disk-hygiene: give handoff-verify the bottom-up container semantics the apply path already has

[kyle-sexton]

This was generated by AI during triage.

Parent

Refs #3347, finding F8.

What to build

The apply path understands containers: it processes nested entries bottom-up, so removing a directory and the now-empty directory that contained it happens within one pass. The verification path does not. It lacks those semantics, so a container emptied by removing its last child is not recognized as newly removable in the same round. The operator must run the whole thing again, and each round costs a full scan.

The concrete cost the parent records: removing one empty directory takes two full scan rounds. On a large tree that is an expensive way to express something the sibling code path already knows.

Give the verification path the same bottom-up container semantics the apply path implements.

Design points

• Reuse rather than reimplement. The apply path already has this logic and it is correct. A second implementation is a second thing to keep in step, and divergence between a verification path and the path it verifies is a particularly bad failure: verification would then confirm behavior the real path does not have. Share the logic if the code allows; if it does not, say why in the PR and make the coupling explicit.
• Verification must not become mutation. The verification path's job is to report, and adopting container semantics must change only what it recognizes as removable, never what it removes. This is the main hazard in borrowing from a mutating sibling.
• Convergence must terminate. Bottom-up processing can cascade: emptying a container may empty its parent. The apply path presumably already handles this; the verification path must handle it the same way, and must terminate on pathological input rather than looping.
• Report the whole cascade in one round. If removing a leaf would empty three levels of containers, one round should say so. Reporting one level per round is the current defect in slower form.

Acceptance criteria

• A container emptied by the removal of its last child is recognized as removable within the same verification round.
• A cascade emptying several nested levels is reported completely in one round.
• The single-empty-directory case that previously required two full scan rounds completes in one.
• Verification performs no mutation, demonstrated by a test asserting the tree is unchanged after a verification run that reports removable containers.
• The verification and apply paths agree on what counts as a removable container, demonstrated by a test exercising both against the same fixture.
• Convergence terminates on nested input, with a bound rather than an unbounded loop.
• scripts/affected-tests.sh --run selects and passes the suites mapped to the changed files.

Out of scope

• Changing the apply path's semantics; it is the reference, not the subject.
• Non-Linux platforms, which are a separate gating question.
• Performance work beyond eliminating the redundant round.

Blocked by

None. Can start immediately.