Simplify root-scoped cleanup

2026-09-02 00:48:40 +00:00
parent 39b2665d8b
commit 1e418d6929
8 changed files with 42 additions and 145 deletions
--- a/docs/operations.md
+++ b/docs/operations.md
@@ -555,7 +555,7 @@ Rules:
 - `clean` deletes work/spool session state;
 - cache is preserved unless `--clear-cache` is set;
 - each deletion is confined beneath its configured workspace, spool, or cache
-  root and refuses symlinked paths;
+  root; root, traversal, and out-of-root targets are refused;
 - automatic post-publish cleanup is gated by successful publish commit plus:
  - `pipeline.spool.delete_audio_after_publish=true`
  - `pipeline.workspace.cleanup_after_publish=true`