fix(debug-retention): collect key-log-only proxy run dirs from new runs only; existing key logs untouched

[Juliusolsson05]

Fixes #1385.

Plan: docs/plans/2026-09-27-retention-collects-keylog-run-dirs.md.

Problem

collectProxyRunDirs recognised a proxy run dir only by proxy-events.jsonl. A run dir holding just session-meta.json + sslkeylog.log was walked into and never collected, budgeted or removed. Those are plaintext TLS session secrets. #1380 review c recounted names and sizes only (contents never read): 23 such dirs on the owner's machine, 5.18 MB, May–September 2026.

What merges: FUTURE runs only

• A key-log-only dir is recognised as a run dir, but collected only when it is NOT in the BASELINE: the set of key-log-only dirs that existed when this build first started. keyLogBaseline() captures it at run start (holdDebugStoragePruneUntilRecovered), strictly (any unlistable directory means no baseline, and nothing is written), and writes it once to STATE_DIR/debug-retention-keylog-baseline.json. With no baseline, NO key-log-only dir is collected. Timestamps were tried twice and dropped (review a): a date constant and a first-prune marker each excluded new runs forever, and any clock comparison admits a pre-upgrade run after a clock step back.
• The existing dirs, including the owner's 23, are NOT touched: they are in the baseline, so they are never collected and never walked into, whatever their names. Deleting them stays the owner's decision (q91), now tracked in Owner decision (q91): delete the existing pre-upgrade key-log-only proxy run dirs? #1460; this PR does not make it.
• A dir with an events file is collected whole as before, key log included (main's existing behaviour; the q91 ruling, tracked in Owner decision (q91): delete the existing pre-upgrade key-log-only proxy run dirs? #1460, covers only the key-log-only dirs). Metadata alone and _shared-conf are still skipped.
• q115 ("unknown is never empty"): dirStats no longer skips a child it cannot read. Only ENOENT means absent; any other error leaves the whole dir uncollected that pass.
• The manual-bundle ledger loader is NOT changed: W4's fix: bound the small unbounded-growth items from the C6 hunt (#1278) #1417 owns it (q118), and this PR will use it as-is.

Tests

• debugRetention.keylog.test.ts, real directory shapes:
  • a new key-log-only dir is collected beside a normal run dir;
  • baseline members (the owner's shape, and one whose name sorts after a new run), _shared-conf and a metadata-only dir are not;
  • a run dir with an unreadable child keeps its key log through the locked pass and after two readable passes, and is removed once genuinely old. Red before the fix.
• Pinned after B6's check: the birthtime-filter revert (a capture on a clock stepped back to 2020 still baselines every existing key log) and the baseline shape check.
• Mutations, each killed: the birthtime filter re-added; baseline membership ignored; null collecting everything; lenient capture; capture recording nothing; returning an unsaved baseline.
• Merged main (a real conflict with fix(claude): bump claude-code-headless to the rotating proxy-events log (#1273) #1376's rotated-generation marker): a dir holding proxy-events.jsonl OR proxy-events.1.jsonl is collected as on main; a key-log-only dir only when new.
• Gate: npx tsc -b is clean; src/main/storage passes, 13 files / 164 tests at 35001c8a.
• Residual (conservative, never a deletion): a run created during the few-millisecond startup scan, or before a delayed first successful capture, is baselined and never collected. A birthtime filter was tried and reverted: a clock step back could exclude an old key log from the baseline.

🤖 Generated with Claude Code

[Juliusolsson05]

Disposition at 35001c8 (review cap reached; B6 manual inspection, then manager-verify a/b/c MERGE-READY):

• a r1, same-day runs excluded by the date cutoff: fixed with a first-run marker (d8c62e9).
• a r2, marker written after the boot delay, and a clock rollback: fixed with a baseline set captured at run start (8bd7e32).
• a r3, a missing proxy root saved an empty baseline: fixed. There is no ENOENT exception now; an unlistable dir means no baseline.
• b r3, the birthtime rule could exclude an old key log after a clock step back: fixed by reverting it (68baa3e). A test pins the revert with Date.now at 2020 (35001c8).
• B6 verify: the wrong-shape baseline returns null. It is pinned, and fails without the shape guard.
• Accepted residuals are conservative only (they keep, never delete): runs created during the startup capture are baselined. Dirs holding an events file keep main's existing behaviour. The key-log-only decision (q91) is tracked in Owner decision (q91): delete the existing pre-upgrade key-log-only proxy run dirs? #1460.
  Gates: tsc -b + 164 tests at 35001c8; CI green.

🤖 Generated with Claude Code