# Repositories and worktrees `repos` manages local repository checkouts operationally. It does not declare that discovered repositories form one software system. ```bash reckon repos discover --depth 4 --linked-worktrees=skip reckon repos init --dry-run reckon repos status reckon repos doctor reckon repos search "payment adapter" --root --items 25 --tokens 16384 --json ``` Use `--linked-worktrees=include` explicitly to include linked worktrees. Discovery is deterministic, bounded by depth, does not follow child symlinks, and does not prune Git metadata. Results distinguish: - a Git main worktree; - a Git linked worktree owned by that repository; - a repository nested inside another checkout; - stale linked-worktree metadata; - an unrelated repository under the same discovery root. Sibling location never establishes system membership or a relationship. `repos init` works sequentially and performs each live repository operation in a disposable process with a 768 MiB RSS ceiling. A worker that exceeds the ceiling or its deadline has its process group terminated, produces a repository-scoped failure, and does not prevent later repositories from being processed. JSON records the observed per-repository peak, enforced ceiling, and count of ceiling failures. The 50 ms RSS heartbeat is a bounded enforcement interval rather than a claim that transient allocation can never overshoot by one sample. Windows can terminate the worker process but cannot provide the same descendant process-group guarantee as macOS/Linux. Initialization supports `--dry-run` and preserves a healthy graph when only managed integration needs refreshing. Dry-run never starts a worker, opens a graph database, or loads a model. JSON output is versioned and never contains progress or deprecation messages. For large initialization runs, add `--manifest `. Reckon atomically records each completed repository after it succeeds. Repeating the identical command with the same manifest skips completed repositories and resumes the remaining deterministic sequence. A manifest is rejected if its repository selection, depth, or linked-worktree policy differs. `--dry-run` never writes the manifest. The single MCP gateway exposes equivalent `dryRun` and `manifestPath` arguments on `repositoryAction: "init"`. `reckon fleet init` is a deprecated compatibility alias for two minor releases. Its warning is written only for human output, never JSON/JSONL or MCP stdio. Repository inventory is portfolio health, not semantic federation. Configure cooperating components explicitly in `reckon.yaml`; use `reckon system validate` before system-scoped queries. ## Independent repository search `repos search` visits selected repositories sequentially, never establishes system membership, and never uses the legacy semantic-federation peer list. Use repeatable `--include ` and `--exclude ` filters. Results retain repository-scoped symbol/file identity, exact source evidence, confidence, graph freshness, and health. The default is fail closed: an uninitialized, empty, indexing, repair-required, lifecycle-degraded, or unknown selected graph makes the answer `unavailable`, not an ordinary zero-match result. `--allow-partial` returns `partial` and names every omitted repository and remediation. A healthy search with no matches is `no-match`. `--items`, `--bytes`, and `--tokens` are hard response budgets. A truncated response includes an opaque `--cursor` value for deterministic continuation. The cursor is bound to the query and stable selection and is rejected if reused for a different search. Versioned inventory records include stable identity, checkout classification, initialization and health, HEAD/index freshness, languages, package identities, configured system memberships, bounded documentation candidates, errors, and remediation. Local paths are personal output; team configuration contains only stable identities. A roadmap filename is only a candidate unless team configuration declares authority.