The daemon now writes the ENGRAM backup catalog (engram-catalog.json), so a freshly provisioned machine is covered without a hand-written file. Previously the catalog only existed when written manually; now every subc and standalone startup derives it from what is on disk, and sensitive folders are no longer captured.
Declares only paths that exist as real files or directories, not symlinks; a declared path that is missing would halt the whole fleet capture. aft.db is captured page by page, and creating the database refreshes the catalog so a fresh machine's database is declared right away instead of at the next restart. Undo history, checkpoints, task output, logs, diagnostics, caches, and generated shims are declared excluded with a reason.
Undo backups keep their earlier entry ids, matching the hand-written catalog (for example aft/backups-mcp-claude-code), so ENGRAM records the switch to excluded on the same entries. Ids are otherwise kept per path from the catalog already on disk, so removing a folder never renames a survivor.
The catalog is written only when the storage root's folder is named aft, since ENGRAM looks nowhere else. The write is atomic, skipped when the bytes are unchanged, refused for dev/test builds pointed at the account's real storage, and never stops startup on failure.
Confidence Score: 5/5
The PR appears safe to merge; no new actionable issues were found.
Summary
The daemon now writes engram-catalog.json at startup from paths that exist on disk.
AFT builds ENGRAM's backup catalog from its storage files.
All three earlier findings are addressed: unsupported roots are skipped, surviving folders keep their IDs, and newly created databases are declared.
Diagram
%%{init: {'theme': 'neutral'}}%%
flowchart TD
A[Daemon starts] --> B[Write catalog for existing paths]
B --> C[Accept requests]
C --> D[Open aft.db]
D --> E{File was missing?}
E -->|Yes| F[Refresh catalog with database entry]
E -->|No| G[Reuse existing catalog]
