daemon_pty_cwd_denied fired for 1,438 users in 21 days (2.8% of users adopting
a different-version daemon, 96% on Documents/Desktop/Downloads), so the daemon's
existing verdict already observes the failure and the helper probe for old
daemons has no population left to cover. A fresh same-version daemon ended the
denial for about 69% of observable users; the notice copy now tells the rest to
re-allow the folder.
Replace the helper-first recovery design with a two-layer plan: an in-daemon
opendir verdict plus a notice on the existing attribution poll (ship now), and
the helper probe for already-deployed old daemons (evidence-gated). Record the
2026-09-21 measurements: on Documents, access(2) passes while opendir gets
EPERM, so the current accessSync verdict is blind to the incident's folder
class; daemon-spawned login shells carry the daemon's grant; the login wrapper
is unconditional in production.
Jinwoo-H
Jinjing