@indigoai-us/hq-cloud 6.11.12 → 6.11.13

package/src/cli/rescue-core.ts

@@ -694,6 +694,7 @@ function doRescue(
     unchangedList,
     appendLog,
     out,
+    decisions: [],
     actions: [],
   };
 
@@ -728,16 +729,19 @@ function doRescue(
   }
 
   // --- Walk + classify (PHASE 1: read-only) ---
-  // Classification mutates nothing on disk: every destructive op (delete,
-  // rescue-move, conflict-quarantine, symlink-drop) is recorded as a deferred
-  // closure in `ctx.actions` and executed later (PHASE 2). This is the
+  // Classification mutates nothing on disk: every outcome is recorded as a
+  // typed RescueDecision. Destructive ops (delete, rescue-move,
+  // conflict-quarantine, symlink-drop) are built from those decisions and
+  // executed later (PHASE 2). This is the
   // ordering-safety invariant: if classification throws partway through the
   // wipe set (e.g. an unreadable entry, a future unhandled file shape), it
-  // aborts HERE — before a single file has been touched — instead of leaving a
-  // half-applied wipe like the pre-port bash classifier did (DEV-1767:
+  // aborts HERE — before a single file has been touched or even queued as a
+  // filesystem closure — instead of leaving a half-applied wipe like the
+  // pre-port bash classifier did (DEV-1767:
   // `Error: Path is a directory` on a nested dir-symlink, thrown after ~10 core
-  // files were already deleted). Dry-run runs this exact same pass and then
-  // returns, so the `--check` plan can never miss a condition the live pass hits.
+  // files were already deleted). Dry-run renders each typed decision inline as
+  // the walk records it, preserving the legacy progress/fault timing while
+  // still sharing the same classify path as the live pass.
   out("\n");
   if (wipeToplevel.length === 0) {
     out("==> Wipe set is empty; nothing to process or overlay.\n");
@@ -813,6 +817,7 @@ function doRescue(
   // Actions run in classification (walk) order — the same order the old
   // interleaved walk mutated in — so per-file output and on-disk results are
   // unchanged versus before the two-phase split.
+  ctx.actions = buildRescueActions(ctx);
   applyClassifiedActions(ctx, backupDir);
 
   // --- Back up preserve-subpaths to a mktemp shuttle ---
@@ -1076,7 +1081,7 @@ interface WalkCtx {
   historyFloor: string;
   baselineMode: "history_floor" | "head_compare";
   // Batched git results, precomputed once before the classify walk so
-  // processOne does map lookups instead of spawning git ~3x per file. On a
+  // classifyOne does map lookups instead of spawning git ~3x per file. On a
   // large wipe set, process-startup overhead dominates and this is the
   // difference between minutes and seconds. A rel absent from a map falls back
   // to a per-file spawn (safety for paths that can't be batched line-delimited,
@@ -1089,12 +1094,17 @@ interface WalkCtx {
   floorShas?: Map<string, string | null>;
   runTs: string;
   srcSha: string;
-  // Deferred destructive ops, collected during the (read-only) classification
-  // walk and executed only AFTER the entire wipe set has been classified
-  // without error (PHASE 2 in doRescue). This is what makes a classifier crash
-  // fail-safe — a throw mid-classify aborts before a single file is mutated, so
-  // the wipe is never left half-applied (DEV-1767). Dry-run never fills this (it
-  // returns after classification), so live + dry-run share one classify path.
+  // Read-only classifier output, collected in walk order. Dry-run rendering is
+  // emitted inline as each decision is recorded; live filesystem action
+  // construction is derived from this same list only after the full classify
+  // walk completes.
+  decisions: RescueDecision[];
+  // Deferred destructive ops, built from RescueDecision only AFTER the entire
+  // wipe set has been classified without error (PHASE 2 in doRescue). This is
+  // what makes a classifier crash fail-safe — a throw mid-classify aborts before
+  // a single file is mutated, so the wipe is never left half-applied
+  // (DEV-1767). Dry-run never fills this (it returns after classification), so
+  // live + dry-run share one classify path.
   actions: RescueAction[];
   counts: {
     userOnly: number;
@@ -1118,13 +1128,45 @@ interface RescueAction {
   run: () => void;
 }
 
-function queueAction(
-  ctx: WalkCtx,
-  label: string,
-  affectedRels: string[],
-  runAction: () => void,
-): void {
-  ctx.actions.push({ label, affectedRels, run: runAction });
+export type RescueDecision =
+  | { kind: "skip"; rel: string }
+  | { kind: "drop-conflict-artifact"; rel: string }
+  | { kind: "drop-script-managed"; rel: string }
+  | { kind: "drop-reindex-symlink"; rel: string; target: string }
+  | { kind: "user-only"; rel: string }
+  | { kind: "cloud-symlink-reconciled"; rel: string }
+  | { kind: "drift-reconciled"; rel: string }
+  | { kind: "user-edit-diff-append"; rel: string }
+  | { kind: "user-edit-overwrite-safe"; rel: string }
+  | { kind: "user-edit-conflict"; rel: string }
+  | { kind: "user-edit-rescue"; rel: string; target: string }
+  | { kind: "unchanged-preserve"; rel: string }
+  | { kind: "unchanged-delete"; rel: string }
+  | { kind: "wholesale-replace-template"; rel: "companies/_template" };
+
+function recordDecision(ctx: WalkCtx, decision: RescueDecision): void {
+  ctx.decisions.push(decision);
+  if (ctx.cfg.dryRun) renderDryRunDecision(ctx, decision);
+  switch (decision.kind) {
+    case "drop-reindex-symlink":
+      ctx.counts.symlinkDropped += 1;
+      return;
+    case "user-only":
+      ctx.counts.userOnly += 1;
+      return;
+    case "cloud-symlink-reconciled":
+      ctx.counts.cloudSymlinkReconciled += 1;
+      return;
+    case "drift-reconciled":
+      ctx.counts.driftReconciled += 1;
+      return;
+    case "unchanged-preserve":
+    case "unchanged-delete":
+      ctx.counts.unchanged += 1;
+      return;
+    default:
+      return;
+  }
 }
 
 function applyClassifiedActions(ctx: WalkCtx, backupDir: string): void {
@@ -1294,16 +1336,16 @@ function isOverwriteSafe(rel: string): boolean {
   );
 }
 
-function isMasterSyncSymlink(localPath: string): boolean {
+function masterSyncSymlinkTarget(localPath: string): string | null {
   const st = lstatOrNull(localPath);
-  if (!st || !st.isSymbolicLink()) return false;
+  if (!st || !st.isSymbolicLink()) return null;
   let tgt = "";
   try {
     tgt = fs.readlinkSync(localPath);
   } catch {
-    return false;
+    return null;
   }
-  return tgt.includes("/personal/") || tgt.startsWith("personal/");
+  return tgt.includes("/personal/") || tgt.startsWith("personal/") ? tgt : null;
 }
 
 function isUnderPreserve(cfg: Config, rel: string): boolean {
@@ -1556,14 +1598,13 @@ function conflictOne(ctx: WalkCtx, rel: string): void {
   ctx.appendLog(`conflicted\t${rel}\t-> ${destRel}\n`);
 }
 
-// --- classify + act on one file (the per-file workhorse) ---
+// --- classify one file (the per-file workhorse) ---
 //
-// Read-only by contract: this records intent (counts + dry-run plan lines +
-// deferred `ctx.actions` closures) but never mutates the filesystem itself. The
-// closures are run later by the PHASE 2 apply loop, only once the whole wipe
-// set has classified without throwing. Keep it that way — a stray `fs.rmSync`
-// here re-opens the half-applied-wipe hole this split closed (DEV-1767).
-function processOne(ctx: WalkCtx, rel: string): void {
+// Read-only by contract: this returns a RescueDecision only. It does not render
+// dry-run text, update action queues, or mutate the filesystem. Dry-run text is
+// rendered by recordDecision, and PHASE 2 action building happens only once the
+// whole wipe set has classified without throwing. Keep it that way.
+function classifyOne(ctx: WalkCtx, rel: string): RescueDecision {
   const { cfg } = ctx;
   const localPath = path.join(ctx.hqRoot, rel);
   const srcPath = path.join(ctx.srcDir, rel);
@@ -1574,54 +1615,27 @@ function processOne(ctx: WalkCtx, rel: string): void {
     throw new Error(`rescue classifier fault injected at ${rel} (HQ_RESCUE_FAULT_AT_REL)`);
   }
 
-  if (isUnderPreserve(cfg, rel)) return;
+  if (isUnderPreserve(cfg, rel)) return { kind: "skip", rel };
 
   // Conflict-resolution artifacts (`<name>.conflict-<ts>-<peer>.<ext>`).
   const base = rel.includes("/") ? rel.slice(rel.lastIndexOf("/") + 1) : rel;
   if (/\.conflict-/.test(base)) {
-    if (cfg.dryRun) {
-      ctx.out(`    drop conflict artifact: ${rel}\n`);
-    } else {
-      queueAction(ctx, `drop conflict artifact: ${rel}`, [rel], () =>
-        fs.rmSync(localPath, { force: true }),
-      );
-    }
-    return;
+    return { kind: "drop-conflict-artifact", rel };
   }
 
   // Script-managed files: core/core.yaml + legacy core.yaml.
   if (rel === "core/core.yaml" || rel === "core.yaml") {
-    if (cfg.dryRun) {
-      ctx.out(`    skip script-managed (rewrites at stamp step): ${rel}\n`);
-    } else {
-      queueAction(ctx, `drop script-managed: ${rel}`, [rel], () =>
-        fs.rmSync(localPath, { force: true }),
-      );
-    }
-    return;
+    return { kind: "drop-script-managed", rel };
   }
 
   // Symlinks (mid-tree).
   const lst = lstatOrNull(localPath);
   if (lst && lst.isSymbolicLink()) {
-    if (isMasterSyncSymlink(localPath)) {
-      ctx.counts.symlinkDropped += 1;
-      if (cfg.dryRun) {
-        let tgt = "";
-        try {
-          tgt = fs.readlinkSync(localPath);
-        } catch {
-          /* ignore */
-        }
-        ctx.out(`    drop reindex symlink: ${rel}  ->  ${tgt}\n`);
-      } else {
-        queueAction(ctx, `drop reindex symlink: ${rel}`, [rel], () => {
-          fs.rmSync(localPath, { force: true });
-          ctx.appendLog(`symlink-dropped\t${rel}\t(reindex regenerable)\n`);
-        });
-      }
+    const target = masterSyncSymlinkTarget(localPath);
+    if (target !== null) {
+      return { kind: "drop-reindex-symlink", rel, target };
     }
-    return;
+    return { kind: "skip", rel };
   }
 
   // Is path in upstream HEAD?
@@ -1652,9 +1666,7 @@ function processOne(ctx: WalkCtx, rel: string): void {
 
   // USER-ONLY: unknown to upstream (HEAD AND floor both lack it).
   if (inHead === 0 && inFloor === 0) {
-    ctx.counts.userOnly += 1;
-    if (cfg.dryRun) ctx.out(`    user-only (leave in place): ${rel}\n`);
-    return;
+    return { kind: "user-only", rel };
   }
 
   // Path is/was in upstream. Determine if user edited it.
@@ -1679,99 +1691,186 @@ function processOne(ctx: WalkCtx, rel: string): void {
 
   // Cloud-update reclassification.
   if (userEdited === 1 && isCloudFlattenedSymlinkEquiv(ctx, rel, localPath)) {
-    ctx.counts.cloudSymlinkReconciled += 1;
-    if (cfg.dryRun) {
-      ctx.out(
-        `    cloud-symlink reconciled (unchanged): ${rel}  (hq-symlink: marker matches upstream target)\n`,
-      );
-    } else {
-      queueAction(ctx, `cloud-symlink reconciled: ${rel}`, [rel], () => {
-        fs.rmSync(localPath, { force: true });
-        ctx.appendLog(
-          `cloud-symlink-reconciled\t${rel}\t(hq-symlink: marker matches upstream target; overlay re-lays symlink)\n`,
-        );
-      });
-    }
-    return;
+    return { kind: "cloud-symlink-reconciled", rel };
   }
 
   // Convergence guard: drifted from floor but identical to upstream HEAD.
   if (userEdited === 1 && inHead === 1 && bytesEqual(localPath, srcPath)) {
-    ctx.counts.driftReconciled += 1;
-    if (cfg.dryRun) {
-      ctx.out(`    drift reconciled (identical to upstream HEAD; no rescue): ${rel}\n`);
-    } else {
-      queueAction(ctx, `drift reconciled: ${rel}`, [rel], () => {
-        fs.rmSync(localPath, { force: true });
-        ctx.appendLog(
-          `drift-reconciled\t${rel}\t(identical to upstream HEAD; drifted from floor only — no personal/ copy)\n`,
-        );
-      });
-    }
-    return;
+    return { kind: "drift-reconciled", rel };
   }
 
   if (userEdited === 1) {
-    if (cfg.dryRun) {
-      if (rel === ".claude/CLAUDE.md") {
-        ctx.out(`    user-edit (diff-append): ${rel}  ->  personal/CLAUDE.md\n`);
-        ctx.counts.userEdit += 1;
-      } else if (isOverwriteSafe(rel)) {
-        ctx.out(`    user-edit (overwrite-safe): ${rel}  ->  upstream wins (no copy preserved)\n`);
-        ctx.counts.userOverwrite += 1;
-      } else if (isConflictClass(rel)) {
-        ctx.out(`    user-edit (conflict): ${rel}  ->  .hq-conflicts/rescue-${ctx.runTs}/${rel}\n`);
-        ctx.counts.userConflict += 1;
-      } else {
-        ctx.out(`    user-edit (rescue): ${rel}  ->  ${mapRescueTarget(rel)}\n`);
-        ctx.counts.userEdit += 1;
-      }
-    } else {
-      if (rel === ".claude/CLAUDE.md") {
-        queueAction(ctx, `rescue diff-append: ${rel}`, [rel], () =>
-          rescueOne(ctx, rel),
+    if (rel === ".claude/CLAUDE.md") {
+      return { kind: "user-edit-diff-append", rel };
+    }
+    if (isOverwriteSafe(rel)) {
+      return { kind: "user-edit-overwrite-safe", rel };
+    }
+    if (isConflictClass(rel)) {
+      return { kind: "user-edit-conflict", rel };
+    }
+    return { kind: "user-edit-rescue", rel, target: mapRescueTarget(rel) };
+  }
+
+  // user_edited=0: matches floor baseline. Split on byte-equality to HEAD.
+  if (bytesEqual(localPath, path.join(ctx.srcDir, rel))) {
+    return { kind: "unchanged-preserve", rel };
+  }
+  return { kind: "unchanged-delete", rel };
+}
+
+function renderDryRunDecision(ctx: WalkCtx, decision: RescueDecision): void {
+  switch (decision.kind) {
+    case "skip":
+      break;
+    case "drop-conflict-artifact":
+      ctx.out(`    drop conflict artifact: ${decision.rel}\n`);
+      break;
+    case "drop-script-managed":
+      ctx.out(`    skip script-managed (rewrites at stamp step): ${decision.rel}\n`);
+      break;
+    case "drop-reindex-symlink":
+      ctx.out(`    drop reindex symlink: ${decision.rel}  ->  ${decision.target}\n`);
+      break;
+    case "user-only":
+      ctx.out(`    user-only (leave in place): ${decision.rel}\n`);
+      break;
+    case "cloud-symlink-reconciled":
+      ctx.out(
+        `    cloud-symlink reconciled (unchanged): ${decision.rel}  (hq-symlink: marker matches upstream target)\n`,
+      );
+      break;
+    case "drift-reconciled":
+      ctx.out(`    drift reconciled (identical to upstream HEAD; no rescue): ${decision.rel}\n`);
+      break;
+    case "user-edit-diff-append":
+      ctx.out(`    user-edit (diff-append): ${decision.rel}  ->  personal/CLAUDE.md\n`);
+      ctx.counts.userEdit += 1;
+      break;
+    case "user-edit-overwrite-safe":
+      ctx.out(`    user-edit (overwrite-safe): ${decision.rel}  ->  upstream wins (no copy preserved)\n`);
+      ctx.counts.userOverwrite += 1;
+      break;
+    case "user-edit-conflict":
+      ctx.out(
+        `    user-edit (conflict): ${decision.rel}  ->  .hq-conflicts/rescue-${ctx.runTs}/${decision.rel}\n`,
+      );
+      ctx.counts.userConflict += 1;
+      break;
+    case "user-edit-rescue":
+      ctx.out(`    user-edit (rescue): ${decision.rel}  ->  ${decision.target}\n`);
+      ctx.counts.userEdit += 1;
+      break;
+    case "unchanged-preserve":
+      ctx.out(`    unchanged (preserved in place): ${decision.rel}\n`);
+      break;
+    case "unchanged-delete":
+      ctx.out(`    unchanged (delete + replace): ${decision.rel}\n`);
+      break;
+    case "wholesale-replace-template":
+      ctx.out("    wholesale-replace: companies/_template (template carve-out)\n");
+      break;
+  }
+}
+
+function buildRescueActions(ctx: WalkCtx): RescueAction[] {
+  const actions: RescueAction[] = [];
+  const add = (label: string, affectedRels: string[], runAction: () => void) => {
+    actions.push({ label, affectedRels, run: runAction });
+  };
+
+  for (const decision of ctx.decisions) {
+    const localPath = path.join(ctx.hqRoot, decision.rel);
+    switch (decision.kind) {
+      case "skip":
+      case "user-only":
+        break;
+      case "drop-conflict-artifact":
+        add(`drop conflict artifact: ${decision.rel}`, [decision.rel], () =>
+          fs.rmSync(localPath, { force: true }),
         );
-      } else if (isOverwriteSafe(rel)) {
-        queueAction(ctx, `overwrite-safe: ${rel}`, [rel], () => {
+        break;
+      case "drop-script-managed":
+        add(`drop script-managed: ${decision.rel}`, [decision.rel], () =>
+          fs.rmSync(localPath, { force: true }),
+        );
+        break;
+      case "drop-reindex-symlink":
+        add(`drop reindex symlink: ${decision.rel}`, [decision.rel], () => {
+          fs.rmSync(localPath, { force: true });
+          ctx.appendLog(`symlink-dropped\t${decision.rel}\t(reindex regenerable)\n`);
+        });
+        break;
+      case "cloud-symlink-reconciled":
+        add(`cloud-symlink reconciled: ${decision.rel}`, [decision.rel], () => {
+          fs.rmSync(localPath, { force: true });
+          ctx.appendLog(
+            `cloud-symlink-reconciled\t${decision.rel}\t(hq-symlink: marker matches upstream target; overlay re-lays symlink)\n`,
+          );
+        });
+        break;
+      case "drift-reconciled":
+        add(`drift reconciled: ${decision.rel}`, [decision.rel], () => {
+          fs.rmSync(localPath, { force: true });
+          ctx.appendLog(
+            `drift-reconciled\t${decision.rel}\t(identical to upstream HEAD; drifted from floor only — no personal/ copy)\n`,
+          );
+        });
+        break;
+      case "user-edit-diff-append":
+        add(`rescue diff-append: ${decision.rel}`, [decision.rel], () =>
+          rescueOne(ctx, decision.rel),
+        );
+        break;
+      case "user-edit-overwrite-safe":
+        add(`overwrite-safe: ${decision.rel}`, [decision.rel], () => {
           fs.rmSync(localPath, { force: true });
           ctx.counts.userOverwrite += 1;
-          ctx.appendLog(`overwritten\t${rel}\t(overwrite-safe; upstream wins, no copy preserved)\n`);
+          ctx.appendLog(
+            `overwritten\t${decision.rel}\t(overwrite-safe; upstream wins, no copy preserved)\n`,
+          );
         });
-      } else if (isConflictClass(rel)) {
-        queueAction(ctx, `conflict quarantine: ${rel}`, [rel], () =>
-          conflictOne(ctx, rel),
+        break;
+      case "user-edit-conflict":
+        add(`conflict quarantine: ${decision.rel}`, [decision.rel], () =>
+          conflictOne(ctx, decision.rel),
         );
-      } else {
-        queueAction(ctx, `rescue: ${rel}`, [rel], () => rescueOne(ctx, rel));
-      }
-    }
-  } else {
-    // user_edited=0: matches floor baseline. Split on byte-equality to HEAD.
-    ctx.counts.unchanged += 1;
-    if (bytesEqual(localPath, path.join(ctx.srcDir, rel))) {
-      if (cfg.dryRun) {
-        ctx.out(`    unchanged (preserved in place): ${rel}\n`);
-      } else {
-        queueAction(ctx, `preserve unchanged: ${rel}`, [], () => {
-          fs.appendFileSync(ctx.unchangedList, `/${rel}\n`);
-          ctx.appendLog(`unchanged\t${rel}\t(identical to upstream; left in place, mtime preserved)\n`);
+        break;
+      case "user-edit-rescue":
+        add(`rescue: ${decision.rel}`, [decision.rel], () => rescueOne(ctx, decision.rel));
+        break;
+      case "unchanged-preserve":
+        add(`preserve unchanged: ${decision.rel}`, [], () => {
+          fs.appendFileSync(ctx.unchangedList, `/${decision.rel}\n`);
+          ctx.appendLog(
+            `unchanged\t${decision.rel}\t(identical to upstream; left in place, mtime preserved)\n`,
+          );
         });
-      }
-    } else {
-      if (cfg.dryRun) {
-        ctx.out(`    unchanged (delete + replace): ${rel}\n`);
-      } else {
-        queueAction(ctx, `delete unchanged: ${rel}`, [rel], () => {
+        break;
+      case "unchanged-delete":
+        add(`delete unchanged: ${decision.rel}`, [decision.rel], () => {
           fs.rmSync(localPath, { force: true });
-          ctx.appendLog(`deleted\t${rel}\t(unchanged vs baseline; re-laid by overlay if still upstream)\n`);
+          ctx.appendLog(
+            `deleted\t${decision.rel}\t(unchanged vs baseline; re-laid by overlay if still upstream)\n`,
+          );
         });
-      }
+        break;
+      case "wholesale-replace-template":
+        add("wholesale-replace: companies/_template", [decision.rel], () =>
+          fs.rmSync(path.join(ctx.hqRoot, "companies", "_template"), {
+            recursive: true,
+            force: true,
+          }),
+        );
+        break;
     }
   }
+
+  return actions;
 }
 
 // --- walk a wipe-set root ---
-// Precompute the per-file git facts processOne needs, in two batched passes
+// Precompute the per-file git facts classifyOne needs, in two batched passes
 // instead of ~3 `git` spawns per file. Process-startup overhead (~15-20ms per
 // spawn) dominates the per-file path, so on a large wipe set this turns a
 // minutes-long classify into a seconds-long one. Behaviour is identical: the
@@ -1779,10 +1878,10 @@ function processOne(ctx: WalkCtx, rel: string): void {
 // rel not represented in a map falls back to its original per-file spawn.
 //
 // Mirrors walkAndProcess's enumeration so the batched set matches what actually
-// reaches processOne: it skips `companies/_template` (wholesale-replaced, never
+// reaches classifyOne: it skips `companies/_template` (wholesale-replaced, never
 // classified per-file) and top-level symlinks (dropped, never classified).
 function precomputeGitMaps(ctx: WalkCtx, wipeToplevel: string[]): void {
-  const allRels: string[] = []; // every rel that reaches processOne (files + symlinks)
+  const allRels: string[] = []; // every rel that reaches classifyOne (files + symlinks)
   const fileRels: string[] = []; // subset that are regular files (hashable)
   const fileAbs: string[] = []; // parallel to fileRels
 
@@ -1798,7 +1897,7 @@ function precomputeGitMaps(ctx: WalkCtx, wipeToplevel: string[]): void {
         : [];
     for (const rel of rels) {
       // A path containing a newline can't survive line-delimited batch stdin;
-      // leave it out of the maps and let processOne spawn per-file for it.
+      // leave it out of the maps and let classifyOne spawn per-file for it.
       if (rel.includes("\n")) continue;
       allRels.push(rel);
       const st = lstatOrNull(path.join(ctx.hqRoot, rel));
@@ -1809,7 +1908,7 @@ function precomputeGitMaps(ctx: WalkCtx, wipeToplevel: string[]): void {
     }
   }
 
-  // In head_compare mode processOne never consults these maps (it compares
+  // In head_compare mode classifyOne never consults these maps (it compares
   // bytes against the upstream working tree directly), so skip both git passes.
   if (ctx.baselineMode !== "history_floor") {
     ctx.floorShas = new Map();
@@ -1846,7 +1945,7 @@ function precomputeGitMaps(ctx: WalkCtx, wipeToplevel: string[]): void {
   ctx.floorShas = floorShas;
 
   // Pass 2: local blob SHA, but ONLY for regular files that are in the floor.
-  // processOne reads localShas exclusively in the `inFloor === 1` branch, so a
+  // classifyOne reads localShas exclusively in the `inFloor === 1` branch, so a
   // file absent from the floor (e.g. the transient `.claude/worktrees/` trees,
   // which classify as user-only) never needs a hash — and hashing it would mean
   // reading its bytes for nothing. Restricting the hash set to floor members is
@@ -1877,22 +1976,12 @@ function precomputeGitMaps(ctx: WalkCtx, wipeToplevel: string[]): void {
 }
 
 function walkAndProcess(ctx: WalkCtx, rootRel: string): void {
-  const { cfg } = ctx;
   const rootAbs = path.join(ctx.hqRoot, rootRel);
   if (!lexists(rootAbs)) return;
 
   // companies/_template — wholesale-replace.
   if (rootRel === "companies/_template") {
-    if (cfg.dryRun) {
-      ctx.out("    wholesale-replace: companies/_template (template carve-out)\n");
-    } else {
-      queueAction(ctx, "wholesale-replace: companies/_template", [rootRel], () =>
-        fs.rmSync(path.join(ctx.hqRoot, "companies", "_template"), {
-          recursive: true,
-          force: true,
-        }),
-      );
-    }
+    recordDecision(ctx, { kind: "wholesale-replace-template", rel: "companies/_template" });
     return;
   }
 
@@ -1900,35 +1989,22 @@ function walkAndProcess(ctx: WalkCtx, rootRel: string): void {
 
   // Top-level symlink.
   if (lst && lst.isSymbolicLink()) {
-    if (isMasterSyncSymlink(rootAbs)) {
-      ctx.counts.symlinkDropped += 1;
-      if (cfg.dryRun) {
-        let tgt = "";
-        try {
-          tgt = fs.readlinkSync(rootAbs);
-        } catch {
-          /* ignore */
-        }
-        ctx.out(`    drop reindex symlink: ${rootRel}  ->  ${tgt}\n`);
-      } else {
-        queueAction(ctx, `drop reindex symlink: ${rootRel}`, [rootRel], () => {
-          fs.rmSync(rootAbs, { force: true });
-          ctx.appendLog(`symlink-dropped\t${rootRel}\t(reindex regenerable)\n`);
-        });
-      }
+    const target = masterSyncSymlinkTarget(rootAbs);
+    if (target !== null) {
+      recordDecision(ctx, { kind: "drop-reindex-symlink", rel: rootRel, target });
     }
     return;
   }
 
   // Top-level regular file.
   if (lst && lst.isFile()) {
-    processOne(ctx, rootRel);
+    recordDecision(ctx, classifyOne(ctx, rootRel));
     return;
   }
 
   // Top-level directory: recursive walk, pruning node_modules + nested .git.
   for (const rel of findFilesAndSymlinks(rootAbs, ctx.hqRoot)) {
-    processOne(ctx, rel);
+    recordDecision(ctx, classifyOne(ctx, rel));
   }
 }