2026-09-16 (session 106): the 03:00 drift alert cleared. unlikely-field-listener added to EXPECTED_CONTAINERS in /opt/scripts/dr-drift-check.sh (compose service since session 101, idle until FIELD_LISTENER tokens are set). SQLITE_DBS in smartsuite-backup.py: rfi_tokens.db re-added because services/rfi_token_service._get_db recreates it on any /portal/rfi token call (it came back 9/2 after the 8/30 removal); notifications.db dropped (0-byte stub, no code path). Five 0-byte stub DBs deleted from /data/portal-auth (pms_archive, portal-auth, portal_auth, users, notifications) — the pattern is a stray sqlite3 <guessed path> creating an empty file. scripts 6cba9e3. Drift check CLEAN. Open: dr-restore.sh steps 8–9 still reference the dead OpenClaw and Stripe webhook stacks (guarded, warn only) and do not mention announcer / f5-ingest / field-listener.
2026-10-10 (Dustin): every drift run now also posts its DRIFT lines to ops tagging Dustin via /opt/scripts/ops-post.py (notify(“ops”) in-container = Kilroy ops-mirror lane, Slack DM fallback); clean runs silent. A 0-byte unlisted .db is labelled a stray sqlite3 probe to rm, never a backup-list entry (notifications.db stub recurred 10/02; 10/04, 10/07, 10/10 emails). scripts 4f71f20.