# Build-storage policy

The tracked limits live in `.codex/workflow.toml`. Defaults are a 55 GiB soft total, 80 GiB hard total, at least 40 GiB or 15% free space, a 40 GiB persistent-lane ceiling, and a 35 GiB ceiling per disposable lane.

The canonical workspace path is hashed so `/home/.../Bevy` and `/mnt/Fedora/.../Bevy` share one cache identity. Managed lanes carry a sentinel with workspace path/hash, lane, toolchain, feature/profile signature, target/build directories, and timestamps.

Enforcement order:

1. Report total/per-lane size and largest children.
2. Under storage pressure, print the checked byte plan and prune expired marked disposable lanes.
3. Prune stale package intermediates after preserving published output.
4. Remove non-evidence Cargo timing/doc output.
5. Block a new heavy gate if the hard limit or free-space floor still fails.
6. Reset the persistent lane only at a safe slice boundary, after a dry run and verification-ledger update.

`enforce --phase pre|post` automatically prunes only when tracked policy enables it, storage pressure
exists, and a disposable lane has expired. Automatic and explicit prune/reset paths first print and
flush the complete byte-counted plan, including sentinel, path, process, and preservation checks,
before deleting any lane. A candidate lane additionally requires
`.codex/session/candidate-prune-safe.json`, created only after preserved evidence and at least one
distinct binary/package file have been hashed with `mark-candidate-preserved`; any later candidate
lane use makes that generation-bound marker stale.

Never prune an active lane, an unmarked directory, a symlink, another workspace, `/`, home, Cargo
home, the workspace root, `.git`, or a parent of any protected path. `cargo clean` is not a routine
operation; the one-time legacy-target migration is the sole exception documented by the workflow
installation record.
