.gitignore

@@ -3,3 +3,10 @@ app/dist/
 app/src-tauri/target/
 Screenshot*.png
 code-review.md
+
+# Windows NTFS alternate-data-stream artifacts, created when files arrive
+# through the WSL/host bind mount.
+*:Zone.Identifier
+
+# Local bug-report screenshots, same spirit as Screenshot*.png above.
+screenshot_for_fix/

app/src-tauri/src/commands/migration_commands.rs

@@ -460,6 +460,13 @@ async fn fresh_migration(
         }
     }
 
+    // Scrub *before* the stop, not inside the commit below. `scrub_writable_layer`
+    // is a `docker exec`, which only works on a running container — and the
+    // pre-swap commit is the single largest snapshot Triple-C ever takes, so
+    // letting this one path commit unscrubbed is what the scrub exists to
+    // prevent. Failure is swallowed inside; it must never block a migration.
+    docker::scrub_writable_layer(&container_id).await;
+
     emit_progress(&app_handle, &project_id, "Stopping the container...");
     let _ = state
         .projects_store

app/src-tauri/src/docker/container.rs

@@ -2047,9 +2047,10 @@ fn parse_scrub_total(output: &str) -> Option<u64> {
 /// **Never fails the caller, by design.** A scrub is an optimisation; a commit
 /// is the only copy of the user's system layer. Losing some disk is a strictly
 /// better outcome than refusing to snapshot, so every failure here is a log
-/// line and nothing more. Note that one caller (the pre-swap commit in
+/// line and nothing more. Note that this is a `docker exec` and therefore only
-/// `migrate_project_to_base`) has already *stopped* the container, so `docker
+/// works while the container runs: `migrate_project_to_base` stops its
-/// exec` legitimately fails there — that path simply commits unscrubbed.
+/// container before the pre-swap commit, so it calls this itself beforehand
+/// rather than relying on the call inside [`commit_container_snapshot`].
 pub async fn scrub_writable_layer(container_id: &str) -> u64 {
     let script = snapshot_scrub_script();
     let cmd = vec!["/bin/sh".to_string(), "-c".to_string(), script];

container/entrypoint.sh

@@ -480,7 +480,8 @@ fi
 # already in place, so it keeps printing its "run /terminal-setup" tip. This
 # flag is what that tip is gated on: purely cosmetic, and it changes nothing
 # about how the sequence is decoded.
-CLAUDE_JSON="/home/claude/.claude.json"
+#
+# $CLAUDE_JSON is already set by the awsAuthRefresh block above.
 if [ -f "$CLAUDE_JSON" ]; then
     # Only rewrite when the value isn't already true, to avoid a needless jq
     # reformat of ~/.claude.json on every single start.