[zackees]

What

Removes pre-prune = true from [flow.main] — clud's only cache-writer flow — in ci.toml, and rewrites the two comments that described the waiver as active (the one above [flow.minimal], the one above [flow.main]) so they record why it is deliberately absent.

No budget, cardinality, family, max, per, or evict numbers were touched, and no workflow was added.

Why

zackees/ci.yml#352 added CACHE-034: a ci.toml flow declaring pre-prune = true waives CACHE-004's lockfile-change peak, and that waiver must correspond to a real ci-lint cache preprune call somewhere in the repository. clud declared it at ci.toml L128 with zero calls in any workflow, composite action, or ci/*.py script — so the waiver was unhonoured and the modelled footprint was understated by the entire peak term.

zackees/ci.yml#354 established the two honest fixes:

1. add the step — ci-lint cache preprune on a job holding actions: write, ordered ahead of the cache saves within the same run (same job, or an earlier needs: link; GitHub Actions has no cross-workflow barrier), or
2. drop the declaration so CACHE-004 counts the peak.

This PR takes (2), the remediation tracked as clud's checklist item in zackees/ci.yml#360.

Fleet precedent: zackees/bosn#533 and zackees/reld#219, both titled ci: drop the unhonoured pre-prune waiver (CACHE-034).

CACHE-004 modelled worst case: before vs after

uvx --from git+https://github.com/zackees/ci.yml@main ci-lint precheck --local, run from the repository root before and after the edit:

	formula applied	worst case	budget ([cache].budget)	fits?
before (waiver active)	worst = steady + [cache.pr].budget — every writer flow pre-prunes: lockfile peak waived	9,599,713,280 B	10,200,547,328 B (9.5GB)	yes
after (peak counted)	worst = steady + lockfile-change peak + [cache.pr].budget — not every writer flow pre-prunes	18,932,039,680 B	10,200,547,328 B (9.5GB)	over by 8,731,492,352 B

• steady total = 9,599,713,280 B
• lockfile-change peak = 9,332,326,400 B (compile 8,808,038,400 + deps 262,144,000 + cargoregistry 262,144,000)
• [cache.pr].budget = 0 B

Dropping the waiver does not make clud fit — it makes the number honest. The cardinality/max decision that closes that gap is zackees/clud#1800 and is deliberately out of scope here. #354's severity note calls out exactly this situation for soldr and running-process, whose waivers were also hiding an already-failing steady state, and names clud#1800 as the shared wall.

Verification

check	before	after
schema loads (no parse errors)	OK	OK
CACHE-034	1 NEEDS REVIEW	0 — cleared
CACHE-004	0 (waived)	1 VIOLATION — the honest overage above
total violations	1562	1563
total needs_review	26	25

Read this before approving: the diff is not zero-new-findings. diff of the per-rule histograms is exactly one-for-one:

>       1 [CACHE-004]
<       1 [CACHE-034]

So every other rule's count is unchanged — no pre-existing finding increased, disappeared, or was reclassified — but CACHE-034's NEEDS REVIEW is replaced by a new CACHE-004 VIOLATION. That is the expected and intended consequence of the honest fix: #354 states outright that removing the declaration "makes the modelled footprint larger, because the waived peak term comes back", and #360 carries the same note for soldr and running-process ("this PR clears CACHE-034 but a cardinality/max decision is still owed"). The finding is real, it is clud's to close through #1800, and it is not papered over by keeping a declaration nothing honours.

Repo-wide grep -E "pre-prune|preprune|pre_prune|CACHE-034|CACHE-004" returns hits only in ci.toml's own comments (the text this PR writes). No other file carries an active waiver.

Local gate

Not run — no Local-Gate: trailer. clud's local-gate.toml sets [gate] mode = "shadow": "Opt-in: an unattested PR head is reported, never failed. It simply runs every lane remotely, as before." The gate is a full bosn ci → act2 replay of the PR plan (static, dylint, clippy, build, unit) — a heavy, host-dependent run for a change that only edits ci.toml comments and removes one cache-policy flag, none of which those lanes exercise. The trailer is not faked; this PR runs the routine remote lanes as normal.