# Submodule worktree cleanup proof

Target: [#20368](https://github.com/pingdotgg/t3code/pull/20368).
Final reviewed and independently tested head: bffca7f18c967a9a2f79eb183a33dc09251ea21b.
Base merged from main: 1451e7cb23034d29774338608368a15d8845df36.

All fixtures use disposable local repositories; no developer data or real credentials.
Linux, Git 2.43.0, Node 24.21.0. Nonvisual server behavior; no screenshots apply.

Before: exact main runtime with the five rebuilt cases produced four assertion failures and one pass (137 baseline skipped). Original contributor suite had 146 passing cases; rebuilt suite has 142, preserving all 137 baseline cases.

Review regression before the fix: actual StorageCleanup.runNow deleted a nested gitlink directory containing an .env written after deinitialization under any-local-files. Expected kept/exact bytes; observed removed/null. 141 passed, one failed.

Review regression before the policy correction: actual service also deleted notes.txt after deinitialization under the default uncommitted-changes policy. Expected kept/exact notes after deinit bytes; observed removed/null. 141 passed, one failed. These phases extend the same existing policy test, not additional test cases.

After: primary agent independently ran all 142 cases on the final head, all passed, zero skipped. The five PR cases prove recursive clean removal including admin directory deletion, policy-protected files in populated/deinitialized children with exact bytes, unpublished nested history across deinitialization, malformed metadata retention, and the unforced late tracked-edit guard. Server typecheck, two-file lint and format passed on the same source bytes.

Additional temporary actual-service probes on final source: three passed: clean submodule worktree under a symlinked managed parent removed for each of the two file-protecting policies; clean submodule worktree with 1,000 committed root files (77,132 index bytes) removed. These diagnostics were not added as committed test cases.

Three full parallel Claude Opus 5.5 / Codex GPT-6-Sol review rounds. Round one caught deinitialized ignored-file loss. Round two caught default-policy loss, symlink-parent false retention and the too-small index output cap. Both round-three reviews found no confirmed code findings. Fresh tests and implementations used GPT-6-Astra and GPT-6.1-Sol, high effort, Codex harness.

Limits: forced removal cannot be atomic against external writers after checks. History checks HEAD/live refs against local remote-tracking history, not the network; tag/SHA-only commits may conservatively retain a clean worktree. Default policy conservatively retains ignored files in deinitialized directories too, except the existing node_modules directory exception. Unreadable or bounded-out metadata keeps the worktree. No guarantee for dangling/reflog-only history.

Not executed: Git 2.34.1, macOS, Windows, iOS, Android, Electron UI or browser flow. Human safety approval and published-head CI remain merge gates. No merge performed.