autoresearch/ runs, agent/predict/ ngram models, local/ artifact dumps, wt/
worktrees and memories/--home-blank-.omp-wt-* buckets are runtime state keyed
on ephemeral paths; none were tracked, so the rules are purely additive.
Memory-file flush for the dotfiles-deploy session with the blankpad admin
credential scrubbed to a placeholder; sessions transcripts untracked
(gitignored) since harness transcripts can carry raw secrets.
Managed skills: command-center-dotfiles-import, ssh-fish-host-remote-exec,
stash-supersession-audit-before-drop.
Import Dankware's environment layer into the repo as home-relative package
trees (niri, gtk-3/4, ghostty, alacritty, fish, zsh, bash, profile,
systemd-user, dconf). scripts/deploy.sh implements stow-equivalent semantics
(check|adopt|sync modes): identical files adopt to symlinks, new files link,
divergent files quarantine-and-replace under .quarantine/<host>/<ts>/ (gitignored).
zz-<hostname> override packages deploy last with override semantics.
Secrets never enter git: GITEA_TOKEN moved from .zshrc into untracked
~/.config/environment.d/secrets.env (0600); tracked .zshrc sources it
guarded. core.hooksPath armed by deploy.sh so the pre-commit secret gate is
live on every machine that deploys.
Config in, state out: databases, WAL/SHM sidecars, caches, logs, sessions,
run dirs, ssh-control sockets stay OUT of history. Quarantine list: auth.json,
.env, trust.json, private keys never tracked. Pre-commit hook scans staged diff
for live-secret shapes (sk-, ghp_, github_pat_, glpat-, xox, AKIA, PEM headers,
JWTs) before anything reaches the Gitea remote.
Frank