Workspace handoff staging aborts when an ignored runtime root exists: exclude pathspec misses the directory entry #281

Summary

captureWorkspaceTree / captureWorkspacePatch abort with a non-zero git add when a gitignored runtime root such as node_modules exists at the workspace root. The exclude pathspecs cover the directory's contents but not the directory entry, so git add -A -- . still names the ignored path and git fails.

Confirmed live in the Aave v4 invariant-only run R44.

Evidence

Run aave-v4-v0012-main-issue272-r44-invariant-only (main 77da78a, image im-01KZBJ546AZANSE7RNBY35A9DG). Node property-specification-a16z failed at 2026-08-06T14:14Z with:

Command failed: git add -A -- . :(exclude).ultrafuzz/** :(exclude).smithers/** :(exclude)node_modules/** :(exclude)artifacts/**
The following paths are ignored by one of your .gitignore files:
node_modules
hint: Use -f if you really want to add them.

Counts at that point: 13 succeeded / 1 failed / 1 running / 17 pending. The other property-specification lenses on the same run were unaffected, so this reproduces only when that particular worktree actually contains node_modules — i.e. when the node's agent installed dependencies. That intermittency is why it survives most runs.

Cause

packages/runtime/src/workspace-handoff.ts:133-139

function stageWorkspaceTree(workspaceRoot: string, index: string): void {
  runGit(
    workspaceRoot,
    ["add", "-A", "--", ".", ...WORKSPACE_RUNTIME_ROOTS.map((root) => `:(exclude)${root}/**`)],
    index
  );
}

with WORKSPACE_RUNTIME_ROOTS = [".ultrafuzz", ".smithers", "node_modules", "artifacts"] (:21).

:(exclude)node_modules/** excludes paths under node_modules, not node_modules itself. git add -A -- . therefore still matches the directory entry, and because it is ignored git exits non-zero rather than skipping it.

Impact

The failure surfaces as a genuinely failed node, so it is retryable and less severe than #275 — but property-specification-fanin depends on all eight lens nodes, so a lens that fails deterministically in its own worktree blocks the invariant pipeline from ever reaching fan-in, invariant setup, Recon, findings or report.md.

Expected fix

Exclude the runtime root entry as well as its contents (:(exclude)<root> alongside :(exclude)<root>/**), or stage from an explicit path list rather than a broad add -A pathspec.

Regression test: create a workspace containing an ignored node_modules directory at the root and assert captureWorkspaceTree / captureWorkspacePatch succeed rather than throwing.

Relationship to #254

Draft PR #254 already proposes "stage workspace handoff patches from an explicit Git path list instead of broad add pathspecs" and "filter runtime roots before staging so ignored dependency/runtime directories do not abort patch capture", which would cover this. That PR bundles eight unrelated changes, so a narrow fix for this specific abort is likely easier to land and review than reviving the bundle.