From 2def86baf7c86b3664f105acd5aa4e344673f6a2 Mon Sep 17 00:00:00 2001
From: Codex Bot <codex-bot@gitea.entroia.local>
Date: Sat, 31 Oct 2026 04:11:09 +0800
Subject: [PATCH] Inventory tagged images across tasks before scoped cleanup

---
 .../creative-browser-diagnostics.yml          | 27 +++++++------------
 1 file changed, 10 insertions(+), 17 deletions(-)

diff --git a/.gitea/workflows/creative-browser-diagnostics.yml b/.gitea/workflows/creative-browser-diagnostics.yml
index 359a13a..984db11 100644
--- a/.gitea/workflows/creative-browser-diagnostics.yml
+++ b/.gitea/workflows/creative-browser-diagnostics.yml
@@ -1,27 +1,20 @@
-name: runner old dangling image cache recovery
+name: runner tagged image ownership inventory
 on:
   push:
     branches: [codex/creative-browser-diagnosis]
 jobs:
   diagnose:
     runs-on: ces-control
-    timeout-minutes: 15
+    timeout-minutes: 10
     steps:
-      - name: Reclaim old untagged unused image cache without volumes or tagged releases
+      - name: Inventory tagged image repositories and container references without deleting
         run: |
           set -euo pipefail
           df -h /
-          echo 'Dangling image cache count (before age filtering)'
-          docker image ls -q --filter dangling=true | sort -u | wc -l
-          python3 -u - <<'PY'
-          import json,subprocess,shutil,time,urllib.request
-          before=shutil.disk_usage('/').free
-          # Default dangling-only mode. Do not add --all or use system/volume prune.
-          subprocess.run(['docker','image','prune','--force','--filter','until=24h'],check=True)
-          time.sleep(5)
-          after=shutil.disk_usage('/').free
-          print('DANGLING RECOVERY '+json.dumps({'beforeFreeBytes':before,'afterFreeBytes':after,'netRecoveredBytes':after-before}),flush=True)
-          with urllib.request.urlopen('http://8.211.154.134:18131/api/health',timeout=20) as response:
-           print('PUBLIC HEALTH '+response.read().decode(),flush=True)
-          PY
-          df -h /
+          docker image ls --no-trunc --format 'IMAGE {{json .}}'
+          ids=$(docker ps -aq)
+          if [ -n "$ids" ]; then
+            docker inspect --format 'CONTAINER {{.Name}} status={{.State.Status}} image={{.Image}} tag={{.Config.Image}} project={{with index .Config "Labels"}}{{index . "com.docker.compose.project"}}{{end}}' $ids
+          fi
+          echo 'DEPLOYMENT ROOT DIRECTORIES (names only)'
+          find /opt -mindepth 1 -maxdepth 2 -type d -print