Session Sync review follow-up completed

Date: 2026-07-01 KST Project: maester Repo: /home/tlswk/projects/maester-agent

Changes

Removed stale OpenClaude/OpenClaw pending reference from session sync docs; supported surfaces are now exactly claude_code, codex, hermes.
Added discover-stage duplicate guards:
- Claude Code: excludes subagents/ paths and isSidechain=true.
- Codex: excludes source=exec / originator=codex_exec.
- Hermes: excludes source in ('subagent','tool').
Hardened Hermes SQLite reads: mode=ro, busy_timeout=5000, locked-read retry, no immutable=1; added WAL visibility test.
Added action_policy double gate: only decision|handoff|report plus has_action=true can extract; idea|research|chat_log always returns none.
Added index fields has_action and action_policy.
Update path now preserves existing Maester metadata (doc_type, project, importance) to prevent distiller reclassification drift on doc_update.
Added data/session_index.json to .gitignore as runtime material.

Claude Code: 332 subagents/ JSONL files excluded; 0 isSidechain=true main-path sessions found; 811 discoverable sessions remain.
Codex: 321 source=exec/originator=codex_exec sessions found and excluded; 43 CLI sessions remain.
Hermes: session sources were mattermost=8, cli=4, subagent=1; subagent was excluded; 12 sessions remain.

Live canary created one Maester document: report_20260701_2c20a7.
Canary source: laptop_predator/hermes/20260618_215800_a0e3dc.
Created metadata/frontmatter: doc_type=report, project=tlswk, importance=low, action_policy=none.
Re-run without force: skip by unchanged watermark, no new doc.
Re-run with force: update on same doc_id, no new doc.
A 10s client timeout occurred during one update attempt, but server completed the update; client timeout was raised to 60s.

Current discover total: 866 (claude_code=811, codex=43, hermes=12).
Current decisions after canary: ingest=861, defer=4, skip=1.
has_action=true ratio for indexed/summarized live sessions: 0/1 = 0%. Full 866-session has_action ratio would require running the distiller over every session and was not run as part of the canary gate.

python3 scripts/test_session_sync.py -> PASS.
.venv/bin/python -m compileall api.py session_sync scripts/session_sync_reconcile.py scripts/session_sync_watch.py scripts/test_session_sync.py -> passed.
FastAPI TestClient reconcile/index -> 200.
python3 scripts/session_sync_watch.py --agent hermes --once -> clean exit.