From ec4ad984c13160032dc2b9ebb5be0ce9f0374291 Mon Sep 17 00:00:00 2001 From: Joseph Doherty Date: Tue, 11 Aug 2026 05:51:21 -0400 Subject: [PATCH] docs(playbook): enumerate untracked paths before staging a sweep commit MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A sweep's landing commit is where unrelated local state gets swept in. One repo's '78 modified' was 76 modified + 2 untracked, one of which was .claude/ holding settings.local.json — a literal 'git add -A' would have put permission config into a tracked commit feeding a production deploy, invisible in a 76-file diff. --- admin_ui_cleanup.md | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/admin_ui_cleanup.md b/admin_ui_cleanup.md index 904bc27..7c4b3ef 100644 --- a/admin_ui_cleanup.md +++ b/admin_ui_cleanup.md @@ -387,6 +387,17 @@ plus stating the claim's scope honestly ("verified in these three; not checked i when it hasn't. All three were caught by someone re-examining their own earlier assertion, never by the assertion being challenged. +**Enumerate untracked paths BEFORE staging, not after.** A sweep touches many files, so the landing +commit is where unrelated local state gets swept in — and `git status` counts mislead: one repo's +"78 modified" was 76 modified + 2 untracked, and one of the untracked entries was `.claude/`, +containing that session's `settings.local.json`. A literal `git add -A`/`git add .` following a +"commit the sweep" instruction would have put local permission config into a tracked commit feeding a +production deploy, invisible inside a 76-file diff. Run `git status --porcelain` and read the `??` +lines specifically; decide each one before staging anything. Two repos in this round had an exclusion +that had to be made deliberately (`.claude/`, and a `docker-compose.yml` carrying an undecided +`DisableLogin` override) — in both cases the exclusion was agreed before the commit existed, which is +the only point at which it is cheap. + **When every hypothesis is falsified, test the SHARED PREMISE before adding a new one.** Two investigations into a 0-byte log file eliminated, between them, config levels, env vars in five scopes, ACLs, stale files and a two-stage bootstrap — and deadlocked. The unexamined premise both