--- name: museum-readme-txt-leak description: "FIXED 2026-07-20: walk() now reads git ls-files, not the filesystem, so gitignored/untracked files can't leak into the museum" metadata: node_type: memory type: project originSessionId: 3e4faaa8-ab7b-4f3a-ab11-02989d3ddb5c modified: 2026-07-21T01:21:00.023Z --- FIXED (2026-07-20, commit 76c1970, following the line-ending session's own recommendation). `museum/generate.mjs`'s `walk()` used to recurse `fs.readdirSync` over the whole archive root, so any file on disk — tracked or not — became a published page and fed the global input-tree stamp. The repo-root `README.txt` (gitignored, explicitly "NOT part of the archive") leaked in this way: its own doc page (`docs/fe41f879e76a.html`) plus a stamp only reproducible on a machine that happened to have that untracked file. The fix: `walk()` now runs `git ls-files -z` scoped to the archive root and returns that list (still excluding the `museum/` subtree). This was chosen over an .gitignore-respecting fix because it's strictly stronger — it also excludes any untracked-but-not-ignored stray, which a gitignore-only fix would still leak (and which still wouldn't survive a clone). Verified via fresh GitHub clone AND a bare-clone-derived clone, both regenerating to the identical stamp (`80bf9bb8b148` · `f64fb7397980c9cb`, 704 files, 0 broken links) with `git status` clean except pre-existing, unrelated thumbnail-PNG re-encode jitter — see [[museum-thumb-render-nondeterminism]]. Related: the line-ending fix is [[museum-lf-normalization]].