@rubytech/create-maxy-code 0.1.0

package/payload/platform/scripts/installer-device-verify.sh

@@ -0,0 +1,249 @@
+#!/usr/bin/env bash
+# Task 939 — post-publish device-side verification harness.
+#
+# Closes the verification gap that let Task 938 archive on source-diff alone:
+# without a device run, neither (a) the classifier-extension fix nor (b) the
+# CDP probe brand-aware fix shipped to actual hardware. This script SSHes to
+# every device in a manifest, runs the published installer for that brand,
+# then greps the install log for the canonical CDP success banner.
+#
+# Exit zero ↔ every device's installer reached "Browser automation ready
+# (CDP connected)". Any other state — ssh failure, npx non-zero, missing
+# banner — is a non-zero exit with the failing device named on stderr.
+#
+# CONTRACT
+#   Archival of any task that touches packages/create-maxy/** is contingent
+#   on this script exiting zero against the published version. The exit code
+#   and the per-device summary are quoted in the close commit body.
+#
+# USAGE
+#   $ installer-device-verify.sh <published-version>
+#
+#   <published-version>  e.g. 1.0.853 — appended to `npx -y @rubytech/create-<brand>@<version>`.
+#
+# MANIFEST
+#   Path: $MAXY_VERIFY_MANIFEST (default $HOME/.maxy-verify-devices.json).
+#   Format: JSON array of devices; each entry:
+#     {
+#       "name":    "maxy-pi-test",            // free-form display name
+#       "brand":   "maxy",                    // npm package suffix (@rubytech/create-<brand>)
+#       "configDir": ".maxy",                 // brand configDir; logs live in $HOME/<configDir>/logs/
+#       "sshTarget": "admin@maxytest.local",  // user@host for ssh
+#       "sshPass":  "password"                // optional; uses sshpass if present
+#     }
+#   sshTarget supports inline port via "user@host:port" — script splits if present.
+#   sshPass omission → relies on existing ssh keys / agent.
+#
+# OUTPUT
+#   Per-device summary line on stdout.
+#   Detailed log: $HOME/.maxy/logs/installer-verify-<runId>.log (created if absent).
+#
+# DEPENDENCIES
+#   ssh (always), sshpass (only if any device uses sshPass), jq (always — the
+#   manifest is JSON; bash-only parse would be a CVE waiting to happen).
+
+set -euo pipefail
+
+if [[ $# -ne 1 ]]; then
+  echo "ERROR: missing argument <published-version>" >&2
+  echo "Usage: $0 <published-version>" >&2
+  echo "Example: $0 1.0.853" >&2
+  exit 2
+fi
+
+VERSION="$1"
+# Pattern-validate version before any remote-shell interpolation. The version
+# flows into `npx -y @rubytech/create-<brand>@$VERSION` over SSH; a stray
+# semicolon or backtick would land inside the remote shell. Operator-owned
+# input but the principle is validate-at-boundary.
+if [[ ! "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.-]+)?$ ]]; then
+  echo "ERROR: invalid version '$VERSION' — expected semver (e.g. 1.0.853 or 1.0.853-rc.1)" >&2
+  exit 2
+fi
+
+MANIFEST="${MAXY_VERIFY_MANIFEST:-$HOME/.maxy-verify-devices.json}"
+RUN_ID="$(date +%Y%m%dT%H%M%SZ)-$$"
+SUMMARY_DIR="$HOME/.maxy/logs"
+SUMMARY_LOG="$SUMMARY_DIR/installer-verify-$RUN_ID.log"
+
+if [[ ! -f "$MANIFEST" ]]; then
+  cat >&2 <<EOF
+ERROR: device manifest not found at $MANIFEST.
+
+Create one with this shape (JSON array, one entry per device):
+[
+  {
+    "name":      "maxy-pi-test",
+    "brand":     "maxy",
+    "configDir": ".maxy",
+    "sshTarget": "admin@maxytest.local",
+    "sshPass":   "password"
+  }
+]
+
+Or set \$MAXY_VERIFY_MANIFEST to point elsewhere.
+Device list reference: ~/.claude/projects/-Users-neo-getmaxy/memory/reference_device_ssh.md
+EOF
+  exit 2
+fi
+
+if ! command -v jq >/dev/null 2>&1; then
+  echo "ERROR: jq is required (manifest is JSON)." >&2
+  echo "  macOS:    brew install jq" >&2
+  echo "  Ubuntu:   sudo apt-get install -y jq" >&2
+  exit 2
+fi
+
+mkdir -p "$SUMMARY_DIR"
+: > "$SUMMARY_LOG"
+
+# Resolve sshpass once: required only if any manifest entry has sshPass set.
+NEEDS_SSHPASS=$(jq -r 'any(.[]; .sshPass != null and .sshPass != "")' "$MANIFEST")
+if [[ "$NEEDS_SSHPASS" == "true" ]] && ! command -v sshpass >/dev/null 2>&1; then
+  echo "ERROR: manifest references sshPass but sshpass is not installed." >&2
+  echo "  macOS:    brew install hudochenkov/sshpass/sshpass" >&2
+  echo "  Ubuntu:   sudo apt-get install -y sshpass" >&2
+  exit 2
+fi
+
+DEVICE_COUNT=$(jq 'length' "$MANIFEST")
+FAILED=0
+
+# Common ssh hardening: short timeouts, no host-key prompt that would block
+# when adding a new Pi to the fleet, and StrictHostKeyChecking=accept-new so
+# fingerprints are recorded the first time but rejected on mismatch after.
+SSH_OPTS=(
+  -o "ConnectTimeout=10"
+  -o "ServerAliveInterval=15"
+  -o "ServerAliveCountMax=2"
+  -o "StrictHostKeyChecking=accept-new"
+  -o "BatchMode=no"
+)
+
+run_ssh() {
+  local target="$1" pass="$2"
+  shift 2
+  if [[ -n "$pass" ]]; then
+    SSHPASS="$pass" sshpass -e ssh "${SSH_OPTS[@]}" "$target" "$@"
+  else
+    ssh "${SSH_OPTS[@]}" "$target" "$@"
+  fi
+}
+
+# Allowed brand pattern matches what bundle.js validates: lowercase
+# alphanumeric, hyphens. Reject anything else before interpolating into
+# remote shell commands. configDir mirrors the brand convention (a leading
+# dot then the same character class), so the same shape passes through.
+# `$NAME` is interpolated into `--hostname "$NAME"` over SSH — same boundary
+# discipline applies; allow dots so it can carry mDNS hostnames like
+# `maxytest.local`, but never quote characters or shell metacharacters.
+ALLOWED='^[a-z0-9][a-z0-9-]*$'
+ALLOWED_HOSTNAME='^[a-zA-Z0-9][a-zA-Z0-9.-]*$'
+
+echo "installer-device-verify run=$RUN_ID version=$VERSION devices=$DEVICE_COUNT" | tee -a "$SUMMARY_LOG"
+
+for i in $(seq 0 $((DEVICE_COUNT - 1))); do
+  NAME=$(jq -r ".[$i].name"      "$MANIFEST")
+  BRAND=$(jq -r ".[$i].brand"     "$MANIFEST")
+  CONFIGDIR=$(jq -r ".[$i].configDir" "$MANIFEST")
+  TARGET=$(jq -r ".[$i].sshTarget" "$MANIFEST")
+  PASS=$(jq -r ".[$i].sshPass // \"\"" "$MANIFEST")
+
+  if [[ ! "$BRAND" =~ $ALLOWED ]]; then
+    echo "FAIL  $NAME — invalid brand '$BRAND' (must match $ALLOWED)" | tee -a "$SUMMARY_LOG"
+    FAILED=1
+    continue
+  fi
+
+  if [[ ! "$NAME" =~ $ALLOWED_HOSTNAME ]]; then
+    echo "FAIL  device name '$NAME' rejected — must match $ALLOWED_HOSTNAME" | tee -a "$SUMMARY_LOG"
+    FAILED=1
+    continue
+  fi
+
+  # configDir always begins with '.' (e.g. .maxy); strip the dot and validate
+  # the remainder with the same allowed-character class.
+  CD_TAIL="${CONFIGDIR#.}"
+  if [[ "$CD_TAIL" == "$CONFIGDIR" || ! "$CD_TAIL" =~ $ALLOWED ]]; then
+    echo "FAIL  $NAME — invalid configDir '$CONFIGDIR' (must be a leading dot + $ALLOWED)" | tee -a "$SUMMARY_LOG"
+    FAILED=1
+    continue
+  fi
+
+  echo "" | tee -a "$SUMMARY_LOG"
+  echo "[$NAME] brand=$BRAND target=$TARGET version=$VERSION" | tee -a "$SUMMARY_LOG"
+
+  # Step 1 — install. Run npx with auto-yes; redirect to the device's own
+  # install log path so the summary log on the operator side stays clean,
+  # and so the device-side log matches what reference_device_ssh.md would
+  # tail.
+  set +e
+  run_ssh "$TARGET" "$PASS" "npx -y @rubytech/create-$BRAND@$VERSION --hostname \"$NAME\"" >>"$SUMMARY_LOG" 2>&1
+  INSTALL_RC=$?
+  set -e
+
+  if [[ $INSTALL_RC -ne 0 ]]; then
+    echo "FAIL  $NAME — install exited $INSTALL_RC (see $SUMMARY_LOG)" | tee -a "$SUMMARY_LOG"
+    FAILED=1
+    continue
+  fi
+
+  # Step 2 — confirm a terminal-success banner in the latest install log.
+  # Pick the newest install-*.log by mtime (`ls -t`) and grep for either of
+  # the installer's two terminal-success markers emitted by
+  # packages/create-maxy/src/index.ts:
+  #   • DISPLAY_MODE=virtual (Pi, headless VNC) →
+  #     "Browser automation ready (CDP connected)"  (index.ts:3012)
+  #   • DISPLAY_MODE=native  (laptop, on-demand Chromium) →
+  #     "[cdp-check] skipped reason=native-display"  (index.ts:3004)
+  # Both terminate the install successfully; either is a pass. Hard-coding
+  # only the virtual-mode banner would mark every laptop install FAIL even
+  # though the laptop install correctly skips CDP probing because there is
+  # no persistent Chromium running for CDP to talk to.
+  REMOTE_CHECK=$(cat <<'REMOTE'
+set -euo pipefail
+LOG_DIR="$HOME/__CONFIGDIR__/logs"
+LATEST=$(ls -t "$LOG_DIR"/install-*.log 2>/dev/null | head -n1 || true)
+if [[ -z "${LATEST:-}" ]]; then
+  echo "no-install-log"
+  exit 1
+fi
+echo "log=$LATEST"
+if grep -F -q "Browser automation ready (CDP connected)" "$LATEST"; then
+  echo "marker=cdp-connected"
+  exit 0
+fi
+if grep -F -q "[cdp-check] skipped reason=native-display" "$LATEST"; then
+  echo "marker=native-display-skip"
+  exit 0
+fi
+echo "banner-not-found"
+tail -n 30 "$LATEST"
+exit 1
+REMOTE
+)
+  REMOTE_CHECK="${REMOTE_CHECK//__CONFIGDIR__/$CONFIGDIR}"
+
+  set +e
+  run_ssh "$TARGET" "$PASS" "$REMOTE_CHECK" >>"$SUMMARY_LOG" 2>&1
+  CHECK_RC=$?
+  set -e
+
+  if [[ $CHECK_RC -eq 0 ]]; then
+    echo "OK    $NAME — CDP banner present" | tee -a "$SUMMARY_LOG"
+  else
+    echo "FAIL  $NAME — CDP banner missing (rc=$CHECK_RC, see $SUMMARY_LOG)" | tee -a "$SUMMARY_LOG"
+    FAILED=1
+  fi
+done
+
+echo "" | tee -a "$SUMMARY_LOG"
+if [[ $FAILED -eq 0 ]]; then
+  echo "PASS — all $DEVICE_COUNT devices installed and reported CDP banner" | tee -a "$SUMMARY_LOG"
+  echo "summary: $SUMMARY_LOG"
+  exit 0
+else
+  echo "FAIL — at least one device did not reach CDP banner; details in $SUMMARY_LOG" | tee -a "$SUMMARY_LOG"
+  echo "summary: $SUMMARY_LOG"
+  exit 1
+fi

package/payload/platform/scripts/lib/resolve-account-dir.sh

@@ -0,0 +1,186 @@
+# resolve-account-dir.sh — identity-aware account resolver + orphan sweeper
+# Sourced by seed-neo4j.sh. Defines `resolve_and_sweep_account_dir`.
+#
+# Invariant: the TypeScript `resolveAccount()` at platform/ui/app/lib/claude-agent.ts
+# is READ-ONLY. This bash helper is the SOLE sweep surface, because seed-time is
+# the only safe moment to mutate filesystem layout. Any future "share the logic"
+# refactor must preserve that asymmetry.
+#
+# Contract (inputs via env vars):
+#   ACCOUNTS_DIR — {installDir}/data/accounts
+#   USERS_FILE   — $HOME/<brand.configDir>/users.json (Task 904 — was
+#                  {installDir}/platform/config/users.json pre-Task-904, but
+#                  that path lived in the installer's wipe zone)
+#
+# Contract (outputs via env vars):
+#   ACCOUNT_ID   — resolved uuid (existing kept, or freshly minted)
+#   ACCOUNT_DIR  — full path to the live account dir
+#
+# Exit:
+#   0 on success; non-zero on abort (multi-candidate + no unique identity match).
+
+# Helper: classify account.json at $1 against userId $2.
+# Exit codes are trichotomous so callers can distinguish "definitely not a match"
+# from "could not determine" — the latter is a doctrine-level loud failure, not
+# a silent fall-through to orphan-classification.
+#   0 = admins[] contains userId (match)
+#   1 = account.json readable and parsed; userId absent from admins[] (no match)
+#   2 = account.json missing, unreadable, or unparseable (undetermined — caller must abort)
+_account_dir_matches() {
+  local config="$1/account.json"
+  local uid="$2"
+  [ -f "$config" ] || return 2
+  python3 - "$config" "$uid" <<'PY'
+import json, sys
+try:
+    cfg = json.load(open(sys.argv[1]))
+except Exception:
+    sys.exit(2)
+admins = cfg.get('admins') or []
+uid = sys.argv[2]
+for a in admins:
+    if isinstance(a, dict) and a.get('userId') == uid:
+        sys.exit(0)
+sys.exit(1)
+PY
+}
+
+# Two-pass resolver: enumerate+classify all candidates, then act.
+# Never mutates filesystem before the full classification is complete.
+resolve_and_sweep_account_dir() {
+  mkdir -p "$ACCOUNTS_DIR"
+
+  # Enumerate candidates: direct children with account.json, basenames not starting with '.'
+  local candidates=()
+  local dir base
+  for dir in "$ACCOUNTS_DIR"/*/; do
+    [ -d "$dir" ] || continue
+    base="$(basename "$dir")"
+    case "$base" in .*) continue ;; esac
+    [ -f "$dir/account.json" ] || continue
+    candidates+=("$base")
+  done
+
+  # Read target userId from users.json (if present and valid)
+  local target_user_id=""
+  if [ -f "$USERS_FILE" ]; then
+    target_user_id=$(python3 - "$USERS_FILE" <<'PY' 2>/dev/null || true
+import json, sys
+try:
+    data = json.load(open(sys.argv[1]))
+    if isinstance(data, list) and data and isinstance(data[0], dict):
+        uid = data[0].get('userId')
+        if uid:
+            print(uid)
+except Exception:
+    pass
+PY
+)
+  fi
+
+  local n=${#candidates[@]}
+
+  # Case 0: no candidates — fresh install, mint new UUID.
+  # Task 900 sub-scope F — atomic-mint discipline: refuse to mint a new
+  # accountId if any stub dir (subdir present, account.json missing) exists
+  # under data/accounts/. The Task 900 root cause was install 1 minting
+  # accountId X then losing X/account.json (cron stamped X/logs/ first); the
+  # next install saw zero candidates and minted Y, orphaning X/logs/. The
+  # guard turns that silent regression into an operator-actionable abort.
+  if [ "$n" -eq 0 ]; then
+    local stub_dirs=()
+    for dir in "$ACCOUNTS_DIR"/*/; do
+      [ -d "$dir" ] || continue
+      base="$(basename "$dir")"
+      case "$base" in .*) continue ;; esac
+      [ -f "$dir/account.json" ] && continue
+      stub_dirs+=("$base")
+    done
+    if [ "${#stub_dirs[@]}" -gt 0 ]; then
+      echo "==> [seed] FAIL phase=mint reason=\"stub-account-dirs present (no account.json): ${stub_dirs[*]}\" — refusing to mint a fresh accountId; remove or repair the stub before re-running install" >&2
+      return 1
+    fi
+    ACCOUNT_ID="$(cat /proc/sys/kernel/random/uuid 2>/dev/null || python3 -c 'import uuid; print(uuid.uuid4())')"
+    ACCOUNT_DIR="$ACCOUNTS_DIR/$ACCOUNT_ID"
+    return 0
+  fi
+
+  # Case 1: single candidate — accept (preserves legacy + fresh-install-pre-users.json).
+  # Log identity-match on exact match; WARN on mismatch (mirrors TS resolveAccount line 653 —
+  # accept-with-flag rather than abort because Task 380's users.json regeneration on PIN
+  # change would otherwise brick legitimate installs).
+  if [ "$n" -eq 1 ]; then
+    ACCOUNT_ID="${candidates[0]}"
+    ACCOUNT_DIR="$ACCOUNTS_DIR/$ACCOUNT_ID"
+    if [ -n "$target_user_id" ]; then
+      local rc=0
+      _account_dir_matches "$ACCOUNT_DIR" "$target_user_id" || rc=$?
+      case "$rc" in
+        0) echo "==> [seed] identity-match: kept=${ACCOUNT_ID:0:8} via userId=${target_user_id:0:8}" ;;
+        1) echo "==> [seed] WARN: single account does not match users.json userId=${target_user_id:0:8} — accepting but flagging" >&2 ;;
+        *) echo "==> [seed] identity-match FAILED: sole candidate $ACCOUNT_ID has unreadable or unparseable account.json — aborting" >&2
+           return 1 ;;
+      esac
+    fi
+    return 0
+  fi
+
+  # Case 2+: multi-candidate — identity-match-or-abort.
+  # First classify everything, THEN decide and act.
+  if [ -z "$target_user_id" ]; then
+    echo "==> [seed] identity-match FAILED: users.json missing or unreadable, $n candidates — aborting" >&2
+    for uuid in "${candidates[@]}"; do echo "    candidate: $uuid" >&2; done
+    return 1
+  fi
+
+  local matches=()
+  local orphans=()
+  local rc
+  for uuid in "${candidates[@]}"; do
+    rc=0
+    _account_dir_matches "$ACCOUNTS_DIR/$uuid" "$target_user_id" || rc=$?
+    case "$rc" in
+      0) matches+=("$uuid") ;;
+      1) orphans+=("$uuid") ;;
+      *) echo "==> [seed] identity-match FAILED: candidate $uuid has unreadable or unparseable account.json — aborting" >&2
+         for u in "${candidates[@]}"; do echo "    candidate: $u" >&2; done
+         return 1 ;;
+    esac
+  done
+
+  if [ "${#matches[@]}" -eq 0 ]; then
+    echo "==> [seed] identity-match FAILED: $n candidates, none match users.json userId=${target_user_id:0:8} — aborting" >&2
+    for uuid in "${candidates[@]}"; do echo "    candidate: $uuid" >&2; done
+    return 1
+  fi
+
+  if [ "${#matches[@]}" -gt 1 ]; then
+    echo "==> [seed] identity-match FAILED: $n candidates, ${#matches[@]} match userId=${target_user_id:0:8} (ambiguous) — aborting" >&2
+    for uuid in "${candidates[@]}"; do echo "    candidate: $uuid" >&2; done
+    return 1
+  fi
+
+  ACCOUNT_ID="${matches[0]}"
+  ACCOUNT_DIR="$ACCOUNTS_DIR/$ACCOUNT_ID"
+  echo "==> [seed] identity-match: kept=${ACCOUNT_ID:0:8} via userId=${target_user_id:0:8}"
+
+  # Sweep orphans. mv is the only destructive op; abort loud on failure before any further state change.
+  local trash_dir="$ACCOUNTS_DIR/.trash"
+  mkdir -p "$trash_dir"
+  local ts; ts=$(date -u +%Y%m%dT%H%M%SZ)
+  local moved=0 uuid dest
+  for uuid in "${orphans[@]}"; do
+    dest="$trash_dir/${uuid}-${ts}"
+    if ! mv "$ACCOUNTS_DIR/$uuid" "$dest"; then
+      echo "==> [seed] ERROR: failed to move $uuid → $dest — aborting" >&2
+      return 1
+    fi
+    echo "==> [seed] swept orphan: ${uuid:0:8} → .trash/${uuid:0:8}-${ts}"
+    moved=$((moved + 1))
+  done
+  if [ "$moved" -gt 0 ]; then
+    echo "==> [seed] orphan sweep: moved $moved → $ACCOUNTS_DIR/.trash/"
+  fi
+
+  return 0
+}

package/payload/platform/scripts/log-adherence-check.sh

@@ -0,0 +1,125 @@
+#!/usr/bin/env bash
+# log-adherence-check.sh — Task 1006 existence contract diagnostic.
+#
+# Reads every sessionKey under the active install's per-account logs and
+# asserts that a resolvable claude-agent-stream-<sessionKey>.log exists for
+# each. Runs hourly on-device in addition to the in-process timer wired
+# from platform/ui/app/lib/claude-agent/logging.ts; both are intentionally
+# redundant — one runs inside the server process, this one runs out of band
+# so a stalled server still leaves a fresh adherence record.
+#
+# Emits one `[log-tee] adherence-check window=24h sessions=N misses=M ts=...`
+# line to the platform server log on every run. Per-miss lines surface as
+# `[log-tee] missing-on-resolve sessionKey=<8> surface=adherence-script
+# reason=file-not-on-disk`. `misses=0` is the steady state.
+#
+# Exit codes:
+#   0  No misses (steady state).
+#   1  At least one miss recorded.
+#   2  Usage / environment error.
+set -euo pipefail
+
+# --- Resolve install dir, the same way logs-read.sh does. ---
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PLATFORM_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+INSTALL_DIR="$(dirname "$PLATFORM_ROOT")"
+INSTALL_DIR_NAME=$(basename "$INSTALL_DIR")
+CONFIG_DIR="$HOME/.$INSTALL_DIR_NAME"
+SERVER_LOG="$CONFIG_DIR/logs/server.log"
+
+ACCOUNTS_DIR="$INSTALL_DIR/data/accounts"
+if [[ ! -d "$ACCOUNTS_DIR" ]]; then
+  echo "[log-adherence-check] accounts directory missing: $ACCOUNTS_DIR" >&2
+  exit 2
+fi
+
+# Window: only count session keys whose stream-log file was modified in the
+# last 24h. This avoids fingerprinting long-archived sessions that have aged
+# out via the 7-day retention purge.
+WINDOW_HOURS=24
+
+# Collect every basename-derived sessionKey from claude-agent-stream-*.log
+# files across all account log directories, filtered to the active window.
+declare -a KEYS=()
+shopt -s nullglob
+for log_dir in "$ACCOUNTS_DIR"/*/logs; do
+  for f in "$log_dir"/claude-agent-stream-*.log; do
+    if [[ -f "$f" ]]; then
+      # find -mmin needs minutes; 24h = 1440 min.
+      if find "$f" -mmin "-$((WINDOW_HOURS * 60))" -print -quit | grep -q .; then
+        base=$(basename "$f")
+        key="${base#claude-agent-stream-}"
+        key="${key%.log}"
+        KEYS+=("$key")
+      fi
+    fi
+  done
+done
+shopt -u nullglob
+
+# De-duplicate sessionKeys (one session may emit multiple .log files via
+# sibling prefixes; the existence contract is per-sessionKey).
+declare -A SEEN=()
+declare -a UNIQUE=()
+for k in "${KEYS[@]:-}"; do
+  if [[ -z "${SEEN[$k]:-}" ]]; then
+    SEEN[$k]=1
+    UNIQUE+=("$k")
+  fi
+done
+
+SESSIONS=${#UNIQUE[@]}
+MISSES=0
+
+# For each sessionKey, verify the agent-stream file is present. Misses
+# surface as a missing-on-resolve line. The file we just listed must
+# exist by definition; this loop catches the case where a sessionKey was
+# referenced in tee/register emissions on server.log but the file itself
+# was unlinked between the scan and the check (very rare, but visible).
+TS=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+for k in "${UNIQUE[@]:-}"; do
+  found=0
+  for log_dir in "$ACCOUNTS_DIR"/*/logs; do
+    if [[ -f "$log_dir/claude-agent-stream-${k}.log" ]]; then
+      found=1
+      break
+    fi
+  done
+  if [[ $found -eq 0 ]]; then
+    MISSES=$((MISSES + 1))
+    echo "${TS} [log-tee] missing-on-resolve sessionKey=${k:0:8} surface=adherence-script reason=file-not-on-disk" >> "$SERVER_LOG" 2>/dev/null || true
+  fi
+done
+
+# Task 1013 — duplicate-basename check. Two stream-log files for one
+# sessionKey across account dirs is the structural-failure signature this
+# task exists to make impossible. The build gate prevents the writer-side
+# regression that produces it (sessions.ts:568 wrong-identifier path); this
+# diagnostic is the runtime backstop on every device, every hour. `dup=0`
+# is the steady state; `dup>0` is a P0 page (the writer collapse regressed).
+declare -A BASENAME_COUNT=()
+for log_dir in "$ACCOUNTS_DIR"/*/logs; do
+  for f in "$log_dir"/claude-agent-stream-*.log; do
+    if [[ -f "$f" ]]; then
+      base=$(basename "$f")
+      key="${base#claude-agent-stream-}"
+      key="${key%.log}"
+      BASENAME_COUNT[$key]=$(( ${BASENAME_COUNT[$key]:-0} + 1 ))
+    fi
+  done
+done
+DUP_BASENAMES=0
+for k in "${!BASENAME_COUNT[@]}"; do
+  if [[ ${BASENAME_COUNT[$k]} -gt 1 ]]; then
+    DUP_BASENAMES=$((DUP_BASENAMES + 1))
+    echo "${TS} [log-tee] dup-basename sessionKey=${k:0:8} count=${BASENAME_COUNT[$k]} surface=adherence-script — Task 1013 P0: writer collapse regressed" >> "$SERVER_LOG" 2>/dev/null || true
+  fi
+done
+
+echo "${TS} [log-tee] adherence-check window=${WINDOW_HOURS}h sessions=${SESSIONS} misses=${MISSES} dup-basenames=${DUP_BASENAMES} surface=script ts=${TS}" >> "$SERVER_LOG" 2>/dev/null || true
+echo "[log-adherence-check] sessions=${SESSIONS} misses=${MISSES} dup-basenames=${DUP_BASENAMES} window=${WINDOW_HOURS}h"
+
+if [[ $MISSES -gt 0 || $DUP_BASENAMES -gt 0 ]]; then
+  exit 1
+fi
+exit 0