Where the data lives

The baseline storage catalog describes xo-space 5221119; saved-command behavior is updated against revision 84f0737e23b6bb369fc6b8853afb510a02dd8b21. Paths are defaults, not a scan of your computer. Optional features create their files when used, and older installations can retain the legacy files described below. A runtime or connected service can keep additional data of its own.

Resolve the two roots first

Setup shows the effective roots. Persisted root changes go into <state root>/roots.env and take effect after a restart. Changing a configured root is not a bulk migration of all files, native homes, credentials, and browser state. The local installer and standalone defaults are defined in install.sh, project_layout.py, and runtime_config.py.

Portable project and workspace records

Portable means the record is intended to travel with the project or workspace. It does not mean anonymous, automatically uploaded, or safe to discard. These documents can contain names, descriptions, task text, identities, remote URLs, and paths.

Inside each project

Keep service-owned .xo records consistent through their APIs. In particular, a runtime's native task tool does not write Space's shared todos. The current contracts are in the project template, identity sink, agent schema, and the todo, workitem, and peer stores.

At the projects root

The filename space.json has two meanings that are easy to confuse: the portable .xo/space.json is the Space record. The HTTP response /xo/space.json is the derived graph, stored as <state root>/workspace/graph.json. See the Space record writer, project registry, frontend manifest, and view paths.

Machine-local project history

The following paths are relative to <state root>/projects/<runtime key>/. They stay outside the portable project tree. Some are replaceable projections; others are accumulated history or local decisions. Treating this entire directory as a disposable cache would lose information.

See session I/O, session enrichment, stats, timeline, issue mirror, and claims.

Workspace projections and watcher infrastructure

These paths are relative to the state root.

Presence is separate from history: a session can have historical usage and no current presence row. The current model cache is process-local, so a restarted watcher can need a new assistant usage event before it can publish a live row. Sources without process-presence support can contribute historical events while returning no live sessions. See the watcher, state paths, workspace writers, and lock implementation.

Inbox, connections, and sharing state

These paths are also relative to the state root. They include content and user choices, not just counters.

Sharing status also has an in-memory recent-event buffer. Inbox can retain a summary of a relay event after that buffer has changed. Deleting a connection's polling data does not retroactively delete its copied Inbox items. See the Inbox store, connection store, collectors, and sharing state.

Saved commands and schedules

Setup's Commands card uses the existing scheduler for both manual commands and interval jobs. Their files live under the machine-local state root, outside project .xo folders:

scheduler/
├── jobs.json          # command definitions and optional intervals
├── state.json         # next/last run, running marker, last result
├── runs/<id>.jsonl    # append-only results and raw output tails
└── logs/<id>.log      # appended full command output

A manual definition has no interval and never launches from a watcher tick. Run launches it explicitly; status reads collect completed results even when the watcher is off. Interval jobs share the same executor, concurrency limit, history, and logs. A server restart cannot resume a command: a remaining running marker is recorded as lost when reconciled.

Deleting a saved definition retains its history and logs and does not cancel an active process. Its eventual result can still be collected while the server remains running. Those files can outlive the command's row in Setup. The Quirq state view labels the directory and its files without returning their contents. The Commands card's separate API shows definitions and run output.

Configuration, credentials, logs, and scheduled work

The state root is not the only installation-owned directory. These exceptions matter when locating sensitive data or moving an installation.

The command logger's redaction does not cover every persisted scheduler field: job definitions preserve supplied arguments/environment, and result records keep a raw output tail. Setup's write-only presentation also does not encrypt the underlying env file. Keep these stores within the appropriate local access boundary. See agent env, token store, Composio paths, backup config, command logger, scheduler, and usage reporting.

Native runtime stores and ingestion databases

Native runtimes own their conversations, tool inputs/results, authentication, and internal settings. Space's ability to read a subset is not a retention policy for the whole runtime home.

SQLite readers and transcript adapters are described in the adapter source tree. Only Claude Code, Codex, and Cursor currently provide the aggregate Sessions capability. The watcher discovers a different capability, so these two lists need not match. See how collection works.

Argus stores more than the metric fields Space displays. In the pinned Argus 0.5.1 release, its database includes sessions, turns, tool-call metadata, source cursors, settings, alerts, and parse errors with short raw-line excerpts. It also ingests prompt display text from Claude's history.jsonl independently of the transcript-search toggle. Optional transcript indexing retains user, assistant, thinking, and tool-result segments plus full-text indexes. Disabling indexing does not remove those previously stored segments or prompt records. See the Argus collection boundary.

In-memory, browser, and temporary copies

“The transcript remains native” does not mean no content ever enters another buffer. File preview and prompt-detail requests necessarily read content into the server/browser. Their copies have a different lifetime from disk history.

See prompt endpoint, Sessions UI, preview state, Atlas preferences, and temporary MCP config.

Copies created by backup and sharing

An encrypted project backup creates a private GitHub repository named xo-project-<project-id>. Each timestamped snapshot contains encrypted chunks and an unencrypted manifest.json: project/snapshot ID, time, byte size, hash, part names, git-origin URL, and optional note. The encryption protects the archive payload, not those manifest fields or the repository name.

For a git project, the archive includes tracked and untracked non-ignored files, plus .xo/ even if git ignores it. Mandatory exclusions still remove .env, .env.*, .git, node_modules, .venv, __pycache__, and socket files at any depth. A non-git project uses a filesystem walk with those exclusions. The state root and native homes are outside the archive when they are outside the project directory. If configured inside a project, the normal file-selection rules apply; there is no special exclusion for those roots. Arbitrarily named sensitive files inside a project are not detected by a content scan. See archive selection and snapshot manifest.

Git sharing has a different boundary: commits carry whatever the repository contains to its remote. The sharing relay records and exchanges repository identity and commit/ledger state; it does not turn a git push into an encrypted backup. A recipient's clone creates another copy of the shared repository. See Sharing and the relay implementation.

What happens to older layouts

Migration is specific to each store; it is not “move everything into .quirq.”

Do not expect old and new copies to be merged into a complete audit history when both exist. Destination precedence is deliberate. The implementation details are in runtime migration, workspace migration, and each store linked above. Continue with collection and controls to understand which data is regenerated, retained, or sent to another service.