@kirrosh/zond 0.23.0 → 0.26.1

package/src/cli/commands/doctor.ts

@@ -34,6 +34,7 @@ import { hashSpec } from "../../core/meta/meta-store.ts";
 import { jsonOk, jsonError, printJson } from "../json-envelope.ts";
 import { printError } from "../output.ts";
 import { getApi } from "../util/api-context.ts";
+import { detectSkillDrift } from "./init/skills.ts";
 
 export interface DoctorOptions {
   api?: string;
@@ -120,6 +121,10 @@ interface DoctorReport {
     exists: boolean;
     sha: string | null;
   };
+  endpoints: {
+    total: number;
+    by_method: Record<string, number>;
+  } | null;
   fixtures: {
     required: FixtureMetaRow[];
     optional: FixtureMetaRow[];
@@ -341,6 +346,21 @@ export async function doctorCommand(opts: DoctorOptions): Promise<number> {
   const warnings: string[] = [];
   if (!specExists) warnings.push(`spec.json not found at ${specAbsPath}`);
   if (!manifest) warnings.push(`.api-fixtures.yaml missing — run \`zond refresh-api ${apiName}\``);
+
+  // ARV-237: warn when workspace .claude/skills/ copy drifts from the
+  // in-binary template (binary upgraded but `zond init` not re-run).
+  // `missing` is silent — user may have opted out via `--no-skills`.
+  try {
+    const wsRoot = findWorkspaceRoot().root;
+    const outdated = detectSkillDrift(wsRoot).filter(d => d.status === "outdated");
+    if (outdated.length > 0) {
+      warnings.push(
+        `workspace skills outdated (${outdated.map(d => d.name).join(", ")}) — run \`zond init\` to refresh .claude/skills/`,
+      );
+    }
+  } catch {
+    // not in a workspace — skip
+  }
   const placeholderRows = [...requiredOut, ...optionalOut].filter(r => r.placeholder);
   if (placeholderRows.length > 0) {
     warnings.push(
@@ -348,6 +368,32 @@ export async function doctorCommand(opts: DoctorOptions): Promise<number> {
     );
   }
 
+  // Endpoint counts from .api-catalog.yaml — read what `zond add api` already
+  // computed, so `--json` consumers (e.g. /zond-scan PF2 budget estimate)
+  // don't have to walk raw spec.json themselves (which would violate the
+  // "never read raw OpenAPI" iron rule in the zond skill).
+  let endpoints: DoctorReport["endpoints"] = null;
+  const catalogPath = join(baseDir, ".api-catalog.yaml");
+  if (existsSync(catalogPath)) {
+    const catalog = readYamlIfExists<{
+      endpointCount?: number;
+      endpoints?: Array<{ method?: string }>;
+    }>(catalogPath);
+    if (catalog) {
+      const list = Array.isArray(catalog.endpoints) ? catalog.endpoints : [];
+      const byMethod: Record<string, number> = {};
+      for (const ep of list) {
+        const m = (ep.method ?? "").toUpperCase();
+        if (!m) continue;
+        byMethod[m] = (byMethod[m] ?? 0) + 1;
+      }
+      endpoints = {
+        total: typeof catalog.endpointCount === "number" ? catalog.endpointCount : list.length,
+        by_method: byMethod,
+      };
+    }
+  }
+
   const report: DoctorReport = {
     api: apiName,
     mode: "spec",
@@ -357,6 +403,7 @@ export async function doctorCommand(opts: DoctorOptions): Promise<number> {
       exists: specExists,
       sha: specSha,
     },
+    endpoints,
     fixtures: {
       required: requiredOut,
       optional: optionalOut,
@@ -378,12 +425,18 @@ export async function doctorCommand(opts: DoctorOptions): Promise<number> {
   if (opts.query) {
     const resolved = resolveDotPath(presented, opts.query);
     if (resolved === undefined) {
-      const message = `--query path '${opts.query}' did not resolve in the doctor report (canonical paths: api, spec, fixtures.required, fixtures.optional, fixtures.extraInEnv, staleArtifacts, warnings)`;
+      const message = `--query path '${opts.query}' did not resolve in the doctor report (canonical paths: api, spec, endpoints, fixtures.required, fixtures.optional, fixtures.extraInEnv, staleArtifacts, warnings)`;
       if (opts.json) printJson(jsonError("doctor", [message]));
       else printError(message);
       return 2;
     }
     process.stdout.write(JSON.stringify(resolved, null, 2) + "\n");
+    // ARV-274: --json (incl. --query) returns 0 on successful emit.
+    // Fixture/staleness state is *data*, not command failure — non-zero is
+    // reserved for command failure (missing api, parse error). Text mode
+    // still surfaces state via exit code so `if zond doctor; then ...`
+    // remains a useful gate.
+    if (opts.json) return 0;
     if (blockedRequired > 0) return 1;
     if (staleArtifacts.some(s => !s.fresh) || !specExists || !manifest) return 2;
     return 0;
@@ -392,10 +445,11 @@ export async function doctorCommand(opts: DoctorOptions): Promise<number> {
   // ── Output ──
   if (opts.json) {
     printJson(jsonOk("doctor", presented));
-  } else {
-    printHuman(presented, envVars, { missingOnly: opts.missingOnly === true });
+    return 0; // ARV-274: JSON envelope emit success → exit 0
   }
 
+  printHuman(presented, envVars, { missingOnly: opts.missingOnly === true });
+
   if (blockedRequired > 0) return 1;
   if (staleArtifacts.some(s => !s.fresh) || !specExists || !manifest) return 2;
   return 0;

package/src/cli/commands/fixtures.ts

@@ -100,7 +100,7 @@ async function readEnv(envPath: string): Promise<Record<string, string>> {
   return (await loadEnvFile(envPath)) ?? {};
 }
 
-async function applyEnvWrites(
+export async function applyEnvWrites(
   envPath: string,
   writes: Record<string, string>,
 ): Promise<{ backup: string | null }> {

package/src/cli/commands/generate.ts

@@ -68,10 +68,9 @@ export interface GenerateOptions {
    *  exits — no files written. Use to debug "why didn't generate emit a
    *  CRUD chain for resource X?" on real specs. */
   explain?: boolean;
-  /** TASK-219: accepted but currently a no-op — `zond generate` already
-   *  overwrites unconditionally. Kept on the CLI so agents passing
-   *  `--force` / `--overwrite` don't see "unknown option" and bail. A
-   *  future fix will gate sha-mismatched user edits behind this flag. */
+  /** TASK-219/ARV-361: overwrite hand-edited suite files (those whose
+   *  auto-gen header was removed). Default false = preserve them; files that
+   *  still carry the header are regenerated regardless. */
   force?: boolean;
   json?: boolean;
   /** ARV-9 unified filter: path:<regex> / method:<csv> / tag:<csv> /
@@ -371,6 +370,22 @@ export async function generateCommand(options: GenerateOptions): Promise<number>
       const yaml = serializeSuite(suite);
       const fileName = `${suite.fileStem ?? suite.name}.yaml`;
       const filePath = join(options.output, fileName);
+      // m-24 (ARV-361): don't silently clobber agent-edited suites. The
+      // auto-gen header already promises "drop the header (or rename) to
+      // keep changes" — honour it deterministically: a file whose first line
+      // is no longer the auto-gen marker is agent-owned, so preserve it
+      // unless --force. Files that still carry the header get overwritten,
+      // exactly as the header warns. Makes the previously no-op --force real.
+      if (!options.force && existsSync(filePath)) {
+        // Small yaml — whole-file read is fine; we only need the first line.
+        const firstLine = (await Bun.file(filePath).text()).split("\n", 1)[0] ?? "";
+        if (!firstLine.startsWith("# Auto-generated by")) {
+          warnings.push(
+            `Preserved ${fileName} — no auto-gen header, treated as hand-edited. Pass --force to overwrite.`,
+          );
+          continue;
+        }
+      }
       const header = autoGenHeader("zond generate", `zond generate --api <name> --output ${options.output}`);
       await Bun.write(filePath, header + yaml);
       createdFiles.push({
@@ -505,7 +520,9 @@ export async function generateCommand(options: GenerateOptions): Promise<number>
     if (options.json) {
       printJson(jsonError("generate", [message]));
     } else {
-      printError(message);
+      // ARV-203: pass err so ZOND_DEBUG=1 dumps the stack and the user
+      // gets a hint about the env var when running without it.
+      printError(message, err);
     }
     return 2;
   }
@@ -518,7 +535,7 @@ import { getApi } from "../util/api-context.ts";
 export function registerGenerate(program: Command): void {
   program
     .command("generate [spec]")
-    .description("Generate test suites from OpenAPI spec (overwrites existing suite files unconditionally — re-run is safe; user-edited tests are not preserved). Body fields are filled with `{{$random*}}` helpers (slug/email/url/uuid/…) — see `zond reference random-helpers` or docs/random-helpers.md for the full list (TASK-267).")
+    .description("Generate test suites from OpenAPI spec. Re-run regenerates files that still carry the auto-gen header; hand-edited suites (header removed) are preserved unless --force (ARV-361). Body fields are filled with `{{$random*}}` helpers (slug/email/url/uuid/…) — see `zond reference random-helpers` or docs/random-helpers.md for the full list (TASK-267).")
     .option("--api <name>", "Use the registered API's spec (apis/<name>/spec.json)")
     .option("--db <path>", "Path to SQLite database file")
     .option("--output <dir>", "Output directory for generated test files (required unless --explain)")
@@ -534,7 +551,7 @@ export function registerGenerate(program: Command): void {
     .option("--uncovered-only", "Skip endpoints already covered by existing tests")
     .option("--include-deprecated", "Generate suites for deprecated endpoints too (filtered out by default)")
     .option("--explain", "Print the CRUD detection table (which resources became chain candidates and why) without writing files (TASK-139)")
-    .option("--force, --overwrite", "Accepted for compatibility — generate already overwrites by default (TASK-219). No-op today; will gate user-edited file overwrites in a future release.")
+    .option("--force, --overwrite", "ARV-361: overwrite even hand-edited suite files (those whose auto-gen header was removed). Default: preserve them and warn — files that still carry the header are always regenerated.")
     .action(async (specPos: string | undefined, opts, cmd: Command) => {
       const resolved = resolveSpecArg(specPos, opts.api, opts.db);
       if ("error" in resolved) { printError(resolved.error); process.exitCode = 2; return; }

package/src/cli/commands/init/bootstrap.ts

@@ -44,7 +44,10 @@ export interface BootstrapResult {
  * (unless `writeAgents` is false) `AGENTS.md`.
  */
 export function bootstrapWorkspace(opts: BootstrapOptions = {}): BootstrapResult {
-  const cwd = resolve(opts.cwd ?? process.cwd());
+  // Honor ZOND_WORKSPACE so `zond init` writes the workspace at the same root
+  // that findWorkspaceRoot() reads from (headless/CI runs anchor both here).
+  // Explicit opts.cwd (tests) still wins.
+  const cwd = resolve(opts.cwd ?? process.env.ZOND_WORKSPACE?.trim() ?? process.cwd());
   const warnings: string[] = [];
   const writeAgents = opts.writeAgents ?? true;
   const writeSkills = opts.writeSkills ?? true;

package/src/cli/commands/init/index.ts

@@ -163,7 +163,7 @@ function printBootstrapResult(b: BootstrapResult, writeAgents: boolean): void {
       `\nNext steps:\n` +
       `  1. zond add api <name> --spec <path|url>   # register API → builds .api-fixtures.yaml (manifest)\n` +
       `  2. zond doctor --api <name>                 # gap report: which vars are UNSET in .env.yaml\n` +
-      `  3. zond prepare-fixtures --api <name> --apply [--seed]   # fill .env.yaml values\n` +
+      `  3. zond prepare-fixtures --api <name> --apply   # fill .env.yaml values (single-pass); fill any gaps by hand\n` +
       `\nNote: zond init only refreshes workspace files (skills, AGENTS.md, zond.config.yml).\n` +
       `      It does NOT touch fixtures or .env.yaml — that's the doctor/prepare-fixtures loop above.\n`
     );
@@ -173,7 +173,7 @@ function printBootstrapResult(b: BootstrapResult, writeAgents: boolean): void {
       `\nFixtures untouched. zond init only refreshes skills/AGENTS.md/zond.config.yml.\n` +
       `Verify env state with:\n` +
       `  zond doctor --api ${sample} --missing-only   # show UNSET vars + blocked endpoints\n` +
-      `  zond prepare-fixtures --api ${sample} --apply [--seed]   # discover/seed values\n`
+      `  zond prepare-fixtures --api ${sample} --apply   # discover values (single-pass); fill any gaps by hand\n`
     );
   }
 }

package/src/cli/commands/init/skills.ts

@@ -4,6 +4,8 @@ import { dirname, join } from "node:path";
 import zondSkill from "./templates/skills/zond.md" with { type: "text" };
 import checksSkill from "./templates/skills/zond-checks.md" with { type: "text" };
 import triageSkill from "./templates/skills/zond-triage.md" with { type: "text" };
+import seedSkill from "./templates/skills/zond-seed.md" with { type: "text" };
+import warmUpSkill from "./templates/skills/warm-up-target.md" with { type: "text" };
 
 export interface SkillResult {
   name: string;
@@ -27,6 +29,13 @@ const SKILLS: SkillTemplate[] = [
   { name: "zond-checks", body: checksSkill },
   // Read-only triage of a finished run / probe artifact.
   { name: "zond-triage", body: triageSkill },
+  // ARV-355: agent-orchestrated auto-seed loop (read gaps → order by
+  // fkDependencies → author body → request POST --capture → fix 4xx + retry).
+  { name: "zond-seed", body: seedSkill },
+  // ARV-366: warm up external-input fixtures (issue_id/file_id/integration_id)
+  // via the target's own SDK/CLI/replay — the honest-2xx ceiling zond-seed
+  // can't reach with a plain POST. Agent warms, zond stores + measures.
+  { name: "warm-up-target", body: warmUpSkill },
 ];
 
 /**
@@ -47,6 +56,40 @@ export interface StaleSkill {
   path: string;
 }
 
+/**
+ * Per-skill drift status vs the in-binary template. `missing` is
+ * non-actionable on its own (user may have intentionally passed
+ * `--no-skills`); `outdated` is the actionable one — workspace skill
+ * predates a binary upgrade and `zond init` will refresh it.
+ */
+export type SkillDriftStatus = "fresh" | "outdated" | "missing";
+
+export interface SkillDrift {
+  name: string;
+  path: string;
+  status: SkillDriftStatus;
+}
+
+/**
+ * Compare each in-binary skill template against the workspace copy at
+ * `<cwd>/.claude/skills/<name>/SKILL.md`. Returns one entry per skill —
+ * callers filter by status (`outdated` → warn the user to re-run
+ * `zond init`).
+ */
+export function detectSkillDrift(cwd: string): SkillDrift[] {
+  return SKILLS.map(({ name, body }) => {
+    const path = join(cwd, ".claude", "skills", name, "SKILL.md");
+    const desired = body.endsWith("\n") ? body : body + "\n";
+    if (!existsSync(path)) return { name, path, status: "missing" as const };
+    const current = readFileSync(path, "utf-8");
+    return {
+      name,
+      path,
+      status: (current === desired ? "fresh" : "outdated") as SkillDriftStatus,
+    };
+  });
+}
+
 /**
  * Returns directories under `<cwd>/.claude/skills/` whose name is in
  * `LEGACY_SKILL_NAMES`. User-authored skill directories (any other

package/src/cli/commands/init/templates/agents.md

@@ -16,8 +16,14 @@ only, no MCP server in this workspace.
   lifecycle_transitions) and the `zond api annotate dump+apply` flow.
 - **`.claude/skills/zond-triage/SKILL.md`** — read-only triage of a
   finished run / probe artifact. Routes by `recommended_action` enum.
+- **`.claude/skills/zond-seed/SKILL.md`** — agent-orchestrated seed loop:
+  read fixture gaps → order by FK deps → author body → `request POST
+  --capture` → fix 4xx + retry. Fills what `prepare-fixtures` reports missing.
+- **`.claude/skills/warm-up-target/SKILL.md`** — warm external-input
+  fixtures (issue_id/file_id/integration_id) via the target's own
+  SDK/CLI/replay — the honest-2xx ceiling a plain POST can't reach.
 
-Both skills work off the per-API artifacts written by `zond add api`:
+These skills work off the per-API artifacts written by `zond add api`:
 
 ```
 apis/<name>/
@@ -41,7 +47,8 @@ an env fix.
 zond init                                              # bootstrap workspace (no fixture changes)
 zond add api <name> --spec <path-or-url>               # register API + emit manifest + seed empty .env.yaml
 zond doctor --api <name> --missing-only                # gap report: which vars are UNSET
-zond prepare-fixtures --api <name> --apply [--seed]    # fill .env.yaml from live API
+zond prepare-fixtures --api <name>                     # gap report: verify + which FK vars need a value
+# → fill each gap yourself: `zond fixtures add` / edit .env.yaml (you pick the value)
 zond doctor --api <name>                               # re-check (exit 0 = ready)
 ```
 
@@ -52,7 +59,9 @@ What each step does to `.env.yaml`:
 | `zond init` | no — only writes workspace/skills files |
 | `zond add api` | seeds skeleton with empty placeholders for every required var |
 | `zond doctor` | no — read-only diagnostic |
-| `zond prepare-fixtures --apply` | writes discovered values (`.bak` backup); `--seed` POST-creates resources when list endpoints return `[]` |
+| `zond prepare-fixtures` | no — reports gaps only; **never harvests a value** (which record/field fills a slot is your call) |
+| `zond prepare-fixtures --refresh` | unsets stale (404) ids so they resurface as gaps (`.bak` backup); does not re-resolve |
+| `zond fixtures add` / `import` | writes the value you supply (`.bak` backup) |
 | `zond refresh-api` | no — only re-snapshots `spec.json` and rebuilds the manifest |
 
 `zond refresh-api <name> [--spec <new-source>]` re-snapshots when the upstream

package/src/cli/commands/init/templates/skills/warm-up-target.md

@@ -0,0 +1,122 @@
+---
+name: warm-up-target
+description: |
+  Warm up the TARGET API's environment so honest-2xx coverage stops being
+  capped by empty state. Picks up where `zond-seed` stops: the fixtures the
+  API cannot self-create via a plain POST — a real error `issue_id` (needs an
+  actual event), a `file_id` (needs a sourcemap/artifact upload), an
+  `integration_id` (needs an OAuth/app install), a `webhook_event_id` (needs a
+  replay). YOU decide HOW to warm each one using the target's OWN tooling (its
+  SDK, CLI, dashboard, replay/trigger endpoints); then harvest the resulting
+  LIVE id into `.env.yaml`. Use when honest-2xx is stuck low (~30%), when
+  `zond-seed` / `prepare-fixtures` report roots as un-seedable / external-input,
+  or the user asks to "warm up the target", "raise honest-2xx", "seed via the
+  SDK", "generate real test data". zond only STORES the id and MEASURES the
+  lift — the warm-up judgment is yours. Hand back to `zond` once warm.
+allowed-tools: [Read, Write, Edit, Bash]
+---
+
+# warm-up-target — get the API into a testable state
+
+`prepare-fixtures` reports fixture gaps; `zond-seed` fills the ones the API
+self-serves (plain `POST` + capture). Whatever is left — resources that exist
+only after a **real-world event** — is the honest-2xx ceiling. This skill
+breaks that ceiling by warming the target with **its own means**, then storing
+the live ids zond will reuse.
+
+This is **not** core zond and **not** a heuristic: zond never learns how to
+warm an API (that judgment has an infinite tail — every provider is different).
+YOU read the provider's docs/SDK and drive it; zond only records the id
+(`fixtures add`) and measures the coverage delta (`coverage`). Keep it that way
+— no warm-up logic goes into zond core (litmus test).
+
+## Iron rules
+
+- **You warm, zond stores + measures.** You run the SDK/CLI/dashboard action
+  that creates the real resource; you read the returned id; `zond fixtures add`
+  writes it. Never ask zond to "figure out" how to warm a resource.
+- **Live + throwaway/sandbox + cleanup.** Warm-ups create real state (events,
+  files, installs). Confirm `base_url` is a sandbox/test account first. Track
+  what you create; tear it down after (or use a disposable org). If you can't
+  guarantee cleanup, ask before creating.
+- **Hand off to `zond-seed` first.** Only warm what `zond-seed` marked
+  un-seedable. Don't reinvent plain-POST creation here — that's zond-seed's job.
+- **Ask early, don't reverse-engineer.** Give yourself a hard budget of ~1-2
+  attempts to derive a create-recipe from the spec/API. If a blind create 4xx/5xx
+  (missing an integer id the API doesn't expose, an opaque body shape), STOP —
+  ask the user for an example request (a working `curl`/HAR/body from their UI).
+  Extract the ids from it deterministically and replay. Do NOT spelunk 10 endpoints
+  guessing how creation works — that's the slow path the user hates.
+- **Delete only by self-captured id.** Tear-down must target the id YOUR create
+  returned, never a harvested read-fixture value. Deleting by `{{key}}` when that
+  key came from a live resource wipes pre-existing data (see ARV-368). Track
+  created ids explicitly; DELETE those and only those.
+- **Report honestly what you can't warm.** Some fixtures need a human (a paid
+  plan, a KYC step, a physical device, a manual dashboard toggle). Surface those
+  as a short "needs you" list with the exact action — never fake a value (it
+  just 422s and lies about coverage).
+- **Measure the lift.** Snapshot honest-2xx before and after so the warm-up's
+  value is visible (`zond coverage --api <name> --union session`).
+
+## Inputs — what needs warming
+
+| Signal | Command | What it tells you |
+|---|---|---|
+| Un-seedable roots | `zond-seed` handoff / `zond prepare-fixtures --api <name> --json` → `summary.fixtureGaps.unseededRoots[]` | fixtures no plain-POST can create |
+| Empty-list gaps | `prepare-fixtures` items with `status: miss-empty` | resource exists in spec, zero records in the target |
+| What each id is for | `apis/<name>/.api-resources.yaml` (the owning resource + its create/read endpoints) | which real-world action mints this id |
+| Current honest-2xx | `zond coverage --api <name> --union session --json` | the ceiling you're trying to raise |
+
+## Warm-up patterns (pick per resource)
+
+The resource's *nature* tells you the warm-up path. Common families:
+
+| Fixture shape | Warm-up path (via the target's own tooling) |
+|---|---|
+| Error / issue id (`issue_id`, `event_id`) | Trigger a real event: `sentry-cli send-event`, the app's error-report endpoint, or an SDK `captureException`. Poll the list endpoint until the id appears, capture it. |
+| Uploaded-artifact id (`file_id`, `release`, `sourcemap`) | Upload via the provider CLI/SDK (`sentry-cli releases files upload`, a `POST .../files` multipart). Capture the returned id. |
+| Integration / connection id (`integration_id`, `installation_id`) | Install the app/integration into a **sandbox** org (OAuth flow / provider dashboard "add to test workspace"). Capture the id from the callback or the list endpoint. |
+| Delivered-webhook id (`delivery_id`, `webhook_event_id`) | Register a webhook, trigger the source event, replay/list deliveries, capture the id. |
+| Provisioned-async id (needs a background job to finish) | Kick off the job, poll the status endpoint until ready, capture. |
+
+These are *examples*, not a lookup table — read the actual provider's docs for
+the target you're on.
+
+## The loop
+
+For each un-seedable root:
+
+1. **Identify the warm-up path.** From `.api-resources.yaml` + the provider
+   docs, decide which real-world action mints this id. If it needs a human,
+   add it to the "needs you" list and move on.
+
+2. **Warm it via the target's own tooling.** Run the SDK/CLI/curl that creates
+   the real resource in the sandbox. Read the id from the response (or poll the
+   list endpoint until it shows up — async resources aren't instant).
+
+3. **Store the live id.**
+   ```bash
+   zond fixtures add --api <name> issue_id=<real-id-you-got> --validate --apply
+   ```
+   `--validate` GETs the read-by-id endpoint and confirms the id is `live`
+   before writing (so a warm-up that half-failed doesn't poison later runs).
+
+4. **Verify the gap closed.** Re-run `zond prepare-fixtures --api <name> --json`
+   — the warmed root should drop out of `unseededRoots` / flip off `miss-empty`.
+
+5. **Measure + hand back.** When the worklist is drained (or only "needs you"
+   items remain), snapshot honest-2xx again and report the delta, then hand
+   back to `zond` for the audit:
+   ```bash
+   zond coverage --api <name> --union session   # after — compare to the before snapshot
+   ```
+
+## Output to the user
+
+- **Warmed:** table of `fixture → how it was warmed → live id captured`.
+- **Needs you:** fixtures that require a human action, each with the exact step
+  (e.g. "enable the Slack integration in the sandbox workspace, then re-run").
+- **Coverage:** honest-2xx before → after, so the lift is measurable.
+
+Cleanup: DELETE the resources you created (or note they live in a disposable
+sandbox). Never leave test events/files/installs on a shared account.