Preparation only: Fenn ran no syntax check, inventory, control, compiler, validator or deletion. All commands below are prospective. This supersedes the per-file proposal preserved in reclaim-incremental-cache-before-session-guard.py (SHA256 f87e5cf5865bda044cf2f4be3ec12090a492896f07e8316ad92c1a5bf1c6ec25) and incremental-cache-capacity-plan-before-session-guard.md.

The correction preserves C-aud-5's failure and uses C-aud-6's exact tiny source/edit. Wren observed Rust1.99 query-cache-only removal ICE101 and a stale binary; those external runs were not contained release evidence. Olo must run independent contained controls below. No poisoned-session recovery deletion is authorized by this script.

After #40 cell18, fresh-8fb6f413179b-01-package-inspect, completes exit0 with exact stopped outer receipts, and before #43 admission, compute a new strict namespace census in the helper. Bind that full command/observation to the inventory. The required goal is max(0, actual_data_bytes − 81,041,356,288 + 1,073,741,824); at or below 79,967,614,464 bytes, record not_needed_bound_census and skip cleanup. This removes the old unbound operator minimum. If positive goal exceeds 5,368,709,120 bytes, or eligible whole-session capacity cannot meet it, preserve the actual census/eligible sizes and report unresolved before any deletion. Do not loosen witnesses. #40 cell18 is now actually0/stopped (inspection SHA780f55b23c7970793090223cd3e8466989407f6324022c01e39585983a77b1d2); last strict census84,513,417,313 bytes. This historical observation does not substitute for the new in-script census or eligible-session inventory. Feasibility remains unknown.

Full future reservation remains 13,958,643,712 bytes (13GiB), strict census maximum 81,041,356,288 bytes, plus sufficient real free disk. Census + reservation must stay ≤95,000,000,000. A cleanup result never admits later work: repeat actual census after output growth.

Olo's read-only audit is incremental-cache-read-only-audit-02.json, SHA256 49ec16e5f2b5996876abaec74f49fa273046aada5ca14e3cd4524b75cc057c08: UID1000 single-link .bin4341/5,585,382,257 bytes; .o16074/1,951,390,304; .rmeta53/33,316,670; .lock1447/0; excluded multi-link/other28693. It is inspection only, not eligible inventory/admission. The audit is hash-bound; no forecast substitutes for current witnesses.

Select whole finalized sessions. Every present admitted name (dep-graph.bin, query-cache.bin, work-products.bin) must pass all existing path/owner/regular/single-link/non-executable/same-device/RSIC/compiler/fingerprint/source witnesses. One ineligible present member excludes the entire session. Count the whole session against the actual minimum and 5GiB maximum. Preserve other names, directories and hardlinks. Within each session, remove dep-graph.bin first when present, then query-cache, then work-products; before either latter unlink require graph absent. Interruption before graph removal changes nothing; after it leaves the compiler's out-of-date fallback, which real controls must check. Dry-run validates/reports whole sessions and graph-first order, with immutable actual path/order lists.

Primary source at compiler commit b940084d7eb6a299eb4bfeb8e34901bc051e7ac4: session protocol fs.rs1–90, lock path163–181, shared reader364–375, exclusive collector737–746, Linux flock16–25, missing graph becomes DataOutOfDate90–92. Lock is existing crate/s-<timestamp>-<random>.lock, dropping final SVH component, opened O_RDONLY|O_NOFOLLOW; nonblocking exclusive flock, no create/write. Linux flock documentation supports locks independent of open mode; unsupported/contended locking fails closed. Hold all selected locks through revalidation/removal; preserve lock files. Advisory locks do not protect against actors ignoring the protocol; serial ownership remains an assumption.

Classification retains Cargo CACHEDIR.TAG, actual .rustc_info.json Rust1.99 identity, unambiguous workspace target, fingerprint target/profile, dep-info naming preserved target source, and clean frozen A manifest/source hashes. This does not attest historical sessions compiled frozen8fb6f41. No lineage guard is relaxed. Existing cleanup SHA 7fbdf2db556bc4cd7179983914f4ff52bece9074a4f31442768657ab10c7c383 and census SHA 399bc25f8c5c4f2bc5c386f286369815db7ee432b02d5be9301f13833eb0a495 remain bound in actual inventory.

Before first unlink revalidate all selected members/witnesses and whole-session membership. Refuse path/ownership/identity drift, mounts, active compiler/server/VM/project units and failed/stale cell18 inspection. Use unchanged held-file FD-relative O_NOFOLLOW unlink, immediate name-versus-FD equality and exact dev/inode/mode/uid/gid/nlink/size/mtime/ctime/hash; accept only own nlink→0/ctime transition. No directories removed. Exclusive reports/fsynced unlink journal preserve failures/partial progress; attempt fresh census after partial failure. No auto-retry or broadened deletion.

Current helper SHA256 73819d6686922dc89392ac80732b09cfed81169ac9691dd8db0d09b368549394; synthetic control SHA256 595e93fc9466038b2f9d6303a278a37b78d6683a3d071d2b9152d9fe73db4b5b. Root review precedes commands. Use unchanged default16/20GiB high/max, no swap,1800s outer, serial A driver, 1GiB archive reservation per cell. Read #59 and verify actual raw/stop receipts after each cell.

set -euo pipefail
RECLAIM_META=/run/media/kmosoti/data/FabricO11y/results/candidate-build-fresh-8fb6f413179b-01
RECLAIM_DRIVER="$RECLAIM_META/run-step-a.py"
RECLAIM_SCRIPT="$RECLAIM_META/reclaim-incremental-cache.py"
RECLAIM_CONTROL="$RECLAIM_META/incremental-cache-rebuild-controls.py"
RECLAIM_SHA=73819d6686922dc89392ac80732b09cfed81169ac9691dd8db0d09b368549394
test "$(sha256sum "$RECLAIM_SCRIPT" | cut -d ' ' -f1)" = "$RECLAIM_SHA"
test "$(sha256sum "$RECLAIM_CONTROL" | cut -d ' ' -f1)" = 595e93fc9466038b2f9d6303a278a37b78d6683a3d071d2b9152d9fe73db4b5b
python3 -B "$RECLAIM_DRIVER" incremental-cache-syntax-01 1073741824 python3 -B -c 'from pathlib import Path; import hashlib; m=Path("/run/media/kmosoti/data/FabricO11y/results/candidate-build-fresh-8fb6f413179b-01"); pairs=[("reclaim-incremental-cache.py","73819d6686922dc89392ac80732b09cfed81169ac9691dd8db0d09b368549394"),("incremental-cache-rebuild-controls.py","595e93fc9466038b2f9d6303a278a37b78d6683a3d071d2b9152d9fe73db4b5b")]; [(None if hashlib.sha256((m/n).read_bytes()).hexdigest()==s else (_ for _ in ()).throw(ValueError("script hash differs")),compile((m/n).read_bytes(),str(m/n),"exec")) for n,s in pairs]; print("syntax/hash checks completed")'
python3 -B "$RECLAIM_DRIVER" incremental-cache-rebuild-positive-01 1073741824 python3 -B "$RECLAIM_CONTROL" --expected-script-sha256 "$RECLAIM_SHA"
python3 -B "$RECLAIM_DRIVER" incremental-cache-rebuild-negative-01 1073741824 python3 -B "$RECLAIM_CONTROL" --expected-script-sha256 "$RECLAIM_SHA" --negative-only
python3 -B "$RECLAIM_DRIVER" incremental-cache-inventory-01 1073741824 python3 -B "$RECLAIM_SCRIPT" --inventory

Stop/read inventory result. For not_needed_bound_census, skip cleanup; fresh #43 admission still applies. For positive inventory review census formula, eligible/excluded whole-session sizes, source/audit hashes, canonical paths/member eligibility/order, minimum/maximum and stop receipts. These are review steps, not automatic paste continuation.

set -euo pipefail
RECLAIM_INVENTORY="$RECLAIM_META/incremental-cache-capacity-inventory-01.json"
RECLAIM_INVENTORY_SHA="$(sha256sum "$RECLAIM_INVENTORY" | cut -d ' ' -f1)"
python3 -B "$RECLAIM_DRIVER" incremental-cache-control-01 1073741824 python3 -B "$RECLAIM_SCRIPT" --negative-control --expected-inventory-sha256 "$RECLAIM_INVENTORY_SHA"
python3 -B "$RECLAIM_DRIVER" incremental-cache-dry-01 1073741824 python3 -B "$RECLAIM_SCRIPT" --expected-inventory-sha256 "$RECLAIM_INVENTORY_SHA"

Read #59 and review dry-run whole-session/graph-first assertions, zero removals, unchanged actual inventory SHA, literal scope refusal and stopped receipts before execute. Literal control changes one selected path to DATA/cargo/debug/fabric-server in memory only: exact INCREMENTAL-CACHE-SCOPE before deletion; callback/raw unlink/rmdir/rename/replace/write-mode os.open/builtins.open/io.open/Path.open are raising stubs only around admission, report writing afterward. Require exit0/unlink_invokedfalse/unchanged inventory SHA. Scope control is separate from compiler controls.

set -euo pipefail
test "$(sha256sum "$RECLAIM_SCRIPT" | cut -d ' ' -f1)" = "$RECLAIM_SHA"
test "$(sha256sum "$RECLAIM_INVENTORY" | cut -d ' ' -f1)" = "$RECLAIM_INVENTORY_SHA"
python3 -B "$RECLAIM_DRIVER" incremental-cache-execute-01 1073741824 python3 -B "$RECLAIM_SCRIPT" --execute --expected-inventory-sha256 "$RECLAIM_INVENTORY_SHA"

Execute binds positive+negative compiler reports/helper hash/exact stopped outer argv, scope-refusal stop, dry-run stop, immutable inventory, cell18 inspection/log/source/admission/resource receipts and current preserved witnesses. It records census again; later growth still needs fresh #43 admission. Reports are exclusive; failed/stopped runs stay so. Preserve failures and stop, no broad cleanup.

Synthetic controls use C-aud-6's exact four-line rsic_probe V0 main hash 5f714433ee20cbe09fa949a31a7441a21208774db144bf531fd973ff91797909, edition2024/default dev, CARGO_INCREMENTAL=1, isolated disk-backed targets, actual pinned rustc/cargo1.99. E1 replaces i * 3 + 1→i * 3 + 2 and V0→V1. Baseline must print 145 3 9 V0; positive rebuild must print 155 3 9 V1, exit0 and changed binary hash. Positive cases use production selection/lock/identity/unlink helpers: whole session/all3 graph-first removal, and interruption after graph-only removal. Literal missing-query/order controls reject before deletion. Negative deletes query only from its synthetic session, expects specific ICE101/failed-green-node diagnostic/stale binary, and archives raw output/source/target/working sessions before judgment. No recovery deletion. Actual outcomes are NOT RUN; failed specific reproduction is unresolved, never arbitrary negative success. This is representative granularity evidence, not real-cache/multi-crate/capacity admission.

Olo read the complete current helper and exact V0/E1 compiler-control draft independently. No tool execution has run for this revised proposal. The mandatory controls demonstrate normal complete graph-first removal and interrupted-after-graph state, alongside exact query-only ICE101/stale-binary negative; T/E2/repeated variants are not included and are not claimed. No actual shared-cache reconstruction is asserted. The per-file page at20a2e64 remains blocked historical evidence.