[santoshkumarradha]

Summary

Capture plans a caller never sealed stayed in capture-plans/ forever. One machine held 43 of them, 98 GB in total. A plan more than ten minutes old is now treated as abandoned and removed.

 capture_plan
+  prune_plans(workspace/capture-plans)   # one read_dir, never the store
   ...plan...
   write <token>.json

 daemon writer, idle tick (0.3.3)
   check_index
+  prune_abandoned_plans(store)           # workspaces/*/capture-plans, for timelines that never plan again

prune_plans(dir)
  for <64-hex>.json or .tmp* (a write that never got renamed)
    if mtime is more than 10 min old: remove (errors ignored)
  future mtime counts as fresh; other names are left alone

Rule: age only, 10 minutes. codeaf seals within SealWithin (30 s), and a person running capture-plan then hook turn-end by hand still has plenty of time. A count cap would remove young plans whenever several callers plan on one timeline at once, which breaks the promise that a plan in use is never deleted. With age alone, a directory holds at most the plans made in the last ten minutes, and a plan that is sealed removes itself, as before.

A seal that lost its plan to pruning gets the existing capture plan is absent; re-plan error. If a seal has already read its plan, deleting the file does not affect it.

Evidence

• Before (0a705ca, tests only): all four new tests fail. Old plans survive a new plan, the seal of a stalled plan succeeds, and the quiet daemon writer never removes anything.
• After (e8e0f30): they pass.

40 plans + a .tmp leftover, all aged 1 day; fresh plan F; new plan N
  -> only F.json, N.json and the unrelated notes.txt remain; F still seals
stalled plan aged 1 day, then a new plan  -> seal(stalled) = "capture plan is absent; re-plan"
handle A: 30 rounds of plan+seal  ||  handle B: 30 rounds of 20 aged junk plans + capture_plan
  -> every seal by A succeeds, and B's junk is gone after each round
daemon (idle 100 ms): aged plans on a timeline with no further plans are removed; a fresh one stays

Spark fleet job 20261026-184751-002483 ran on e8e0f30. cargo fmt --check, cargo clippy --workspace --all-targets --locked -D warnings and cargo test --workspace --locked all passed, exit 0. The prune tests also passed 25 out of 25 repeated runs.

Merge Danger

Door: two-way

Plans are disposable. The worst case is that a caller stalled for more than ten minutes has to re-plan.

Blast Radius: small

Only capture-plans/ changes. Release step: a separate release: 0.3.4 PR that bumps the workspace version, as was done for 0.3.3, then tag v0.3.4. After that, codeaf's engine pin can move.

🤖 Generated with Claude Code