwrap(),
+                "HEAD",
+            ],
+        );
+        commit_branch_content(&wt_path, &branch);
+        squash_into_main(&branch);
+    }
+
+    for i in 0..count {
+        let branch = format!("merged-br-{i}");
+        run_git(repo_path, &["checkout", "-q", "-b", &branch]);
+        commit_branch_content(repo_path, &branch);
+        run_git(repo_path, &["checkout", "-q", "main"]);
+        squash_into_main(&branch);
+    }
+}
+
 /// Canonicalize path without Windows `\\?\` prefix.
 pub fn canonicalize(path: &Path) -> std::io::Result<PathBuf> {
     dunce::canonicalize(path)
@@ -806,6 +946,61 @@ mod tests {
         assert_eq!(before.stdout, after.stdout);
     }
 
+    /// The prune fixture's load-bearing property: a squash-merged branch is
+    /// integrated *by content* — `git merge-tree --write-tree main <branch>`
+    /// yields main's own tree (merging it adds nothing). That's exactly the
+    /// probe `wt step prune`'s integration check runs, so if this drifts, the
+    /// prune benchmark stops removing anything. Round 1 re-creation must keep
+    /// the property (unique file content per round).
+    #[test]
+    fn squash_merged_fixture_is_content_integrated() {
+        let temp = create_repo(&RepoConfig {
+            commits_on_main: 3,
+            files: 2,
+            branches: 0,
+            commits_per_branch: 0,
+            worktrees: 1,
+            worktree_commits_ahead: 0,
+            worktree_uncommitted_files: 0,
+        });
+        let repo_path = temp.path().join("repo");
+
+        for round in 0..2 {
+            add_squash_merged(&repo_path, 1, round);
+
+            let main_tree = git_command()
+                .args(["rev-parse", "main^{tree}"])
+                .current_dir(&repo_path)
+                .output()
+                .unwrap();
+            for branch in ["merged-wt-0", "merged-br-0"] {
+                let merged_tree = git_command()
+                    .args(["merge-tree", "--write-tree", "main", branch])
+                    .current_dir(&repo_path)
+                    .output()
+                    .unwrap();
+                assert!(
+                    merged_tree.status.success(),
+                    "merge-tree failed (round {round})"
+                );
+                assert_eq!(
+                    String::from_utf8_lossy(&merged_tree.stdout).trim(),
+                    String::from_utf8_lossy(&main_tree.stdout).trim(),
+                    "{branch} must merge into main without adding changes (round {round})"
+                );
+            }
+
+            // Simulate the live benchmark's per-iteration cleanup before the
+            // next round re-creates the candidates.
+            let wt_path = temp.path().join("repo.merged-wt-0");
+            run_git(
+                &repo_path,
+                &["worktree", "remove", "--force", wt_path.to_str().unwrap()],
+            );
+            run_git(&repo_path, &["branch", "-D", "merged-wt-0", "merged-br-0"]);
+        }
+    }
+
     /// Regression: degenerate `count` values must not panic. `count == 0`
     /// divided into `5000`, and `count > 5000` flooring `step` to 0 for
     /// `step_by`, both panicked before the `max(1)` guards.
diff --git a/tests/helpers/wt-perf/src/main.rs b/tests/helpers/wt-perf/src/main.rs
index be35104917..ff6ce19227 100644
--- a/tests/helpers/wt-perf/src/main.rs
+++ b/tests/helpers/wt-perf/src/main.rs
@@ -10,7 +10,8 @@ use std::time::{Duration, Instant};
 use clap::{Parser, Subcommand};
 use worktrunk::trace::{TraceEntry, TraceEntryKind, TraceResult};
 use wt_perf::{
-    canonicalize, create_mixed_repo_at, create_repo_at, invalidate_caches_auto, parse_config,
+    canonicalize, create_mixed_repo_at, create_prune_repo_at, create_repo_at,
+    invalidate_caches_auto, parse_config,
 };
 
 #[derive(Parser)]
@@ -25,7 +26,7 @@ struct Cli {
 enum Commands {
     /// Set up a benchmark repository
     Setup {
-        /// Config name: typical-N, branches-N, branches-N-M, divergent, mixed-W-B, picker-test
+        /// Config name: typical-N, branches-N, branches-N-M, divergent, mixed-W-B, prune-M-U, picker-test
         config: String,
 
         /// Directory to create repo in (default: temp directory)
@@ -124,12 +125,12 @@ fn main() {
             path,
             persist,
         } => {
-            // `mixed-W-B`: W worktrees + B branches in varied states (warm
-            // re-run benchmark fixture); handled separately since it doesn't
-            // map onto the flat `RepoConfig`.
-            let mixed = parse_mixed(&config);
+            // `mixed-W-B` / `prune-M-U`: composite fixtures handled separately
+            // since they don't map onto the flat `RepoConfig`.
+            let mixed = parse_pair(&config, "mixed-");
+            let prune = parse_pair(&config, "prune-");
 
-            let repo_config = if mixed.is_some() {
+            let repo_config = if mixed.is_some() || prune.is_some() {
                 None
             } else {
                 Some(parse_config(&config).unwrap_or_else(|| {
@@ -143,6 +144,9 @@ fn main() {
                     eprintln!("  branches-N-M    - N branches with M commits each");
                     eprintln!("  divergent       - 200 branches × 20 commits (GH #461 scenario)");
                     eprintln!("  mixed-W-B       - W worktrees + B branches in varied states");
+                    eprintln!(
+                        "  prune-M-U       - M squash-merged candidates + U unmerged worktrees/branches (wt step prune workload)"
+                    );
                     eprintln!(
                         "  picker-test     - Config for wt switch interactive picker testing"
                     );
@@ -163,16 +167,20 @@ fn main() {
             };
 
             eprintln!("Creating {} repo...", config);
-            let (worktrees, branches) = match (mixed, &repo_config) {
-                (Some((w, b)), _) => {
+            let (worktrees, branches) = match (mixed, prune, &repo_config) {
+                (Some((w, b)), _, _) => {
                     create_mixed_repo_at(w, b, &base_path);
                     (w, b)
                 }
-                (None, Some(cfg)) => {
+                (None, Some((m, u)), _) => {
+                    create_prune_repo_at(m, u, &base_path);
+                    (m + u + 1, m + u)
+                }
+                (None, None, Some(cfg)) => {
                     create_repo_at(cfg, &base_path);
                     (cfg.worktrees, cfg.branches)
                 }
-                (None, None) => unreachable!("repo_config is Some when mixed is None"),
+                (None, None, None) => unreachable!("repo_config is Some when composites are None"),
             };
 
             let mut parts = vec![format!("main @ {}", base_path.display())];
@@ -243,11 +251,11 @@ fn main() {
     }
 }
 
-/// Parse a `mixed-W-B` config string into `(worktrees, branches)`.
-fn parse_mixed(config: &str) -> Option<(usize, usize)> {
-    let rest = config.strip_prefix("mixed-")?;
-    let (w, b) = rest.split_once('-')?;
-    Some((w.parse().ok()?, b.parse().ok()?))
+/// Parse a `<prefix>N-M` config string (e.g. `mixed-4-8`) into its two counts.
+fn parse_pair(config: &str, prefix: &str) -> Option<(usize, usize)> {
+    let rest = config.strip_prefix(prefix)?;
+    let (a, b) = rest.split_once('-')?;
+    Some((a.parse().ok()?, b.parse().ok()?))
 }
 
 /// Resolve the `wt` binary as a sibling of the current executable

From f7a3546cf04668fc7eba89dca67d56372b823010 Mon Sep 17 00:00:00 2001
From: Maximilian Roos <m@maxroos.com>
Date: Mon, 6 Jul 2026 22:05:09 -0700
Subject: [PATCH 2/5] bench(prune): rust-scale prune-real fixture with 36
 diverged worktrees

Scale the prune-real fixture to the shape users report as slow: 12
squash-merged candidate pairs + 24 two-sided-diverged worktrees and
branches (36 linked worktrees, 72 scanned items). Measured live prune:
~12 s wall (cold scan 5.4 s; 24 removals serialized under the scan
write lock).

- ensure_prune_real_repo: build once into target/bench-repos (~15 GiB,
  minutes), classify Intact/Consumed/Broken on reuse, re-create
  consumed candidates in ~1 min after a live prune (round derived from
  the surviving squash commits), heal deleted worktree indexes
- gate prune_real_repo behind the new real-repo-benches feature so the
  nightly cargo bench on a hosted runner never builds the fixture;
  keep only the warm dry-run variant (cold/live are one-shot timelines)
- fix history_spread_shas collapsing to the tip on short logs (the
  synthetic backdrop was not actually history-spread)
- add_squash_merged: detect the default branch (rust uses master) and
  use targeted git add; parallelize restore_worktree_indexes
- anchor the bench-repos cache to the workspace root instead of cwd
- dedupe git capture/clone helpers (run_capture, clone_rust_repo_at)
- prune-real[-M-U] CLI config; drop the invalidate hint that wedged
  the cached fixture; document the workflow in benches/CLAUDE.md

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 Cargo.toml                        |   6 +
 benches/CLAUDE.md                 |  74 ++++-
 benches/prune.rs                  | 141 ++++++---
 tests/helpers/wt-perf/src/lib.rs  | 509 +++++++++++++++++++++++++++---
 tests/helpers/wt-perf/src/main.rs |  74 ++++-
 5 files changed, 692 insertions(+), 112 deletions(-)

diff --git a/Cargo.toml b/Cargo.toml
index 23e50fdc91..4a2a950593 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -102,6 +102,12 @@ syntax-highlighting = ["dep:tree-sitter", "dep:tree-sitter-bash", "dep:tree-sitt
 # When enabled, run with NEXTEST_NO_INPUT_HANDLER=1 to avoid suspension.
 # See CLAUDE.md "Nextest Terminal Suspension" section for details.
 shell-integration-tests = []
+# Enable benchmarks whose fixture is too large for hosted CI: the rust-scale
+# prune fixture (~15 GiB of rust-lang/rust worktrees, cached in
+# target/bench-repos/). The daily benchmarks workflow runs plain `cargo bench`
+# and must never build it; opt in locally with
+# `cargo bench --bench prune --features real-repo-benches`.
+real-repo-benches = []
 # Install git-wt binary so `git wt` works as a git subcommand
 git-wt = []
 
diff --git a/benches/CLAUDE.md b/benches/CLAUDE.md
index e30b0f82cc..c6c56a2372 100644
--- a/benches/CLAUDE.md
+++ b/benches/CLAUDE.md
@@ -24,8 +24,8 @@ cargo bench --bench time_to_first_output         # all commands
 cargo bench --bench time_to_first_output remove  # just remove
 
 # wt step prune (scan + removal on the squash-merged fixture)
-cargo bench --bench prune                        # all variants
-cargo bench --bench prune dry_run                # scan-only variants
+cargo bench --bench prune                        # synthetic variants
+cargo bench --bench prune --features real-repo-benches prune_real_repo  # rust scale (~15 GiB cached fixture)
 
 # Picker preview pre-compute (wt switch preview workload)
 cargo bench --bench picker_preview               # all variants
@@ -165,16 +165,47 @@ Record them in two layers:
 
 **Criterion cadence** — `benches/remove.rs` and `benches/prune.rs`. Expected
 numbers on an M-series Mac (`prune-4-8` fixture: 4 squash-merged worktrees +
-4 squash-merged branches as candidates, 8 unmerged worktrees + 8 unmerged
-branches as backdrop, 200 commits, 100 files):
+4 squash-merged branches as candidates, 8 two-sided-diverged worktrees + 8
+diverged branches as backdrop, 200 commits, 100 files; `prune_real_repo` runs
+a warm dry-run on the `prune-real` fixture — a rust-lang/rust clone with 12
+squash-merged candidate pairs + 24 diverged worktrees and 24 diverged
+branches, i.e. 36 linked worktrees, cached and self-repairing in
+`target/bench-repos/rust-prune-12-24/`. That group is opt-in —
+`cargo bench --bench prune --features real-repo-benches prune_real_repo` —
+because its ~15 GiB fixture must never build on a hosted CI runner):
 
 | Variant | Expected | What it measures |
 |---------|----------|------------------|
-| `prune_e2e/dry_run_cold` | ~153 ms | full parallel scan, integration probes uncached |
-| `prune_e2e/dry_run_warm` | ~87 ms | steady-state re-scan, probes hit sha_cache |
-| `prune_e2e/live` | ~670 ms | cold scan + serial removal of the 8 candidates (~60 ms each, under the scan write lock) |
+| `prune_e2e/dry_run_cold` | ~160 ms | full parallel scan, integration probes uncached |
+| `prune_e2e/dry_run_warm` | ~90 ms | steady-state re-scan, probes hit sha_cache |
+| `prune_e2e/live` | ~620 ms | cold scan + serial removal of the 8 candidates (~60 ms each, under the scan write lock) |
+| `prune_real_repo/dry_run_warm` | ~0.3–0.8 s | steady-state scan of 72 items (36 worktrees + 36 branches) at 331k-commit scale |
 | `remove_e2e/first_output` | ~86 ms | single-target validation up to first output |
 
+Cold and live at rust scale are **one-shot timelines, not criterion groups**
+(a cold criterion iteration costs ~1 min in re-hashing statuses alone; a live
+one consumes the candidates). Expected one-shots on the `prune-real` fixture:
+
+- **cold dry-run ~5.5 s wall** (~46 s CPU over 472 subprocesses absorbed by
+  the rayon pool) — dominated by stat-cold `git status` at ~4.5 s per fresh
+  worktree; the probes are `merge-base --is-ancestor` ~40 ms and `merge-tree
+  --write-tree` ~130 ms (vs 4–25 ms synthetic, where shallow history walks
+  bottom out at subprocess-spawn cost)
+- **live ~12 s wall** — all 24 removals serialize under the scan write lock
+  inside the `prune-scan` window: each of the 12 worktree candidates takes
+  ~0.5–1.7 s (pre-remove re-checks plus drain waits), branch-only candidates
+  ~50 ms
+
+This is the "prune takes many seconds" experience users report: worktree
+count × stat-cold statuses bounds the scan, and removals extend it serially.
+The synthetic fixture can't show it — its statuses are milliseconds — so
+scale-sensitive changes need a one-shot on `prune-real` (or
+`wt-perf timeline -- -C <repo> step prune --dry-run` on a real repo) alongside
+the criterion cadence. All rust-scale numbers are I/O-bound and move with
+ambient machine load (sibling builds, Spotlight): treat them as shape, not
+thresholds, and read criterion "regressed" verdicts on this bench against
+`uptime` before believing them.
+
 Cold prune benches pair `invalidate_caches_auto` with `restore_worktree_indexes`:
 deleting a worktree's index makes `git status` report every tracked file as a
 staged deletion, which flips prune's clean-worktree removability gate and
@@ -201,6 +232,24 @@ cargo run -p wt-perf -- timeline -- -C /tmp/prune-repo step prune --dry-run --mi
 cargo run -p wt-perf -- timeline -- -C /tmp/prune-repo step prune --min-age 0s
 ```
 
+**Live prune at real scale is a one-shot timeline, not a criterion group** —
+each live run consumes the candidates, and re-creating them on rust costs
+minutes per iteration. The `prune-real[-M-U]` fixture is built for this
+workflow: it lives in `target/bench-repos/` (no `--path`), and after a live
+prune the next `wt-perf setup prune-real` or `prune_real_repo` bench run
+detects the consumed candidates and re-creates just them (~1 min) instead of
+rebuilding the ~15 GiB fixture. Don't run two builders concurrently (a bench
+and a setup racing can wipe each other's half-built tree), and don't
+`wt-perf invalidate` it — deleting worktree indexes flips prune's
+clean-worktree gate; the next setup/bench call heals that, but the run you
+invalidated for measures a degraded scan:
+
+```bash
+cargo run -p wt-perf -- setup prune-real     # build or validate/repair the cache
+cargo run -p wt-perf -- timeline -- -C target/bench-repos/rust-prune-12-24/repo step prune --min-age 0s
+cargo run -p wt-perf -- setup prune-real     # repair the consumed candidates
+```
+
 **The `wt remove` exit-delay is machine-dependent and invisible to benches.**
 After its last message, `wt remove` runs an in-process sweep
 (`run_internal_sweep`) that enumerates `git fsmonitor--daemon` processes
@@ -218,6 +267,8 @@ count.
 
 - Results: `target/criterion/`
 - Cached rust repo: `target/bench-repos/rust/`
+- Cached rust prune fixture: `target/bench-repos/rust-prune-<M>-<U>/` (repo +
+  sibling worktrees + `round` counter for candidate re-creation)
 - HTML reports: `target/criterion/*/report/index.html`
 
 ## Performance Investigation with wt-perf
@@ -236,8 +287,13 @@ cargo run -p wt-perf -- setup typical-8 --persist
 #   branches-N-M    - N branches, M commits each
 #   divergent       - 200 branches × 20 commits (GH #461 scenario)
 #   mixed-W-B       - W worktrees + B branches in varied states (the `full` fixture)
-#   prune-M-U       - M squash-merged candidates + U unmerged worktrees/branches
-#                     (the `wt step prune` workload; see benches/prune.rs)
+#   prune-M-U       - M squash-merged candidates + U two-sided-diverged
+#                     worktrees/branches (the `wt step prune` workload; see
+#                     benches/prune.rs)
+#   prune-real[-M-U] - rust-lang/rust clone + M squash-merged candidate pairs
+#                     + U diverged worktrees/branches (default 12-24), cached
+#                     and self-repairing in target/bench-repos/ (no --path);
+#                     first run clones from the network
 #   picker-test     - Config for wt switch interactive picker testing
 
 # Invalidate caches for cold run
diff --git a/benches/prune.rs b/benches/prune.rs
index 05466f7f20..3ef716048b 100644
--- a/benches/prune.rs
+++ b/benches/prune.rs
@@ -12,18 +12,27 @@
 //
 // The fixture is `wt_perf::create_prune_repo_at`: squash-merged candidates
 // (integrated by content — the expensive probe path, the post-PR-squash shape
-// prune typically removes) against a backdrop of unmerged worktrees and
-// branches that are scanned every run but never removed.
+// prune typically removes) against a two-sided-diverged backdrop of unmerged
+// worktrees and branches (forked deep in history while main advanced) that
+// are scanned every run but never removed.
 //
 // Benchmark variants:
 //   - prune_e2e/dry_run_cold — full scan, sha_cache invalidated per iteration
 //   - prune_e2e/dry_run_warm — full scan, caches warm (steady-state re-run)
 //   - prune_e2e/live        — scan + removal of the squash-merged candidates,
 //                             which are re-created before every iteration
+//   - prune_real_repo/      — warm dry-run on a rust-lang/rust clone with
+//     dry_run_warm            both populations at "dozens of worktrees" scale
+//                             (cached ~15 GiB fixture; first-ever run clones,
+//                             minutes). Opt-in via `--features
+//                             real-repo-benches` so the daily CI benchmarks
+//                             job never builds it; cold and live at this
+//                             scale are one-shot timelines, not criterion
+//                             groups (see below)
 //
 // Run examples:
-//   cargo bench --bench prune                # All variants
-//   cargo bench --bench prune dry_run        # Both dry-run variants
+//   cargo bench --bench prune                # Synthetic variants
+//   cargo bench --bench prune --features real-repo-benches prune_real_repo
 //
 // For phase attribution (scan vs per-candidate removal), trace one invocation
 // instead: `wt-perf setup prune-4-8 --path /tmp/prune-repo --persist`, then
@@ -38,7 +47,8 @@ use std::process::Command;
 use criterion::{Criterion, criterion_group, criterion_main};
 use worktrunk::testing::isolate_subprocess_env;
 use wt_perf::{
-    add_squash_merged, create_prune_repo_at, invalidate_caches_auto, restore_worktree_indexes,
+    PRUNE_REAL_MERGED, PRUNE_REAL_UNMERGED, add_squash_merged, create_prune_repo_at,
+    ensure_prune_real_repo, invalidate_caches_auto, restore_worktree_indexes,
 };
 
 /// Squash-merged candidates per population (worktrees and orphan branches) —
@@ -60,41 +70,38 @@ const DRY_RUN_ARGS: &[&str] = &[
 ];
 const LIVE_ARGS: &[&str] = &["step", "prune", "--min-age", "0s", "--format", "json"];
 
+/// Run `wt <args>` in `repo`, panicking with stderr on failure; returns stdout.
+fn run(repo: &Path, args: &[&str], label: &str) -> Vec<u8> {
+    let mut cmd = Command::new(Path::new(env!("CARGO_BIN_EXE_wt")));
+    cmd.args(args).current_dir(repo);
+    isolate_subprocess_env(&mut cmd, None);
+    let output = cmd.output().unwrap();
+    assert!(
+        output.status.success(),
+        "{label} failed:\nstderr: {}",
+        String::from_utf8_lossy(&output.stderr)
+    );
+    output.stdout
+}
+
+/// Guard against silently measuring a degraded scan: every run must list
+/// exactly `expected` candidates as planned (dry run) or removed (live). This
+/// is what caught the invalidated-index state flipping the removability gate,
+/// and on the live variant it fails the offending iteration directly instead
+/// of the next iteration's re-creation tripping over a leftover branch. An
+/// exact count also catches integration-detection false positives against the
+/// unmerged backdrop.
+fn assert_candidates(stdout: &[u8], expected: usize, label: &str) {
+    let items: serde_json::Value = serde_json::from_slice(stdout).unwrap();
+    let found = items.as_array().unwrap().len();
+    assert_eq!(
+        found, expected,
+        "{label}: expected {expected} candidates, run listed {found}"
+    );
+}
+
 fn bench_prune_e2e(c: &mut Criterion) {
     let mut group = c.benchmark_group("prune_e2e");
-    let binary = Path::new(env!("CARGO_BIN_EXE_wt"));
-
-    let make_cmd = |repo: &Path, args: &[&str]| {
-        let mut cmd = Command::new(binary);
-        cmd.args(args).current_dir(repo);
-        isolate_subprocess_env(&mut cmd, None);
-        cmd
-    };
-    let run = |repo: &Path, args: &[&str], label: &str| -> Vec<u8> {
-        let output = make_cmd(repo, args).output().unwrap();
-        assert!(
-            output.status.success(),
-            "{label} failed:\nstderr: {}",
-            String::from_utf8_lossy(&output.stderr)
-        );
-        output.stdout
-    };
-    // Guard against silently measuring a degraded scan: every run must list
-    // exactly the fixture's candidates (MERGED worktrees + MERGED branches)
-    // as planned (dry run) or removed (live). This is what caught the
-    // invalidated-index state flipping the removability gate, and on the live
-    // variant it fails the offending iteration directly instead of the next
-    // iteration's re-creation tripping over a leftover branch.
-    let assert_candidates = |stdout: &[u8], label: &str| {
-        let items: serde_json::Value = serde_json::from_slice(stdout).unwrap();
-        let found = items.as_array().unwrap().len();
-        assert_eq!(
-            found,
-            MERGED * 2,
-            "{label}: expected {} candidates, run listed {found}",
-            MERGED * 2
-        );
-    };
 
     // Dry-run repo: candidates present but never removed, so the fixture is
     // reusable across iterations without re-setup.
@@ -117,7 +124,7 @@ fn bench_prune_e2e(c: &mut Criterion) {
             },
             |_| {
                 let stdout = run(&repo_dry, DRY_RUN_ARGS, "dry_run_cold");
-                assert_candidates(&stdout, "dry_run_cold");
+                assert_candidates(&stdout, MERGED * 2, "dry_run_cold");
             },
             criterion::BatchSize::PerIteration,
         );
@@ -127,7 +134,7 @@ fn bench_prune_e2e(c: &mut Criterion) {
     group.bench_function("dry_run_warm", |b| {
         b.iter(|| {
             let stdout = run(&repo_dry, DRY_RUN_ARGS, "dry_run_warm");
-            assert_candidates(&stdout, "dry_run_warm");
+            assert_candidates(&stdout, MERGED * 2, "dry_run_warm");
         });
     });
 
@@ -158,7 +165,7 @@ fn bench_prune_e2e(c: &mut Criterion) {
             },
             |_| {
                 let stdout = run(&repo_live, LIVE_ARGS, "live");
-                assert_candidates(&stdout, "live");
+                assert_candidates(&stdout, MERGED * 2, "live");
             },
             criterion::BatchSize::PerIteration,
         );
@@ -167,12 +174,62 @@ fn bench_prune_e2e(c: &mut Criterion) {
     group.finish();
 }
 
+/// Rust-lang/rust-scale scan ([`ensure_prune_real_repo`]): a 331k-commit repo
+/// with 12 squash-merged candidate pairs against a two-sided-diverged
+/// backdrop of 24 worktrees + 24 orphan branches forked across the last 5000
+/// commits — 36 linked worktrees, lots removable, more not. Scale is what
+/// moves every per-item cost — `merge-base --is-ancestor` ~40 ms, `merge-tree
+/// --write-tree` ~130 ms, `git status` over ~60k files — vs the synthetic
+/// fixture where probes bottom out at subprocess spawn. First run clones
+/// rust-lang/rust from the network (minutes), then builds ~36 worktrees at
+/// ~3 s each; both are cached in `target/bench-repos/` across runs.
+///
+/// Warm dry-run only, for two reasons. A live iteration would consume the
+/// candidates and pay a minutes-long re-creation per sample. And a cold
+/// iteration costs ~1 min: `invalidate_caches_auto` deletes every worktree
+/// index and the `git reset` restore rebuilds them without stat data, so all
+/// 36 statuses re-hash their trees — criterion's 10-sample minimum turns that
+/// into a ~10-minute benchmark whose probe-cost signal the synthetic
+/// `dry_run_cold` already tracks. Measure cold and live at this scale as
+/// one-shots instead (`wt-perf setup prune-real`, then `wt-perf timeline --
+/// -C <repo> step prune --min-age 0s`); the next `ensure_prune_real_repo`
+/// call repairs the consumed candidates.
+fn bench_prune_real_repo(c: &mut Criterion) {
+    // Opt-in only (`--features real-repo-benches`): the fixture is ~15 GiB —
+    // bigger than a hosted CI runner's disk and the actions cache cap — so
+    // the daily benchmarks workflow (plain `cargo bench`) must never build
+    // it. `cfg!` keeps the body compiling either way.
+    if !cfg!(feature = "real-repo-benches") {
+        return;
+    }
+
+    let mut group = c.benchmark_group("prune_real_repo");
+
+    group.bench_function("dry_run_warm", |b| {
+        // Built inside the closure: criterion invokes a bench closure only
+        // when the CLI filter matches it, but runs this function (and any
+        // eager setup in it) unconditionally. This keeps a filtered run
+        // (`cargo bench --bench prune prune_e2e`) from cloning
+        // rust-lang/rust — or worse, racing a concurrent `wt-perf setup
+        // prune-real` and wiping the fixture it is mid-build. Repeat
+        // invocations re-validate the cached fixture in a few git commands.
+        let repo = ensure_prune_real_repo(PRUNE_REAL_MERGED, PRUNE_REAL_UNMERGED);
+        let expected = PRUNE_REAL_MERGED * 2;
+        b.iter(|| {
+            let stdout = run(&repo, DRY_RUN_ARGS, "real dry_run_warm");
+            assert_candidates(&stdout, expected, "real dry_run_warm");
+        });
+    });
+
+    group.finish();
+}
+
 criterion_group! {
     name = benches;
     config = Criterion::default()
         .sample_size(10)
         .measurement_time(std::time::Duration::from_secs(20))
         .warm_up_time(std::time::Duration::from_secs(3));
-    targets = bench_prune_e2e
+    targets = bench_prune_e2e, bench_prune_real_repo
 }
 criterion_main!(benches);
diff --git a/tests/helpers/wt-perf/src/lib.rs b/tests/helpers/wt-perf/src/lib.rs
index 7639131d4c..b522edf32c 100644
--- a/tests/helpers/wt-perf/src/lib.rs
+++ b/tests/helpers/wt-perf/src/lib.rs
@@ -132,6 +132,26 @@ pub fn run_git(path: &Path, args: &[&str]) {
     );
 }
 
+/// Run a prepared git command, panicking on failure and returning trimmed
+/// stdout. Shared body of [`capture_git`] and [`git_stdout`].
+fn run_capture(cmd: &mut Command, path: &Path) -> String {
+    let output = cmd.output().unwrap();
+    assert!(
+        output.status.success(),
+        "Git command failed: {:?}\nstderr: {}\npath: {}",
+        cmd,
+        String::from_utf8_lossy(&output.stderr),
+        path.display()
+    );
+    String::from_utf8_lossy(&output.stdout).trim().to_string()
+}
+
+/// Run a git command in the given directory, panicking on failure and
+/// returning trimmed stdout.
+fn capture_git(path: &Path, args: &[&str]) -> String {
+    run_capture(git_command().args(args).current_dir(path), path)
+}
+
 /// Run a git command, returning whether it succeeded. Does not panic.
 pub fn run_git_ok(path: &Path, args: &[&str]) -> bool {
     git_command()
@@ -141,6 +161,20 @@ pub fn run_git_ok(path: &Path, args: &[&str]) -> bool {
         .is_ok_and(|o| o.status.success())
 }
 
+/// Run a git plumbing command against a scratch `GIT_INDEX_FILE`, panicking on
+/// failure and returning trimmed stdout. Used to build commits without
+/// touching the repo's working tree or real index (see
+/// [`add_diverged_backdrop`]).
+fn git_stdout(path: &Path, args: &[&str], index_file: &Path) -> String {
+    run_capture(
+        git_command()
+            .args(args)
+            .current_dir(path)
+            .env("GIT_INDEX_FILE", index_file),
+        path,
+    )
+}
+
 /// Create a test repository from config.
 ///
 /// Returns a `TempDir` containing the repo. The main worktree is at `temp.path().join("repo")`.
@@ -410,11 +444,18 @@ pub fn restore_worktree_indexes(repo_path: &Path) {
         .output()
         .unwrap();
     assert!(output.status.success(), "git worktree list failed");
-    for line in String::from_utf8_lossy(&output.stdout).lines() {
-        if let Some(path) = line.strip_prefix("worktree ") {
-            run_git(Path::new(path), &["reset", "-q"]);
+    let stdout = String::from_utf8_lossy(&output.stdout);
+    // Parallel: each reset rebuilds one worktree's index from its own HEAD,
+    // fully independent of the others. On the rust-scale fixture a rebuild
+    // is ~2.5 s per worktree — serially that would dominate every cold-bench
+    // iteration's setup.
+    std::thread::scope(|s| {
+        for line in stdout.lines() {
+            if let Some(path) = line.strip_prefix("worktree ") {
+                s.spawn(move || run_git(Path::new(path), &["reset", "-q"]));
+            }
         }
-    }
+    });
 }
 
 /// Resolve git's common directory for `repo_path` from the filesystem.
@@ -450,13 +491,25 @@ fn resolve_git_common_dir(repo_path: &Path) -> Option<PathBuf> {
     pointed.parent()?.parent().map(Path::to_path_buf)
 }
 
+/// The shared cache for real-repo fixtures: `<workspace>/target/bench-repos`,
+/// anchored to the workspace root at compile time so every entry point —
+/// benches (cwd = workspace root) and the `wt-perf` CLI (cwd = anywhere) —
+/// resolves the same cache.
+fn bench_repos_dir() -> PathBuf {
+    Path::new(env!("CARGO_MANIFEST_DIR"))
+        .ancestors()
+        .nth(3)
+        .unwrap()
+        .join("target/bench-repos")
+}
+
 /// Get or clone the rust-lang/rust repository for real-world benchmarks.
 ///
 /// The repo is cached at `target/bench-repos/rust` and reused across runs.
 pub fn ensure_rust_repo() -> PathBuf {
     RUST_REPO
         .get_or_init(|| {
-            let cache_dir = std::env::current_dir().unwrap().join("target/bench-repos");
+            let cache_dir = bench_repos_dir();
             let rust_repo = cache_dir.join("rust");
 
             if rust_repo.exists() {
@@ -492,66 +545,184 @@ pub fn ensure_rust_repo() -> PathBuf {
         .clone()
 }
 
-/// Clone rust-lang/rust into `temp/repo` for benchmarking.
-///
-/// Returns the clone path. Configures git user for commits.
-/// The `temp` dir must outlive usage.
-pub fn clone_rust_repo(temp: &TempDir) -> PathBuf {
+/// Local-clone the cached rust repo ([`ensure_rust_repo`]) to `dest` and
+/// configure a git user for commits.
+pub fn clone_rust_repo_at(dest: &Path) {
     let rust_repo = ensure_rust_repo();
-    let workspace_main = temp.path().join("repo");
-
     let clone_output = git_command()
         .args([
             "clone",
             "--local",
             rust_repo.to_str().unwrap(),
-            workspace_main.to_str().unwrap(),
+            dest.to_str().unwrap(),
         ])
         .output()
         .unwrap();
     assert!(
         clone_output.status.success(),
-        "Failed to clone rust repo to workspace"
+        "Failed to local-clone rust repo: {}",
+        String::from_utf8_lossy(&clone_output.stderr)
     );
+    run_git(dest, &["config", "user.name", "Benchmark"]);
+    run_git(dest, &["config", "user.email", "bench@test.com"]);
+}
 
-    run_git(&workspace_main, &["config", "user.name", "Benchmark"]);
-    run_git(&workspace_main, &["config", "user.email", "bench@test.com"]);
-
+/// Clone rust-lang/rust into `temp/repo` for benchmarking.
+///
+/// Returns the clone path. The `temp` dir must outlive usage.
+pub fn clone_rust_repo(temp: &TempDir) -> PathBuf {
+    let workspace_main = temp.path().join("repo");
+    clone_rust_repo_at(&workspace_main);
     workspace_main
 }
 
-/// Create branches pointing at different depths in the repo's commit history.
+/// Sample up to `count` commit SHAs evenly spread across the last 5000
+/// commits of `repo_path`'s current branch, newest first.
 ///
-/// Samples `count` commits evenly spread across the last 5000 commits and
-/// creates `feature-NNN` branches pointing at them. This reproduces the
-/// GH #461 scenario where branch divergence depth (not count) drives cost.
-pub fn add_history_spread_branches(repo_path: &Path, count: usize) {
+/// The spread reproduces the GH #461 scenario where branch divergence *depth*
+/// (not count) drives cost: consumers fork branches at these points so
+/// merge-base walks and merge-tree three-ways span the whole history rather
+/// than a handful of tip-adjacent forks.
+pub fn history_spread_shas(repo_path: &Path, count: usize) -> Vec<String> {
     let log_output = git_command()
         .args(["log", "--oneline", "-n", "5000", "--format=%H"])
         .current_dir(repo_path)
         .output()
         .unwrap();
     let log_str = String::from_utf8_lossy(&log_output.stdout);
+    // Step over the log we actually got, not the 5000 cap: on a short history
+    // (the synthetic fixtures have a few hundred commits) dividing by the cap
+    // floors every sample onto the tip, collapsing the spread to one SHA.
     // Guard the degenerate inputs: `count == 0` would divide by zero, and
-    // `count > 5000` would yield `step == 0`, which panics `step_by`. Both
+    // `count > len` would yield `step == 0`, which panics `step_by`. Both
     // `max(1)`s preserve the spread for every in-range count.
-    let step = (5000 / count.max(1)).max(1);
-    let commits: Vec<&str> = log_str.lines().step_by(step).take(count).collect();
+    let len = log_str.lines().count();
+    let step = (len / count.max(1)).max(1);
+    log_str
+        .lines()
+        .step_by(step)
+        .take(count)
+        .map(str::to_string)
+        .collect()
+}
 
-    for (i, commit) in commits.iter().enumerate() {
+/// Create branches pointing at different depths in the repo's commit history.
+///
+/// Samples `count` commits via [`history_spread_shas`] and creates
+/// `feature-NNN` branches pointing at them (behind-only — no own commits).
+pub fn add_history_spread_branches(repo_path: &Path, count: usize) {
+    for (i, commit) in history_spread_shas(repo_path, count).iter().enumerate() {
         let branch_name = format!("feature-{i:03}");
         run_git(repo_path, &["branch", &branch_name, commit]);
     }
 }
 
-/// `git rev-parse HEAD` in `path`, trimmed.
+/// Add `worktrees` two-sided-diverged linked worktrees (`feature-wt-N`) and
+/// `branches` two-sided-diverged orphan branches (`feature-NNN`) to an
+/// existing repo.
+///
+/// Each forks at a [`history_spread_shas`] point — so the default branch has
+/// advanced past every fork — and carries its own commits on top. That is the
+/// shape of real long-lived feature work: `git merge-base` must walk back to
+/// the fork, and the integration probes (`merge-tree --write-tree`, diff)
+/// three-way over genuinely diverged trees. None of them is integrated, so
+/// against `wt step prune` they are a pure scan backdrop: every probe runs and
+/// fails. Worktrees get 2 untracked files (dirty in the way real worktrees
+/// are — untracked scratch, no staged state, so index-restoring helpers stay
+/// safe to use).
+///
+/// The populations are sized independently because their costs differ wildly
+/// on large repos: an orphan branch is a few commits' worth of objects, while
+/// a linked worktree materializes a full working tree (~1 GiB on
+/// rust-lang/rust) and pays a checkout.
+pub fn add_diverged_backdrop(repo_path: &Path, worktrees: usize, branches: usize) {
+    let repo_name = repo_path.file_name().unwrap().to_str().unwrap();
+    let parent_dir = repo_path.parent().unwrap();
+    let forks = history_spread_shas(repo_path, worktrees.max(branches).max(1));
+
+    // Orphan branches are built with plumbing (temp index + `commit-tree`),
+    // never touching the working tree: on a large repo like rust-lang/rust,
+    // `git checkout <old-fork>` rewrites the whole tree and would cost
+    // minutes per branch. Each branch gets 3 commits on top of its fork,
+    // each adding one new file — real content divergence, so the
+    // integration probes can't short-circuit.
+    let scratch = tempfile::tempdir().unwrap();
+    for i in 0..branches {
+        let branch = format!("feature-{i:03}");
+        let fork = &forks[i % forks.len()];
+        let index = scratch.path().join(format!("index-{i}"));
+        let mut parent = fork.clone();
+        for j in 0..3 {
+            let blob_file = scratch.path().join("blob");
+            std::fs::write(&blob_file, format!("// {branch} {j}\n")).unwrap();
+            let blob = git_stdout(
+                repo_path,
+                &["hash-object", "-w", blob_file.to_str().unwrap()],
+                &index,
+            );
+            git_stdout(repo_path, &["read-tree", &parent], &index);
+            git_stdout(
+                repo_path,
+                &[
+                    "update-index",
+                    "--add",
+                    "--cacheinfo",
+                    &format!("100644,{blob},{}_{j}.rs", branch.replace('-', "_")),
+                ],
+                &index,
+            );
+            let tree = git_stdout(repo_path, &["write-tree"], &index);
+            parent = git_stdout(
+                repo_path,
+                &[
+                    "commit-tree",
+                    &tree,
+                    "-p",
+                    &parent,
+                    "-m",
+                    &format!("{branch} commit {j}"),
+                ],
+                &index,
+            );
+        }
+        run_git(repo_path, &["branch", &branch, &parent]);
+    }
+
+    for i in 0..worktrees {
+        let wt_branch = format!("feature-wt-{i}");
+        let wt_path = parent_dir.join(format!("{repo_name}.{wt_branch}"));
+        run_git(
+            repo_path,
+            &[
+                "worktree",
+                "add",
+                "-q",
+                "-b",
+                &wt_branch,
+                wt_path.to_str().unwrap(),
+                &forks[i % forks.len()],
+            ],
+        );
+        // Targeted add — a bare `git add .` would rescan the whole tree,
+        // which on rust-lang/rust costs seconds per commit.
+        for j in 0..5 {
+            let name = format!("{}_{j}.rs", wt_branch.replace('-', "_"));
+            std::fs::write(wt_path.join(&name), format!("// {wt_branch} {j}\n")).unwrap();
+            run_git(&wt_path, &["add", &name]);
+            run_git(
+                &wt_path,
+                &["commit", "-q", "-m", &format!("{wt_branch} commit {j}")],
+            );
+        }
+        for j in 0..2 {
+            std::fs::write(wt_path.join(format!("uncommitted_{j}.txt")), "scratch\n").unwrap();
+        }
+    }
+}
+
+/// `git rev-parse HEAD` in `path`, trimmed. Panics on failure.
 fn head_sha(path: &Path) -> String {
-    let out = git_command()
-        .args(["rev-parse", "HEAD"])
-        .current_dir(path)
-        .output()
-        .unwrap();
-    String::from_utf8_lossy(&out.stdout).trim().to_string()
+    capture_git(path, &["rev-parse", "HEAD"])
 }
 
 /// Append a line to a tracked file (creating it if missing). Used to make
@@ -756,9 +927,12 @@ pub fn create_mixed_repo_at(worktrees: usize, branches: usize, repo: &Path) {
 ///   carries its own commits whose content also landed on main as a single
 ///   squash commit, so it is integrated *by content* (the `merge-tree` probes),
 ///   not by ancestry — the post-PR-squash shape prune typically removes.
-/// - **Backdrop** (`unmerged` of each): linked worktrees ahead of main with
-///   uncommitted files, and orphan branches with their own commits. Scanned on
-///   every run, never removed — the steady state that dominates scan cost.
+/// - **Backdrop** (`unmerged` of each): two-sided-diverged linked worktrees
+///   and orphan branches ([`add_diverged_backdrop`] — forked at points spread
+///   across history, with their own commits, while main advanced past them).
+///   Scanned on every run, never removed — the steady state that dominates
+///   scan cost, and the shape where merge-base walks and merge-tree
+///   three-ways do real work rather than short-circuiting at the tip.
 ///
 /// The main history is mature (200 commits, 100 files) so `git status` and the
 /// integration probes pay realistic per-worktree costs.
@@ -766,13 +940,14 @@ pub fn create_prune_repo_at(merged: usize, unmerged: usize, base_path: &Path) {
     let config = RepoConfig {
         commits_on_main: 200,
         files: 100,
-        branches: unmerged,
-        commits_per_branch: 2,
-        worktrees: unmerged + 1,
-        worktree_commits_ahead: 5,
-        worktree_uncommitted_files: 2,
+        branches: 0,
+        commits_per_branch: 0,
+        worktrees: 1,
+        worktree_commits_ahead: 0,
+        worktree_uncommitted_files: 0,
     };
     create_repo_at(&config, base_path);
+    add_diverged_backdrop(base_path, unmerged, unmerged);
     add_squash_merged(base_path, merged, 0);
     // The squash commits advanced main past the fake remote ref written by
     // `create_repo_at`; refresh so origin/main tracks the final tip.
@@ -782,7 +957,9 @@ pub fn create_prune_repo_at(merged: usize, unmerged: usize, base_path: &Path) {
 /// Add `count` squash-merged worktrees (`merged-wt-N`) and `count`
 /// squash-merged orphan branches (`merged-br-N`) to an existing repo.
 ///
-/// Each branch gets its own commits, then main takes the same content as one
+/// Each branch gets its own commits, then the default branch (whatever the
+/// primary worktree has checked out — `main` on the synthetic fixtures,
+/// `master` on rust-lang/rust) takes the same content as one
 /// `git merge --squash` commit — integrated by content, so `wt step prune`
 /// detects it via the merge-tree probes and removes it.
 ///
@@ -796,14 +973,17 @@ pub fn create_prune_repo_at(merged: usize, unmerged: usize, base_path: &Path) {
 pub fn add_squash_merged(repo_path: &Path, count: usize, round: usize) {
     let repo_name = repo_path.file_name().unwrap().to_str().unwrap();
     let parent_dir = repo_path.parent().unwrap();
+    let default_branch = capture_git(repo_path, &["rev-parse", "--abbrev-ref", "HEAD"]);
 
     // Two commits in `dir`, each adding a round-uniquified file (the branch
-    // name already carries the candidate index).
+    // name already carries the candidate index). The add is targeted — a bare
+    // `git add .` would rescan the whole tree, which on rust-lang/rust costs
+    // seconds per commit.
     let commit_branch_content = |dir: &Path, branch: &str| {
         for j in 0..2 {
-            let file = dir.join(format!("{}_{round}_{j}.rs", branch.replace('-', "_")));
-            std::fs::write(&file, format!("// {branch} {round}/{j}\n")).unwrap();
-            run_git(dir, &["add", "."]);
+            let name = format!("{}_{round}_{j}.rs", branch.replace('-', "_"));
+            std::fs::write(dir.join(&name), format!("// {branch} {round}/{j}\n")).unwrap();
+            run_git(dir, &["add", &name]);
             run_git(
                 dir,
                 &[
@@ -815,8 +995,8 @@ pub fn add_squash_merged(repo_path: &Path, count: usize, round: usize) {
             );
         }
     };
-    // Land the branch's content on main as a single squash commit.
-    let squash_into_main = |branch: &str| {
+    // Land the branch's content on the default branch as one squash commit.
+    let squash_into_default = |branch: &str| {
         run_git(repo_path, &["merge", "--squash", "-q", branch]);
         run_git(
             repo_path,
@@ -845,18 +1025,189 @@ pub fn add_squash_merged(repo_path: &Path, count: usize, round: usize) {
             ],
         );
         commit_branch_content(&wt_path, &branch);
-        squash_into_main(&branch);
+        squash_into_default(&branch);
     }
 
     for i in 0..count {
         let branch = format!("merged-br-{i}");
         run_git(repo_path, &["checkout", "-q", "-b", &branch]);
         commit_branch_content(repo_path, &branch);
-        run_git(repo_path, &["checkout", "-q", "main"]);
-        squash_into_main(&branch);
+        run_git(repo_path, &["checkout", "-q", &default_branch]);
+        squash_into_default(&branch);
     }
 }
 
+/// Default populations for the rust-scale prune fixture (`prune-real`):
+/// 12 squash-merged candidates of each kind + 24 unmerged worktrees and
+/// branches → 36 linked worktrees, and a live prune that removes 24
+/// candidates while keeping 72 unmerged items — the "dozens of worktrees,
+/// lots removed, lots kept" shape where prune takes multiple seconds.
+pub const PRUNE_REAL_MERGED: usize = 12;
+pub const PRUNE_REAL_UNMERGED: usize = 24;
+
+/// Create a rust-lang/rust-scale `wt step prune` workload at `base_path`.
+///
+/// Local-clones the cached rust repo ([`ensure_rust_repo`] — first call clones
+/// from the network, minutes) and adds the same two populations as
+/// [`create_prune_repo_at`]: `merged` squash-merged candidates of each kind
+/// ([`add_squash_merged`]) against a two-sided-diverged backdrop of `unmerged`
+/// worktrees and branches forked across the last 5000 commits
+/// ([`add_diverged_backdrop`]). This is the shape where prune's costs are
+/// real — merge-base walks over deep history, `merge-tree` three-ways over
+/// ~400 MiB trees, `git status` over ~60k files per worktree — and reproduces
+/// the "prune takes seconds" experience that small synthetic fixtures can't
+/// (their probes bottom out at subprocess-spawn cost).
+///
+/// Each linked worktree materializes a full working tree: ~400 MiB and ~3 s
+/// per worktree, so the default populations build in minutes and take ~15 GiB.
+/// Prefer [`ensure_prune_real_repo`], which builds once into
+/// `target/bench-repos` and repairs consumed candidates on later runs.
+pub fn create_prune_real_repo_at(merged: usize, unmerged: usize, base_path: &Path) {
+    clone_rust_repo_at(base_path);
+    add_diverged_backdrop(base_path, unmerged, unmerged);
+    add_squash_merged(base_path, merged, 0);
+}
+
+/// How a cached prune fixture compares to its expected populations.
+#[derive(Debug, PartialEq, Eq)]
+pub enum PruneFixtureState {
+    /// Backdrop and candidates all present.
+    Intact,
+    /// Backdrop intact, candidates fully consumed — a live prune ran.
+    /// Repairable by re-running [`add_squash_merged`] with a fresh round.
+    Consumed,
+    /// Anything else (partial removal, corruption) — rebuild from scratch.
+    Broken,
+}
+
+/// Classify a prune fixture ([`create_prune_repo_at`] /
+/// [`create_prune_real_repo_at`] layout) against its expected populations.
+///
+/// Counts are the fixture's invariants: `1 + unmerged + merged` worktrees,
+/// `2 * unmerged` `feature-*` branches (worktree + orphan), `2 * merged`
+/// `merged-*` branches. A live prune removes exactly the `merged-*` items,
+/// which is the [`PruneFixtureState::Consumed`] signature.
+pub fn prune_fixture_state(repo: &Path, merged: usize, unmerged: usize) -> PruneFixtureState {
+    if !run_git_ok(repo, &["rev-parse", "HEAD"]) {
+        return PruneFixtureState::Broken;
+    }
+    let worktrees = capture_git(repo, &["worktree", "list", "--porcelain"])
+        .lines()
+        .filter(|l| l.starts_with("worktree "))
+        .count();
+    let branches = capture_git(
+        repo,
+        &["for-each-ref", "--format=%(refname:short)", "refs/heads"],
+    );
+    let merged_branches = branches
+        .lines()
+        .filter(|b| b.starts_with("merged-"))
+        .count();
+    let feature_branches = branches
+        .lines()
+        .filter(|b| b.starts_with("feature-"))
+        .count();
+
+    if feature_branches != 2 * unmerged {
+        return PruneFixtureState::Broken;
+    }
+    if worktrees == 1 + unmerged + merged && merged_branches == 2 * merged {
+        PruneFixtureState::Intact
+    } else if worktrees == 1 + unmerged && merged_branches == 0 {
+        PruneFixtureState::Consumed
+    } else {
+        PruneFixtureState::Broken
+    }
+}
+
+/// The next [`add_squash_merged`] round for a fixture repo, derived from the
+/// repo itself: each completed round leaves `merged_br_0_<round>_*.rs` files
+/// on the default branch's tip tree (the squash commits survive candidate
+/// removal), so the number of distinct rounds already landed IS the next
+/// round index. Derived rather than stored — a sidecar counter can desync
+/// from the repo (interrupted repair, hand cleanup) and turn a ~1-minute
+/// repair into a name-collision panic.
+fn next_squash_round(repo: &Path) -> usize {
+    capture_git(repo, &["ls-tree", "--name-only", "HEAD"])
+        .lines()
+        .filter(|l| l.starts_with("merged_br_0_") && l.ends_with("_0.rs"))
+        .count()
+}
+
+/// Get or build the cached rust-scale prune fixture, returning the repo path.
+///
+/// The fixture lives at `target/bench-repos/rust-prune-<merged>-<unmerged>/repo`
+/// (worktrees as siblings) so its minutes-long build ([`create_prune_real_repo_at`])
+/// is paid once, not per bench run. On reuse it is validated by
+/// [`prune_fixture_state`]:
+///
+/// - `Intact` → returned as-is (dry runs don't mutate it).
+/// - `Consumed` — a live `wt step prune` removed the candidates — → repaired
+///   in place by re-running [`add_squash_merged`] with the next round
+///   (`next_squash_round`), so a live-prune measurement costs a ~1-minute
+///   repair, not a full rebuild.
+/// - `Broken` (interrupted prune or build, corruption) → wiped and rebuilt.
+///
+/// Deleted worktree indexes (a stray `wt-perf invalidate` / `timeline --cold`
+/// against the fixture) are healed first with [`restore_worktree_indexes`] —
+/// without an index, `git status` reports every tracked file as a staged
+/// deletion and prune's clean-worktree gate silently drops the worktree
+/// candidates. Safe here because the fixture's only dirt is untracked files.
+///
+/// No cross-process locking: two concurrent callers (e.g. `cargo bench
+/// --bench prune` while `wt-perf setup prune-real` is mid-build) can classify
+/// each other's half-built tree as `Broken` and wipe it. Don't run two
+/// builders at once; the same limitation applies to [`ensure_rust_repo`].
+pub fn ensure_prune_real_repo(merged: usize, unmerged: usize) -> PathBuf {
+    let cache_dir = bench_repos_dir().join(format!("rust-prune-{merged}-{unmerged}"));
+    let repo = cache_dir.join("repo");
+
+    if repo.exists() {
+        let worktrees_dir = repo.join(".git/worktrees");
+        let index_missing = !repo.join(".git/index").exists()
+            || std::fs::read_dir(&worktrees_dir).is_ok_and(|entries| {
+                entries
+                    .flatten()
+                    .any(|entry| !entry.path().join("index").exists())
+            });
+        if index_missing {
+            eprintln!("Restoring invalidated worktree indexes...");
+            restore_worktree_indexes(&repo);
+        }
+        match prune_fixture_state(&repo, merged, unmerged) {
+            PruneFixtureState::Intact => {
+                eprintln!("Using cached prune fixture at {}", repo.display());
+                return repo;
+            }
+            PruneFixtureState::Consumed => {
+                let round = next_squash_round(&repo);
+                eprintln!(
+                    "Re-creating {merged} consumed squash-merged candidate pairs (round {round})..."
+                );
+                add_squash_merged(&repo, merged, round);
+                return repo;
+            }
+            PruneFixtureState::Broken => {
+                eprintln!("Cached prune fixture unusable, rebuilding...");
+            }
+        }
+    }
+
+    eprintln!(
+        "Building prune fixture: {} rust worktrees at ~3s each (one-time, cached)...",
+        merged + unmerged
+    );
+    // Clear remnants unconditionally: an interrupted build or rebuild can
+    // leave sibling worktree dirs without `repo`, and `git worktree add`
+    // fails on an existing non-empty destination.
+    if cache_dir.exists() {
+        std::fs::remove_dir_all(&cache_dir).unwrap();
+    }
+    std::fs::create_dir_all(&cache_dir).unwrap();
+    create_prune_real_repo_at(merged, unmerged, &repo);
+    repo
+}
+
 /// Canonicalize path without Windows `\\?\` prefix.
 pub fn canonicalize(path: &Path) -> std::io::Result<PathBuf> {
     dunce::canonicalize(path)
@@ -1001,6 +1352,62 @@ mod tests {
         }
     }
 
+    /// The classifier that decides whether the cached rust-scale fixture is
+    /// reusable, repairable, or must be rebuilt ([`ensure_prune_real_repo`]).
+    /// Exercised on the synthetic fixture, which shares the exact layout.
+    #[test]
+    fn prune_fixture_state_classifies_lifecycle() {
+        let temp = tempfile::tempdir().unwrap();
+        let repo_path = temp.path().join("repo");
+        create_prune_repo_at(1, 2, &repo_path);
+
+        assert_eq!(
+            prune_fixture_state(&repo_path, 1, 2),
+            PruneFixtureState::Intact
+        );
+        // Wrong expected populations don't match this repo.
+        assert_eq!(
+            prune_fixture_state(&repo_path, 2, 2),
+            PruneFixtureState::Broken
+        );
+
+        // Partial consumption (worktree candidate gone, branches still there)
+        // is Broken — an interrupted live prune needs a rebuild.
+        let wt_path = temp.path().join("repo.merged-wt-0");
+        run_git(
+            &repo_path,
+            &["worktree", "remove", "--force", wt_path.to_str().unwrap()],
+        );
+        assert_eq!(
+            prune_fixture_state(&repo_path, 1, 2),
+            PruneFixtureState::Broken
+        );
+
+        // Full consumption — exactly what a live prune leaves behind.
+        run_git(&repo_path, &["branch", "-D", "merged-wt-0", "merged-br-0"]);
+        assert_eq!(
+            prune_fixture_state(&repo_path, 1, 2),
+            PruneFixtureState::Consumed
+        );
+
+        // Repair restores Intact, with the round derived from the repo
+        // itself (round 0's squash commits survive candidate removal).
+        assert_eq!(next_squash_round(&repo_path), 1);
+        add_squash_merged(&repo_path, 1, next_squash_round(&repo_path));
+        assert_eq!(next_squash_round(&repo_path), 2);
+        assert_eq!(
+            prune_fixture_state(&repo_path, 1, 2),
+            PruneFixtureState::Intact
+        );
+
+        // A missing backdrop branch is Broken.
+        run_git(&repo_path, &["branch", "-D", "feature-000"]);
+        assert_eq!(
+            prune_fixture_state(&repo_path, 1, 2),
+            PruneFixtureState::Broken
+        );
+    }
+
     /// Regression: degenerate `count` values must not panic. `count == 0`
     /// divided into `5000`, and `count > 5000` flooring `step` to 0 for
     /// `step_by`, both panicked before the `max(1)` guards.
diff --git a/tests/helpers/wt-perf/src/main.rs b/tests/helpers/wt-perf/src/main.rs
index ff6ce19227..c0fdd52720 100644
--- a/tests/helpers/wt-perf/src/main.rs
+++ b/tests/helpers/wt-perf/src/main.rs
@@ -10,8 +10,9 @@ use std::time::{Duration, Instant};
 use clap::{Parser, Subcommand};
 use worktrunk::trace::{TraceEntry, TraceEntryKind, TraceResult};
 use wt_perf::{
-    canonicalize, create_mixed_repo_at, create_prune_repo_at, create_repo_at,
-    invalidate_caches_auto, parse_config,
+    PRUNE_REAL_MERGED, PRUNE_REAL_UNMERGED, canonicalize, create_mixed_repo_at,
+    create_prune_repo_at, create_repo_at, ensure_prune_real_repo, invalidate_caches_auto,
+    parse_config,
 };
 
 #[derive(Parser)]
@@ -26,7 +27,7 @@ struct Cli {
 enum Commands {
     /// Set up a benchmark repository
     Setup {
-        /// Config name: typical-N, branches-N, branches-N-M, divergent, mixed-W-B, prune-M-U, picker-test
+        /// Config name: typical-N, branches-N, branches-N-M, divergent, mixed-W-B, prune-M-U, prune-real[-M-U], picker-test
         config: String,
 
         /// Directory to create repo in (default: temp directory)
@@ -125,8 +126,49 @@ fn main() {
             path,
             persist,
         } => {
-            // `mixed-W-B` / `prune-M-U`: composite fixtures handled separately
-            // since they don't map onto the flat `RepoConfig`.
+            // `mixed-W-B` / `prune-M-U` / `prune-real[-M-U]`: composite
+            // fixtures handled separately since they don't map onto the flat
+            // `RepoConfig`. Test `prune-real` before `prune-` so the pair
+            // parser never sees it.
+            let prune_real = if config == "prune-real" {
+                Some((PRUNE_REAL_MERGED, PRUNE_REAL_UNMERGED))
+            } else {
+                parse_pair(&config, "prune-real-")
+            };
+
+            // The rust-scale fixture is cache-managed (built once under
+            // target/bench-repos/, repaired after a live prune consumes its
+            // candidates), so it takes no --path and never offers cleanup.
+            if let Some((merged, unmerged)) = prune_real {
+                if path.is_some() {
+                    eprintln!(
+                        "prune-real fixtures are cache-managed under target/bench-repos/; --path is not supported"
+                    );
+                    std::process::exit(1);
+                }
+                let repo = ensure_prune_real_repo(merged, unmerged);
+                eprintln!(
+                    "Ready: main @ {}, {} worktrees, {} branches",
+                    repo.display(),
+                    merged + unmerged + 1,
+                    merged + unmerged
+                );
+                eprintln!();
+                eprintln!(
+                    "  wt-perf timeline -- -C {} step prune --dry-run --min-age 0s",
+                    repo.display()
+                );
+                eprintln!(
+                    "  wt-perf timeline -- -C {} step prune --min-age 0s   # live; next setup/bench run re-creates the candidates",
+                    repo.display()
+                );
+                // No `wt-perf invalidate` hint: deleting this fixture's
+                // worktree indexes flips prune's clean-worktree gate and
+                // degrades every later run (ensure_prune_real_repo heals it,
+                // but only on the next setup/bench call).
+                return;
+            }
+
             let mixed = parse_pair(&config, "mixed-");
             let prune = parse_pair(&config, "prune-");
 
@@ -147,6 +189,9 @@ fn main() {
                     eprintln!(
                         "  prune-M-U       - M squash-merged candidates + U unmerged worktrees/branches (wt step prune workload)"
                     );
+                    eprintln!(
+                        "  prune-real[-M-U] - rust-lang/rust clone + M squash-merged candidates + U unmerged worktrees/branches, cached in target/bench-repos (default {PRUNE_REAL_MERGED}-{PRUNE_REAL_UNMERGED}; first run clones from network)"
+                    );
                     eprintln!(
                         "  picker-test     - Config for wt switch interactive picker testing"
                     );
@@ -180,7 +225,9 @@ fn main() {
                     create_repo_at(cfg, &base_path);
                     (cfg.worktrees, cfg.branches)
                 }
-                (None, None, None) => unreachable!("repo_config is Some when composites are None"),
+                (None, None, None) => {
+                    unreachable!("repo_config is Some when composites are None")
+                }
             };
 
             let mut parts = vec![format!("main @ {}", base_path.display())];
@@ -192,13 +239,20 @@ fn main() {
             }
             eprintln!("Created: {}", parts.join(", "));
             eprintln!();
+            let example_args = if prune.is_some() {
+                "step prune --dry-run --min-age 0s"
+            } else {
+                "list --progressive"
+            };
             eprintln!(
-                "  wt-perf timeline -- -C {} list --progressive",
-                base_path.display()
+                "  wt-perf timeline -- -C {} {}",
+                base_path.display(),
+                example_args
             );
             eprintln!(
-                "  wt-perf timeline --chrome -- -C {} list --progressive > trace.json",
-                base_path.display()
+                "  wt-perf timeline --chrome -- -C {} {} > trace.json",
+                base_path.display(),
+                example_args
             );
             eprintln!("  wt-perf invalidate {}", base_path.display());
 

From 4810ab9df7f8c6d24f98af71e99dc5e37c900200 Mon Sep 17 00:00:00 2001
From: Maximilian Roos <m@maxroos.com>
Date: Thu, 9 Jul 2026 19:39:01 -0700
Subject: [PATCH 3/5] docs: fix dead Claude Code docs links (docs.anthropic.com
 now 404s)

docs.anthropic.com/en/docs/build-with-claude/claude-code redirects into
platform.claude.com and lands on a 404, failing lychee on every push
(main is red on the same link). Point the llm-commits installation link
and the plugins install-hint at code.claude.com/docs/en/setup, which
resolves directly.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 docs/content/llm-commits.md                                    | 2 +-
 skills/worktrunk/reference/llm-commits.md                      | 2 +-
 src/commands/config/plugins.rs                                 | 2 +-
 ...__config_show__plugins_claude_install_claude_not_found.snap | 3 ++-
 4 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/docs/content/llm-commits.md b/docs/content/llm-commits.md
index e5654f101b..598cd8e18c 100644
--- a/docs/content/llm-commits.md
+++ b/docs/content/llm-commits.md
@@ -27,7 +27,7 @@ Any command that reads a prompt from stdin and outputs a commit message works. A
 command = "MAX_THINKING_TOKENS=0 claude -p --no-session-persistence --model=haiku --tools='' --safe-mode --setting-sources='user' --system-prompt=''"
 ```
 
-`--no-session-persistence` prevents the commit conversation from polluting `claude --continue`. `--safe-mode` keeps the run hermetic — no hooks, plugins, MCP, skills, or CLAUDE.md — while leaving authentication working normally, so setups that authenticate via `apiKeyHelper` (not just OAuth or `ANTHROPIC_API_KEY`) still get a key. `--setting-sources='user'` scopes settings to your user config so a project `.claude/settings.json` can't override auth. The remaining flags disable tools, system prompt, and thinking for fast text-only output. `--safe-mode` requires Claude Code ≥ 2.1.169. See [Claude Code docs](https://docs.anthropic.com/en/docs/build-with-claude/claude-code) for installation.
+`--no-session-persistence` prevents the commit conversation from polluting `claude --continue`. `--safe-mode` keeps the run hermetic — no hooks, plugins, MCP, skills, or CLAUDE.md — while leaving authentication working normally, so setups that authenticate via `apiKeyHelper` (not just OAuth or `ANTHROPIC_API_KEY`) still get a key. `--setting-sources='user'` scopes settings to your user config so a project `.claude/settings.json` can't override auth. The remaining flags disable tools, system prompt, and thinking for fast text-only output. `--safe-mode` requires Claude Code ≥ 2.1.169. See [Claude Code docs](https://code.claude.com/docs/en/setup) for installation.
 
 ### Codex
 
diff --git a/skills/worktrunk/reference/llm-commits.md b/skills/worktrunk/reference/llm-commits.md
index 999c0fa0d9..c69492baa8 100644
--- a/skills/worktrunk/reference/llm-commits.md
+++ b/skills/worktrunk/reference/llm-commits.md
@@ -13,7 +13,7 @@ Any command that reads a prompt from stdin and outputs a commit message works. A
 command = "MAX_THINKING_TOKENS=0 claude -p --no-session-persistence --model=haiku --tools='' --safe-mode --setting-sources='user' --system-prompt=''"
 ```
 
-`--no-session-persistence` prevents the commit conversation from polluting `claude --continue`. `--safe-mode` keeps the run hermetic — no hooks, plugins, MCP, skills, or CLAUDE.md — while leaving authentication working normally, so setups that authenticate via `apiKeyHelper` (not just OAuth or `ANTHROPIC_API_KEY`) still get a key. `--setting-sources='user'` scopes settings to your user config so a project `.claude/settings.json` can't override auth. The remaining flags disable tools, system prompt, and thinking for fast text-only output. `--safe-mode` requires Claude Code ≥ 2.1.169. See [Claude Code docs](https://docs.anthropic.com/en/docs/build-with-claude/claude-code) for installation.
+`--no-session-persistence` prevents the commit conversation from polluting `claude --continue`. `--safe-mode` keeps the run hermetic — no hooks, plugins, MCP, skills, or CLAUDE.md — while leaving authentication working normally, so setups that authenticate via `apiKeyHelper` (not just OAuth or `ANTHROPIC_API_KEY`) still get a key. `--setting-sources='user'` scopes settings to your user config so a project `.claude/settings.json` can't override auth. The remaining flags disable tools, system prompt, and thinking for fast text-only output. `--safe-mode` requires Claude Code ≥ 2.1.169. See [Claude Code docs](https://code.claude.com/docs/en/setup) for installation.
 
 ### Codex
 
diff --git a/src/commands/config/plugins.rs b/src/commands/config/plugins.rs
index eba12d80ab..9d653eb8b8 100644
--- a/src/commands/config/plugins.rs
+++ b/src/commands/config/plugins.rs
@@ -185,6 +185,6 @@ fn require_claude_cli() -> anyhow::Result<()> {
         return Ok(());
     }
     bail!(
-        "claude CLI not found. Install Claude Code first: https://docs.anthropic.com/en/docs/claude-code/overview"
+        "claude CLI not found. Install Claude Code first: https://code.claude.com/docs/en/setup"
     );
 }
diff --git a/tests/snapshots/integration__integration_tests__config_show__plugins_claude_install_claude_not_found.snap b/tests/snapshots/integration__integration_tests__config_show__plugins_claude_install_claude_not_found.snap
index 1ca13156d0..19a4862862 100644
--- a/tests/snapshots/integration__integration_tests__config_show__plugins_claude_install_claude_not_found.snap
+++ b/tests/snapshots/integration__integration_tests__config_show__plugins_claude_install_claude_not_found.snap
@@ -10,6 +10,7 @@ info:
     - "--yes"
   env:
     APPDATA: "[TEST_CONFIG_HOME]"
+    CLAUDE_CONFIG_DIR: "[TEST_CLAUDE_CONFIG]"
     CLICOLOR_FORCE: "1"
     COLUMNS: "500"
     GIT_AUTHOR_DATE: "2025-01-01T00:00:00Z"
@@ -49,4 +50,4 @@ exit_code: 1
 ----- stdout -----
 
 ----- stderr -----
-✗ claude CLI not found. Install Claude Code first: https://docs.anthropic.com/en/docs/claude-code/overview
+✗ claude CLI not found. Install Claude Code first: https://code.claude.com/docs/en/setup

From eba7da6e47414692c277b9e628c59339167dcfcd Mon Sep 17 00:00:00 2001
From: Maximilian Roos <m@maxroos.com>
Date: Thu, 9 Jul 2026 19:42:34 -0700
Subject: [PATCH 4/5] style: collapse bail! to one line after URL shortening

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 src/commands/config/plugins.rs | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/src/commands/config/plugins.rs b/src/commands/config/plugins.rs
index 9d653eb8b8..ee5183ccc1 100644
--- a/src/commands/config/plugins.rs
+++ b/src/commands/config/plugins.rs
@@ -184,7 +184,5 @@ fn require_claude_cli() -> anyhow::Result<()> {
     if is_claude_available() {
         return Ok(());
     }
-    bail!(
-        "claude CLI not found. Install Claude Code first: https://code.claude.com/docs/en/setup"
-    );
+    bail!("claude CLI not found. Install Claude Code first: https://code.claude.com/docs/en/setup");
 }

From 1ce91affc5a70697e8a1d299a7f03746da2c4165 Mon Sep 17 00:00:00 2001
From: Maximilian Roos <m@maxroos.com>
Date: Thu, 9 Jul 2026 21:24:43 -0700
Subject: [PATCH 5/5] test(remove): assert -vv traces the fsmonitor sweep

Covers the sweep's daemon-count debug line (the codecov/patch gap): CI
runners have no fsmonitor daemons, so pgrep is mocked to report one bogus
PID and lsof is mocked to fail per-PID resolution.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 tests/integration_tests/remove.rs | 57 +++++++++++++++++++++++++++++++
 1 file changed, 57 insertions(+)

diff --git a/tests/integration_tests/remove.rs b/tests/integration_tests/remove.rs
index 748077fd15..52b9cbfaa6 100644
--- a/tests/integration_tests/remove.rs
+++ b/tests/integration_tests/remove.rs
@@ -3151,6 +3151,63 @@ fn test_remove_sweeps_stale_trash_entries(mut repo: TestRepo) {
     );
 }
 
+/// `wt remove -vv` traces the end-of-command fsmonitor sweep: the
+/// `enumerate-fsmonitor-daemons` span appears and the machine-wide daemon
+/// count is surfaced, so a slow sweep (per-PID `lsof` resolution) is
+/// explainable from the trace. `pgrep` is mocked to report one bogus PID —
+/// CI runners have no real fsmonitor daemons, so the count line is otherwise
+/// unreachable — and `lsof` is mocked to fail its per-PID resolution, which
+/// the best-effort sweep treats as "no daemons".
+#[rstest]
+#[cfg(unix)]
+fn test_remove_vv_traces_fsmonitor_sweep(mut repo: TestRepo) {
+    use crate::common::mock_commands::{MockConfig, MockResponse};
+
+    let bin_dir = repo.root_path().join(".bin");
+    std::fs::create_dir_all(&bin_dir).unwrap();
+    MockConfig::new("pgrep")
+        .command("_default", MockResponse::output("999999999\n"))
+        .write(&bin_dir);
+    MockConfig::new("lsof")
+        .command("_default", MockResponse::exit(1))
+        .write(&bin_dir);
+
+    let mut paths: Vec<std::path::PathBuf> = std::env::var_os("PATH")
+        .map(|p| std::env::split_paths(&p).collect())
+        .unwrap_or_default();
+    paths.insert(0, bin_dir.clone());
+    let new_path = std::env::join_paths(&paths).unwrap();
+
+    repo.add_worktree("feature-fsmon");
+    let output = repo
+        .wt_command()
+        .args(["remove", "feature-fsmon", "-vv"])
+        .env("PATH", &new_path)
+        .env("MOCK_CONFIG_DIR", &bin_dir)
+        .output()
+        .unwrap();
+    assert!(
+        output.status.success(),
+        "wt remove should succeed: {}",
+        String::from_utf8_lossy(&output.stderr)
+    );
+
+    // -vv streams primary output to stderr but writes trace records to the
+    // log files; the sweep runs in the foreground process, so its records are
+    // complete once the command exits.
+    let trace_log =
+        crate::common::resolve_git_common_dir(repo.root_path()).join("wt/logs/trace.log");
+    let trace = std::fs::read_to_string(&trace_log).unwrap();
+    assert!(
+        trace.contains("◷ enumerate-fsmonitor-daemons"),
+        "sweep span should appear in the -vv trace. trace.log: {trace}"
+    );
+    assert!(
+        trace.contains("resolving sockets for 1 daemon(s) via lsof"),
+        "sweep should surface the daemon count. trace.log: {trace}"
+    );
+}
+
 /// Tests that foreground removal shows remaining directory entries when
 /// `git worktree remove` fails because a directory can't be deleted.
 ///