[overtrue]

Summary

The clean-room provenance guard repeatedly applies a costly regular expression to the tracked tree during its mutation suite. First select candidate files using fixed words that every branch of the expression requires, then apply the original expression to those candidates. Untracked files and tracked symlink targets retain their original scan. Command failures remain failures.

Related to #1465. This improves one measured cost; it does not establish the cause of the earlier incomplete guard census.

Verification

$ cargo fmt --all --check
exit 0
$ cargo clippy --workspace --all-targets -- -D warnings
exit 0
$ cargo test --workspace
exit 0
$ cargo xtask verify --crate xtask
verify: crate xtask build compiled 0 crate(s) in 0.63s outside the budget
verify: crate xtask passed in 17.35s
$ cargo xtask verify --all
verify: workspace test build finished in 0.43s, 0.43s into its 480s budget
verify: workspace tests finished in 304.09s, 304.52s into the 480s budget it shares with workspace test build
verify: guard self-test finished in 337.83s, 337.83s into its 480s budget
verify: workspace tests and build guards passed in 642.35s

The full verifier exited zero but its reported 642.35 seconds exceeds the documented 600-second whole-command feedback target. The two phase budgets passed separately. The 1983-case guard census independently passed on both baseline and an earlier candidate, in 321.35 and 297.99 seconds respectively; other work overlapped both runs, so that difference is not a controlled causal estimate. Three direct baseline guard timings were 2.90, 3.76 and 3.67 seconds; three final candidate timings were 1.89, 1.76 and 1.84 seconds on this host.

The first workspace run failed one socket observation, which reported reset instead of closed, and one corpus test reporting cases c-h2-0019 and c-h2-0020 as regressions. Each corresponding focused test passed on the original main scripts; their causes remain unknown. The unchanged complete workspace gate then passed on the candidate.

The first CI run failed Build guard self-test 5 because the original 64-file batches spawned 19 scanner processes against the existing ceiling of 12. The final candidate uses argument-size-bounded batches: the exact local group 5 control reported 11/12 scanner processes and all seven cases passed. A 601-file test detected a deliberately omitted final batch.

The new controls caught independent removal of each of the four fixed-word alternatives, suppression of a failed prefilter, and alterations to the licence, origin and prefilter-failure diagnostics. The original full expression and existing tests remain intact.

Role Verdicts

• simplicity-adversary: attacked prefilter coverage of each expression branch, tracked and untracked inputs, symlink handling, and failure propagation — no break found.

Breaking Change

• BREAKING — this PR touches a protected file or changes a public contract.

Checklist

• The four-command gate passed (fmt, clippy, test, cargo xtask verify)
• New or changed public API has rustdoc
• Negative test cases outnumber positive ones
• Every new assertion was mutated — the implementation was broken on purpose and the assertion
  went red. The PR description names which ones
• No Protected File touched; if one was, the PR description contains BREAKING and a migration path
• No unsafe introduced
• No inventory / linkme introduced
• No #[non_exhaustive] added to a DTO
• No s3s code copied; behavioural evidence is URL + self-written summary
• No credentials, signatures, or expected-signature values reachable from logs or error bodies
• No plan document, analysis report, or working note committed
• Commits follow Conventional Commits; PR title ≤72 characters
• A Handoff comment has been appended to the issue

[overtrue]

Role review

• simplicity-adversary: attacked whether any original expression branch lacks a fixed-word candidate, whether tracked symlinks and untracked files retain their prior scan, whether missing inputs and scan errors fail closed, whether the bounded batch drops its final candidates, and whether the worker census or case selection changes. Four independent keyword-removal mutations, a failed-prefilter mutation, and a final-batch omission were detected. The 1983-case full guard census passed; the unchanged build-guard group 5 passed at 11/12 scanner processes. No additional break found. These checks do not establish the cause of the earlier guard timeout.

[overtrue]

Reviewed head b4864d8. Build guard self-test 5 fails its unchanged scanner-process ceiling: 19 observed, 12 allowed. The job completed every assigned case (7 of 35 in group 5/5, exactly once) in 24 of 380 seconds. The Test aggregate failure is downstream; this is not a timeout or a main failure.

The fixed-word prefilter selects 575 tracked files in an independent local check. Scanning them in groups of 64 adds enough scanner processes to reproduce the exact 19-versus-12 failure. Keep the existing ceiling and coverage; reduce batching overhead instead.

The originating session already has an unpublished byte-bounded batching repair and is running its commit gates. An independent snapshot check of that candidate used 11/12 scanner processes and passed all 12 focused allowance tests. Removing the final candidate-batch scan made its new rejection test fail as intended; restoring it passed again. These are candidate-source observations, not CI acceptance of this published head or an independent full workspace gate. No alternative commit or CI rerun was published by this review session.

Role Verdicts

• simplicity-adversary: scripts/check_no_minio_source.sh:218 — the new 64-file tracked-candidate batches exceed the existing scanner-process ceiling on the repository corpus.

[overtrue]

Reviewed the batching repair on head 2d2dc16 against the previously reviewed head. Both changed files are byte-for-byte identical to the candidate snapshot independently checked in the previous review: 11/12 scanner processes, 12 passing allowance tests, and a failing final-batch omission mutation followed by a passing restoration. The unchanged ceiling, full expression, extra-file scans, failure propagation and assigned case census are preserved. No additional actionable finding in this delta.

The author records a fresh ordered local gate and complete verifier. I have not independently repeated that workspace gate. The serial verifier's reported aggregate duration is separate from its individually bounded stages and from CI wall time. Current remote checks are still running; this review does not declare CI acceptance or authorize bypassing them.

Role Verdicts

• simplicity-adversary: attacked bounded argument accumulation, final-batch reachability, scanner error propagation, unchanged process ceiling, and prefilter coverage — no break found.