---
name: purge-not-rm-for-perch-state
description: "FEEDBACK 2026-08-04 (operator) — tear disposable endpoints down with `spt endpoint purge`, never `rm -rf` on the owlery perch dir. rm leaves the records purge owns."
metadata: 
  node_type: memory
  type: feedback
  originSessionId: d6211a93-5b64-4d57-ac63-6cc25cbed57c
  modified: 2026-08-05T02:51:40.047Z
---

**Tear an endpoint down with the tool's own verb: `spt endpoint purge <id> --force`. Never `rm -rf`
the owlery perch directory.**

Operator correction (2026-08-04), given while I was writing a disposable-probe teardown that ended
with `rm -rf "$OWLERY/$ID"`.

**Why:** `purge --force` deletes **all** of an endpoint's records — its own warning enumerates them:
"perch tree, context branches, registry + trust rows" — and stops it first if it is running. An
`rm -rf` deletes only the on-disk perch tree and leaves everything else behind, so the node keeps
registry and trust rows pointing at an endpoint whose files are gone. That is strictly worse than
doing nothing: a half-removed endpoint is invisible to `ls` but still real to spt. The rm was also
redundant — purge had already removed the tree.

Same family as [[adapter-record-dir-hazard]] (never `rm` `adapters/<name>/` — Pointer-mode
`record.toml` lives there; recover via `adapter add --release`). The general rule: **spt owns state in
more places than the directory you can see. Use the removal verb, not the filesystem.**

**How to apply:**
- Disposable-probe teardown order: kill the spawned process by cmdline match → `spt endpoint stop`
  → `echo y | spt endpoint purge <id> --force`. Confirm with `PURGED:<id>` and a roster count of 0.
- Never add `rm -rf "$OWLERY/$ID"` as a "belt and braces" step after purge. It cannot help — purge
  already removed the tree — and if purge FAILED, the rm hides that failure by removing the only
  visible evidence while the registry rows survive.
- Applies to the existing ints too: several carry this `rm -rf` in cleanup as a legacy step
  (`bind-int.sh`, `wake-survival-int.sh`, `multi-subnet-bringup-int.sh`). Strip it when touching them.
- Disposable ids stay per-run unique and never a live agent's id
  ([[worker-perch-leak-diagnosis]], REQ-HAZARD-PERCH-COLLISION).