Track vault root view bugfix

AGENTS.md

@@ -135,6 +135,7 @@ These features are product requirements, not “nice to have” ideas.
 
 ## Delivery Discipline
 
+- Treat bug fixes as the highest-priority items in `TODO.md`.
 - Do not treat this product as complete until the stated requirements in this file are actually satisfied.
 - Do not stop at a “good checkpoint” or “meaningful tranche” when required product capabilities are still missing.
 - Continue iterating in test-first slices:

TODO.md

@@ -6,6 +6,13 @@ These segments are intended to be independently executable wherever possible.
 Each segment has its own local exit criteria.
 The product is not complete until the global exit criteria at the end of this file are also met.
 
+## Priority Bugs
+
+- Vault root view bug:
+  stop leaking the physical `keepass` storage root into user-facing group lists
+  and API-facing logical paths by introducing explicit `Vault`, `VaultRoot`,
+  and `VaultRecycleBin` datastore views.
+
 ## UI Review Follow-Ups
 
 These items came from a hands-on emulator and desktop walkthrough.