ferstar unpacked ZCode’s logged-in snapshot sidecar. I read the post, Tokenstead, live Repo Wiki docs, and the privacy policy (effective June 15 2026). I counted OrcaPromptVault activeReceiptVerified: 24 tools. I did not run ZCode or unpack app.asar.

Those 24 names include Read and ReadSessionContext. They do not include snapshot or upload. Live wiki docs say the .git directory never reaches the model context used to generate the wiki. #707 already has lastAcceptedManifestHash with repoSnapshotIndexingEnabled false. The privacy page has no snapshot, workspace, .git, or checkpoint.