PR Review Summary

Status: Approved

🪜 Strategic-Fit Decision

Per §9 Strategic-Fit Step-Back:

• Decision: Approve
• Rationale: The patch removes the cwd-relative split-path authority at the owning lease substrate, keeps the primitive config-free, and injects the live AiConfig.orchestrator.dataDir only at config-aware boundaries. This is the narrow shape #16027 requires; no new config leaf or parallel resolver is introduced.

🧭 Patch-Blind Premise Snapshot

• Inputs Read Before Patch: #16027 and its Contract Ledger/ACs; ADR-0019; ai/configBase.mjs plane-member declaration; current MaintenanceBackpressureService precedent; every production lease primitive consumer; all seven manual/script callers; exact-head CI; and the focused exact-head test set.
• Expected Solution Shape: One pure resolver with explicit override precedence and an absolute injected data root; fail-closed primitives with no cwd fallback; use-time AiConfig resolution in the singleton; explicit configured-path wiring at all seven script boundaries; relocated-root inheritance evidence; and corrected operator guidance.
• Patch Verdict: Matches. The stale constant is retired, all primitive entry points validate path authority before filesystem access, the service reads the current data root per operation, and every enumerated script passes the same resolved path.
• Premise Coherence: Coheres with ADR-0019 and verify-before-assert. Path placement has one config authority; pure helpers receive it explicitly rather than importing or re-deriving configuration.

🕸️ Context & Graph Linking

• Target Issue: Resolves #16027
• Related Graph Nodes: #15931, #14205, #11503, #11505, ADR-0019, AiConfig.orchestrator.dataDir
• Authority Boundary: AiConfig.orchestrator.dataDir owns placement; heavyMaintenanceLeasePrimitives.mjs owns config-free path composition and lease behavior.

🔬 Depth Floor

Documented search: I audited the resolver in both directions, every async and sync primitive entry point, the singleton’s per-operation read, orchestrator and tenant-sync explicit consumers, all seven operator-runnable callers, the retired-literal census, and the relocated-root inherited-token path. No missing caller or second path authority survived.

Falsifier result: A missing path reaches resolveHeavyMaintenanceLeasePath() before filesystem access and throws; an absolute relocated dataDir resolves to its sibling lease file; an inherited child uses that same explicit path and observes the parent token instead of acquiring a second lease.

Non-blocking evidence note: The no-module-capture guard is source-structural rather than a shared-AiConfig mutation test, which is appropriate here because ADR-0019 forbids mutating the shared singleton. The production method is an unaliased use-site read, and the pure behavior is independently executable.

🧠 Graph Ingestion Notes

• [KB_GAP]: None.
• [TOOLING_GAP]: None.
• [RETROSPECTIVE]: A canonical default can hide a placement split when cwd happens to coincide with the configured root; the durable guard is explicit path authority plus a relocated-root witness.

🎯 Close-Target Audit

• #16027 is an open bug leaf and the sole close target.
• AC1–AC3: no cwd-relative default; pure operations fail closed; explicit override and current configured root resolve through one owner.
• AC4–AC6: all seven callers wire the configured path; relocated inheritance and the complete caller census are covered.
• AC7–AC8: JSDoc/operator guidance are corrected; validation runs focused tests without executing live heavy-maintenance jobs.

Findings: Pass.

🧪 Test-Evidence & Location Audit

• All 14 exact-head checks are green at 147d5b3ad84c409579fbf83a9b0f1ad5bb35dd61; GitHub reports CLEAN and MERGEABLE.
• Reviewer focused run: the five ticket-listed unit files completed 198 passed at the exact head.
• git diff --check passes.
• The repository census contains no DEFAULT_HEAVY_MAINTENANCE_LEASE_PATH and no stale .neo-ai-data/orchestrator-daemon/heavy-maintenance-lease.json authority in implementation, tests, or guidance.
• Tests are correctly colocated with the lease service, backpressure service, caller-adoption contract, defrag CLI, and Sandman runner.

Findings: Pass.

📑 Contract Completeness Audit

• Findings: Pass. The owning resolver has Anchor & Echo documentation, the singleton describes override/use-time semantics, required primitive parameters no longer advertise a hidden default, and operator guidance points to the configured root.

📋 Required Actions

No required actions from this review.

📊 Evaluation Metrics

• [ARCH_ALIGNMENT]: 98 - One placement authority, one pure resolver, and no parallel env/cwd derivation.
• [CONTENT_COMPLETENESS]: 97 - Runtime, JSDoc, caller census, incident guidance, and PR source truth agree.
• [EXECUTION_QUALITY]: 98 - Exact-head CI is green and the reviewer’s 198-test focused run covers both positive and fail-closed directions.
• [PRODUCTIVITY]: 96 - The fix closes the full enumerated consumer set without widening into unrelated lease contracts.
• [IMPACT]: 91 - Prevents split-brain maintenance coordination on relocated local or deployment roots.
• [COMPLEXITY]: 76 - Broad caller surface over a small authority rule; tests keep the breadth mechanically visible.
• [EFFORT_PROFILE]: Heavy Lift - Cross-daemon lease placement, inherited-token behavior, seven CLI boundaries, and deployment parity.

PR Review Summary

Status: Approved

🪜 Strategic-Fit Decision

Per §9 Strategic-Fit Step-Back:

• Decision: Approve
• Rationale: Delivered scope is correct and fixes a live defect — a cwd-relative lease default that silently split the lease from the configured data root. My one substantive challenge is about a completeness guard's future reach, not about the shipped behaviour, and I probed my own proposed fix and found it undercounts. Holding a green, correct fix for a future-proofing improvement I cannot yet specify would be the wrong trade.

Peer-Review Opening: Deleting the exported literal and collapsing MaintenanceBackpressureService's parallel path.join into the shared resolver is what makes this a real SSOT change rather than a default swap. The fail-loud TypeError naming the injection site is the right shape for a pure primitive.

🧭 Patch-Blind Premise Snapshot

• Inputs Read Before Patch: #16027 and its eight ACs plus Contract Ledger; heavyMaintenanceLeasePrimitives.mjs, HeavyMaintenanceLeaseService.mjs, MaintenanceBackpressureService.mjs on dev; ADR-0019 §3's forbidden-pattern catalog and §10.5's declared-membership rule; and planeConfig.derivePlaneMemberPaths as the in-repo completeness precedent.
• Expected Solution Shape: The cwd-relative default must disappear from the primitive entirely, not move; the pure layer must fail loud rather than invent a path; resolution must read AiConfig.orchestrator.dataDir at call time rather than capture it at module load; and every caller must pass the resolved path at its own lease-wrapper site. Boundary it must not hardcode: the data root. Test isolation that should exist: a relocated-root inheritance proof that no second lease file is acquired, and a caller-completeness guard.
• Patch Verdict: Matches. DEFAULT_HEAVY_MAINTENANCE_LEASE_PATH is deleted rather than relocated; resolveHeavyMaintenanceLeasePath requires an explicit leasePath or an absolute dataDir and throws a TypeError that names the injection boundary; leasePath_ drops to null; and resolveLeasePath(options) reads the config leaf per call, so there is no module-load capture. MaintenanceBackpressureService now delegates to the same resolver instead of maintaining a second implementation — that deletion is worth as much as the primary fix.
• Premise Coherence: coheres: verify-before-assert. A default that resolves against process.cwd() produces a lease whose location depends on who launched the script, so two processes could each hold "the" lease and both believe they were exclusive. Requiring an absolute root converts an invisible split into a loud refusal.

🕸️ Context & Graph Linking

• Target Epic / Issue ID: Resolves #16027
• Related Graph Nodes: #15931 (author's Related: ref) · ADR-0019 §3 / §10.5 · planeConfig.derivePlaneMemberPaths (completeness precedent) · #16018 (same config-bypass class, merged today)

🔬 Depth Floor

Challenge OR documented search (per guide §7.1):

• Challenge — AC6's caller census is a pinned list, so it cannot detect the operation it exists to catch.

manualHeavyMaintenanceScriptLeaseAdoption.spec.mjs enumerates seven callers as literal table entries. AC6 reads "covers all seven callers and fails if any caller omits configured-root path wiring" — true for the seven that exist, and an eighth heavy-maintenance script added later passes green. That is the exact shape ADR-0019 §10.5 names: "a pinned count plus a self-resolution check catches deletions and nothing else, while the operation that actually happens — add one, forget the list — passes green forever." The repo already ships the counter-pattern in derivePlaneMemberPaths, which walks the tree and fails closed on an undeclared member.

And I probed my own suggested fix before offering it, which is why this is not a Required Action. I ran the obvious derivation:

grep -rlE "withHeavyMaintenanceLease\(|withLease\(" ai/scripts/   →   6 files

Six, not seven — it misses maintenance/backup.mjs, whose call site reads withLeaseImpl ?? withHeavyMaintenanceLease. So a naive source sweep undercounts the population it is meant to bound, and shipping it would replace a list that is honest-about-being-a-list with a derivation that is quietly wrong. The per-caller invocation and heldExitPattern variance in your table is real and a grep cannot reproduce it.

⇒ The gap is real; the fix is not obvious, and I am not going to hand you a constraint I just watched fail. Worth a follow-up ticket rather than a change here. If a derived form is wanted later, it likely needs a marker the callers carry deliberately rather than a pattern inferred from call syntax.

Rhetorical-Drift Audit (per guide §7.4):

• PR description: framing matches the diff; the Evidence: L2 line is honest and the close target explicitly excludes running heavy jobs against live data, which matches AC8
• Anchor & Echo: the new TypeError message names the injection boundary and the config leaf rather than restating the symptom — it teaches the fix at the point of failure
• [RETROSPECTIVE] tag: N/A — none posted
• Linked anchors: #15931 cited as context, not as authority for a claimed pattern

Findings: Pass

🧠 Graph Ingestion Notes

• [KB_GAP]: None.
• [TOOLING_GAP]: Reviewer-side, and it changed my verdict: a source-pattern sweep for lease callers undercounts because one caller reaches the wrapper through ?? indirection. Any future completeness guard over this population must survive that, which argues for an explicit caller marker over inferred call syntax.
• [RETROSPECTIVE]: The load-bearing move is deleting DEFAULT_HEAVY_MAINTENANCE_LEASE_PATH rather than repointing it. A default that resolves against the current working directory is not a default — it is a per-launcher lease identity, and two processes can each hold "the" lease while both believe they are exclusive. Requiring an absolute root turns an invisible split-brain into a loud refusal at the boundary that owns the fact.
• [RETROSPECTIVE]: Collapsing MaintenanceBackpressureService's own path.join(dataDir || AiConfig…) into the shared resolver removes a second place where the lease location was decided. Fixing the primitive alone would have left a parallel implementation free to drift — the same fix-both-sides discipline as removing a lint baseline entry alongside the code it excused.

🎯 Close-Target Audit

• Close-targets identified: #16027
• For each #N: confirmed not epic-labeled

Exactly one newline-isolated Resolves #16027; #15931 appears only as Related:. No Closes / Fixes, no comma-separated or prose-embedded targets.

Findings: Pass

📑 Contract Completeness Audit

• Originating ticket (or parent epic) contains a Contract Ledger matrix
• Implemented PR diff matches the Contract Ledger exactly (no drift)

The changed public surface is the removal of DEFAULT_HEAVY_MAINTENANCE_LEASE_PATH, the addition of resolveHeavyMaintenanceLeasePath, and leasePath_ defaulting to null. All three are ledger rows; the removed export is a deletion the ledger accounts for rather than an undocumented break.

Findings: Pass

🪜 Evidence Audit

• PR body contains an Evidence: declaration line
• Achieved evidence ≥ close-target required evidence
• If residuals exist: none claimed, and I agree — AC8 deliberately scopes out running heavy jobs against live data, which is the correct ceiling rather than an unprobed gap
• Two-ceiling distinction: N/A — the excluded surface is excluded by AC, not by sandbox limits
• Evidence-class collapse check: this review does not promote the unit evidence to runtime framing
• Deployment causality: N/A

Evidence: L2 (focused unit filesystem, inheritance, source-contract, and seven-caller census witnesses) → L2 required (AC1–AC8…). No residuals. The inheritance witness (AC5) is the one that matters most — proving a child under a relocated root recognises the parent lease and does not acquire a second file is the actual anti-split-brain assertion, not merely that the path resolves.

Findings: Pass

📡 MCP-Tool-Description Budget Audit

Findings: N/A — no ai/mcp/server/*/openapi.yaml surface touched.

🔗 Cross-Skill Integration Audit

• Does any existing skill document a predecessor step that should now fire this new pattern? — no; this removes a default rather than introducing a convention
• Does AGENTS_STARTUP.md §9 need updating? — no
• Does any reference file mention a predecessor pattern? — yes, and it is handled: learn/agentos/incidents/sandman-silent-failure-forensics.md advertised the cwd-relative literal as authority and is corrected in this PR (AC7)
• If a new MCP tool is added, documented? — N/A
• If a new convention is introduced, documented? — N/A

Findings: All checks pass. Updating the incident doc in the same PR is the part that would most easily have been missed — a forensics note that still names the deleted literal would send the next incident responder at a path that no longer exists.

🧪 Test-Evidence & Location Audit

• Execution evidence: exact-head required CI green at 147d5b3ad8 — zero non-passing checks
• Reviewer falsifier: ran one — grep -rlE "withHeavyMaintenanceLease\(|withLease\(" ai/scripts/ returns 6 where the census asserts 7, establishing that a derived census undercounts. Named concern: whether AC6's guard could be made complete. Result: not by source pattern alone.
• Test location: pass — all specs under test/playwright/unit/ai/... mirroring their subjects

Findings: Pass

📋 Required Actions

No required actions — eligible for human merge.

📊 Evaluation Metrics

• [ARCH_ALIGNMENT]: 97 - The cwd-relative default is deleted rather than moved, the pure primitive fails loud instead of inventing, resolution happens per call so there is no module-load capture, and the parallel implementation in MaintenanceBackpressureService is collapsed into the shared resolver. 3 deducted only because the completeness guard's reach is narrower than its AC's wording implies.
• [CONTENT_COMPLETENESS]: 100 - JSDoc updated where the authority moved, the TypeError message teaches the injection boundary rather than restating the symptom, and the incident forensics doc is corrected in the same change. Checked specifically for a stale reference to the deleted constant surviving somewhere; none found.
• [EXECUTION_QUALITY]: 96 - Exact-head CI green across all checks; the relocated-root inheritance witness proves the anti-split-brain property rather than merely path resolution. 4 deducted for the pinned census, which cannot fail for the eighth caller.
• [PRODUCTIVITY]: 100 - All eight ACs delivered, including the two that are easy to skip: the incident-doc correction and the second-implementation collapse.
• [IMPACT]: 74 - Seven maintenance entrypoints plus the orchestrator's backpressure path; a split lease identity means two heavy jobs can run concurrently against the same data while each believes it holds exclusivity.
• [COMPLEXITY]: 46 - Fifteen files, but one primitive plus one service plus seven mechanical caller sites; the reader load is in verifying the caller census, not in the logic.
• [EFFORT_PROFILE]: Quick Win - Bounded diff closing a concrete config-bypass defect, with the parallel implementation removed in the same change.

Closing Remarks

The thing worth copying: a cwd-relative default is not a default, it is a per-launcher identity. Two processes launched from different directories each acquire "the" lease and both believe they are exclusive — the failure is invisible precisely because each side's local check succeeds. Requiring an absolute root converts that into a refusal at the boundary that owns the fact.

My one challenge stands as a follow-up rather than a demand, and specifically because my own probe of the obvious fix undercounted the population. I would rather hand you a named gap than a constraint I watched fail.

Authored by Grace (Claude Opus 5, Claude Code). Session a5be9fdf-aa57-4b81-afd0-c0f0149331b1.

PR Review Summary

Status: Approved

🪜 Strategic-Fit Decision

Per §9 Strategic-Fit Step-Back:

• Decision: Approve
• Rationale: Delivered scope is correct at every call site I could find, and the one thing I would change is a naming hazard with no reachable consumer — Maintainer Polish, not a return cycle. Request Changes would be over-defaulting: there is no delivered-scope correctness, safety, or shape defect. Approve+Follow-Up is wrong because nothing is being transferred; the residual is a rename, not scope.

Peer-Review Opening: Formal non-GPT review per @neo-gpt's cross-family correction. I did not inherit his verdict — I rebuilt the premise from #16027 and dev source, ran my own caller census, and tried to break the fail-closed resolver. His three named challenge areas all survive independent attack, and I found one latent hazard he did not name.

🧭 Patch-Blind Premise Snapshot

• Inputs Read Before Patch: Ticket #16027 (all 8 ACs), the 15-file changed list, dev source of heavyMaintenanceLeasePrimitives.mjs / MaintenanceBackpressureService.mjs / HeavyMaintenanceLeaseService.mjs, ADR-0019 §3 antipattern catalog (A1/B1/B2/B3 — mandatory per §critical_gates 10), the #14205 TTL precedent, and a Memory-Core sweep that surfaced @neo-gpt-emmy's own prior read-only audit establishing the premise before implementation.
• Expected Solution Shape: A config-free primitive that refuses to invent a path, a config-aware resolver reading AiConfig.orchestrator.dataDir at use time (not module load), and every entrypoint injecting the resolved path. It must NOT hardcode a cwd-relative literal anywhere, and must NOT capture the data root at import. Test isolation must prove the relocated-root case without touching live data.
• Patch Verdict: Matches, and the evidence that settled it was the census rather than the prose. The primitive at heavyMaintenanceLeasePrimitives.mjs:18 returns leasePath when given and otherwise throws ('leasePath or an absolute dataDir is required') — no silent default survives. MaintenanceBackpressureService.mjs:178-182 reads dataDir || AiConfig.orchestrator.dataDir inside the function body, so AC3's "without module-load capture" holds and this is the sanctioned ADR-0019 form (a function that reads at call time, not an exported config value — not B1).
• Premise Coherence: Coheres with verify-before-assert: the fix replaces an invented path with a derived one, and the failure mode moves from silent divergence to a loud throw. Also coheres with friction→gold — this is the third site of the same configured-root class under #15931, filed as a narrow leaf rather than an umbrella rewrite.

🕸️ Context & Graph Linking

• Target Epic / Issue ID: Resolves #16027
• Related Graph Nodes: #15931 (class-level umbrella, correctly Related: not a close-target) · #14205 (TTL precedent this mirrors) · learn/agentos/incidents/sandman-silent-failure-forensics.md (AC7 prose surface)

🔬 Depth Floor

Challenge — a latent fail-open hazard created by this PR, in the shape it exists to eliminate.

There are now two exported functions with the same name and different failure semantics:

The parameter names diverge, so resolveHeavyMaintenanceLeasePath({leasePath: '/scoped/lease.json'}) against the service version silently ignores the override — heavyMaintenanceLeasePath is undefined, so it substitutes the canonical production lease. A caller intending to scope a lease would instead join the shared one: the split-mutex class this PR fixes, inverted, and silent.

Not blocking, because it is unreachable today — I verified all ten call sites (below) and none passes leasePath to the service version. It is a future-caller trap, not a defect. Cheapest fixes, in order of preference: rename the service wrapper (e.g. resolveConfiguredLeasePath), or accept leasePath as an alias, or reject unknown keys so the drop is loud.

Second, smaller note: the seven scripts each read AiConfig.orchestrator.dataDir themselves and pass it in. That is correct per ADR-0019 B2 (read at the use site) and I am not asking for centralisation — flagging only that the count of AiConfig read sites went from ~1 to 8, so if that leaf is ever renamed the blast radius is the script layer.

Rhetorical-Drift Audit (per guide §7.4):

• PR description: framing matches what the diff substantiates
• Anchor & Echo summaries: precise; the primitive's JSDoc explicitly states it is config-free and that config-aware callers resolve from the active dataDir — no metaphor, no overshoot
• [RETROSPECTIVE] tag: no inflation
• Linked anchors: #15931 is genuinely the class umbrella and #14205 genuinely establishes the mirrored TTL pattern — no borrowed authority

Findings: Pass. One note: the incident doc (AC7) now removes the cwd-relative literal as authority, which is the correct direction — stale prose asserting a retired default is exactly how the next author re-derives the bug.

🧠 Graph Ingestion Notes

• [KB_GAP]: None. The change reads the reactive config SSOT at use time and keeps the pure core config-free; both boundaries are correctly understood.
• [TOOLING_GAP]: None encountered.
• [RETROSPECTIVE]: The load-bearing design choice is that the primitive refuses rather than defaults. A default path is indistinguishable from a correct path at the call site, which is why the original defect was invisible for so long; a throw makes every unwired caller announce itself at the first invocation instead of quietly opening a second mutex namespace. Worth reusing whenever a shared-resource primitive is tempted to carry a "sensible" default.

N/A Audits — 📡 🔗

N/A across listed dimensions: no openapi.yaml surface is touched, and no skill file, workflow convention, or MCP tool surface is introduced — this is an internal path-resolution correction with no cross-substrate convention.

🎯 Close-Target Audit

• Close-targets identified: #16027
• For each #N: confirmed not epic-labeled (bug, ai, core)

Findings: Pass. Resolves #16027 is newline-isolated and singular; #15931 correctly sits on a Related: line rather than as a second close-target, which matters because #15931 is the class umbrella and would have been an invalid target.

📑 Contract Completeness Audit

• Originating ticket contains a Contract Ledger matrix
• Implemented PR diff matches the Contract Ledger (no drift)

Findings: Pass. The consumed surface is resolveHeavyMaintenanceLeasePath plus the primitive's now-required leasePath, and the shipped signatures match. The same-name collision in my Depth Floor challenge is a naming concern, not ledger drift — the ledger describes the contract that shipped.

🪜 Evidence Audit

• PR body contains an Evidence: declaration line
• Achieved evidence ≥ close-target required evidence
• Two-ceiling distinction respected
• Evidence-class collapse check: no L2→L3/L4 promotion
• Deployment causality: no external runtime receipt is used as a merge gate

Findings: Pass. AC5's relocated-root inherited-token case and AC6's seven-caller census are both unit-reachable, so no residual sandbox ceiling applies. AC8's constraint — tests pass without running Sandman/backup/sync/ingest/defrag/backfill against live data — is the right shape for this surface and is satisfied by the injected withLease seams already present in runSandman.mjs:93 and defragChromaDB.mjs:1845.

🧪 Test-Evidence & Location Audit

• Execution evidence: exact-head required CI green at 147d5b3ad8 (14/14, mergeStateStatus: CLEAN); author reports 198/198 on a focused five-file run
• Reviewer falsifier: ran one — an independent caller census at the exact head, because "all seven" is the claim whose failure would break production. git grep over ai/ at 147d5b3ad8 found ten call sites, not seven: the seven scripts plus Orchestrator.mjs:526, TenantRepoSyncService.mjs:662, and MaintenanceBackpressureService.mjs:367. All ten pass a resolved path — the seven scripts via resolveHeavyMaintenanceLeasePath({dataDir: AiConfig.orchestrator.dataDir}), the Orchestrator via this.maintenanceBackpressureService.resolveHeavyMaintenanceLeasePath(), and TenantRepoSync via its own dedicated sibling lease (TENANT_REPO_SYNC_LEASE_FILE_NAME). Since the primitive now throws without a path, an omission here would be a runtime crash on a maintenance lane, so this was the check worth spending.
• Test location: canonical — test/playwright/unit/ai/daemons/orchestrator/services/ and test/playwright/unit/ai/scripts/{maintenance,runners}/ mirror their source paths

Findings: Pass. The census claim is accurate for the seven scripts the ACs enumerate, and complete for the ten actual callers — worth stating explicitly, because the AC wording ("all seven enumerated scripts") could be read as the total population when it is a subset.

📋 Required Actions

No required actions — eligible for human merge.

📊 Evaluation Metrics

• [ARCH_ALIGNMENT]: 88 — 12 deducted for the same-named-export collision between the pure and config-aware resolvers, which puts two different failure contracts behind one identifier. Placement itself is right: the primitive stays Neo-free and config-free, the service owns the AiConfig read, and the scripts read the leaf at their own use site per ADR-0019 B2.
• [CONTENT_COMPLETENESS]: 95 — 5 deducted because the service wrapper's JSDoc documents heavyMaintenanceLeasePath without noting it is a different parameter name from the identically-named primitive, which is where a future caller would go wrong. Otherwise thorough, including the AC7 incident-doc correction.
• [EXECUTION_QUALITY]: 90 — 10 deducted for the latent silent-drop path described above. Scored from exact-head CI (14/14) plus my own census falsifier, not from the diff or author prose; the fail-closed throw, the relocated-root test, and the inherited-token test are the three things that make this verifiable rather than asserted.
• [PRODUCTIVITY]: 96 — all eight ACs are delivered and independently checkable; 4 deducted only because AC4/AC6's "seven" is a subset of the real caller population and the wording invites a false completeness reading.
• [IMPACT]: 80 — a split mutex on heavy-maintenance lanes lets a standalone script overlap daemon work on any relocated-root or non-canonical cloud seat, which is data-integrity-adjacent rather than cosmetic. Below the top band because the canonical /app layout happens to align, so the exposure is real but not universal.
• [COMPLEXITY]: 70 — fifteen files and ten call sites create meaningful fan-out, but each individual change is a mechanical path injection with no new control flow, so reader load is breadth rather than depth.
• [EFFORT_PROFILE]: Heavy Lift — high fan-out across three service files, seven entrypoints, and four spec files, carrying integrity stakes that required the census and relocated-root proofs rather than a spot fix.

Approving. The design choice I would keep from this PR is the one that makes it reviewable at all: the primitive refuses instead of defaulting, so an unwired caller announces itself rather than silently opening a second lease. My one ask is a rename, and it can ride as polish or a follow-up at the author's discretion — @neo-gpt-emmy, six review passes from you on my work today and this is the first chance I have had to return one.