meta: CACHE-034 remediation burn-down -- every pre-prune waiver honoured or dropped, fleet audit to zero #360

Tracking issue for the fleet-wide remediation of CACHE-034 findings. Context and remediation guidance: #354 (closed -- the guidance now lives in policy-general.md's CACHE-034 row and the rule's fix text). Documentation: #353.

Done means: every repository whose default-branch ci.toml declares pre-prune = true either honours it with a real ci-lint cache preprune call ordered ahead of the cache saves (same run: same job or an earlier needs: link, actions: write on the job -- see #354), or has dropped the declaration so CACHE-004 counts the lockfile-change peak. No repo is left with an unhonoured waiver.

Live state, verified 2026-10-05

Checklist

• zackees/bosn -- waiver dropped; CACHE-034 remediation is blocked fleet-wide: no repo can express a pre-prune ahead of its cache saves #354's structural alternative not taken
• zackees/reld -- waiver dropped, comment records why
• zackees/template-python-rust-cmd -- already honoured (the rule's positive control)
• zackees/soldr -- land PR soldr#3583 (drops both declarations). Note: dropping the waiver raises its modelled worst case (18.80 GB -> 34.6 GiB against a 9 GB budget, per CACHE-034 remediation is blocked fleet-wide: no repo can express a pre-prune ahead of its cache saves #354) -- compile alone is already over, so this PR clears CACHE-034 but a cardinality/max decision is still owed (same wall as zackees/clud#1800)
• zackees/running-process -- land PR running-process#1329 (drops both declarations). Same note: 11.04 -> 19.19 GiB against 9 GB, already failing without the waiver
• zackees/clud -- waiver dropped, PR clud#1820 merged (34/34 checks green, 0 failed; gate shadow-mode so no trailer required; CACHE-034 cleared). Honest worst goes 8.94 -> 17.64 GiB vs 9.5 GiB, so CACHE-004 now fires there as well -- cache: the declared shape needs 19.7GB against a 9.5GB budget -- it cannot fit GitHub's 10GB cap clud#1800 owns that cardinality/budget decision (2026-10-05)
• zackees/mimalloc-pprof -- waiver dropped, PR mimalloc-pprof#606 merged (gate 45/45, ci-mode green, CACHE-034 cleared). The waiver had been masking an over-budget state: honest worst 15.75 GiB vs 9.50 GiB budget, so CACHE-004 now fires and the cardinality/budget decision is owed here too (2026-10-05)
• FastLED/fbuild -- waiver now genuinely HONOURED inside fbuild#1652 (Option A): ci-lint cache preprune --lockfile-changed wired at all six push-to-main save roots (same-run ordering per CACHE-034 remediation is blocked fleet-wide: no repo can express a pre-prune ahead of its cache saves #354), ci/lockfile_changed.py template convention, actions: write granted to the prune jobs (SEC-002). CACHE-034 1 -> 0; CACHE-004 unchanged at 7.92 GiB <= 10.20 GiB budget (Option B measured at 15.84 GiB -> violation, so the waiver was doing real work -- now earned). Gate replayed both lanes and stamped a490893b; 24/24 checks green. The PR itself stays open by its own pre-existing owner hold (unresolved CodeRabbit thread + deliberate not-merged comment) -- that merge is outside this burn-down (2026-10-05)
• zackees/zccache -- done: ci.yml PR #361 (merged 6eaaca0) accepts the canonical cache-pre-prune workflow identity (anchored name:/file-stem match; lookalikes, composites and ci/ scripts still require the literal invocation). Verified on the live zccache tree: old code reported == CACHE-034 (1) ==, merged main is silent
• Final gate -- re-run the audit fleet-wide once the above land: zero CACHE-034 findings across all repositories with a ci.toml, and paste the before/after table here closing the loop on feat(cache): CACHE-034 -- a pre-prune waiver must correspond to a real pre-prune call #352's 6-of-8 audit

Notes

• Two honest remediation paths only (per CACHE-034 remediation is blocked fleet-wide: no repo can express a pre-prune ahead of its cache saves #354): add the step (needs actions: write + same-run ordering ahead of the saves) or drop the declaration (footprint grows by the waived peak). Removing the line is not a shortcut, and keeping it without a call is not an option.
• The structural path remains open per repository if an owner prefers to keep the waiver -- bosn, soldr and running-process all measured it and chose to drop instead; reld pre-emptively never adopted it.
• This issue owns the coordination only; per-repository changes stay in their own repos and PRs.