🤖 plan storage: follow-ups from the #5611 review (installation-scoped SSH plans)

[ThomasK33]

Follow-ups from the review of #5611 (installation-scoped SSH plans, #5174). Codex raised these in review rounds 2 and 4. Rounds 4–6 of that review accept blockers only, so they wait here.

• A legacy path that cannot be read is treated as missing. If the remote ~/.mux/plans folder cannot be traversed, or a stat fails, during the one-time migration, both [ -f ] tests in migrateRemotePlanScript (src/node/utils/runtime/planLocation.ts) fail. Xum then records the row as migrated with no legacy plan. The plan stays on the host but is never offered again. Fix: treat only confirmed absence as "no legacy plan", and fail (retry later) on other stat errors. (🤖 fix: give each Xum installation its own SSH plan namespace (#5174) #5611 (comment))
• The import notice stays after nothing_to_import. If the shared file vanishes after the offer, LegacyPlanImportBanner shows the error but keeps the notice and its palette action. Fix: settle the offer after it reports the error. (🤖 fix: give each Xum installation its own SSH plan namespace (#5174) #5611 (comment))
• The identity temp file leaks when a write fails. If writeFile or sync fails in src/node/config/installationIdentity.ts (for example ENOSPC), the random temp file stays in the data root. Fix: always remove tempPath in an outer finally. (🤖 fix: give each Xum installation its own SSH plan namespace (#5174) #5611 (comment))
• Known limitation: a rename made while downgraded. An older build renames the workspace but does not move the scoped plan. The docs explain how to recover. A permanent fix would key scoped plans by workspace ID. (🤖 fix: give each Xum installation its own SSH plan namespace (#5174) #5611 (comment))

---

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: high

[ThomasK33]

Picked up by the issue coordinator: workspace workspace-71, branch plan-storage-5620-followups

Triage (all against main at 235980f). Classes: A = single-backend defect, small fix, no new persisted field. B = needs two backends, a crash window or mixed versions. C = new persisted field or subsystem. D = low priority. E = already fixed by #5611 (merged as 235980f), with evidence. M = model or repro refinement in formal/plan-storage.

Item	Class	Disposition
1. A legacy path that cannot be read counts as missing	A	Fix in migrateRemotePlanScript. A legacy plan counts as absent only when the nearest existing ancestor folder is a searchable directory, so the missing entry is a real ENOENT. Any other result exits with a new "unverified" code, and Xum fails closed: no flag is set and the next access retries.
2. The import notice stays after nothing_to_import	A	Fix in LegacyPlanImportBanner: the notice settles the offer once it has shown the error, so the notice and its palette action go away.
3. The identity temp file leaks when a write fails	A	Fix in installationIdentity.ts: remove tempPath in an outer finally.
4. Known limitation: a rename made while downgraded	C	A permanent fix keys scoped plans by workspace ID, which is a new remote layout and a migration. The docs explain how to recover. It stays open in backlog.

The PR will say "Refs", because item 4 stays open. Afterwards I will label the issue backlog.

---

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: high

[ThomasK33]

Items 1–3 are fixed by #5621, merged as 43cea0b:

• 1. A legacy plan path that cannot be checked now fails closed (new exit code "unverified"), and the next access retries.
• 2. The import notice settles after nothing_to_import: the reason stays visible, and the button and the palette action go away.
• 3. The identity temp file is removed in an outer finally.

Still open (backlog):

• Item 4, a rename made while downgraded: class C. A permanent fix keys scoped plans by workspace ID, which is a new remote layout.
• A gap in item 1, found by the final check on 🤖 fix: plan storage follow-ups from the #5611 review (#5620) #5621: a stat that fails for a reason other than an unsearchable folder (EIO, ESTALE on NFS) still counts as absent, because a POSIX shell cannot read the errno. The same applies to a symlinked legacy plan whose target cannot be checked. Trigger: a report of a hidden legacy plan on such a host.

---

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: high