phase: filter out non-draft item in "draft root" The on-disk file can contain draft root that are descendants of secret root. The resulting phase computation is correct, but the phases root content is not. I will send another series to introduce code that remove some of the cases where this can happens, but we first need to damage control the existing case. After this changeset, we can no longer advertise secret changeset as draft root.