Transcripts tend to have secrets pasted into them during debugging, api keys, .env values and so on. Is there anything that keeps the sync agent from writing those into almanac/ pages that get committed?
Cross-volume moves can't use rename(2), so they fall back to copy-then-delete. If the copy dies halfway, does it roll back or leave a partial file at the destination?