spawn(..., { shell: true }) made Node concatenate argv without quoting;
cmd.exe re-tokenized it and the ingest prompt arrived as a bare "ingest"
with the filename silently discarded, while the run still reported
success. claude.exe is a real executable here, so no shell is needed:
drop shell: true and pass argv directly. isSafeFilename is unchanged
(still correct defence in depth) but its comment now reflects that the
spawn path carries no injection surface today.
Caret and control characters added to the filename guard, file-keyed in-flight
registry replacing the row-scoped one, try/catch around spawn, single finish()
exit path, UTF-8 chunk decoding, bounded output buffer.
index.md groups integration-dead-ends and leave-less-room-for-imagination
under Machine side, and both are absent from the script. The claim that every
absent concept is human-side or strategy-side was wrong: it is 8 of 10.
Corrections made during execution as reviews surfaced defects in the plan
itself: duplicate raw-path claim handling and its one-pass orphaned filter,
unescaped-pipe table split, RAW_EXTENSIONS widening, dark accent tracking the
installed theme, the bare node --test command, and test counts.
- readPipeline no longer filters raw/sources to .md only; CLAUDE.md
documents txt and pdf as valid raw source types, and hiding them from
the queue silently was the same invisibility bug the dashboard exists
to remove.
- Dark-mode accent now tracks the installed tesanti theme (same signal
red, no base-color lift) instead of contradicting it; status colors
(ok/warn/danger) keep their lifted dark values for AA contrast on
small text, per design-system separation of status tokens from the
brand accent.
