[brettheap]

Lane: openRepoProject-5

DRAFT for Brett Heap's word. Refs #24 (governing issue, claimed by lane openRepoProject-5) and #6 (the maintenance design packet record).

Status at the final head, 7f3453c (2026-10-23)

This change lets project clean dispose of Python bytecode caches (__pycache__ directories and loose .pyc and .pyo files) just before it removes a merged, clean, published linked worktree whose only ignored files are such caches; change 1 keeps those worktrees today as ignored-local-files. The disposal is capped, never follows a symlink, checks the whole list of caches before the first unlink, and stops before any worktree removal if its stage fails. It is a draft for Brett Heap's word: nothing is ratified or merged, and its ratification task (tasks.md 1.6) is still open.

Since this description was written (2026-10-11):

• Each removal in the cache stage is waited for (up to the 300 s removal ceiling), the stage starts only while more than the 5 s removal floor remains, and once the first removal is handed over the stage runs to its end (B-16, B-17).
• When the removal floor stops a read after the stage's first removal, the stage now ends as the floor does at a hand-off, with exit 1 and the later targets deadline-exceeded, and is not reported as a change of state; the design's table gains the row (B-117, on the review wave's MEDIUM-2).
• After a removal that ends git-failed, the result line no longer says that the worktree was not removed, since Git may already have deleted part of it and its registration, as reproduced on Git 2.43.0 and on the 2.36.6 floor. The line now says so and points to inspecting the path by hand; git-refused and spawn-error keep the old line (B-117, on the wave's MEDIUM-1).
• Smaller fixes: the plan-time walk checks the worktree root's identity; removed is true only where the stage's own removal removed the path; a chain reopened for the removals with another identity is named among what ends the stage; the narrow guarantee's window, as the ADDED requirement states it, also holds an entry put at a name the preflight fixed; the stall line names remounting a read-only filesystem; and the README edit points follow feature 004's README (B-117).
• Round B25 words the by-hand recovery as Brett Heap's Q3 (a) has it ("inspect, then delete <path> and its administrative directory <common_dir>/worktrees/<admin_id> by hand"), which replaces round (p)'s form in this change's own restatements of the retire and reconcilable-result texts (R-380, B-121).
• The rule for a status probe that warns (RE23-1) now follows PR OpenSpec: amend add-project-clean-all-safe so the push child reaches its remote #19's Q8, in the spec delta, with the combined run as a scenario case, and in the design (B-115, B-116, B-124).
• Q1's fifth status pin is added at every site that lists the pins, so the cache enumeration child carries what the combined probe carries; D11 quotes contains-submodule in PR OpenSpec: amend add-project-clean-all-safe so the push child reaches its remote #19's words at its head; and D4 notes that the lstat calls that PR OpenSpec: amend add-project-clean-all-safe so the push child reaches its remote #19's rounds (q) and (r) add are unmeasured, with no figure moved (B-123, B-124).
• RB2's LOW-5 (B-119) is applied, in the batch block as the two edits that lane openRepoProject-2's byte check names (R-400), and where its sites leave this change's own text. Lane openRepoProject-3's W128 LOW-1 and LOW-2 are applied in live text, and its LOW-3 is recorded as a table row (B-121).
• Round B26 restates PR OpenSpec: amend add-project-clean-all-safe so the push child reaches its remote #19's round (s) in this change's text. Round (s) rewords PR OpenSpec: amend add-project-clean-all-safe so the push child reaches its remote #19's Q2 (2) contains-submodule clause in the preservation block, and leaves the registration-mismatch sentence beside it unchanged. Task 2.1 and the design's B-127 row, which is corrected in place with a note, now say that round B25's "preservation untouched" covered only that sentence (lane openRepoProject-3's W146, B-138). D4 gives PR OpenSpec: amend add-project-clean-all-safe so the push child reaches its remote #19's warm-cache figure for the gate's lstat calls, about 0.25 s at 50,000 tracked directories, in PR OpenSpec: amend add-project-clean-all-safe so the push child reaches its remote #19's words and counted in none of this change's figures, so no figure moves (B-137). The round B22 Context sentence's pointer to T8 is fixed (B-132).
• The check of the whole cache list before the first unlink now keeps the run's 1 GiB byte total (B-26), reports a stop by the deadline as "not attempted" and not as a changed state (B-34), and lets a signal received first outrank every outcome of that check (B-39, B-41).
• Every directory the plan records now counts toward the per-worktree cap of 512 recorded objects, and the plan-time walk is bounded at 8,192 objects (16 rows of 512) in the time fit (B-33, B-25).
• The walk and the whole-list check read a directory one entry at a time and close the read at the cap, so no whole directory listing is held in memory (B-44).
• The stall line (why capped rows will not drain) keys on persistent reasons, not on blocking alone (B-32), and prints only when a later candidate was left by the 16-enumeration cap (B-45).
• A cache directory the user cannot change keeps its row at the rung as cache-unwritable and stops nothing (B-20); where the platform lacks the needed calls, a row an earlier rung classified keeps that class, so a dirty worktree stays dirty (B-37).
• The overview exception, a recommendation on 2026-10-11, is now a third delta, project-overview, agreed by lane openRepoProject-4 (B-14, B-22, B-30).
• Every block this change carries from change 1 follows PR OpenSpec: amend add-project-clean-all-safe so the push child reaches its remote #19's text: two since round B10, and all eight since round B15. Rounds B16 to B22 brought them to its text at 88d0d36: the retire, reconcilable-result and bounds blocks at its round (n), 2250830, the revalidation block at its round (k), 173d83c, the batch block at its round (h), b3228bb, the classification block at 6bf9f77, and two at f0bf538, whose text 88d0d36, PR OpenSpec: amend add-project-clean-all-safe so the push child reaches its remote #19's round (o), keeps, since it changes no spec text after 2250830 (B-95, B-99, B-104, B-107). Lane openRepoProject-2 checked and agreed them before each commit (B-54, B-69, B-84, B-87, B-88, B-93, and rounds B11 to B19, B21 and B22). Round B25 re-based seven of the eight, since PR OpenSpec: amend add-project-clean-all-safe so the push child reaches its remote #19's rounds (p) and (q) changed them, and its round (r) changed three of those: classification, retire and revalidation were carried at round (r), 4512441, which lane openRepoProject-2 accepted (R-396), and batch, bounds, reconcilable-result and preservation at round (q), 818311a (R-389), with the narrow guarantee at f0bf538, whose text 4512441 keeps. Round B26 re-bases four of them on PR OpenSpec: amend add-project-clean-all-safe so the push child reaches its remote #19's round (s), dab8a64, which lane openRepoProject-2 accepted (R-412): classification, batch, preservation and revalidation. Classification gains PR OpenSpec: amend add-project-clean-all-safe so the push child reaches its remote #19's scenario "The main worktree's recommendation", placed before this change's own. Retire stays at 4512441, bounds and the reconcilable result at 818311a, and the narrow guarantee at f0bf538, and all four are byte-identical at PR OpenSpec: amend add-project-clean-all-safe so the push child reaches its remote #19's round (t), 54e869b (R-415). In both rounds each changed block was rebuilt two ways, by hunk re-application and by git merge-file, with identical outputs: PR OpenSpec: amend add-project-clean-all-safe so the push child reaches its remote #19's text is carried byte for byte, and this change's additions word for word (B-126, B-128, B-135, B-136). Lane openRepoProject-2 checked the held blocks byte for byte before each commit (R-400, R-421). At 37c0c23 all seven equaled round B25's held set (R-410), and at 7f3453c the four re-based blocks equal round B26's held set byte for byte, and the other four are unchanged since 37c0c23 (R-423).
  • The fit names its basis, the design packet's 150 ms per child. Where the plan reads extensions.worktreeConfig as false, planning and revalidation spawn 283 Git children besides the 16 removals, about 47.3 s. The first 14 targets start before the spawn limit, 45 s into the run, and the last two are not attempted, with deadline-exceeded.
  • Where the setting is true, PR OpenSpec: amend add-project-clean-all-safe so the push child reaches its remote #19 has resolved its open question LQ-20 by measurement, and the change states its own fit on PR OpenSpec: amend add-project-clean-all-safe so the push child reaches its remote #19's measured costs: the 16th target starts at about 37.6 s through one worker, or 44.6 s at a thread per call, so all 16 start in time. Beside it, a conservative variant costs the cache enumeration child as a full enumeration, which gives about 45.9 s at a thread per call, so the 16th target waits for the next run. Task 2.3's measurement settles which holds (B-65, B-79).
  • At revalidation, a deadline cut of the cache enumeration child gives deadline-exceeded, and the child's own failure or timeout gives state-changed, as PR OpenSpec: amend add-project-clean-all-safe so the push child reaches its remote #19's rules R-171 and R-208 have it. The cache stage's own filesystem checks agree with R-208.
  • PR OpenSpec: amend add-project-clean-all-safe so the push child reaches its remote #19's round (h) carries Brett Heap's rulings F-1, F-2 and O-1. A batch read that the deadline cuts now records deadline-exceeded, while this change's cache-walk read that times out still leaves its row cache-unverified with the plan complete. The 283-child figure holds where no repository path holds a line feed (B-84, B-85).
• PR OpenSpec: amend add-project-clean-all-safe so the push child reaches its remote #19's round (p), e0b1671, which lane openRepoProject-2 accepted on 2026-10-23, gave the source texts of two of those blocks, retire and reconcilable-result, F-1's (b), a no-prune warning beside an unread row (Brett Heap's R-365). Round B24 re-based neither (B-114, B-117). Round B25 does, on PR OpenSpec: amend add-project-clean-all-safe so the push child reaches its remote #19's round (q), which builds Brett Heap's answers to lane openRepoProject-2's Q1 to Q9 (R-380) and, with round (p), changes seven of the eight blocks, and on its round (r). B-121 rules that round B25 re-bases on round (q), and so supersedes B-118's reading that round (q) leaves this change's blocks alone.
• PR OpenSpec: amend add-project-clean-all-safe so the push child reaches its remote #19 is at 54e869b, its round (t). Lane openRepoProject-2 accepted round (s) at dab8a64 (R-412) and round (t) at 54e869b (R-415), and round (t) changes none of the eight blocks. Brett Heap's answer "yes, recommended for M1 and M3" (R-413) is built by round (t), so M1 and M3 are ruled, each as its (a), and this change names them as ruled. A round (u) is possible. It is not started, and it would re-base the batch block again, in its own small round.
• A cache-only row that a gate after deferred-target-cap excludes (such as one holding an initialized submodule, an operation in progress or hidden local state) now counts as held for a persistent reason. The stall line names it with change 1's next steps, and it no longer counts toward the run's totals. The plan applies those gates in one pass, with no Git child added (B-56, on Codex's finding on d4e960b).
• Each cap has its own drain condition (B-58, B-62).
  • Candidates that the 16-enumeration cap leaves drain as the candidates ahead of them are removed or cease to be candidates, since a candidate left at the ignored-local-files rung keeps its place.
  • Candidates that the invocation's totals leave drain as those ahead are removed, cease to be candidates or cease to count toward the totals.
  • Rows that deferred-target-cap leaves drain by change 1's own condition.

Review: the alignment review, council B (13 concerns: 12 valid, 1 noted, none dismissed) and rounds B2 to B9 are applied and recorded in proposal.md's round tables. Lane openRepoProject-3's last read, a confirm read of round B7, found no high or medium finding, and lane openRepoProject-4 agreed the overview exception block. Of Codex's 12 inline findings, all are applied. Its review of fe5b245 found no major issues. On 2026-10-21 a fresh read-only adversarial review found one HIGH, 3 MEDIUM and 5 LOW, all applied in round B9 (B-47 to B-52). The HIGH: a user's status.showStash=true with a stash put a # stash N line in the pinned status output, so disposal never ran; the child now pins -c status.showStash=false. Lane openRepoProject-4's cited ranges keep their bytes, and it was sent their new lines. Codex's review of e07cc42 (2026-10-21) found no major issues, and lane openRepoProject-4 verified the eight moved ranges byte for byte. The lane's final composition read of the three drafts (reader RF, 2026-10-21) found that PR #19 had moved, so this change's two blocks on its text had to be rewritten before ratification (B-54). Round B10 rewrote them on a664799, and applied lane openRepoProject-3's eight LOWs on round B9 (B-53) and a second re-base check (RF's M1). Lane openRepoProject-4 verified its moved ranges again. Codex's review of d4e960b raised one P2 finding. Rows that pass the gates before deferred-target-cap but fail a later gate (contains-submodule or hidden-local-state) still count as cache candidates, so they could hold the 16 enumerations on every run with no stall line. A read-only verification found it valid and wider. A cache-only row that any gate after deferred-target-cap excludes would hold an enumeration, the run's totals and a target place on every run. A plain row behind sixteen such rows would then be deferred for ever, where change 1 removes it. The defect dates from the first delta. The lead's ruling B-56 fixes it in the next round, B11. Such rows count as a persistent stall, which the stall line names with change 1's next steps, and they no longer count toward the run's totals. No Git child is added and the fit does not move. An optional pre-filter by one admin-directory listing per row would keep initialized-submodule and in-progress-operation rows out entirely, and it goes to Brett Heap as a question, recommended yes. Round B11 (f170079) applied B-56, and re-based both PR #19 blocks on PR #19's round (c), 2e819ad. Lane openRepoProject-2 checked both blocks before they were committed and agreed them, with one correction to this change's own drain sentence, which now carries change 1's full condition ("removed or excluded by a gate before the cap"). Codex's review of f170079 found no major issues. Round B12 (25f7333) re-based "Cleanup revalidates destructive actions" on PR #19's round (d), 9267303 (R-208: filesystem reads at revalidation). It worded the bounds block's fit clause in the specs' own terms, and gave the drain sentence each cap's own condition. Lane openRepoProject-2 agreed all three before the commit, with no correction (B-58, B-59). Codex's review of 25f7333 (03:16:21Z) found no major issues. Round B13 (bced895) re-based the same block on PR #19's round (e), f0bf538. In that round, an administrative directory that the operation-in-progress listing finds absent at revalidation is identity-changed. B13 also applied lane openRepoProject-3's confirm read of rounds B10 to B12, which found 0 HIGH, 1 MEDIUM and 4 LOW. The MEDIUM: the drain sentence had dropped the drain promise for a candidate that the invocation's totals leave, and each cap now has its own condition. Lane openRepoProject-2 agreed before the commit, with no correction (B-60 to B-62). Codex's review of bced895 (08:08:46Z) found no major issues. Round B14 (69cb7a1) applied lane openRepoProject-3's confirm read of round B13, which found three wording LOWs and nothing higher (B-64). Design D10 now states outright that a filesystem call which finds no file or directory at its path decides that the path is absent, and that a decided value keeps its step's own reason. There was no spec edit. Codex's review of 69cb7a1 raised two P1 findings and one P2. The removal command lacked PR #19's stat pins, the ordered gate list lacked operation-in-progress and worktree-only-commits, and the refused reasons lacked both. The lane's composition read found the cause: six of this change's blocks still carried change 1's older text, which PR #19 has changed. Round B15 (8d34525) re-based all six on PR #19's f0bf538, so all eight blocks now follow PR #19's text, and lane openRepoProject-2 checked each one byte for byte before the commit (B-69). project-clean now has 59 scenarios, the four new ones PR #19's. B15 also gave the cache enumeration child all four status pins, and made the cache-unwritable next step name the failing directory and the read-only remount (B-72, B-74). Codex's review of 8d34525 (14:11:09Z) found no major issues, and lane openRepoProject-3's confirm read of round B15 found nothing (0 HIGH, 0 MEDIUM, 0 LOW). Round B16 (57bfc15) re-based the blocks that PR #19's rounds (g), (g3) and (h) changed, the last carrying Brett Heap's rulings F-1, F-2 and O-1: five at b3228bb, and the classification block at 6bf9f77. Lane openRepoProject-2 checked every block byte for byte before the commit, and accepted the two adaptations: the cache-walk exception attaches to gate 7's budget clause, and the 283-child fit holds where no repository path holds a line feed (B-76 to B-85). Lane openRepoProject-3's confirm read of round B16 found 0 HIGH, 0 MEDIUM and 2 LOW. Round B17 (97bf4ee) applied them, correcting one count in the conservative variant to "11 or 13". It also re-based the retire and reconcilable-result blocks on PR #19's round (i), e0c91bb, which adds a third recovery text for a .git the rescan cannot read (R-284, since confirmed by Brett Heap, R-290). Lane openRepoProject-2 checked both blocks byte for byte before the commit (B-86, B-87). Lane openRepoProject-3's confirm read of round B17 found 0 HIGH, 0 MEDIUM and 1 LOW. Round B18 (9473b2c) applied it, named R-284 as confirmed (R-290), and re-based the retire, reconcilable-result and revalidation blocks on PR #19's round (j), e14ada0. Lane openRepoProject-2 checked the three blocks byte for byte before the commit (B-88 to B-92). Round B19 (dc39ec3) re-based the retire and revalidation blocks on PR #19's round (k), 173d83c, where the ceiling's recovery text for an unread .git applies "instead", "whatever the rescan finds of the registry entry", and the work-tree probe's two lines are read as one path. Lane openRepoProject-2 checked both blocks byte for byte before the commit (B-93, R-306). Lane openRepoProject-3's confirm read of rounds B18 and B19 found 0 HIGH, 0 MEDIUM and 1 LOW. Round B20 (383da59) applied it, and recorded PR #19's round (l), ccc52b9, which changes none of the eight blocks, and Brett Heap's confirmation of its texts T1 to T5 (B-95 to B-98). Round B21 (04be7f6) re-based the bounds block on PR #19's round (m), 20084cd, whose inspect-cap refusal now warns not to run git worktree prune while a worktree's path cannot be read, and recorded Brett Heap's confirmation of T1 to T8. Lane openRepoProject-2 checked the block byte for byte before the commit (B-99, R-325). Lane openRepoProject-3's confirm read of rounds B20 and B21 found 0 HIGH, 0 MEDIUM and 1 LOW, on the record only. Round B22 (dafe476) applied it, and re-based the retire, reconcilable-result and bounds blocks on PR #19's round (n), 2250830, in which every no-prune warning also names git worktree remove and git gc, as Brett Heap ruled ("R-324: yes"). Lane openRepoProject-2 checked the three blocks byte for byte before the commit (B-101 to B-106). Lane openRepoProject-3's confirm read of round B22 found 0 HIGH, 0 MEDIUM and 1 LOW, on the record only. Round B23 (288fc34) applied it, and named PR #19's round (o), 88d0d36, whose spec text is round (n)'s, as its current head, with every block's base unchanged (B-107 to B-109). Lane openRepoProject-3's confirm read of round B23 (W110) found 0 HIGH, 0 MEDIUM and 2 LOW, both in the round tables and so on the record only (B-111). The lane's review wave of 2026-10-23 then read this change at 288fc34 (B-112, B-113). Reader RB's adversarial read, which RB2 finished on Git 2.43.0 and on the 2.36.6 floor, found 0 HIGH, 2 MEDIUM and 5 LOW. Reader RE's read of feature 004 at f3724fc, which RE2 finished, gave this change four items (RE23-1, RE23-4, RE23-5 and RE2-2), and lane openRepoProject-3's W120 read of the next steps that Git refuses gave it one LOW (L-3). Round B24 (d95eea2, in three commits: the spec bab9e24, the design 309113b, then the proposal and tasks) applied them in one stage with no re-base, changing only the two ADDED requirements, so the scenario counts stay 59, 32 and 8 (B-110 to B-117). Of the round's 21 items, 10 are applied, 2 are applied with change, 3 waited for round B25 or later and 6 need no action; none is declined. The three that waited are RB2's LOW-5, whose sites lie in carried blocks that this round may not change (B-119); the re-base of the retire block on PR #19's round (p) (B-114), though the round did check, with no edit, that this change states that change 2 archives first; and RE23-1, the rule for a status probe that warns, which follows lane openRepoProject-2's Q8 and so round (q) (B-116). Round B25 (37c0c23, in three commits pushed without force: the spec deltas 7f74be2, the design 18854da, then the proposal and tasks) took all three, with W128's three LOWs, on PR #19's rounds (q) and (r) (B-114 to B-132), so the scenario counts became 61, 35 and 8. Its table, Re-read and Codex Findings (round B25), holds 28 counted rows (14 applied, 14 recorded), plus a row for lane openRepoProject-2's R-400. The Status, the keys and tasks 1.1, 1.4, 1.5 and 2.1 ran to B-130, and named each block's base. Round B26 (7f3453c, in three commits pushed without force: the spec deltas d3de27d, the design db8380a, then the proposal and tasks) took PR #19's round (s), lane openRepoProject-3's W146 read of it and B-132's three record answers (B-135 to B-142), so the scenario counts are now 62, 35 and 8. Round B26 is accepted (B-143). Its table, Re-read and Codex Findings (round B26), holds 21 counted rows (9 applied, 12 recorded), plus a row for lane openRepoProject-2's R-421. The Status, the keys and tasks 1.1, 1.4, 1.5 and 2.1 run to B-142, and name each block's base. Codex is at its usage limit, so rounds B25 and B26 request no review.

Checks at 7f3453c: scenarios (grep -c '^#### Scenario'): project-clean 62, project-clean-review-safety 35 (with PR #19's own scenarios, carried), project-overview 8, unchanged (blob a40458cb). /usr/bin/openspec validate add-project-clean-cache-disposal --strict reports the change valid, and validate --all --strict passes 8 of 8, on a fresh archive; both print the expected INFO lines that the archive would refuse the three deltas until changes 1 and 2 are archived. Every MODIFIED block carries its source scenarios at its named base: the carry check passes, with 76 carried scenarios byte-exact, 4 edited and 7 added in the MODIFIED blocks. The committed spec deltas equal stage 1's held state byte for byte. The 444 lines the round adds carry no non-ASCII, bidi or host-path text, and git diff --check is clean. Lane openRepoProject-4's 8 pinned ranges keep their bytes at their new lines, each compared by cmp in the round's line map. CI and SonarCloud pass at 7f3453c: the lead read them once by GraphQL (2026-10-23, 22:52:24Z), and test (3.10), test (3.12), test (ubuntu-latest, 3.10), test (ubuntu-latest, 3.12), test (macos-latest, 3.10), test (macos-latest, 3.12) and SonarCloud Code Analysis were all SUCCESS, completed by 22:50:45Z. Lane openRepoProject-2 checked round B26's held set before the commit (R-421), and at 7f3453c the four re-based blocks equal it byte for byte, and the other four are unchanged since 37c0c23 (R-423). Lane openRepoProject-3's W128 read round B24, 288fc34..d95eea2, and found 0 HIGH, 0 MEDIUM and 3 LOW, with 0 DEPARTS (its file is confirm-b24-d95eea2-findings.md). The three LOWs were record and wording items that rode with round B25 (B-121), after PR #19's round (q), and the round applied the first two and recorded the third: LOW-1, text that says round (p) waits for Q1 to Q9, which is overtaken; LOW-2, ENOTDIR from rmdir called "absent"; and LOW-3, two "Section edited" cells missing. Lane openRepoProject-3's one-pass confirm read of d95eea2..7f3453c, rounds B25 and B26, is asked for and not yet done (B-133); round B25's acceptance stands meanwhile (B-132, R-410). Its W152 read of PR #19's round (t) found nothing for this change.

Open questions for Brett Heap (six, each with its recommendation in proposal.md):

• Enum closure and schema_version. Recommended: schema_version stays 1, since no existing enum gains a value; if he reads a widened merged-removable as a change of meaning, clean --json moves to version 2.
• .pytest_cache as a third listed form (B-23). Recommendation now: no, not in this change (B-50, 2026-10-21). Admitting it as first proposed would delete files under .pytest_cache/v/ by place rather than by name. It would remove .pytest_cache/.gitignore first, so a partial stage leaves an untracked directory and the next run reads dirty. It would never accept repositories that ignore .pytest_cache/ themselves, this one among them. And it would force three carried scenarios to be reworded. A later change would need a name-based rule, an order that keeps .gitignore last, and acceptance of a repository's own ignore rule.
• Other cache kinds (.mypy_cache, .ruff_cache, node_modules, virtual environments). Recommended: no; each needs its own allowlist, caps and change.
• The caps (B-3/CD-6). 512 recorded objects and 256 MiB per worktree, 4,096 objects and 1 GiB per run, 16 enumerations. Recommended: adopt, and measure before the Speckit handoff (tasks.md 2.3). On PR OpenSpec: amend add-project-clean-all-safe so the push child reaches its remote #19's terms at 54e869b, as at 4512441 and f0bf538, at the packet's 150 ms per child, 14 of 16 all-safe targets start before the spawn limit where the plan reads extensions.worktreeConfig as false. The last two wait for the next run, with exit 1. On PR OpenSpec: amend add-project-clean-all-safe so the push child reaches its remote #19's measured basis, where the plan read the setting as false, all 16 fit, at about 36.3 s through one worker and about 43.3 s at a thread per call. Where the setting is true, PR OpenSpec: amend add-project-clean-all-safe so the push child reaches its remote #19 has resolved LQ-20 by measurement. On its measured costs all 16 fit (about 37.6 s through one worker, 44.6 s at a thread per call), or 15 of 16 at a thread per call if the cache enumeration child costs a full enumeration. Task 2.3 measures it (B-65, B-79).
• A limit on directory opens (B-33). Recommended: a new limits.cache_opens of 512 opens per pass per worktree, since one deep tree can cost about 44,000 opens, about 20 s; the alternative is opening each directory once per pass, which checks ancestor identities less often. The deltas add no such cap until he answers.
• The admin-directory pre-filter (B-56). One listing of a would-be candidate's worktree administrative directory, at most 127 filesystem calls and no Git child, would keep rows holding an initialized submodule or an operation in progress out of the candidate set, so they take no enumeration and no target place. An error or timeout of that listing would filter nothing, so the pre-filter never makes a plan incomplete (B-61). Recommended: yes, in this change. The deltas add it only on his answer.

Order: this change archives after change 1 (add-project-clean-all-safe) and PR #19's amendment of it, and after change 2 (add-project-overview), whose overview block is first re-read against main's text (tasks.md 3.2); it archives before add-project-clean-branch-retirement (#23, PR #26).

The sections below are this description as first written on 2026-10-11, kept as history; where they differ from the change's proposal.md at 7f3453c, the proposal governs.

What this proposes

A new OpenSpec change, add-project-clean-cache-disposal: a bounded cache stage, after revalidation and before the removal spawn of each selected worktree, inside the same deadline, that disposes of Python bytecode caches only (non-symlink __pycache__ directories holding only non-symlink regular .pyc/.pyo files or nested caches of the same shape, and loose non-symlink regular .pyc/.pyo files) under the packet's contract (project-maintenance-batch-cleanup.md:1324-1337 at da33d92): descriptor-relative, no-follow deletion with the opened directory's identity checked against the planned device and inode; a whole-list preflight before the first unlink; each path reported; a partial phase recorded with retry guidance; stop before any worktree mutation when the preflight fails; hard caps on entries and bytes in limits and in the plan estimate. A worktree whose only ignored files are listed caches becomes removable; the ignored-local-files rung applies to blocking ignored paths; the fifteen class names, the stage enum and the refusal codes are unchanged, the new values living in a per-target cache_disposal sub-record. Harvest source 1789ad9 and bb91a49 are reference only; nothing is cherry-picked.

Capabilities

• project-clean: MODIFIED "Clean classifies preservation and cleanup actions" (4 kept, 1 added), "Clean can explicitly retire verified worktrees" (14 kept, one clause inserted), "Clean bounds its Git work and reports omitted work" (written on draft PR OpenSpec: amend add-project-clean-all-safe so the push child reaches its remote #19's text; 5 kept, 1 added); ADDED "Clean disposes of listed caches before a worktree removal" (9 scenarios).
• project-clean-review-safety: MODIFIED "Cleanup preserves all local work not proven disposable" (5 kept, 1 added), "Cleanup revalidates destructive actions" (on PR OpenSpec: amend add-project-clean-all-safe so the push child reaches its remote #19's text; 10 kept, 1 added, because its combined-probe sentence would refuse every cache target); ADDED "Cache disposal never follows a symlink or leaves its worktree" (6 scenarios).

Dependencies and sequencing

Archives only after add-project-clean-all-safe (#9) archives and after draft PR #19 where it bears; before add-project-clean-branch-retirement (#23), which then carries this change's archived blocks of the retire and bounds requirements. It alters nothing in feature 004's or 005's order. Realization is one Speckit feature created by /speckit.specify after ratification.

Open questions before Brett Heap (each with a recommendation in proposal.md)

1. Enum closure: schema_version stays 1; no existing enum gains a value.
2. Other cache kinds: recommended no.
3. Caps: 512 entries and 256 MiB per worktree, 4,096 entries and 1 GiB per run, and a limits.cache_rows of 16 enumerations per plan so the 128-row, 16-target fit holds; to be measured before the Speckit handoff.
4. Change 2's clause that the overview's classification equals clean's: the overview collects no cache evidence, so a cache-only row reads ignored-local-files there and merged-removable in clean; recommended that add-project-overview gains one exception sentence, which is lane openRepoProject-4's to write.

Departures from the lead rulings, stated in the proposal

The run stops at a failed cache target (change 1's stop rule and the packet's stop-on-first-failure) instead of continuing; cache-changed and cache-partial live in the sub-record under a target-level refused/state-changed; an unsupported platform is a per-row reason, not a whole-apply refusal; the revalidation requirement is modified (above); the enumeration command carries --untracked-files=normal and the status pins; a fifth limit, cache_rows, is added.

Checks

/usr/bin/openspec validate add-project-clean-cache-disposal --strict and validate --all --strict pass (8 items); status --change shows every artifact done. The INFO line about a MODIFIED base "not found" is the expected state while change 1 is unarchived. Alignment review and council follow on this PR; their results are recorded in proposal.md and here.

🤖 Generated with Claude Code

Summary by Sourcery

Add an OpenSpec proposal for bounded, fail-closed Python bytecode cache disposal before verified worktree removal.

New Features:

• Define an OpenSpec change for safely disposing of Python bytecode caches before removing eligible worktrees.

Enhancements:

• Specify bounded cache discovery, symlink-safe disposal, revalidation, partial-failure handling, reporting, and fail-closed platform behavior while preserving existing cleanup classifications and enums.

Tests:

• Define comprehensive scenarios covering cache classification, limits, revalidation, symlink safety, partial disposal, platform support, and deadline behavior.

Chores:

• Add the proposal, design, task record, and capability specification deltas for the cache-disposal change.

[sourcery-ai]

Reviewer's Guide

This draft OpenSpec change proposes a bounded, fail-closed cache-disposal stage that safely removes only verified Python bytecode caches immediately before selected worktree removal, with explicit evidence, limits, revalidation, reporting, recovery, and governance controls; it contains specification and design artifacts only, not runtime implementation.

Sequence diagram for bounded cache disposal before worktree removal

sequenceDiagram
    participant User
    participant Clean as project clean
    participant Plan
    participant Git
    participant CacheStage as Cache disposal
    participant Worktree

    User->>Clean: project clean --apply --action remove
    Clean->>Plan: Build bounded cache plan
    Plan->>Git: status --porcelain=v2 -z --untracked-files=normal --ignored=matching
    Git-->>Plan: Ignored cache candidates and blocking paths
    Clean->>Clean: require_unchanged_cleanup_state()
    Clean->>Git: Revalidate selected cache target
    Git-->>Clean: Planned ignored records unchanged
    Clean->>CacheStage: Whole-list preflight
    CacheStage->>Worktree: Open directories with O_NOFOLLOW and verify identities
    CacheStage->>Worktree: Unlink listed files and rmdir emptied caches
    alt Preflight or removal failure
        CacheStage-->>Clean: refused or partial, cache-changed or cache-partial
        Clean-->>User: Report paths and stop before worktree removal
    else All listed caches disposed
        CacheStage-->>Clean: disposed
        Clean->>Worktree: git worktree remove
        Worktree-->>Clean: Removal result
        Clean-->>User: Report cache disposal and worktree removal
    end

Loading

Flow diagram for cache candidate classification and bounded disposal

flowchart TD
    A[Selected worktree has ignored records] --> B{Candidate passes cleanup gates?}
    B -- No --> C[Keep ignored-local-files]
    B -- Yes --> D[Bounded Git cache enumeration]
    D --> E{Only allowed .pyc .pyo and __pycache__ paths?}
    E -- No --> C
    E -- Cap, timeout, or unsupported platform --> C
    E -- Yes --> F[Record cache_disposal and directory identities]
    F --> G[Revalidate planned ignored records]
    G -- Changed or failed --> H[Refuse target; stop batch]
    G -- Unchanged --> I[Whole-list descriptor-relative preflight]
    I -- Failed --> H
    I -- Passed --> J[Remove listed files and emptied directories]
    J -- Partial failure --> K[Rescan paths; report cache-partial; stop batch]
    J -- Complete --> L[Spawn git worktree remove]

Loading

File-Level Changes

Change	Details	Files
Adds a draft OpenSpec proposal and detailed design for bounded Python bytecode-cache disposal before worktree removal.	Defines the allowlist for regular .pyc/.pyo files and shaped __pycache__ trees, with all other ignored paths blocking removal. Introduces per-worktree and per-run cache enumeration, entry/byte limits, plan estimates, cache evidence, directory identities, and digest coverage. Specifies descriptor-relative, no-follow filesystem operations with device/inode validation, whole-list preflight, partial completion reporting, and fail-closed platform behavior. Places the cache stage after targeted revalidation and before Git worktree removal, preserving existing classes, refusal codes, stages, and schema version through a cache_disposal sub-record. Documents revalidation semantics, deadline and signal handling, stop-on-failure behavior, retry guidance, human output, JSON shape, and the proposed test matrix.	openspec/changes/add-project-clean-cache-disposal/.openspec.yaml openspec/changes/add-project-clean-cache-disposal/design.md openspec/changes/add-project-clean-cache-disposal/proposal.md
Extends the cleanup safety contract with cache-specific preservation, revalidation, and symlink-containment requirements.	Allows cache-only ignored content to become removable while preserving rows containing unproven or blocking ignored paths. Defines cache-target revalidation against the planned ignored-path set before any cache mutation. Requires descriptor-relative no-follow deletion, identity checks, whole-list preflight, partial-phase recovery, and per-platform fail-closed behavior. Adds scenarios covering cache-only cleanup, blocking files, cap handling, digest changes, partial disposal, symlink swaps, platform support, signals, and deadline boundaries.	openspec/changes/add-project-clean-cache-disposal/specs/project-clean/spec.md openspec/changes/add-project-clean-cache-disposal/specs/project-clean-review-safety/spec.md
Adds governance, sequencing, validation, measurement, and realization handoff requirements for the proposed change.	Records pending alignment, council, ratification, archive-order, and overview-classification decisions. Requires implementation to wait for the prior clean-all-safe feature and hand off as one future Speckit feature. Documents strict OpenSpec validation results and planned cross-platform tests, measurements, README updates, and rollback.	openspec/changes/add-project-clean-cache-disposal/tasks.md

Possibly linked issues

• OpenSpec: add-project-clean-cache-disposal (a merged worktree holding only Python bytecode caches is excluded from the batch as ignored-local-files) #24: The PR directly proposes the exact cache-disposal change described by issue OpenSpec: add-project-clean-cache-disposal (a merged worktree holding only Python bytecode caches is excluded from the batch as ignored-local-files) #24, including bounded enumeration and safe deletion.

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[brettheap]

@codex review

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[brettheap]

Lane: openRepoProject-5

Alignment review resolved (draft at 7290100, fix round at 3c08613)

The stack-architect and qa-lead passes on 7290100 (2026-10-11) found 19 issues: 7 MISMATCH, 7 DRIFT and 5 GAP, plus five questions for the lane. All 19 are applied in 070ff02..3c08613: 11 as proposed and 8 with a change, each with its reason in proposal.md's table "Questions Resolved by the Alignment Review". The lane's rulings of 2026-10-18 answered the five questions: B-10 to B-15 and L-10 to L-15.

• Where the cache stage contradicts change 1's text, the change now modifies the requirement instead of overriding it from an added one. Three requirements gain MODIFIED blocks: the batch digest, the narrow guarantee's revalidation, and the reconcilable result's "never ... delete a directory itself" (the review's worst finding, SA-1).
• A candidate whose sampled ignored paths include one the allowlist does not admit stays ignored-local-files without spending an enumeration; what can still stall is stated, not claimed to drain.
• cache_disposal is absent where the extension does not act, never null for "not applicable".
• /usr/bin/openspec validate add-project-clean-cache-disposal --strict and validate --all --strict pass (8 items), and every carried scenario is byte-exact apart from the two edits the proposal names.
• One file is held, not committed: the overview exception that lane openRepoProject-4 asked this change to carry (specs/project-overview/spec.md, a MODIFIED "Overview reuses the cleanup classifier and merge target" with lane 4's two sentences and one scenario). It is committed once lane 4 agrees its diff, and the change then also archives after add-project-overview.
• CI wording now names the Linux-only matrix that PR ci: run the test suite on Linux only #32 put in place.

The council review is next. Nothing here is ratified; the change waits for Brett Heap's word.

[brettheap]

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-22T14:11:11.237008Z	8d34525	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3c08613ecb

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Wait for timed-out deletion calls to finish

When an unlink or rmdir blocks past this timeout, abandoning its daemon worker does not cancel the underlying Python thread or filesystem call. The call can therefore complete after the stage has begun its rescan or reported refused/partial, causing an unreported deletion and incorrect entries_removed/path reconciliation. Mutating calls must reach a known terminal state before the stage records its outcome.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Recheck signals at the first deletion boundary

If SIGINT arrives after the post-preflight slot check but before the first unlink, this rule deliberately does not read the signal slot again until the spawn check, so the stage deletes every cache even though the signal preceded its first removal. That contradicts the specified scenario that SIGINT before the first removal leaves every cache in place; the removal path needs to observe or mask signals at that boundary.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Report the actual cache-enumeration stall cause

When the first 16 candidates repeatedly hit the entry/byte cap or fail enumeration, later candidates also cannot drain, but this fixed message claims those rows contain non-cache ignored files. That gives users the wrong diagnosis and remediation for valid cache-only rows; the stall text should derive its explanation from the blocking rows' actual cache_disposal.reason values.

Useful? React with 👍 / 👎.

[brettheap]

Council review: results (lane openRepoProject-5)

The council (Phase 4) reviewed this draft at 9ebe9f0. The writer round applied the lead's verdicts, and the branch is now at 90d18ee. This remains a draft for Brett Heap's word only.

Council. Three read-only members raised 13 concerns, 3 of them HIGH:

• product-advocate: P-1 to P-4;
• systems-architect: S-1 to S-4;
• adversary-engineer: AE-1 to AE-5.

They also weighed Codex's three inline findings on 3c08613, lane openRepoProject-3's packet-fidelity read (review-27), and lane openRepoProject-4's optional precision. Lead verdicts: 12 VALID, 1 NOTED (S-4), 0 DISMISSED. The rulings are in the lane's verdicts-council-B-9ebe9f0.md.

What changed

• Deleting calls are waited for, never abandoned (B-16; S-1, AE-1, Codex P1). Handing off the first removal is now the stage's commit point.
  • A handed-off unlink or rmdir is waited for, as change 1 waits for its removal child. Only change 1's 300 s removal ceiling ends that wait.
  • Descriptors given to an outstanding call stay open until the process exits.
  • The record never says "nothing was deleted" after a hand-off.
• Signals and not-attempted (B-17; AE-3, lane 3 M2, Codex P2).
  • The signal check runs immediately before the first hand-off.
  • A target whose stage removed entries keeps its reconciliation, inside B's MODIFIED block of change 1's reconcilable-result requirement.
• The rescan walks the identity-checked descriptor chain under the reconciliation reserve (B-18; S-2). It no longer uses a root-relative lstat.
• The residual window is stated (B-19; S-3, AE-4, lane 3 M1). Ignored files created during a cache stage are not protected; a 512-entry stage takes about 0.25 s here. The extra status probe was considered and rejected, with its cost recorded.
• A cache the user cannot change is a plan-time keep, cache-unwritable (B-20; AE-2). It is no longer a stop that repeats on every run.
• Stall and stop lines name their actual cause (B-21; Codex P2 at :455, AE-5, P-3).
• The real blocker is named (B-24; P-2). A cache-only row that is not a candidate now says what actually keeps it, in candidate_block.
• The benefit is corrected (B-23; P-1). Of the 20 motivating rows, 13 become removable; 7 also hold .pytest_cache, which the allowlist does not admit.

Held, not yet committed. specs/project-overview/spec.md (B-22). The overview exception is reworded to cover cache-proven rows that project clean excludes as contains-submodule, with lane 4's precision in the carried "Every protected classifier". Lane openRepoProject-4 owns change 2 and agreed the earlier text, so this waits for its agreement on the new diff. Tasks 2.2 is reopened until then.

Open Questions for Brett Heap

• New: .pytest_cache. Admit it in this change as a third listed form, a fixed four-record shape with pytest's CACHEDIR.TAG signature, which unblocks a further 16 of 37 measured rows (recommended). The alternative is a follow-on change, first in line.
• Still open: question 2, enum closure and the caps.

Checks at 90d18ee

• openspec validate --strict passes, and validate --all --strict reports 8 passed, with and without the held file.
• Every MODIFIED block carries its source scenarios in order; the four declared edits are the only differences.
• Archive order: change 1 and PR OpenSpec: amend add-project-clean-all-safe so the push child reaches its remote #19's amendment, then this change, then OpenSpec: add-project-clean-branch-retirement (opt-in paired retirement of a removed worktree's local branch) #26.

[brettheap]

@codex review

[brettheap]

Round B22 (lane openRepoProject-5): 04be7f6..dafe476, in three commits: the spec (bed4eeb), the design (96ce753), then the proposal and tasks (dafe476).

• The scenario counts stay 59, 32 and 8.

The round follows PR #19's round (n) and Brett Heap's yes to R-324. It also applies the one LOW of lane openRepoProject-3's confirm read of rounds B20 and B21. These are rulings B-101 to B-106.

• Re-based on PR OpenSpec: amend add-project-clean-all-safe so the push child reaches its remote #19's round (n), 2250830: the retire, reconcilable-result and bounds blocks.
  • Every no-prune warning in these blocks now ends "so do not run git worktree prune, git worktree remove or git gc until it can". That covers the retire requirement's recovery text and its scenario "A removal past the hard ceiling", the reconcilable-result requirement's text, and the inspect-cap refusal's remedy in "Row cap and planning failures".
  • The change equals PR OpenSpec: amend add-project-clean-all-safe so the push child reaches its remote #19's own in those blocks, with no adaptation. This change's additions to them are unchanged.
  • The other five blocks are byte-identical at 2250830.
• Every place that names PR OpenSpec: amend add-project-clean-all-safe so the push child reaches its remote #19's head now names 2250830. Its D14 and task 2.1 are byte-identical, so the measured figures stand.
• This change's own restatements of the no-prune warnings now give round (n)'s words. The round records keep the words of their time.
• A new row corrects round B21's record of which range of PR OpenSpec: amend add-project-clean-all-safe so the push child reaches its remote #19's design changed. No quote is affected.

Lane openRepoProject-2 checked the three re-based blocks byte for byte against PR #19 before the commit. Codex is at its usage limit, so this round requests no review. CI and SonarCloud pass at 04be7f6.

Checks:

• openspec validate --strict reports the change valid, and --all --strict passes 8 of 8.
• Every MODIFIED block carries its source scenarios at its named base.
• Every part of this change that lane openRepoProject-4 pins keeps its bytes.

This stays a draft for Brett Heap's word. Nothing here ratifies or merges it.

[brettheap]

Round B23 (lane openRepoProject-5): dafe476..288fc34, in two commits: the design (715885c), then the proposal and tasks (288fc34).

• No spec file changes, and the scenario counts stay 59, 32 and 8.

The round applies lane openRepoProject-3's confirm read of round B22: no HIGH or MEDIUM findings, one LOW, and nothing departing. It also follows PR #19's round (o). These are rulings B-107 to B-109.

• PR OpenSpec: amend add-project-clean-all-safe so the push child reaches its remote #19's current head is now named as 88d0d36, its round (o), whose spec text is round (n)'s.
  • Each of the eight blocks keeps its named base, and each base's text equals PR OpenSpec: amend add-project-clean-all-safe so the push child reaches its remote #19's text at 88d0d36. Nothing is re-based.
  • Its D14 and task 2.1 are byte-identical, so the measured figures stand.
• Round B22's record gains two corrections: its re-base row also edited D3, and lane openRepoProject-2's check of the re-base is its R-348.

Codex is at its usage limit, so this round requests no review. CI and SonarCloud pass at dafe476.

Checks:

• openspec validate --strict reports the change valid, and --all --strict passes 8 of 8.
• Every MODIFIED block carries its source scenarios at its named base.
• Every part of this change that lane openRepoProject-4 pins keeps its bytes.

This stays a draft for Brett Heap's word. Nothing here ratifies or merges it.

[brettheap]

Round B24 (lane openRepoProject-5): 288fc34..d95eea2, in three commits: the spec (bab9e24), the design (309113b), then the proposal and tasks (d95eea2).

• The scenario counts stay 59, 32 and 8. Both spec changes are in this change's own ADDED requirements, and no block carried from PR OpenSpec: amend add-project-clean-all-safe so the push child reaches its remote #19 changes.

The round applies the findings on this change from the lane's review wave of 2026-10-23 (readers RB and RB2) and from lane openRepoProject-3's W120. These are rulings B-111 to B-117.

• After a git-failed removal, the result line no longer says that the worktree was not removed. Git may already have deleted part of it and its registration, as reproduced on Git 2.43.0 and on the 2.36.6 floor. The line now says so, and points to inspecting the path by hand. git-refused and spawn-error keep the old line.
• When the removal floor stops a read after the stage's first removal, the stage now ends as the floor does (exit 1), and is not reported as a change of state. The design's table gains the row.
• Smaller fixes:
  • the plan-time walk checks the worktree root's identity;
  • removed is true only when the stage's own removal removed the path;
  • the narrow guarantee's window is stated in the ADDED requirement;
  • the stall line names remounting a read-only filesystem;
  • the README edit points follow feature 004's README.
• Deferred to the next round:
  • the re-base of the retire and reconcilable-result blocks on PR OpenSpec: amend add-project-clean-all-safe so the push child reaches its remote #19's round (p), e0b1671;
  • the rule for a status probe that warns, which waits for Brett Heap's answer to lane openRepoProject-2's Q8.

Codex is at its usage limit, so this round requests no review. CI and SonarCloud pass at 288fc34.

Checks:

• openspec validate --strict reports the change valid, and --all --strict passes 8 of 8.
• Every MODIFIED block carries its source scenarios at its named base.
• Every part of this change that lane openRepoProject-4 pins keeps its bytes.

This stays a draft for Brett Heap's word. Nothing here ratifies or merges it.

[brettheap]

Round B25 (lane openRepoProject-5): d95eea2..37c0c23, in three commits:

• the spec deltas (7f74be2);
• the design (18854da);
• then the proposal and tasks (37c0c23).

The scenario counts are 61, 35 and 8.

The round re-bases this change on PR #19's round (r), 4512441, which lane openRepoProject-2 accepted (R-396), and on its round (q), 818311a (R-389). These are rulings B-114 to B-132.

• The re-base. Of the eight PR OpenSpec: amend add-project-clean-all-safe so the push child reaches its remote #19 blocks this change carries, rounds (p) and (q) changed seven, and round (r) three of those.
  • Classification, retire and revalidation are carried at 4512441.
  • Batch, bounds, the reconcilable result and preservation are carried at 818311a.
  • The narrow guarantee stays at f0bf538.
  • Each changed block was rebuilt two ways, by hunk re-application and by git merge-file, with identical outputs. PR OpenSpec: amend add-project-clean-all-safe so the push child reaches its remote #19's text is carried byte for byte, and this change's additions word for word.
  • Lane openRepoProject-2 checked the held blocks byte for byte before the commit (R-400).
• Q3 (a)'s by-hand form ("inspect, then delete <path> and its administrative directory <common_dir>/worktrees/<admin_id> by hand") replaces round (p)'s form in this change's own restatements.
• The warned status probe follows PR OpenSpec: amend add-project-clean-all-safe so the push child reaches its remote #19's Q8 rule, in the delta and the design (RE23-1).
• Q1's fifth status pin is added at every site, and D11 quotes contains-submodule in the head's words (B-123, B-124). D4 notes the lstat calls that round (r) adds, unmeasured.
• RB2's LOW-5 (B-119) and lane openRepoProject-3's W128 LOW-1 to LOW-3 (B-121) are applied or recorded.
• The record: the table Re-read and Codex Findings (round B25) holds 28 counted rows (14 applied, 14 recorded), plus a row for lane openRepoProject-2's R-400. The Status, the keys and tasks 1.1, 1.4, 1.5 and 2.1 run to B-130, and name each block's base.
• Round (s). PR OpenSpec: amend add-project-clean-all-safe so the push child reaches its remote #19's round (s) has started (R-408). It changes the classification, batch and revalidation blocks again, and not the registration-mismatch sentence (lines 10 to 14 of PR OpenSpec: amend add-project-clean-all-safe so the push child reaches its remote #19's review-safety delta). Round B26 re-bases those blocks on its accepted text (B-131).

Codex is at its usage limit, so this round requests no review. CI and SonarCloud pass at 37c0c23: the six test jobs and SonarCloud Code Analysis, read at 19:37:41Z.

Checks:

• openspec validate --strict reports the change valid, and --all --strict passes 8 of 8, on a fresh archive.
• The committed spec deltas equal stage 1's held state byte for byte, rebuilt independently from d95eea2 and the stage-1 diff.
• The carry check passes: 75 carried scenarios byte-exact, 4 edited and 7 added in the MODIFIED blocks.
• The spec blobs are project-clean 5783f2b4, project-clean-review-safety 630f4919 and project-overview a40458cb, which is unchanged.
• The 959 added lines carry no non-ASCII, bidi or host-path text, and git diff --check is clean.
• Lane openRepoProject-4's eight pinned ranges keep their bytes at their new lines.

This stays a draft for Brett Heap's word. Nothing here ratifies or merges it.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[brettheap]

Round B26 (lane openRepoProject-5): 37c0c23..7f3453c, in three commits:

• the spec deltas (d3de27d);
• the design (db8380a);
• then the proposal and tasks (7f3453c).

The scenario counts are 62, 35 and 8.

The round re-bases this change on PR #19's round (s), dab8a64, which lane openRepoProject-2 accepted (R-412). It names PR #19's round (t), 54e869b (R-415), as PR #19's current head. These are rulings B-135 to B-142.

• The re-base. Of the eight PR OpenSpec: amend add-project-clean-all-safe so the push child reaches its remote #19 blocks this change carries, round (s) changed four, and round (t) none.
  • Classification, batch, preservation and revalidation are carried at dab8a64. Classification gains PR OpenSpec: amend add-project-clean-all-safe so the push child reaches its remote #19's scenario "The main worktree's recommendation", placed before this change's own.
  • Retire stays at 4512441, bounds and the reconcilable result at 818311a, and the narrow guarantee at f0bf538. All four are byte-identical at 54e869b.
  • Each changed block was rebuilt two ways, by hunk re-application and by git merge-file, with identical outputs. PR OpenSpec: amend add-project-clean-all-safe so the push child reaches its remote #19's text is carried byte for byte, and this change's additions word for word.
  • Lane openRepoProject-2 checked the held blocks byte for byte before the commit (R-421).
• Preservation. Round (s) rewords PR OpenSpec: amend add-project-clean-all-safe so the push child reaches its remote #19's Q2 (2) contains-submodule clause. The registration-mismatch sentence beside it is unchanged. Task 2.1 and the design's B-127 row now say that round B25's "preservation untouched" covered only that sentence (lane openRepoProject-3's W146).
• The budget. D4 gives PR OpenSpec: amend add-project-clean-all-safe so the push child reaches its remote #19's warm-cache figure for the gate's lstats, about 0.25 s at 50,000 tracked directories, in PR OpenSpec: amend add-project-clean-all-safe so the push child reaches its remote #19's words and uncounted (B-137).
• M1 and M3 are named as ruled, each as its (a) (R-413).
• The record:
  • The table Re-read and Codex Findings (round B26) holds 21 counted rows (9 applied, 12 recorded), plus a row for lane openRepoProject-2's R-421.
  • The Status, the keys and tasks 1.1, 1.4, 1.5 and 2.1 run to B-142, and name each block's base.
  • The design's B-127 row is corrected in place with a note, and the round B22 Context sentence's pointer to T8 is fixed (B-132).
• Round (u). PR OpenSpec: amend add-project-clean-all-safe so the push child reaches its remote #19 may still take a round (u), which would re-base the batch block once more (W146's LOW). It gets its own small round.

Codex is at its usage limit, so this round requests no review. CI and SonarCloud pass at 7f3453c: the six test jobs and SonarCloud Code Analysis, read at 22:52:24Z.

Checks:

• openspec validate --strict reports the change valid, and --all --strict passes 8 of 8, on a fresh archive.
• The committed spec deltas equal stage 1's held state byte for byte.
• The carry check passes: 76 carried scenarios byte-exact, 4 edited and 7 added in the MODIFIED blocks.
• The spec blobs are project-clean 47ba938d, project-clean-review-safety b653d896 and project-overview a40458cb, which is unchanged.
• The 444 added lines carry no non-ASCII, bidi or host-path text, and git diff --check is clean.
• Lane openRepoProject-4's eight pinned ranges keep their bytes at their new lines.

This stays a draft for Brett Heap's word. Nothing here ratifies or merges it.