[teamleaderleo]

Follows #1622 (landed); based on main.

Leo: "When have we ever had something useful greater than 12 hours?"
Coordinator (sr2): "keeping unpushed commits safe is right, but 168 h of whole checkouts is what fills disks. Fix the root instead."

What changes

• CMUX_JOB_MIRROR_HOURS goes from 168 to DEFAULT_AGE_HOURS (12). It covers the families that use mirror_idle_hours: cmux-job-cache (Linux and macOS) and hq-build-fleet-cache.
• Before such an item is deleted, archive_mirror finds every repository it takes along. It enumerates them the way _nested_loss does: nested_checkouts, bare repos, the repository of a linked worktree inside the item, modules/ submodule stores, and embedded submodules. For each repository, bundle_unpushed reuses local_tips (refs, HEAD, reflogs, worktree-private tips), network_remotes and remote_has to find commits no remote holds. Heads and tags the remotes advertise (ls-remote --heads --tags) count as held, so bare SwiftPM-style mirrors don't bundle their whole history. Those commits go into one bundle. Commits that only a reflog or HEAD holds are named by temporary refs/glaeda-archive/<sha> refs, which are removed afterwards. Each branch or tag that exists only locally and sits on a pushed commit gets its own small bundle (ref --not ref^@).
• Bundles go to ~/archive/glaeda-disk/<stamp>-<repo>.expires-<YYYY-MM-DD>.bundle. Each one must pass git bundle verify and list-heads must show every expected ref; only then is it renamed into place and the tree deleted. If nothing is unpushed, no bundle is written.
• Every apply that has a mirror family prunes expired bundles with prune_mirror_archive. It only touches files in ~/archive/glaeda-disk that match its own name pattern and whose date has passed. Nothing else in ~/archive is touched.
• When bundling fails, the tree is kept. The receipt gets outcome blocked:bundle-failed (verdict blocked, so the run line's blocked counts it), the run line gets a new bundle_failed list, and stderr prints an ALERT: line.
• Ownership, live-process, lock/lease, job-busy and wt-owner checks are unchanged. Bundling runs after all of them, right before the delete.
• After the bundle, right before the delete, the item is renamed aside and run through the same check again: a fresh repo and worktree scan with strict reads, a clean check covering staged, tracked and untracked changes, and every local ref compared by name and value with the refs recorded before bundling. Any difference or error renames the tree back and keeps it (changed:in-use). Uncommitted work is kept as blocked:uncommitted.
• A .glaeda-disk-keep-<name> sidecar is written before the rename and removed only after the recheck passes. That way a tree that can't be renamed back is never finished by finish_deletion or the interrupted-deletions pass. If the sidecar can't be written, nothing is renamed.
• Any repo with linked-worktree records, inside or outside the item, keeps the item. Git stores those records as absolute paths, so the recheck can't find them after the rename.
• A symlinked or non-regular HEAD, packed-refs or reflog counts as unreadable, so the tree stays.
• prune_mirror_archive prunes from the bundle manifest, with sha256 checks.
• On a reserved host, CMUX_JOB_MIRROR_HOURS stays 168 h through LEGACY_AGES.
• If a tree can't be covered safely, it is kept as blocked: its repo has a worktree outside the item, a linked worktree whose repo is outside holds commits only its own reflog has, an ignored nested checkout would lose something, the walk is too big, or no network remote answers.

Tests

New: an unpushed commit, a detached-HEAD commit, a local-only tag and a local-only branch all end up in verified bundles and the tree is gone; a bundle failure keeps the tree and alerts; a mirror with nothing unpushed goes with no bundle; expired bundles are pruned while unexpired, foreign-named and outside-dir files stay. Updated: the cmux-job and retired-hq-worker mirror tests now expect 12 h and bundling. Locally the hook pin check passes, as do HostReservationTest, LinuxLayoutTest, FleetCasNodeCapTest and the age tests. The full GlaedaDiskTest passes except one known local-environment test. CI passes 18/18. Codex Astra SHIPped head 4b65485 with no P0/P1/P2 after several rounds.

Numbers

Before: a reload unit or hq cache entry idle less than 168 h with a commit no remote holds stayed whole, so unit trees sat for a week (107 GiB across eight minis on 2026-10-11). After: such trees go at 12 h, and only their unpushed objects stay, as bundles of KiB to MiB. This is the policy change; the per-host 24 h free-disk minimum gets measured once this deploys.

Size

1,185 changed lines. The coordinator kept it as one PR: the bundle, the recheck and the delete are one safety path, and splitting them would land a 12 h delete without its archive.

Risk

• Medium. Mirror trees now go after 12 h instead of a week. Uncommitted edits in work/<slot> (rsynced from a developer's laptop, which still has them) are not bundled, same as at 168 h today. A reload unit idle 12 to 168 h used to keep its warm clone and now rebuilds cold.
• Trees that can't be bundled now stay where before they would have gone at 168 h: no network remote reachable, a walk too large (5M entries), or an outside worktree. Each one shows as blocked:bundle-failed with an ALERT, so it's visible and not silent.
• Bundling runs ls-remote and, at most, fetch --negotiate-only per repository per deletion. Bundles are written under a timeout of 600 s.

Agent session: agent session

🤖 Generated with Claude Code

[teamleaderleo]

Owned by an agent session · session

[gitguardian]

⚠️ GitGuardian has uncovered 3 secrets following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

🔎 Detected hardcoded secrets in your pull request

GitGuardian id	GitGuardian status	Secret	Commit	Filename
35581672	Triggered	Generic Password	5922735	scripts/test-glaeda-disk.py	View secret
35581672	Triggered	Generic Password	4271160	scripts/test-glaeda-disk.py	View secret
35581672	Triggered	Generic Password	7adc2af	scripts/test-glaeda-disk.py	View secret

🛠 Guidelines to remediate hardcoded secrets

1. Understand the implications of revoking this secret by investigating where it is used in your code.
2. Replace and store your secrets safely. Learn here the best practices.
3. Revoke and rotate these secrets.
4. If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.

To avoid such incidents in the future consider

• following these best practices for managing and storing secrets including API keys and other credentials
• install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.

---

^{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}