EC generates configs/electric_cherry_bank.cfg during server creation/rebuild to provide private bank credentials and configuration, but the drift scanner incorrectly flags this expected file as untracked. This affects both T5 and T6 and can send the private configuration into reconciliation paths intended for unwanted files.
src/lib/server/fleet/drift.ts:59,215 does not exempt the generated bank configuration from untracked-file detection.
src/lib/server/fleet/drift.ts:513,582 treats untracked files as removals and records their previous contents through putFileBlob when preparing a drift rebuild campaign.
src/lib/server/fleet/drift.ts:723 stages untracked files for deletion, capturing their contents in deployment evidence.
docs/guides/bank.md:25,34 documents this as an EC-generated private file that must remain excluded from shared recipes, promoted files and blob downloads; its filename is reserved.
Live maintenance inspection on October 12, 2026 (Eastern) confirmed this exact file as the sole drift difference on Moon lobbies 1–2, Buried lobby 2, Der Riese lobby 2 and Town lobby 2. An identical incident exists for the subsequently deleted Verrückt lobby 2 registration. Maintenance was paused and automatic drift correction disabled during investigation. Deletion or credential exposure was not confirmed, but the reconciliation code creates a deletion risk and a potential path for private credentials to enter shared artifact storage.
Fix
Exempt the exact generated bank configuration path from drift detection for both T5 and T6, while keeping the filename reserved and excluded from shared/promoted configuration.
Protect the file in reconciliation and campaign preparation, including previously generated plans, so it cannot be deleted or captured in file blobs, previews, downloads or audit content.
Clear existing false bank-only drift incidents on rescan; preserve legitimate differences in incidents containing other files.
Verify that creating or rebuilding T5 and T6 servers produces private bank configuration without triggering drift, and that drift preview, manual reconciliation and automatic recovery preserve it without storing or exposing its contents.
Add regression coverage for stale plans and both games; confirm genuine untracked files and modified/missing managed files remain detectable and repairable.
This issue is separate from the bank endpoint change and does not establish the cause of Moon’s earlier “Bank unavailable” error. Uploading the private file into shared configuration must not be the workaround.
EC generates `configs/electric_cherry_bank.cfg` during server creation/rebuild to provide private bank credentials and configuration, but the drift scanner incorrectly flags this expected file as untracked. This affects both T5 and T6 and can send the private configuration into reconciliation paths intended for unwanted files.
- `src/lib/server/fleet/drift.ts:59,215` does not exempt the generated bank configuration from untracked-file detection.
- `src/lib/server/fleet/drift.ts:513,582` treats untracked files as removals and records their previous contents through `putFileBlob` when preparing a drift rebuild campaign.
- `src/lib/server/fleet/drift.ts:723` stages untracked files for deletion, capturing their contents in deployment evidence.
- `docs/guides/bank.md:25,34` documents this as an EC-generated private file that must remain excluded from shared recipes, promoted files and blob downloads; its filename is reserved.
Live maintenance inspection on October 12, 2026 (Eastern) confirmed this exact file as the sole drift difference on Moon lobbies 1–2, Buried lobby 2, Der Riese lobby 2 and Town lobby 2. An identical incident exists for the subsequently deleted Verrückt lobby 2 registration. Maintenance was paused and automatic drift correction disabled during investigation. Deletion or credential exposure was not confirmed, but the reconciliation code creates a deletion risk and a potential path for private credentials to enter shared artifact storage.
**Fix**
- [x] Exempt the exact generated bank configuration path from drift detection for both T5 and T6, while keeping the filename reserved and excluded from shared/promoted configuration.
- [x] Protect the file in reconciliation and campaign preparation, including previously generated plans, so it cannot be deleted or captured in file blobs, previews, downloads or audit content.
- [x] Clear existing false bank-only drift incidents on rescan; preserve legitimate differences in incidents containing other files.
- [x] Verify that creating or rebuilding T5 and T6 servers produces private bank configuration without triggering drift, and that drift preview, manual reconciliation and automatic recovery preserve it without storing or exposing its contents.
- [x] Add regression coverage for stale plans and both games; confirm genuine untracked files and modified/missing managed files remain detectable and repairable.
References: [Maintenance](https://ec.thewrightserver.net/maintenance) · [Drift implementation](https://gitea.thewrightserver.net/josh/electric-cherry/src/branch/main/src/lib/server/fleet/drift.ts).
This issue is separate from the bank endpoint change and does not establish the cause of Moon’s earlier “Bank unavailable” error. Uploading the private file into shared configuration must not be the workaround.
Reviewed d9fa15cdf6 and d6147077d7 against current main at 82e07ea33e. All five fix items are covered by the implementation and passing regression tests, so I'm closing this.
Checklist
Exact-path exemption and reserved filename.private-config.ts identifies the generated config destination for both games; drift scanning skips it before reading or fingerprinting its contents. createScript rejects the reserved filename. The exemption does not hide nested lookalikes or unrelated files.
Reconciliation and stale-plan protection. Drift preview/campaign preparation filters the private target, including previously prepared evidence. Staging, launch activation, persisted native plans, and host-operation delivery reject private-file actions. Agent 1.9.3 rejects reads, staging, old saved activations, rollback writes, and log reads of the private config. Late private read receipts are redacted; legacy campaign diffs and associated blob downloads are blocked.
Existing incidents. A fresh maintenance scan clears the obsolete file details and resolves bank-only incidents. Mixed incidents keep their genuine differences. Watchdog regressions cover both cases, including paused maintenance.
Creation, rebuild, and repair preserve credentials. Python regressions cover private configuration creation and rebuild for T5 and T6. Controller regressions exercise preview, manual reconciliation, automatic campaign preparation, and preservation of private bytes without adding them to shared blobs or deployment evidence.
Regression coverage. Both games, stale prepared evidence and persisted deletion plans, old-agent command delivery/receipts, and blocked downloads are covered. Genuine untracked files and modified/missing managed files remain detectable and repairable.
Passed the full Python agent suite: 340 tests, no skips.
Verified the committed 1.9.3 manifest signature with the repository release key, all three artifact hashes, and equality of the packaged agent with its reviewed source.
Validation used isolated fixtures and simulated hosts; this review did not trigger production drift correction or live rebuilds. The full controller suite was not rerun.
Existing unsafe plans must be cancelled and rescanned, and host-side protections require agent 1.9.3+. As documented, blocking historical downloads does not erase previously captured bytes from databases or backups.
Reviewed d9fa15cdf6df15a12fb0c8e70773283afe63a487 and d6147077d760e5e3bb85b7f91cbdf71f42160e83 against current main at 82e07ea33eedddd7b707f5e62c12d2e606a1e680. All five fix items are covered by the implementation and passing regression tests, so I'm closing this.
**Checklist**
- [x] **Exact-path exemption and reserved filename.** `private-config.ts` identifies the generated config destination for both games; drift scanning skips it before reading or fingerprinting its contents. `createScript` rejects the reserved filename. The exemption does not hide nested lookalikes or unrelated files.
- [x] **Reconciliation and stale-plan protection.** Drift preview/campaign preparation filters the private target, including previously prepared evidence. Staging, launch activation, persisted native plans, and host-operation delivery reject private-file actions. Agent 1.9.3 rejects reads, staging, old saved activations, rollback writes, and log reads of the private config. Late private read receipts are redacted; legacy campaign diffs and associated blob downloads are blocked.
- [x] **Existing incidents.** A fresh maintenance scan clears the obsolete file details and resolves bank-only incidents. Mixed incidents keep their genuine differences. Watchdog regressions cover both cases, including paused maintenance.
- [x] **Creation, rebuild, and repair preserve credentials.** Python regressions cover private configuration creation and rebuild for T5 and T6. Controller regressions exercise preview, manual reconciliation, automatic campaign preparation, and preservation of private bytes without adding them to shared blobs or deployment evidence.
- [x] **Regression coverage.** Both games, stale prepared evidence and persisted deletion plans, old-agent command delivery/receipts, and blocked downloads are covered. Genuine untracked files and modified/missing managed files remain detectable and repairable.
**Review notes**
- Passed 349 controller tests across 12 relevant files: private-bank-drift, native-drift-manifest, watchdog, script-flow, file-blobs, staged-files, native-provisioning, native-launch-preparation, native-hosts, host-log-results, drift-kinds, and host-agent-release.
- Passed the full Python agent suite: 340 tests, no skips.
- Verified the committed 1.9.3 manifest signature with the repository release key, all three artifact hashes, and equality of the packaged agent with its reviewed source.
- Validation used isolated fixtures and simulated hosts; this review did not trigger production drift correction or live rebuilds. The full controller suite was not rerun.
- Existing unsafe plans must be cancelled and rescanned, and host-side protections require agent 1.9.3+. As documented, blocking historical downloads does not erase previously captured bytes from databases or backups.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
EC generates
configs/electric_cherry_bank.cfgduring server creation/rebuild to provide private bank credentials and configuration, but the drift scanner incorrectly flags this expected file as untracked. This affects both T5 and T6 and can send the private configuration into reconciliation paths intended for unwanted files.src/lib/server/fleet/drift.ts:59,215does not exempt the generated bank configuration from untracked-file detection.src/lib/server/fleet/drift.ts:513,582treats untracked files as removals and records their previous contents throughputFileBlobwhen preparing a drift rebuild campaign.src/lib/server/fleet/drift.ts:723stages untracked files for deletion, capturing their contents in deployment evidence.docs/guides/bank.md:25,34documents this as an EC-generated private file that must remain excluded from shared recipes, promoted files and blob downloads; its filename is reserved.Live maintenance inspection on October 12, 2026 (Eastern) confirmed this exact file as the sole drift difference on Moon lobbies 1–2, Buried lobby 2, Der Riese lobby 2 and Town lobby 2. An identical incident exists for the subsequently deleted Verrückt lobby 2 registration. Maintenance was paused and automatic drift correction disabled during investigation. Deletion or credential exposure was not confirmed, but the reconciliation code creates a deletion risk and a potential path for private credentials to enter shared artifact storage.
Fix
References: Maintenance · Drift implementation.
This issue is separate from the bank endpoint change and does not establish the cause of Moon’s earlier “Bank unavailable” error. Uploading the private file into shared configuration must not be the workaround.
Reviewed
d9fa15cdf6andd6147077d7against current main at82e07ea33e. All five fix items are covered by the implementation and passing regression tests, so I'm closing this.Checklist
private-config.tsidentifies the generated config destination for both games; drift scanning skips it before reading or fingerprinting its contents.createScriptrejects the reserved filename. The exemption does not hide nested lookalikes or unrelated files.Review notes