nix: harden custom data directory ownership

AGENTS.md

@@ -25,11 +25,10 @@ Impure shell around pure decision cores:
 - Each tick: `local_snapshot` + `index_snapshot` → pure `reconcile()` → `Vec<Action>`
   {Import, WriteFile, DeleteLocal, Tombstone, Merge} → execute → settle into `SyncState`
   (atomic temp+rename to `data_dir/state.toml`).
-- The `Wiremap` (ssync-core `wiremap.rs`) owns the adapters, the per-agent excludes, and
-  the path-map resolver: every wire-key ↔ local-path translation and every freeze verdict
-  (excluded key #14, dropped-agent guard, failed mapping #49) lives behind it — Engine
-  never touches adapters directly, and the freeze invariants are unit-tested there
-  without iroh.
+- `SessionFilesystem` (ssync-core `session_filesystem.rs`) owns adapters, bounded discovery,
+  wire-key ↔ local-path translation, path-map resolution, freeze verdicts, and contained
+  read/write/delete. Engine never touches adapters or filesystem policy directly; tests cover
+  the interface without iroh.
 - Import path: file → age-encrypt (subprocess) → `Node::publish` (blob + index entry keyed
   `{agent}/{relative_path}`; the ONLY write path — temp-tag prevents the GC race).
 - Export path: index entry → `Node::blob` (local miss → bounded fetch from peers behind

Cargo.toml

@@ -9,7 +9,7 @@ members = [
 ]
 
 [workspace.package]
-version = "0.19.1"
+version = "0.19.4"
 edition = "2024"
 license = "MIT"
 repository = "https://github.com/fosskar/ssync"

crates/ssync-core/src/cleanup.rs

@@ -69,7 +69,8 @@ pub fn plan(adapters: &[Box<dyn Adapter>], filter: &Filter) -> Result<Vec<Victim
         {
             continue;
         }
-        let files = crate::wiremap::session_files(adapter.session_root(), adapter.as_ref());
+        let files =
+            crate::session_filesystem::session_files(adapter.session_root(), adapter.as_ref());
         let mut selected = Vec::new();
         for path in &files {
             let old_enough = match filter.before {

crates/ssync-core/src/config.rs

@@ -235,8 +235,8 @@ impl Config {
     }
 
     /// The validated [`PathMap`] this config describes (empty = inert).
-    pub fn build_path_map(&self) -> Result<crate::pathmap::PathMap> {
-        crate::pathmap::PathMap::new(
+    pub fn build_path_map(&self) -> Result<crate::PathMap> {
+        crate::PathMap::new(
             self.path_map
                 .iter()
                 .map(|e| {