Absorb decant and canary's remaining judgments; gate Mothball's destructive API

[heznpc]

Consolidation work: the judgments decant and canary had that Modore did not, plus the boundary the Mothball absorption left open. Three retirements' worth of unique capability, on Modore's own contracts.

1. Hugging Face cache audit — and the defect fixed before porting it

decant's ContextProbe.isReferenced was fail-open:

guard FileManager.default.fileExists(atPath: projectsRoot) else { return false }

A missing search root, a failed grep, or a mistyped --projects all produced the same answer as an exhaustive search that found nothing. One typo could mark an entire hub cache safe to delete. decant's own cold-read audit lists this as its top critical finding.

Inverted here in one readable function, search_is_complete:

Failure	decant	hfscan
search root missing	unreferenced	unknown + search-root-missing
file cap reached	n/a	unknown + file-cap-reached
subtree unreadable	unreferenced	unknown + tree-partially-unreadable
nothing read at all	unreferenced	unknown + no-files-read

--allow-missing-roots / --ignore-unreadable widen the verdict only when asked. Matching is case-insensitive and substring-based on purpose: over-catching keeps a model, under-catching loses one.

2. MCP config hygiene

Reads ~/.claude.json (including per-project blocks), both Claude Desktop locations, and ~/.mcp.json; reports dead / duplicate / manual-review / unknown.

Two deliberate deviations from decant. Servers are named, not anonymised to server#N — a hygiene report the operator cannot act on is not one, and a server name is configuration metadata of the kind scree already emits. What stays hidden is what was sensitive: env is a key count, never keys or values, pinned by a test that plants a fake API key and asserts neither the value nor the key name appears. And PATH-dependent verdicts are withheld when PATH is unusable rather than reported as dead — the same fail-safe rule as above.

3. File-access reverse index

canary's get_file_access, inverting scree's evidence to path → sessions: reads, writes, shell references, session count, last touch. Rule surfaces (CLAUDE.md, AGENTS.md, settings.json, ~/.claude, ~/.codex) sort first and are the default view.

Stricter content contract than the original. canary attached a 200-character excerpt of the shell command to every row. That excerpt is command content, so it is dropped — a path extracted from a command is metadata about which file was touched; the command that touched it is not. Pinned: a transcript containing grep -r 'hunter2' /tmp/ws/secrets.txt yields the path and neither hunter2 nor grep.

Two things the naive port got wrong, both caught by running it:

• Paths are canonicalised before aggregation. The same file arrives absolute from a tool input and ~/-relative from a shell command, splitting one file across rows — 1,322 rows for 1,212 files, with ~/.claude/settings.json listed twice.
• Dedupe is keyed on the tool_use block id, not the path. Claude streams one assistant message as multiple lines sharing a message id, which is why dedupe is needed; keying on the path also erased genuine repeat reads, turning a count of touches into a count of sessions.

4. Mothball's destructive API is now gated by mechanism

Absorbing Mothball absorbed a second deletion discipline. Modore destroys nothing without a preview-issued single-use 64-byte token, a 15-minute owner-only manifest, a remeasure at the boundary, and a receipt. ArchiveOrchestrator.archive() is careful on its own terms — refuses / and $HOME, verifies before touching the original, moves to Trash rather than unlinking — but it is an in-process call taking no token, and the vendor dependency already compiles it into the binary. Only review stood between a future try orchestrator.archive(…) in a view action and a path the approval chain never sees.

Two tests make it a mechanism: a Modore source naming ArchiveOrchestrator, Restorer, ArchiveRun, or trashItem must also carry the approval-token symbol, so a diff cannot bring one half without showing the other; and MothballService is pinned to the read-only scan-and-classify surface it uses. Wiring the archive path stays allowed — wiring it around the token does not. Both guards were verified by injecting a violation and watching them fail.

MCP surface

Three new read-only tools on the existing contract: hf_orphans, mcp_hygiene, file_access. hf_orphans restates search_complete as a top-level verdicts_withheld flag so an incomplete search cannot read as "no orphans found"; its roots argument is bounded to 8 entries and screened so a value can never be read as an option by the script it is passed to.

None of the three scripts ships inside the signed bundle — no Swift caller, so the runtime-completeness test lists them beside friction.py.

Verification

• 505 tests pass; swift build clean; release_smoke.py clean
• Live: 5 MCP servers all healthy; mistyped-root case returns verdicts_withheld: true through the MCP surface; 60 sessions → 1,876 paths / 208 rule surfaces, ~/.claude/settings.json at 3 writes across 10 sessions, no command text anywhere in the payload

Not in this PR

• balance/bin/cba hard-depends on the decant CLI in 4 places — separate repo, must land before decant is archived
• canary's list_sessions session rows and get_session_transcript are not ported; the latter is refused by Modore's no-content contract
• MothballView.swift:107 still tells the user to run the standalone Mothball app, which goes stale when that repo is archived

---

Supersedes #79, closed automatically when its head branch was renamed from claude/… to the repository's feat/ convention. Same commits, same review.