claude-code: memory carrying never leaves a memory folder, never takes the unreadable for gone, and screens every write (issue 367, review of #276)

A value in the state could name a project such as ../../.. and be written outside
the memory folder; a file or folder that could not be read was carried as a
removal; text kept over a removal or merged in a conflict reached the state
unscreened; and a conflict whose file could not be written was merged into the
state again on every look. Names are judged before any file is touched, what
cannot be read is kept and listed, every state write is screened, a conflict is
written to the file before the state and warns once when it cannot be, a file
changed between reading and writing is not written over, non-UTF-8 text is not
carried, and a node that was away takes a removal it holds no change against
(ADR 0343 §9, as clarified).

modules/claude-code/README.md

@@ -77,7 +77,8 @@ must see, a node that joins later included — kept, so it carries no secret eit
 
 A session started on another node starts with what the sessions on every other node learned (hq issue 367). The
 module's long-running process carries each project's memory folder, `~/.claude/projects/<project>/memory/`, and
-nothing else of the home:
+nothing else of the home. A project is one entry of the projects directory and a path is relative, no part empty,
+`.` or `..`: a value in the state naming anything else is never taken, and nothing is touched for it.
 
 - **Picked up** every ten seconds: a file whose text differs from the version last carried goes into the `memory`
   state. Not carried, and listed with why: a symbolic link, a file over 128 KiB or too large for one value once
@@ -92,7 +93,8 @@ nothing else of the home:
   the operator channel's `notify` (a warning, cleared when the file next changes without a conflict).
 - **A removal** of a carried file, from a folder that still exists, is a marker in the state for 30 days: a node still
   holding the removed version moves it into the copies; a node that changed it keeps it and carries it again. A
-  missing folder, a key the state lost and a deleted key remove nothing.
+  missing folder, a key the state lost and a deleted key remove nothing, and neither does a file or folder that
+  cannot be read on a look: it is kept everywhere and listed as not carried.
 - **The two home kinds never mix**: the operator's own homes carry among themselves, an agent account's among
   themselves (hq ADR 0266), so a confined agent's notes never reach a session run as the operator.
 - **No tool writes memory** (hq issue 340): `claude_code_memory` only lists what is carried — fingerprints, never the