v0.31.7

update.sh

@@ -3,7 +3,7 @@ set -euo pipefail
 
 ROOT="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
 
-KEEP_RELEASES=3
+KEEP_RELEASES=2
 KEEP_BACKUPS=3
 
 prune_directories() {
@@ -12,6 +12,7 @@ prune_directories() {
     local protected="${3:-}"
     local kept=0
     local entry
+    local sorted
     local name
 
     [[ -d "$base" ]] || return 0
@@ -25,7 +26,10 @@ prune_directories() {
         kept=1
     fi
 
-    while IFS= read -r -d '' entry; do
+    while IFS= read -r -d '' sorted; do
+        # find prints a numeric mtime sort key before the actual path. Never
+        # pass that sort key to rm (the old updater did, so nothing was freed).
+        entry="${sorted#* }"
         name="${entry##*/}"
 
         if [[ -n "$protected" && "$name" == "$protected" ]]; then
@@ -90,6 +94,41 @@ cleanup_installed_releases() {
     prune_directories "$releases" "$KEEP_RELEASES" "$current_release"
 }
 
+# Cargo keeps critical fingerprints, build scripts and compiled deps in target/.
+# Never remove these: doing so would trigger a full rebuild. Only stale
+# incremental state can be reclaimed, after a successful managed update.
+cleanup_safe_cargo_target() {
+    local target="${CARGO_TARGET_DIR:-$ROOT/target}"
+    local profile item
+    if [[ "$target" != /* ]]; then target="$ROOT/$target"; fi
+    [[ -d "$target" && ! -L "$target" ]] || return 0
+    # Reject targets with symlinked ancestor paths; never follow links.
+    if [[ "$(realpath -ms -- "$target")" != "$(realpath -e -- "$target" 2>/dev/null || true)" ]]; then
+        printf 'WARNING: target cleanup skipped for symlinked target: %s\n' "$target" >&2
+        return 0
+    fi
+    command -v flock >/dev/null 2>&1 || return 0
+    for profile in release debug; do
+        [[ -d "$target/$profile" && ! -L "$target/$profile" ]] || continue
+        # Cargo itself uses this file as its profile build lock. Skip if
+        # another build is using it, instead of competing with cargo.
+        exec {cargo_lock_fd}>>"$target/$profile/.cargo-lock"
+        if ! flock -n -x "$cargo_lock_fd"; then
+            exec {cargo_lock_fd}>&-
+            continue
+        fi
+        if [[ -d "$target/$profile/incremental" && ! -L "$target/$profile/incremental" ]]; then
+            while IFS= read -r -d '' item; do
+                [[ -d "$item" && ! -L "$item" ]] || continue
+                printf 'Removing stale Cargo incremental state: %s\n' "$item"
+                rm -rf -- "$item"
+            done < <(find "$target/$profile/incremental" -mindepth 1 -maxdepth 1 -type d -mtime +30 -print0)
+        fi
+        flock -u "$cargo_lock_fd"
+        exec {cargo_lock_fd}>&-
+    done
+}
+
 cleanup_source_backups() {
     local target="$1"
     local backup_dir
@@ -152,4 +191,6 @@ if command -v flock >/dev/null 2>&1; then
     exec {cleanup_lock_fd}>&-
 else
     printf 'WARNING: flock unavailable; retention cleanup skipped\n' >&2
-fi
+fi
+# This cleanup does not remove any Cargo dependency/compiler artifacts.
+cleanup_safe_cargo_target