Mirror, don't ask

The team dashboard’s first unattended run reported “0 developers found” — against a folder holding 1,251 files.

The guard was right, the message was wrong

The dashboard declined to overwrite a complete team page with an empty one — the guard did exactly its job. But the message it gave pointed at the wrong cause.

What was actually happening

A scheduled background job can’t read a macOS-protected folder the way an interactive session can. A basic directory check returns true; listing the folder throws a permission error; and the check meant to catch that quietly swallowed the error and returned empty. Every cheap check passed, and the count came back zero.

The fix we didn’t pick

The textbook fix needs Full Disk Access, which needs admin credentials the operator running this doesn’t have. So we didn’t fix it that way.

Instead, a process that already has the right access — one that runs from inside the editor session — mirrors the data out to a location the background job can read freely. The background job never touches the protected folder at all.

The lesson

It’s not the fix I’d have picked on a whiteboard. It’s the one that actually ships, because it works with the permissions we’re allowed to have instead of the ones we’d need to ask for.