conductor(plan): add TRACK_COMPLETION report + track artifacts for tier2_leak_prevention_20260620

Adds the end-of-track artifacts for the tier2_leak_prevention_20260620
fix track:

- docs/reports/TRACK_COMPLETION_tier2_leak_prevention_20260620.md:
  Full track completion report following the precedent set by
  TRACK_COMPLETION_tier2_autonomous_sandbox_20260616.md. Documents
  the 4 atomic commits, the 25 default-on tests, the manual
  end-to-end verification, the key design decisions (auto-unstage
  not exit 1, git rm --cached --force, CRLF handling, specific not
  prefix patterns), the known limitations, and the next steps for
  the user (push to origin, rebase stale tier-2 branches, re-run
  setup on the existing clone, optional CI wiring).

- conductor/tracks/tier2_leak_prevention_20260620/metadata.json:
  Track metadata (status=shipped, scope: 5 new files + 1 modified,
  25 default-on tests, 5 verification criteria, 5 risk-register
  entries, 2 deferred follow-up tracks).

- conductor/tracks/tier2_leak_prevention_20260620/spec.md:
  Track spec (background on the 00e5a3f2 offender commit, design
  with the 3-layer defense-in-depth, forbidden patterns, tests,
  out-of-scope items).

- conductor/tracks/tier2_leak_prevention_20260620/plan.md:
  Track plan (4 phases: revert + hook + audit + install; tasks
  recorded retroactively per workflow.md "Plan is the source of
  truth").

- conductor/tracks/tier2_leak_prevention_20260620/state.toml:
  Track state (status=completed, current_phase=complete, 4 phases
  with checkpoint SHAs, 16 tasks all completed with commit SHAs).

- conductor/tracks.md: registered as track 6f in the Active
  Tracks table; added a "Recently Completed" entry with the
  commit-history summary.

Per conductor/workflow.md "End-of-track report" protocol. The
report includes a "Mistake to flag" section about the
`Remove-Item -Recurse -Force` accident during verification, per
the AGENTS.md "Hard ban on destructive commands" rule (which is
specifically about `git restore`/`git checkout`/`git reset`/`git
push` but the lesson generalizes: destructive PowerShell commands
on directories with tracked files require explicit verification
before running).

conductor/tracks.md

@@ -30,6 +30,7 @@ Tracks that are unblocked and ready to start. Ordered by **dependency** (blocked
 | 6d-3 | A | [Result Migration Sub-Track 3: App Controller](#track-result-migration-sub-track-3-app-controller-2026-06-18) | spec ✓, plan ✓, metadata ✓, state ✓, **active**; migrates 45 sites in `src/app_controller.py` to `Result[T]` (32 INTERNAL_BROAD_CATCH + 8 INTERNAL_SILENT_SWALLOW + 4 INTERNAL_RETHROW + 1 INTERNAL_OPTIONAL_RETURN); 22 sites stay as-is (15 BOUNDARY_FASTAPI + 2 BOUNDARY_SDK + 4 INTERNAL_COMPLIANT + 1 INTERNAL_PROGRAMMER_RAISE). **Phase 1 = fix the 2 known regressions** (test_tool_presets_execution::test_tool_ask_approval + test_extended_sims::test_execution_sim_live) caused by the half-migrated `session_logger.log_tool_call` call site in `_offload_entry_payload` (lines 3715, 3721). 5-file-commit pattern from `doeh_test_thinking_cleanup_20260615` (1 source + 1 test + 1 plan + 1 metadata + 1 state per task). 6 phases: (1) Setup + fix regressions; (2) 32 broad-catch → 4 bulk batches; (3) 8 silent-swallow → 2 batches with logging.debug per Heuristic #19; (4) 4 rethrow classified + 1 optional migrated; (5) Verify + audit + end-of-track report. | `result_migration_20260616` (umbrella); `result_migration_small_files_20260617` (shipped 2026-06-18) | (**NEW 2026-06-18**; sub-track 3 of 5; scope: 1 source file (src/app_controller.py) modified across 6 phases; 45 migration sites organized into 4 bulk batches + 3 single-site tasks; 1 new test file (test_app_controller_result.py) + 2 test files updated; 4 metadata/plan/state files; 1 end-of-track report; 18 atomic commits. **Scope larger than umbrella's T-shirt estimate** (45 migration + 22 stay = 67 total, not the estimated 22 + 34 = 56); the audit's per-category output is the source of truth, not the umbrella's T-shirt estimate**) |
 | 6d-4 | A | [Result Migration Sub-Track 4: gui_2.py](#track-result-migration-sub-track-4-gui_2py-20260619) | spec ✓, plan ✓, metadata ✓, state ✓, **shipped 2026-06-20**; migrated 42 sites in `src/gui_2.py` (25 INTERNAL_BROAD_CATCH + 13 INTERNAL_SILENT_SWALLOW + 2 INTERNAL_RETHROW + 2 UNCLEAR) to `Result[T]`; added 3 new drain-plane render functions + 1 new test file + 2 new audit heuristics (Phase 11 dunder raise + Phase 12 lazy-loading fallback). **Audit: V=0, S=0, ?=0 for gui_2.py.** 81 atomic commits across 13 phases; 114 tests pass; Tier 1+2 batched: 10/10 PASS; Tier 3: 1 known issue (FPS 28.46 vs 30 threshold; documented in TRACK_COMPLETION). **Anti-sliming protocol: 13 phases cap each phase at <=10 sites with per-phase styleguide re-read + per-site audit pre/post check + per-phase invariant test.** | `result_migration_app_controller_20260618` (sub-track 3, SHIPPED 2026-06-19 with Phase 7; data plane ready) | (**NEW 2026-06-19**; sub-track 4 of 5; scope: 1 source file (src/gui_2.py) modified across 13 phases; 42 migration sites organized into 12 migration phases + 3 setup phases; 1 new test file (tests/test_gui_2_result.py) with 114 tests; 1 modified test file (tests/test_audit_heuristics.py) with 8 regression tests; 4 metadata/plan/state/spec files; 1 end-of-track report; 81 atomic commits. **Extra-long phase structure per user directive (2026-06-19) to prevent Tier 2 sliming.**) |
 | 6e | A (meta-tooling) | [Tier 2 Autonomous Sandbox (unattended track execution)](#track-tier-2-autonomous-sandbox-new-2026-06-16) | spec ✓, plan ✓, **shipped 2026-06-16** (9 phases, 24 default-on tests + 4 opt-in tests + 1 smoke e2e) | (none — independent; **NEW 2026-06-16**; meta-tooling; eliminates the `permission: ask` bottleneck for well-regularized tracks via a 3-layer enforcement stack: OpenCode permission system + Windows restricted token + git hooks) |
+| 6f | A (meta-tooling) | [Tier 2 Sandbox File Leak Prevention (revert + 3-layer defense)](#track-tier-2-sandbox-file-leak-prevention-new-2026-06-20) | spec ✓, plan ✓, metadata ✓, state ✓, **shipped 2026-06-20**; selectively reverted the 4 user-named files from offender commit `00e5a3f2` (`.opencode/agents/tier2-autonomous.md`, `.opencode/commands/tier-2-auto-execute.md`, `opencode.json`, `mcp_paths.toml`); added 3-layer defense: pre-commit hook at `conductor/tier2/githooks/pre-commit` (auto-unstages forbidden files at commit boundary; 12 tests), `scripts/audit_tier2_leaks.py` (working-tree audit with `--strict` CI gate; 13 tests), wired hook installation into `scripts/tier2/setup_tier2_clone.ps1`. 25 default-on + 4 opt-in tests pass; 4 atomic commits (`fab2e55b` + `81e1fd7b` + `f5d8ea04` + `8f54deda`); user-driven response to a one-off incident (per user directive: tier-2 must NEVER commit those files again; **NOT via gitignore**). **DEFERRED**: CI wiring of audit `--strict` mode; rebase of stale tier-2 branches (`tier2/result_migration_app_controller_phase6_20260619`, `tier2/test_sandbox_hardening_20260619`) on `origin/master@8f54deda` to drop `00e5a3f2` (user action). | (none — independent; **NEW 2026-06-20**; meta-tooling fix; selective revert of 4 of 9 changes in offender commit `00e5a3f2`) |
 | 7 | — | [UI Polish (Five Issues)](#track-ui-polish-five-issues) | spec ✓, plan ✓, ready to start (Phases 1/4/5 shipped; Phases 2/3 code shipped but tests broken — fixed by track 6a) | (none — independent) |
 | 7a | B | [SQLite-Granularity Inline Docs for gui_2.py](#track-sqlite-granularity-inline-docs-for-gui_2py) | spec ✓, plan ✓, complete | (none — independent) |
 | 7b | B | [Continued SQLite-Granularity Inline Docs for gui_2.py](#track-continued-sqlite-granularity-inline-docs-for-gui_2py) | spec ✓, plan ✓, complete | (none — independent) |
@@ -466,6 +467,13 @@ Lightweight chronology; full spec/plan/state per track is in the linked folder.
 
 *9 phases, 57 tasks. 44 TDD tests added. Main Thread Purity Invariant enforced via `scripts/audit_main_thread_imports.py` CI gate. Final measured: import src.ai_client 161ms (was 1800ms; 91% reduction); import src.gui_2 341ms (was 1770ms; 81% reduction); total ~3067ms saved. 62 audit violations remain (large refactors deferred).*
 
+#### Track: Tier 2 Sandbox File Leak Prevention `[COMPLETE 2026-06-20]`
+*Link: [./tracks/tier2_leak_prevention_20260620/](./tracks/tier2_leak_prevention_20260620/), Report: [../../docs/reports/TRACK_COMPLETION_tier2_leak_prevention_20260620.md](../../docs/reports/TRACK_COMPLETION_tier2_leak_prevention_20260620.md)*
+
+`[phase-1-revert: fab2e55b] [phase-2-hook: 81e1fd7b] [phase-3-audit: f5d8ea04] [phase-4-install: 8f54deda]`
+
+*Selective revert of the 4 user-named files from offender commit `00e5a3f2` (`.opencode/agents/tier2-autonomous.md`, `.opencode/commands/tier-2-auto-execute.md`, `opencode.json`, `mcp_paths.toml`). 3-layer defense-in-depth added: pre-commit hook (auto-unstages forbidden files at commit boundary; 12 tests), working-tree audit script with `--strict` CI gate (13 tests), and hook installation via `scripts/tier2/setup_tier2_clone.ps1`. 25 default-on tests pass. **Out of scope** (per user explicit list): the 4 throwaway scripts in `scripts/tier2/artifacts/.../*.py` and the `project_history.toml` timestamp. **DEFERRED**: CI wiring of `audit_tier2_leaks.py --strict`; rebase of stale tier-2 branches (`tier2/result_migration_app_controller_phase6_20260619`, `tier2/test_sandbox_hardening_20260619`) on `origin/master@8f54deda` to drop `00e5a3f2` (user action).*
+
 #### Track: Test Batching Refactor `[COMPLETE 2026-06-08] [archived]`
 *Link: [./tracks/archive_completed_tracks_20260603/test_batching_refactor_20260606/](./tracks/archive_completed_tracks_20260603/test_batching_refactor_20260606/)*