mover-os 4.7.8 → 4.7.10

package/src/dashboard/lib/distribution-parser.js

@@ -3,7 +3,7 @@
 const fs = require("fs");
 const path = require("path");
 const { dailiesDir } = require("./paths");
-const { localDateKey, localMidnight } = require("./date-utils");
+const { localDateKey, sessionMidnight } = require("./date-utils");
 
 // distribution-parser.js — F30. Heuristic scan of Daily Notes session logs
 // for distribution-action keywords. Buckets by day. Returns 30-day rolling
@@ -27,39 +27,98 @@ const KEYWORDS = [
   /\bDM'?(?:d|ed)\b/i,
   /\bsent (?:\d+ )?(?:DMs?|emails?|outreach|messages?|cold)\b/i,
   /\breached out\b/i,
-  /\breply[- ]seed(?:ing|ed)?\b/i,
+  // reply seeding: PERFORMED forms only. The bare "reply-seeding" noun matched
+  // every strategy sentence that discussed the channel ("reply-seeding should
+  // be primary", "70% X reply-seeding") and made an all-planning week read as
+  // 8 receipts (terra Evidence walk, 2026-07-12).
+  /\breply[- ]seeded\b/i,
+  /\b(?:sent|posted|did|dropped)\b[^.\n]{0,40}\breply[- ]seeds?\b/i,
+  /\breply[- ]seeds?\b[^.\n]{0,30}\b(?:sent|posted|done)\b/i,
   // replies count only when aimed at a person/audience surface, not code review
   /\breplied?\b[^.\n]{0,50}\b(?:lead|prospect|customer|buyer|DM|thread|tweet|comment)\b/i,
   /\btweeted\b/i,
 ];
 
+// A clause that matches a KEYWORD is still NOT a receipt when it is talk
+// ABOUT distribution rather than a report of doing it. Three failure classes
+// from the 2026-07-12 terra Evidence walk, where ALL 8 of the week's counted
+// "receipts" were prose (two literally said "the reel never shipped"):
+//   negation        — "the reel never shipped", "reply seed not posted"
+//   plan/modal      — "reply-seeding should be primary", "will post", "70% X"
+//   meta-discussion — strategy docs, reviews, corpus analysis mentioning reels
+// Undercount over inflate: a rejected real receipt costs a pip; a counted
+// fake receipt makes the product lie on its own honesty surface.
+const NOT_A_RECEIPT = [
+  // bare "zero" over-blocked ("the false-zero bug"); only "zero <artifact>"
+  // is a negation ("sent zero DMs").
+  /\b(?:never|not|didn'?t|hasn'?t|wasn'?t|won'?t|isn'?t|couldn'?t|unshipped|unfilmed|unsent|unposted)\b/i,
+  /\bzero (?:DMs?|reels?|posts?|replies|tweets?|threads?|outreach)\b/i,
+  /\b(?:should|would|will|must|needs? to|plan(?:s|ned|ning)?|intend|gonna|tomorrow|next (?:week|step)|queued|owed|blocked|pending|drafted|commitment|deadline)\b/i,
+  /\b(?:strategy|doc|playbook|corpus|harvest|review|audit|analys\w*|research|parser?|keyword|counted|counter|allocation|weight|copy|evidence|rework|redesign|mandate)\b/i,
+  // "No reel shipped" / "no thread posted" — capital-No negation the \bnot\b
+  // class misses.
+  /\bno (?:reels?|tweets?|threads?|posts?|DMs?|articles?|outreach)\b/i,
+  /%/,
+  // A question is never a receipt ("| Twitter thread published? |" template
+  // checklist rows counted for weeks in March).
+  /\?/,
+];
+function isReceiptClause(frag) {
+  if (!KEYWORDS.some((re) => re.test(frag))) return false;
+  return !NOT_A_RECEIPT.some((re) => re.test(frag));
+}
+
 function compute({ vault, daysLookback = 30 } = {}) {
   if (!vault) return { available: false, days: [], todayCount: null, total7d: null, total30d: null, delta7d: null };
   const dDir = dailiesDir(vault);
   if (!fs.existsSync(dDir)) return { available: false, days: [], todayCount: null, total7d: null, total30d: null, delta7d: null };
 
-  const today = localMidnight();
+  // Session-day anchor (T245): before 05:00 "today" is still yesterday's
+  // session, same convention daily-note-resolver uses — otherwise the 2am
+  // outreach a user is actively logging shows todayCount 0 (R5-A).
+  const today = sessionMidnight();
   const days = [];
   for (let i = 0; i < daysLookback; i++) {
-    const d = new Date(today.getTime() - i * 24 * 3600 * 1000);
+    // setDate (not ms arithmetic): a fixed 24h step skips one calendar day
+    // across a DST spring-forward and shifts the rest of the window (R5-A).
+    const d = new Date(today.getTime());
+    d.setDate(d.getDate() - i);
     const key = localDateKey(d);
     const monthDir = key.slice(0, 7);
     const fpath = path.join(dDir, monthDir, `Daily - ${key}.md`);
     let count = 0;
+    // The actual matched clauses, so Evidence can show REAL receipt lines
+    // instead of the fabricated "Distribution shipped" template rows terra
+    // confirmed (v4b syntheticReceipts, 2026-07-12).
+    const matches = [];
     // R3-E1: a day with no note is NO-RECORD, not "zero receipts" — the UI
     // needs the difference to clamp all-time views to the first real note.
     let exists = false;
     try {
       const text = fs.readFileSync(fpath, "utf8");
       exists = true;
-      const slIdx = text.indexOf("## Session Log");
-      const section = slIdx >= 0 ? text.slice(slIdx) : text;
-      for (const re of KEYWORDS) {
-        const matches = section.match(new RegExp(re.source, "g" + (re.flags.includes("i") ? "i" : "")));
-        if (matches) count += matches.length;
+      // Only a recognizable session-log section counts. The old full-file
+      // fallback (header renamed → scan EVERYTHING) counted journal prose
+      // about last month's article as today's outreach — the 29-vs-2 scar's
+      // second face. No section = count 0 (undercount over inflate).
+      // H2 OR H3, suffix allowed: /log itself writes "### Session Log
+      // [ATTENDED] — 10:00 [Claude Code]" (Codex R5-C catch).
+      const slm = text.match(/^#{2,3}\s*(?:session\s*log|log)\b/im);
+      const section = slm ? text.slice(slm.index) : "";
+      // Count at most ONE action per clause: "sent DMs and reached out to 5
+      // leads" is one outreach session described two ways, not two — but
+      // comma-separated real actions ("posted a thread, sent 5 DMs") each
+      // count (Codex R5-C: sentence-level was undercounting those).
+      if (section) {
+        for (const frag of section.split(/[.\n,;]+/)) {
+          if (isReceiptClause(frag)) {
+            count += 1;
+            if (matches.length < 6) matches.push(frag.trim().slice(0, 140));
+          }
+        }
       }
     } catch (_) { /* missing daily — count stays 0 */ }
-    days.push({ date: key, count, exists });
+    days.push({ date: key, count, exists, matches });
   }
   const total7d = days.slice(0, 7).reduce((s, d) => s + d.count, 0);
   const total30d = days.reduce((s, d) => s + d.count, 0);

package/src/dashboard/lib/drift-history.js

@@ -9,12 +9,17 @@
 const fs = require("fs");
 const path = require("path");
 const os = require("os");
+const { localDateKey } = require("./date-utils");
 
 const HISTORY_PATH = path.join(os.homedir(), ".mover", "drift-history.json");
 const MAX_DAYS = 90;
 
+// LOCAL calendar day, not UTC. The bare toISOString().slice(0,10) bucketed
+// by UTC while every other parser (streak, distribution, session-time) keys
+// by local time via date-utils, so near midnight in any non-UTC zone the
+// drift sparkline's day disagreed with the rest of the dashboard by one day.
 function todayKey() {
-  return new Date().toISOString().slice(0, 10);
+  return localDateKey();
 }
 
 function ensureDir(filePath) {

package/src/dashboard/lib/engine-default-fingerprints.json

@@ -0,0 +1,53 @@
+{
+  "_comment": "Known-good hashes of shipped Engine DEFAULTS across versions (CRLF-normalized+trimmed, sha256). engine-writer allows overwriting a non-sentinel file ONLY if its hash matches one of these (a fresh/older install default); a hash NOT here means the user modified it = real data, refuse. Regenerate: node scripts/gen-engine-fingerprints.mjs.",
+  "generated": "git-history",
+  "files": {
+    "Goals.md": [
+      "27abf1d26d51525baa5a3ae9c8cc6f879a723f929334852b7ef9549a5fa11c57",
+      "30f3e24ad7e45bbb2053a0863164357b3e6cf718146540e685462495e38c996c"
+    ],
+    "Mover_Dossier.md": [
+      "c0d6817e390153f834d6a52e8d0e686cb3eb056e6457afecafd5e3abc0c47c49",
+      "21b1ecb65d7c7dbe7be03efa965fefd54f727663e3f0088be66dd453fd244677",
+      "72ca850dfd15972045918fcf0170315da72290a7ca7d034710362ca77e7cd1fa",
+      "e10ace7b0a72d17f342c70d03f015525e7029b13e43eae2c43e8c6ecd14483ee",
+      "bc568ebd12e25377274cf906d0569218c46d1c06e5dc9e857b98e3fdc128b667"
+    ],
+    "Active_Context.md": [
+      "433ef66c852de9a5c37bb65cc40c9d20e577fbcb46ecf91963c8f2d7b23f8a70",
+      "5dec535b04d4c7b11029222812e782a02dcbaea03faaa8979e0adb45bf9698b9",
+      "22b4855fc5f8337b2d1d2f077d12cf709333ea2cc3aa96c7fd1e380ea55ab7fc",
+      "de5b8133f2fd35ad70920bc1c08f2ab75c26edcf58f6b88fccf245a0e729c5aa",
+      "fc6f35e45f7b3934d0ab705b6e259ce195c637019e49381885dab7c963f3ccca",
+      "8eec472e3f451a1d8a121b3a3bd76065137921aa95824666fbb466fec6fb6443",
+      "f0bf0c38418e6c42be46b1546acd676e55aeb64cd1ba31c164dc7047b5ee6807",
+      "25f525f55fb86c638cd67792ef05f46de688e048586a3ccb2d980b8d1a78c7db",
+      "63e7db7db109bdfa78edf5df5d69e0286d614e84aa0165ae372576f6a816602c",
+      "52a8d57d45cafd662e3d106c2acb6fc07116572ca82bc04ff96f7e913ce47395",
+      "d79582e10cb0410554b9a1a669127cc42150805a1207f867edf90ce60f9effa2",
+      "829a755f53600266f60a8daaa9450e8e3516a7b03538eabeed9ff94ef5ec2b1b",
+      "aaa0e5bdac55f53db3bd36db526f841c5e6f62fb7cd8abf7626ff95b68818e14",
+      "4e2b064fe6d2391704a490020be147c507809a1c420da67eac34add5c85b3ebf",
+      "ae47ece41ab9c4dfa12df6e0c9b895de2e44ad1b788bcbc84728f43764a0a90a",
+      "52332d01a067494dc2cd2a5a642d741aa16cf847e49b5e73b744586e167a7faa"
+    ],
+    "Auto_Learnings.md": [
+      "2f02d8724b3283101be1dce7b14e69f478e841d36453ee990ede636cb0daaced",
+      "54fe4b57dd90bed94ef7c5d6af50ef290347afef55081d5c3ec51b4bc3181b60",
+      "a04fe481a5e79eaf0888c0fd71100fbbc709c1d2c8a1145b7d6fa6482d32a144",
+      "0d5bb1ed881384f1559b9fd2702199d28f7e151bd5ec9f9a559b9ece038e88e5",
+      "e1f5361fbd42cbfb655dbe4fd3a8129ec27e5d31c5bbc397615d0eb61c507438",
+      "10d443002d1056d6a939dea23231acaa0a5f01f1b3c6a86b808bb383efd34621",
+      "2ee52d9282a830ef34c52de5d38e78f19710769b1433391dc787fdfed8cf6093"
+    ],
+    "Metrics_Log.md": [
+      "3e3ab4011b65ddf8b435898ee31d136d31fa346cf408a741b6752f6bd9178537",
+      "4f3e7ba572b46cb7cf594640737badb5c2a742e8e2942a53d554ac0e4cddcb69",
+      "a840982311c4ad8300813316926b50a6bc6050b1c45a058ad146b6b695299dbf"
+    ],
+    "Someday_Maybe.md": [
+      "d9d7889a0923059c182d197aa3579a6d4ee78e19d980a7b144652bae7d7715a5",
+      "115ff4539c651ea87184b124a40ea75c874b5122c26d1ecfce3b5657c3d618da"
+    ]
+  }
+}

package/src/dashboard/lib/engine-health.js

@@ -153,7 +153,10 @@ function scanForExpiredGoals(text) {
   // Drop the bare `Date:` arm. Require explicit "Target Date" semantics.
   // Also: require ISO YYYY-MM-DD shape (was `[\d\-]{8,10}` which accepts
   // `2-3-2026`, `0-0-0`, etc).
-  const re = /(?:\*\*Target Date:?\*\*|^\s*Target Date:)\s*(\d{4}-\d{2}-\d{2})\b/gim;
+  // Both bold conventions accepted: `**Target Date:** X` AND `**Target
+  // Date**: X` — the colon-outside-bold style made a 6-month-overdue goal
+  // silently invisible to the RED alert (R5-A false-negative twin of B#17).
+  const re = /(?:\*\*Target Date:?\*\*:?|^\s*Target Date:)\s*(\d{4}-\d{2}-\d{2})\b/gim;
   let m;
   const now = Date.now();
   while ((m = re.exec(text)) !== null) {

package/src/dashboard/lib/engine-writer.js

@@ -49,7 +49,24 @@ const os   = require("os");
 const ENGINE_DIR_REL = path.join("02_Areas", "Engine");
 
 function assertSafeTarget(targetDir, allowEngineWrite = false) {
-  const resolved = path.resolve(targetDir);
+  const lexical = path.resolve(targetDir);
+  // terra F2 (2026-07-11): path.resolve is purely LEXICAL — if 02_Areas/Engine (or
+  // a parent) is a SYMLINK, the endsWith check still matched "02_Areas/Engine" while
+  // the real writes escaped through the link to an external dir. Resolve the REAL
+  // path so the checks below see where writes actually land. realpath fails for a
+  // not-yet-created target (fresh vault) — that has no symlink to follow, so the
+  // lexical path is authoritative there.
+  let resolved = lexical;
+  try { resolved = fs.realpathSync(lexical); }
+  catch {
+    // Target doesn't exist yet; resolve the deepest existing ancestor so a
+    // symlinked PARENT is still caught, then re-append the remainder.
+    try {
+      let cur = lexical, tail = [];
+      while (cur && cur !== path.dirname(cur) && !fs.existsSync(cur)) { tail.unshift(path.basename(cur)); cur = path.dirname(cur); }
+      resolved = path.join(fs.realpathSync(cur), ...tail);
+    } catch { resolved = lexical; }
+  }
   // Compare case-INSENSITIVELY (Bug6): macOS/APFS is case-insensitive, so a lowercase
   // ".../02_areas/engine" points at the real Engine but a case-sensitive endsWith would miss it and
   // let the write through. Keep `resolved` (original case) for the error messages.
@@ -250,7 +267,19 @@ function parseProjectLine(line) {
   }
   const name = cleanProjectName(parts.shift() || "");
   const rest = sanitizeValue(parts.join(": "), 300);
-  return { name, outcome: rest, state: "" };
+  // People answer in prose ("6 bookings, P1, next action portfolio site, blocker underpricing"),
+  // so lift the fields out of the text instead of leaving the brief full of [TBD].
+  const prio = rest.match(/\b(P[0-9])\b/i);
+  const blocker = rest.match(/\bblockers?\s*[:\-]?\s+([^,.;]+)/i);
+  const next = rest.match(/\bnext(?:\s+(?:action|step|move))?\s*[:\-]?\s+([^,.;]+)/i);
+  return {
+    name,
+    outcome: rest,
+    state: "",
+    priority: prio ? prio[1].toUpperCase() : "",
+    blocker: blocker ? blocker[1].trim() : "",
+    nextAction: next ? next[1].trim() : "",
+  };
 }
 
 function cleanProjectSources(raw) {
@@ -297,9 +326,17 @@ function cleanProjects(raw) {
   if (Array.isArray(raw)) {
     raw.forEach(push);
   } else if (typeof raw === "string") {
+    // Prose answers separate projects with sentences, not semicolons:
+    // "…blocker underpricing. Fitness comeback: gym 3x a week, P2." Split on a
+    // period only when the next sentence opens like a new project head
+    // ("Name: details"), so decimals and ordinary sentences stay intact.
+    // Field-label words never open a new project: "…root cause found. Next:
+    // ship the fix." is a continuation parseProjectLine LIFTS as nextAction —
+    // splitting there minted junk "Next"/"Priority" projects (R5-A).
     raw
       .split(/\n+|;+/)
-      .map((x) => x.trim())
+      .flatMap((chunk) => chunk.split(/(?<=\.)\s+(?=(?!(?:Next(?:\s+(?:[Aa]ction|[Ss]tep|[Mm]ove))?|Blockers?|Priority|Action|Step|Status|State|Metric|Goal)\s*:)[A-Z][^.:;]{1,60}:\s)/))
+      .map((x) => x.trim().replace(/\.$/, ""))
       .filter(Boolean)
       .forEach(push);
   }
@@ -1416,14 +1453,82 @@ function writeEngine({ transcript, digest = "", targetDir, dryRun = true, force
         if (e.code !== "ENOENT") throw e; // ENOENT = fresh; anything else re-throws
       }
     }
+    // terra F1 (2026-07-11): the sentinel check misses a PARTIAL Engine whose user
+    // data lives only in non-sentinel files (a legacy or interrupted setup). Also
+    // refuse when the Engine already holds USAGE artifacts that are never shipped
+    // as install defaults — real Daily notes or Weekly/Monthly/Quarterly Reviews.
+    // The installer ships those folders EMPTY (.gitkeep only), so this can never
+    // false-refuse a fresh install (which is exactly why the sentinel-only guard
+    // existed). Voice_DNA.md is NOT used here — it IS shipped as a default.
+    const usageDirs = ["Dailies", "Weekly Reviews", "Monthly Reviews", "Quarterly Reviews"];
+    const hasRealNote = (root) => {
+      let found = false;
+      const walk = (d) => {
+        let entries;
+        try { entries = fs.readdirSync(d, { withFileTypes: true }); } catch { return; }
+        for (const e of entries) {
+          if (found) return;
+          const full = path.join(d, e.name);
+          if (e.isDirectory()) walk(full);
+          else if (e.name.toLowerCase().endsWith(".md")) found = true;
+        }
+      };
+      walk(path.join(targetDir, root));
+      return found;
+    };
+    const usage = usageDirs.filter(hasRealNote);
+    if (usage.length > 0) {
+      throw new Error(
+        `[engine-writer] SAFETY BLOCK: the Engine already contains usage history (${usage.join(", ")}). ` +
+        `Refusing to overwrite a real prior Engine (a fresh install ships these folders empty).`
+      );
+    }
+    // sol flaw #3 COMPLETION (2026-07-11): a partial Engine whose user data lives
+    // ONLY in a non-sentinel file (Goals / Dossier / Active_Context /
+    // Auto_Learnings / Metrics_Log) with no dailies. Fingerprint each existing
+    // target against the KNOWN shipped defaults across versions
+    // (engine-default-fingerprints.json, generated from git history). A file that
+    // matches ANY known default is a fresh OR older-version install default ->
+    // allow (this is what fixed the cross-version false-refuse that made the
+    // current-only fingerprint unsafe). A non-empty file matching NONE was
+    // modified by the user = real data -> refuse. If the manifest is missing, the
+    // sentinel + usage-artifact checks above still stand.
+    let fingerprints = null;
+    try { fingerprints = require("./engine-default-fingerprints.json").files; } catch {}
+    if (fingerprints) {
+      const crypto = require("crypto");
+      const dnHash = (s) => crypto.createHash("sha256").update(String(s).replace(/\r\n/g, "\n").trim()).digest("hex");
+      for (const { path: filePath } of files) {
+        const base = path.basename(filePath);
+        if (SENTINEL_FILES.has(base)) continue;
+        const known = fingerprints[base];
+        if (!Array.isArray(known) || known.length === 0) continue; // no default tracked (e.g. a Daily)
+        let onDisk;
+        try { onDisk = fs.readFileSync(filePath, "utf8"); } catch { continue; } // absent = fresh
+        if (String(onDisk).replace(/\r\n/g, "\n").trim().length === 0) continue; // empty = nothing to lose
+        if (!known.includes(dnHash(onDisk))) {
+          throw new Error(
+            `[engine-writer] SAFETY BLOCK: ${base} differs from every shipped default and holds real user data. ` +
+            `Refusing to overwrite an existing Engine.`
+          );
+        }
+      }
+    }
   }
 
-  // ── Atomic-ish multi-file commit (Bug1+2) ──────────────────────────────────
-  // Write EVERY file to its tmp first; only once all 8 succeed do we rename them in. A failure during
-  // the write phase (disk full, ENOTDIR, perms) unlinks every staged tmp and commits NOTHING — so a
-  // retry is never locked out by a half-seeded sentinel (Identity_Prime/Strategy), and no orphaned
-  // .engine-writer.tmp is left behind. (Per-file rename is itself atomic; once the bytes are on disk a
-  // same-dir rename effectively never fails, so the residual rename-phase window is negligible.)
+  // ── Atomic-ish multi-file commit (Bug1+2, hardened R5-A) ────────────────────
+  // Write EVERY file to its tmp first; only once all succeed do we rename them
+  // in. A failure during the write phase (disk full, ENOTDIR, perms) unlinks
+  // every staged tmp and commits NOTHING — so a retry is never locked out by a
+  // half-seeded sentinel (Identity_Prime/Strategy), and no orphaned
+  // .engine-writer.tmp is left behind.
+  //
+  // The rename phase is NOT assumed infallible: the target is an Obsidian
+  // vault, and synced vaults (iCloud/OneDrive/Dropbox) intermittently lock
+  // files mid-rename. Two defenses: (1) the SENTINEL files rename LAST, so a
+  // failure on any other file can never seed the guard that locks retries out;
+  // (2) on a rename failure every already-renamed file is rolled back to its
+  // tmp, restoring the pre-write state exactly, before rethrowing.
   const staged = [];
   try {
     for (const { path: filePath, content } of files) {
@@ -1436,9 +1541,50 @@ function writeEngine({ transcript, digest = "", targetDir, dryRun = true, force
     for (const { tmp } of staged) { try { fs.unlinkSync(tmp); } catch (_) {} }
     throw e; // nothing renamed → no partial Engine, no force=false lockout, no dangling tmp
   }
-  for (const { tmp, filePath } of staged) {
-    fs.renameSync(tmp, filePath); // atomic: readers never see a partial file
+  const SENTINELS = new Set(["Identity_Prime.md", "Strategy.md"]);
+  const renameOrder = [
+    ...staged.filter((s) => !SENTINELS.has(path.basename(s.filePath))),
+    ...staged.filter((s) => SENTINELS.has(path.basename(s.filePath))),
+  ];
+  const renamed = [];
+  try {
+    for (const entry of renameOrder) {
+      // A forward rename REPLACES any existing file (the structure installer
+      // ships non-empty defaults for the non-sentinel targets) — park the
+      // original first so a rollback can restore it, not just delete the new
+      // bytes (Codex R5-C catch: the first rollback lost the pre-existing
+      // Dossier default on a mid-commit rename failure).
+      entry.bak = null;
+      if (fs.existsSync(entry.filePath)) {
+        // sol flaw #4 (2026-07-11): the old code SWALLOWED a park failure and then
+        // overwrote the original anyway — so if the .bak rename failed, the
+        // original bytes were replaced with no backup, and a later rollback had
+        // nothing to restore (reproduced: Goals.md vanished after a later
+        // Metrics_Log rename failure). Fail CLOSED instead: if we cannot back up
+        // an existing file, do NOT overwrite it. The throw lands in the rollback
+        // below with this file's original still in place, untouched.
+        entry.bak = entry.filePath + ".engine-writer.bak";
+        fs.renameSync(entry.filePath, entry.bak);
+      }
+      fs.renameSync(entry.tmp, entry.filePath); // atomic: readers never see a partial file
+      renamed.push(entry);
+    }
+  } catch (e) {
+    // Roll back. Order matters: move the new bytes out of the way, then
+    // every parked original goes BACK to its path — including the entry
+    // whose rename failed AFTER parking (its original sits at .bak with
+    // nothing at filePath; deleting that bak would lose it).
+    for (const { tmp, filePath } of renamed) {
+      try { fs.renameSync(filePath, tmp); } catch (_) {}
+    }
+    for (const { filePath, bak } of staged) {
+      if (bak && fs.existsSync(bak)) { try { fs.renameSync(bak, filePath); } catch (_) {} }
+    }
+    for (const { tmp } of staged) { try { fs.unlinkSync(tmp); } catch (_) {} }
+    throw e;
   }
+  // Success: clear the parked originals.
+  for (const { bak } of renamed) { if (bak) { try { fs.unlinkSync(bak); } catch (_) {} } }
 
   return { files, written: true };
 }