Agents read a rendered markdown report grouped by the decisions it needs
instead of querying the JSON, reply with its summary, and work through the
remaining decisions in batches. The report moves to schema 5.

Removal gates were simplified through an adversarial debate: the ignored
scan keeps only its entry and 2 GiB byte caps, a failed removal no longer
re-locks an expired lock, and removal reuses the audit-time merge proof.
The mount guard and the sparse-checkout outcome stay.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

@@ -88,3 +76,1 @@
-    # signal handler, so a kill here writes nothing to the PR — the durable
-    # fix is an internal deadline in the wrapper, not a larger number here.
-    # Re-derive when the pin moves.
+    # Limit runner occupancy even if retries or reconciliation are unfinished.

@@ -78,3 +47,1 @@
-jq '.repositories[] | select(.fatalError != null or .fetch.ok != true or .defaultBranchResolution.remoteHeadOk != true or .forge == null or .defaultBranch == null or .worktreesError != null or .gitPrune.ok != true or .staleRegistrations.ok != true) | {checkout, fatalError, forgeError, defaultBranchError, defaultBranchResolution, fetch, worktreesError, gitPrune, staleRegistrations}' "$report"
-jq '.repositories[].worktrees[] | select(.removal.outcome != "removed") | select(.statusError != null or .outsideRoot or .defaultComparison == null or .defaultComparison.fresh != true) | {path, outsideRoot, statusError, defaultComparison}' "$report"
-```
+When the report does not answer a question, read the item's JSON record, where `<name>` is the path as `report.md` shows it, relative to the root: `jq --arg p <name> '.repositories[].worktrees[] | select(.path | endswith("/" + $p))' "$report/report.json"`. A failure row means coverage is incomplete for that checkout; never report it as clean.

@@ -786,0 +724,7 @@
+test("a replace ref forces a fresh containment proof at removal", (context) => {
+  const fixture = createContainedLinkedWorktree(context);
+  recordAuditContainment(fixture);
+  addReplaceRef(fixture.repositoryPath);
+
+  const result = runMaybeRemove(fixture);
+  assert.equal(result.removal.containment.reused, false);

@@ -0,0 +372,4 @@
+  return `${sections.join("\n\n")}\n`;
+}
+
+// import.meta.main needs Node 24.2+.

@@ -20,20 +20,6 @@ jobs:
         with:

@@ -92,1 +42,3 @@
-| `judgment/precious-ignored-files` | Leave `preciousPaths` in place until the owner disposes of them or explicitly authorizes their disposition; no archival bypass. Rerun the driver afterward. |
+| `judgment/containment-not-proven` | Investigate rungs 4–5 in [containment.md](containment.md); keep it without a concrete proof. |
+| `judgment/worktree-locked` | The lock is under seven days old or future-dated. Wait for expiry, or unlock once the owner confirms the pin no longer applies. |
+| `judgment/hidden-index-flags` | Have the owner clear hand-set flags, prove the revealed tree clean, then rerun. `git ls-files -v` shows assume-unchanged as lowercase letters; clear only those (`--no-assume-unchanged`) or hand-set `skip-worktree` outside a sparse cone. |

@@ -990,3 +971,2 @@
-      fi
-      echo operational/removal-failed
-    fi
+  if [ "$expired_lock" = true ] \
+    && ! git -C "$common_git_dir" worktree unlock "$worktree_path" >>"$removal_output_path" 2>"$removal_error_path"; then

@@ -34,4 +23,1 @@
-          apt-get update
-          apt-get install -y --no-install-recommends "${missing[@]}"
-
       - name: Run tests

@@ -88,4 +76,2 @@
-    # signal handler, so a kill here writes nothing to the PR — the durable
-    # fix is an internal deadline in the wrapper, not a larger number here.
-    # Re-derive when the pin moves.
+    # Limit runner occupancy even if retries or reconciliation are unfinished.
     timeout-minutes: 130

@@ -11,2 +10,3 @@
+## Treat user work as untouchable
 
-Use the requested directory, or the current directory when none is given. Discover below that root without following symlinks; keep checkout inspection and file cleanup scoped to it. Shared repository maintenance is broader: registered worktrees outside the root may appear in the report, their metadata is read, and fetched mode prunes stale registrations repository-wide, including registrations pointing outside the root. Do not treat those worktrees as audited. If outside-root registration changes are forbidden, use `--no-fetch --no-remove` or scoped local queries. If even outside-root metadata reads are forbidden, use scoped local queries; the driver cannot enforce that boundary.
+Uncommitted files, commits no other ref holds, stashes, and ignored files the primary checkout does not also hold (apart from the machine-local footprints named under the modes) are user work. Discard, delete, or drop them only on the user's instruction for that item or class, after the proof the matching reference requires. Age, a vanished upstream branch, or divergence from the default branch never prove work disposable. Leave blocked content where it is: moving it into an archive, backup, or trash folder to clear a gate is deletion by another name. Never create branches or refs to "preserve" a checkout, and never edit `.gitmodules`, selectors, or Gitlinks under a `third-party/` path.

@@ -73,3 +45,1 @@
-has no partial-scan bypass; narrowing the audit root does not narrow a registered
-worktree's scan. Ask the user how to handle the named content before changing
-it, then rerun the complete gate. A partial manual inspection is not a passed gate.
+Call a worktree safe to remove only when the driver removed it or you have freshly established every gate in [references/removal-gates.md](references/removal-gates.md). A cached or `--no-remove` run proves none of them; its Notes column lists the locks and primary-only ignored files it did observe.

@@ -315,0 +320,4 @@
+    [ "$files" -le 1000 ] || return 1
+    file_epoch=$(stat_epoch "$file_path") || return 1
+    [ "$file_epoch" -le "$newest" ] || newest=$file_epoch
+  done < <(find "$directory_path" -type f -print0 2>/dev/null)

@@ -0,0 +361,4 @@
+    }),
+  );
+  assert.ok(markdown.includes("- 1 checkout is current by cached refs."));
+  assert.ok(!markdown.includes("- Updated"));

@@ -0,0 +105,4 @@
+function dirtyCount(status: Status): number {
+  if (status === null) return 0;
+  const tree = status.workingTree;
+  return tree.staged + tree.unstaged + tree.untracked + tree.conflicted;

@@ -35,1 +33,3 @@
-# double-post. Keying on github.ref alone would instead split a stacked pull
+# group deliberately — a manually dispatched review should supersede any live
+# review pass for the same pull request, and the wrapper's reconcilers list
+# before they create, so two overlapping passes double-post. Keying on github.ref alone would instead split a stacked pull

@@ -88,4 +76,2 @@
-    # signal handler, so a kill here writes nothing to the PR — the durable
-    # fix is an internal deadline in the wrapper, not a larger number here.
-    # Re-derive when the pin moves.
+    # Limit runner occupancy even if retries or reconciliation are unfinished.
     timeout-minutes: 130

@@ -23,3 +22,1 @@
-Gated worktree removal is the default; no second permission request is needed. Local-branch deletion, remote-branch deletion, stash drops, and discarding dirty files require cleanup authorization covering that class. A request to clean local branches does not authorize remote deletions or stash drops. Report out-of-scope findings without deleting them.
-
-Treat dirty files, local commits, and stashes as user work. Age, default-branch divergence, and disappearance from a remote do not prove disposability. Delete only established disposable content, with one exception: the two machine-local footprints named in [references/removal-gates.md](references/removal-gates.md), which a removal-enabled run deletes without comparing the primary checkout. Leave unresolved files in their worktrees, never move them into archives or backups to bypass a gate. Git object pruning is report-only (`git prune --dry-run`), not an agent cleanup action.
+The default mode's updates and removals need no further confirmation. Removal proves containment against `origin/<default>` only: for a root holding a fork whose work integrates elsewhere, audit with `--no-remove`. The fetch prunes every `refs/remotes/origin/*` ref that no server branch supplies; for a repository with a custom `origin` fetch refspec, audit with `--no-fetch --no-remove` (see [references/checkout-updates.md](references/checkout-updates.md)). Removal also deletes regenerable ignored output (`node_modules/`, `dist/`, `.venv/`, …) and two machine-local footprints, `.vscode/` and `.ansible/vault_pass.txt`, without comparing them to the primary checkout. If the user wants those kept, use `--no-remove`. Stale-registration pruning is repository-wide: it can drop registrations of worktrees outside the root whose directories are gone.

@@ -78,3 +47,1 @@
-jq '.repositories[] | select(.fatalError != null or .fetch.ok != true or .defaultBranchResolution.remoteHeadOk != true or .forge == null or .defaultBranch == null or .worktreesError != null or .gitPrune.ok != true or .staleRegistrations.ok != true) | {checkout, fatalError, forgeError, defaultBranchError, defaultBranchResolution, fetch, worktreesError, gitPrune, staleRegistrations}' "$report"
-jq '.repositories[].worktrees[] | select(.removal.outcome != "removed") | select(.statusError != null or .outsideRoot or .defaultComparison == null or .defaultComparison.fresh != true) | {path, outsideRoot, statusError, defaultComparison}' "$report"
-```
+When the report does not answer a question, read the item's JSON record, where `<name>` is the path as `report.md` shows it, relative to the root (`.` for a checkout at the root itself): `jq --arg p <name> '.root as $r | .repositories[].worktrees[] | select(.path == (if $p == "." then $r else $r + "/" + $p end))' "$report/report.json"`. A failure row means coverage is incomplete for that checkout; never report it as clean.

@@ -129,3 +58,1 @@
-`latestChange` is an activity hint: newest HEAD commit or non-ignored changed-path mtime, with age relative to the report. Repository aggregates can include removed worktrees. Generated mtimes and age are not merge evidence. Never say “safe to delete” without the specific proof and applicable gates.
-
-In ad hoc shell work, do not name a variable `status`: it is read-only in zsh.
+After acting, rerun the driver over the smallest root holding the affected checkouts and their worktrees, which sit beside the primary checkout rather than inside it, and report the resulting state, not the commands that ran.

@@ -0,0 +335,4 @@
+
+  const directories = report.directoryFindings
+    .filter((finding) => !finding.registeredWorktree)
+    .map((finding) => [display(finding.path), finding.outcome === "inspection-failed" ? `inspection failed: ${firstLine(finding.error)}` : finding.outcome]);

@@ -34,6 +23,3 @@
-          apt-get update
-          apt-get install -y --no-install-recommends "${missing[@]}"
-
       - name: Run tests
         shell: bash
         run: |

@@ -88,4 +76,2 @@
-    # signal handler, so a kill here writes nothing to the PR — the durable
-    # fix is an internal deadline in the wrapper, not a larger number here.
-    # Re-derive when the pin moves.
+    # Limit runner occupancy even if retries or reconciliation are unfinished.
     timeout-minutes: 130

@@ -17,3 +18,1 @@
-| Keep worktrees / do not remove them | `--no-remove` | Same fetched audit and updates; no worktree removal. |
-| Read-only / no checkout changes | `--no-fetch --no-remove` | Cached diagnostic; no driver fetch, updates, or registration/worktree deletion. Comparisons are stale. |
-| Cleanup | Default, plus the named cleanup classes | Interior deletions require the evidence and scope below. |
+| Audit, clean up, "which are behind" | none | Fetch and prune `origin`; fast-forward eligible default checkouts; prune stale worktree registrations; remove proven-merged linked worktrees inside the root. |

@@ -1550,0 +1418,4 @@
+  assert.equal(result.activityReview.error, null);
+});
+
+test("a changed directory that cannot be fully walked leaves the timestamp unknown", { skip: process.getuid?.() === 0 && "root reads directories regardless of mode" }, (context) => {

@@ -0,0 +249,4 @@
+    }
+    case "manual-review": {
+      if (comparison !== null && !comparison.fresh) {
+        if (fetched) return { aheadBehind: formatAheadBehind(comparison), why: "not compared: origin fetch failed" };