Josh: move non-production content out of joshandmariamusic into JoshMariaMusic_private

[JoshuaVSherman]

Part of epic web-jam-tools#315 "Restrict Claude and Flash Dropbox access via a dedicated account" — see that issue for the validated design and budget.

✅ UNBLOCKED 2026-07-30 — but the plan CHANGED, read this before moving anything

web-jam-tools#320 "Validate the production media pin list by Dropbox file ID before any move" delivered its verified, ID-based manifest (see the manifest comment on that issue): 61 production assets pinned — 44 audio, 10 video, 7 image. Nothing new was cleared to move.

🔴 TWO FOLDERS IN THE EPIC'S TARGET-STATE TABLE ARE NOT SAFE TO BULK-MOVE

The epic marks audio, Photos, DriveArchive, JoshMaria_videos-2026, Lent and Stations, MariaParty for a full move. Verified against live song data, two of those are MIXED and must not move as a unit:

Folder	Confirmed production content	Action
joshandmariamusic/JoshMaria_videos-2026/	5 production videos — the Salem Farmers Market 2026 clips (Dark Light, Lodi, I'm Yours, Glorious, Good Enough)	Pin those 5. Evaluate every sibling individually. Do NOT move the folder.
joshandmariamusic/audio/	2 production tracks — "Dirty Water" and "Suicidal Squirrel", both live at the Beast of Blacksburg 2025	Pin those 2. Evaluate every sibling individually. Do NOT move the folder.

That is 7 files that a folder-level move would have taken off the live site.

Filename and folder assumptions are proven unsafe

Two production files resolve to paths nobody would predict:

• 13340120.jpg (referenced by 2 songs) → actually /ShermanHome/Documentation/logoGuitarMan.jpg — different filename, different top-level folder, not in joshandmariamusic at all
• A CollegeLutheran staff photo → /WebJamApps/CLC 3/2023/..., not /CollegeLutheran/website/ where its siblings live

Match by Dropbox file ID against the manifest. Never by filename.

🟡 One gap remains — 5 items UNVERIFIED

The homepage picture slideshow (jamPics) and the live gig collection are served from WebJamSocketCluster's own Mongo (web-jam-data) over a socketcluster connection, not REST. Six connection attempts to webjamsocket.herokuapp.com failed with Socket hung up immediately after handshake, so that data could not be verified. web-jam-back's gig collection is empty, but the frontend does not read it, so that proves nothing.

Consequence: any file that could plausibly be a homepage-slideshow image or gig promo image stays where it is until that gap closes. Six seed-only slideshow candidates were resolved to file IDs as candidates only — not proven live.

Hard rule

A production-referenced file never moves. It stays at its exact current path; only its unreferenced siblings move. Any file whose status cannot be verified stays put. This covers images, audio and video — not audio alone.

Steps

• C1. Confirm the Dropbox desktop app shows sync fully up to date and idle before starting. A multi-gigabyte move interrupted mid-sync is how duplicates and orphans happen
• C2. Move these whole folders into JoshMariaMusic_private/ — none contain production media: audio, Photos, DriveArchive, JoshMaria_videos-2026, Lent and Stations, MariaParty
• C3. Move the loose top-level files of joshandmariamusic into JoshMariaMusic_private/, excluding anything on the verified production manifest. The loose mp4s are prime suspects — Country Roads Alternate Lyrics.mp4 (374 MB), Call_Me.mp4, Dark_Light.mp4, Country Roads in Martinsville.mp4, Country_Roads.mp4 — and good enough.mp3 also sits here and may be a production copy. None of them move until the manifest says so
• C4. Thin originals/ — move everything except its verified production tracks into JoshMariaMusic_private/originals/
• C5. Thin Mission/ the same way — keep only verified production files
• C6. Thin Christmas/ the same way — keep only verified production files
• C7. Wait for the Dropbox desktop app to report sync complete and idle
• C8. Verify size: du -sm ~/Dropbox/joshandmariamusic must be under 2048 MB. Expected range is ~552 MB if no video proves live, up to ~977 MB if every loose video does
• C9. Spot-check the live sites in a browser — play a track from Mission, Pub, originals and Christmas, play a video on the songs page, and load the joshandmariamusic.com homepage slideshow. Any dead link or missing image means a production file was moved; restore it before continuing

Cleared to move without manifest confirmation

joshandmariamusic-qr.svg and joshandmariamusic-qr.png — Josh confirmed directly these were made for banners and are not used on any site. This is the one exception, and it rests on his knowledge rather than the audit.

Out of scope

• Dropbox/CollegeLutheran — six production tracks live there and stay exactly where they are
• Dropbox/WebJamApps — holds production images (hiddenValleyTalentShow.png, Martinsville2017.png) and credentials. Claude's access to it is denied separately, but nothing in it moves or is unshared

Done when

joshandmariamusic is under 2048 MB and every spot-checked track, video and image still loads.