Agent handover surface is lossy: `.claude/checkpoints/` prunes files and `developer/` is not a git repo

[hyperpolymath]

Summary

developer/.claude/checkpoints/ is the estate's agent-handover surface —
MEMORY.md names a file there as the resume-here pointer. That directory
loses files, and developer/ is not a git repository, so the loss is
unrecoverable.

Evidence (measured 2026-09-08)

1. A deliverable vanished inside one session.
2026-09-08-estate-settings-baseline.md (12,703 B, written 08:41) appeared in a
directory listing this afternoon and was absent ~20 minutes later.
find /home/hyperpolymath -name '*estate-settings-baseline*' returned nothing.

2. It is not one bad write — a peer hit it first and its fix died too.
The MEMORY.md resume-here line had already been rewritten by another session
to point at 2026-09-08-E1-RESUME-and-engine-repair.md, annotated "(on disk
15:28Z) … Replaces 3 earlier checkpoints, none of which exist on disk."
That replacement file is also gone.

3. The pointer rot is broad. Every .claude/checkpoints/... path referenced
across the agent memory files was tested for existence:

Referenced	Missing	Genuine (excl. 5 glob/placeholder artefacts)
36	13	~8

4. The pattern looks like rolling retention, not random loss. At the time of
audit only 5 named 2026-09-08-*.md checkpoints survived (3 rebuilt minutes
earlier, 2 written by peers minutes earlier), and the auto-timestamped
checkpoints only reached back ~50 minutes — earlier ones from 07:xx and 15:xx
were gone.

5. No recovery path. git check-ignore in developer/ returns "fatal: not
a git repository" and git ls-files returns 0. There is no object store to
fall back on. (A session-start banner may still report "Is a git repository:
true" — that is wrong, and worth not trusting.)

Why this matters more than it looks

A dead pointer is worse than a missing one. MEMORY.md still advertises the
path as authoritative, so the next session follows resume-here into nothing and
silently loses the parked state while believing it read it. Every campaign
parked "with an exact resume line" is parked in this directory.

Proposed handling

1. Durable state does not live only in .claude/checkpoints/. Anything that
   must survive to next week belongs on an issue/comment here, or in the agent
   memory directory (which has been stable), or both.
2. Keep primary evidence separate from prose. The 435-repo settings baseline
   was fully reconstructible only because its TSV/JSON ledgers sat outside that
   directory. Prose checkpoints should cite ledgers, not replace them.
3. test -f before writing an index line naming a checkpoint — write the
   file first, the pointer second.
4. Periodically re-audit every checkpoint path referenced from memory, and
   print the count checked (a loop that matches nothing prints a confident zero).
5. Decide whether the pruning is intended. If it is, .claude/checkpoints/ must
   stop being advertised as the handover surface.

[hyperpolymath]

Root cause found — it was a hook glob, not agent behaviour

Correcting the issue above: the mechanism is identified and already fixed.

~/.claude/hooks/precompact-checkpoint.sh, line 34, in the version live from
2026-08-27 00:36 until 2026-09-08 ~17:46Z:

ls -1t "$dir"/*.md 2>/dev/null | tail -n +21 | xargs -r rm -f

$dir is developer/.claude/checkpoints. The glob *.md matches every
markdown file in the directory, not just the hook's own auto-snapshots. So on
every compaction it deleted all but the 20 most recent files by mtime.

Named deliverables always lose that race: the hook writes a fresh
YYYY-MM-DDTHH-MM-SSZ.md snapshot on each compaction, 20 of those accumulate
within a few hours, and every hand-written checkpoint is pushed out.
2026-09-08-estate-settings-baseline.md was 10 hours old — its eviction was
certain, not incidental.

The fix (live, verified at line 34):

ls -1t "$dir"/????-??-??T??-??-??Z.md 2>/dev/null | tail -n +21 | xargs -r rm -f

This matches only the hook's own timestamped snapshots. Pre-fix copy preserved as
precompact-checkpoint.sh.bak-2026-09-08. Rotation verified still working and
now correctly scoped.

Two corrections this forces

1. A recorded "model honesty" failure was misdiagnosed. The agent memory
carried the pattern "summaries assert checkpoint files that are not on disk",
filed as a model claiming a write it never performed. That diagnosis was
wrong. The writes happened; the hook ate them. This matters: the wrong
diagnosis teaches future sessions to distrust their own truthful tool results.

2. Every named checkpoint written before ~16:00Z on 2026-09-08 is gone,
across all sessions — not just one. Any issue, memory file or summary citing a
named checkpoint older than that should be assumed to point at nothing until
test -f says otherwise.

What still stands from the issue above

• developer/ is not a git repository — verified, git ls-files returns 0.
  There is no object store behind that directory, so the 20-file window is a
  retention policy over unbacked data.
• A named checkpoint is now safe because the glob no longer matches it, not
  because the directory is durable. Durable state should still be written to an
  issue/comment or to the agent memory directory.
• Keeping primary evidence (TSV/JSON ledgers) outside that directory is what
  made the deleted 435-repo baseline fully reconstructible. Prose checkpoints
  should cite ledgers, not replace them.

Credit for the diagnosis: the developer folder cleanup session found and fixed
the glob.