@rubytech/create-maxy-code 0.1.330 → 0.1.332

package/payload/platform/scripts/lib/provision-account-dir.sh

@@ -0,0 +1,319 @@
+# provision-account-dir.sh — per-account scaffolding, callable per account.
+# Sourced by setup-account.sh (for the resolved house account) and by the
+# admin-core `account_create` lifecycle tool (for a new client account). Defines
+# `provision_account_dir <account_dir> <account_id> <role>`.
+#
+# The function is pure scaffolding: it creates the account dir layout, writes the
+# Claude Code project settings (hooks only), installs agent identities and the
+# specialist plugin, seeds account.json (stamping accountId + role), seeds
+# enabledPlugins from brand defaults, and stamps the install owner into admins[].
+# It does NO account resolution and NO Neo4j work.
+#
+# Required globals (set by the caller before invoking):
+#   TEMPLATES_DIR  — <project>/templates
+#   PROJECT_DIR    — the platform/ dir
+#   SCRIPT_DIR     — the platform/scripts dir (for lib bootstraps)
+#   USERS_FILE     — $HOME/<brand.configDir>/users.json (owner stamp; optional)
+
+provision_account_dir() {
+  local ACCOUNT_DIR="$1"
+  local ACCOUNT_ID="$2"
+  local ROLE="$3"
+
+  mkdir -p "$ACCOUNT_DIR/agents/admin" "$ACCOUNT_DIR/.claude" "$ACCOUNT_DIR/specialists/.claude-plugin" "$ACCOUNT_DIR/specialists/agents"
+
+  # Claude Code discovers project-level .claude/ relative to the nearest .git
+  # root. Without a .git in the account dir it traverses up to ~/maxy/.git and
+  # misses accountDir/.claude/. Initialise a repo so the account dir IS the root.
+  [ -d "$ACCOUNT_DIR/.git" ] || git init -q "$ACCOUNT_DIR"
+
+  # --- project-level .claude/settings.json (hooks; no allowlist) -------------
+  local ACCOUNT_SETTINGS="$ACCOUNT_DIR/.claude/settings.json"
+  local HOOKS_PATH="\$PLATFORM_ROOT/plugins/admin/hooks"
+  cat > "$ACCOUNT_SETTINGS" << SETTINGS_EOF
+{
+  "permissions": {
+    "defaultMode": "bypassPermissions",
+    "allow": [],
+    "deny": []
+  },
+  "hooks": {
+    "PreToolUse": [
+      {
+        "matcher": "Write",
+        "hooks": [
+          { "type": "command", "command": "bash $HOOKS_PATH/archive-ingest-surface-gate.sh" }
+        ]
+      },
+      {
+        "matcher": "Edit",
+        "hooks": [
+          { "type": "command", "command": "bash $HOOKS_PATH/archive-ingest-surface-gate.sh" }
+        ]
+      },
+      {
+        "matcher": "NotebookEdit",
+        "hooks": [
+          { "type": "command", "command": "bash $HOOKS_PATH/archive-ingest-surface-gate.sh" }
+        ]
+      },
+      {
+        "matcher": "Bash",
+        "hooks": [
+          { "type": "command", "command": "bash $HOOKS_PATH/archive-ingest-surface-gate.sh" }
+        ]
+      },
+      {
+        "hooks": [
+          { "type": "command", "command": "bash $HOOKS_PATH/archive-ingest-surface-gate.sh" }
+        ]
+      },
+      {
+        "matcher": "WebFetch",
+        "hooks": [
+          { "type": "command", "command": "node $HOOKS_PATH/webfetch-preflight.mjs" }
+        ]
+      },
+      {
+        "matcher": "AskUserQuestion",
+        "hooks": [
+          { "type": "command", "command": "bash $HOOKS_PATH/askuserquestion-investigate-gate.sh" }
+        ]
+      }
+    ],
+    "PostToolUse": [
+      {
+        "matcher": "Agent",
+        "hooks": [
+          { "type": "command", "command": "bash $HOOKS_PATH/post-tool-use-agent.sh" }
+        ]
+      },
+      {
+        "matcher": "mcp__.*__.*-(export|import)-parse$",
+        "hooks": [
+          { "type": "command", "command": "bash $HOOKS_PATH/archive-ingest-surface-gate.sh" }
+        ]
+      },
+      {
+        "matcher": "mcp__.*",
+        "hooks": [
+          { "type": "command", "command": "bash $HOOKS_PATH/mcp-tool-missing.sh" }
+        ]
+      },
+      {
+        "matcher": "Write",
+        "hooks": [
+          { "type": "command", "command": "bash $HOOKS_PATH/admin-authoring-observer.sh" }
+        ]
+      },
+      {
+        "matcher": "Edit",
+        "hooks": [
+          { "type": "command", "command": "bash $HOOKS_PATH/admin-authoring-observer.sh" }
+        ]
+      }
+    ],
+    "UserPromptSubmit": [
+      {
+        "hooks": [
+          { "type": "command", "command": "bash $HOOKS_PATH/archive-ingest-surface-gate.sh" },
+          { "type": "command", "command": "bash $HOOKS_PATH/prompt-optimiser-directive.sh" }
+        ]
+      }
+    ],
+    "Stop": [
+      {
+        "hooks": [
+          { "type": "command", "command": "bash $HOOKS_PATH/prompt-optimiser-compliance.sh" }
+        ]
+      }
+    ]
+  }
+}
+SETTINGS_EOF
+
+  # --- agent identities + specialist plugin templates ------------------------
+  cp "$TEMPLATES_DIR/agents/admin/IDENTITY.md" "$ACCOUNT_DIR/agents/admin/IDENTITY.md"
+
+  # On re-provision, re-sync the Rubytech-controlled IDENTITY.md for every
+  # already-existing non-admin agent dir (security-load-bearing). Never create
+  # dirs; never write SOUL/KNOWLEDGE/config.
+  local _AGENT_DIR _AGENT_NAME
+  for _AGENT_DIR in "$ACCOUNT_DIR/agents"/*/; do
+    [ -d "$_AGENT_DIR" ] || continue
+    _AGENT_NAME="$(basename "$_AGENT_DIR")"
+    [ "$_AGENT_NAME" = "admin" ] && continue
+    [ -f "$_AGENT_DIR/IDENTITY.md" ] || continue
+    cp "$TEMPLATES_DIR/agents/public/IDENTITY.md" "$_AGENT_DIR/IDENTITY.md"
+    echo "  agents/$_AGENT_NAME/IDENTITY.md re-synced"
+  done
+
+  cp "$TEMPLATES_DIR/specialists/.claude-plugin/plugin.json" "$ACCOUNT_DIR/specialists/.claude-plugin/plugin.json"
+
+  # Replace core specialist files (no '--'); preserve premium plugin agents.
+  local _existing
+  for _existing in "$ACCOUNT_DIR/specialists/agents/"*.md; do
+    [ -f "$_existing" ] || continue
+    case "$(basename "$_existing")" in
+      *--*) continue ;;
+    esac
+    rm -f "$_existing"
+  done
+
+  local specialist
+  for specialist in "$TEMPLATES_DIR/specialists/agents/"*.md; do
+    [ -f "$specialist" ] && cp "$specialist" "$ACCOUNT_DIR/specialists/agents/$(basename "$specialist")"
+  done
+
+  rm -f "$ACCOUNT_DIR/.claude/agents/"*.md 2>/dev/null || true
+
+  # SOUL.md — user-controlled. Only create if missing. Never overwrite.
+  if [ -f "$ACCOUNT_DIR/agents/admin/SOUL.md" ]; then
+    echo "  agents/admin/SOUL.md preserved ($(wc -c < "$ACCOUNT_DIR/agents/admin/SOUL.md" | tr -d ' ') bytes)"
+  else
+    cp "$TEMPLATES_DIR/agents/admin/SOUL.md" "$ACCOUNT_DIR/agents/admin/SOUL.md"
+    echo "  agents/admin/SOUL.md created ($(wc -c < "$ACCOUNT_DIR/agents/admin/SOUL.md" | tr -d ' ') bytes)"
+  fi
+
+  bash "$SCRIPT_DIR/lib/agents-md-bootstrap.sh" "$ACCOUNT_DIR"
+  bash "$SCRIPT_DIR/lib/admin-skills-bootstrap.sh" "$ACCOUNT_DIR" "$PROJECT_DIR/plugins"
+
+  # --- account.json: create from template, stamp accountId + role ------------
+  local TEMPLATE="$TEMPLATES_DIR/account.json"
+  if [ ! -f "$ACCOUNT_DIR/account.json" ]; then
+    if [ -f "$TEMPLATE" ]; then
+      sed "s/\"accountId\": *\"[^\"]*\"/\"accountId\":\"$ACCOUNT_ID\"/" "$TEMPLATE" \
+        | sed "s/\"tier\": *\"[^\"]*\"/\"tier\":\"solo\"/" \
+        > "$ACCOUNT_DIR/account.json"
+    else
+      echo "ERROR: account.json template not found at $TEMPLATE" >&2
+      return 1
+    fi
+  fi
+
+  # Stamp role on the account.json (idempotent migration + designation). A
+  # pre-existing legacy account.json with no role gets ROLE; an account already
+  # carrying a role keeps it unless ROLE differs (operator-driven via the
+  # lifecycle tools, never here).
+  ACCOUNT_ID="$ACCOUNT_ID" ROLE="$ROLE" python3 - "$ACCOUNT_DIR/account.json" <<'PY'
+import json, os, sys
+path = sys.argv[1]
+role = os.environ["ROLE"]
+acct_id = os.environ["ACCOUNT_ID"]
+with open(path) as f:
+    cfg = json.load(f)
+changed = False
+if not cfg.get("accountId"):
+    cfg["accountId"] = acct_id; changed = True
+if role and cfg.get("role") != role:
+    cfg["role"] = role; changed = True
+if "managedService" not in cfg:
+    cfg["managedService"] = False; changed = True
+if changed:
+    with open(path, "w") as f:
+        json.dump(cfg, f, indent=2); f.write("\n")
+    print(f"  account.json role={cfg.get('role')} stamped")
+PY
+
+  # --- enabledPlugins from brand.json plugins.defaultEnabled -----------------
+  local BRAND_JSON="$PROJECT_DIR/config/brand.json"
+  if [ -f "$BRAND_JSON" ] && [ -f "$ACCOUNT_DIR/account.json" ]; then
+    PROJECT_DIR="$PROJECT_DIR" BRAND_JSON="$BRAND_JSON" ACCOUNT_JSON="$ACCOUNT_DIR/account.json" python3 - <<'PY'
+import json, os, sys
+
+brand_path = os.environ['BRAND_JSON']
+account_path = os.environ['ACCOUNT_JSON']
+plugins_dir = os.path.join(os.environ['PROJECT_DIR'], 'plugins')
+
+with open(brand_path) as f:
+    brand = json.load(f)
+
+plugins_cfg = brand.get('plugins', {})
+default_enabled = plugins_cfg.get('defaultEnabled', [])
+core = set(plugins_cfg.get('core', []))
+
+if not default_enabled:
+    print('  [setup] no defaultEnabled plugins in brand.json — skipping')
+    sys.exit(0)
+
+satisfied = core | set(default_enabled)
+validated = []
+for plugin in default_enabled:
+    plugin_md = os.path.join(plugins_dir, plugin, 'PLUGIN.md')
+    requires = []
+    if os.path.isfile(plugin_md):
+        in_frontmatter = False
+        in_requires = False
+        with open(plugin_md) as f:
+            for line in f:
+                stripped = line.rstrip()
+                if stripped == '---':
+                    if in_frontmatter:
+                        break
+                    in_frontmatter = True
+                    continue
+                if not in_frontmatter:
+                    continue
+                if stripped.startswith('requires:'):
+                    inline = stripped.split(':', 1)[1].strip()
+                    if inline.startswith('['):
+                        requires = [x.strip().strip('"').strip("'") for x in inline.strip('[]').split(',') if x.strip()]
+                        in_requires = False
+                    else:
+                        in_requires = True
+                    continue
+                if in_requires:
+                    if stripped.startswith('  - '):
+                        requires.append(stripped.lstrip(' -').strip())
+                    else:
+                        in_requires = False
+    unmet = [r for r in requires if r not in satisfied]
+    if unmet:
+        print(f'  [setup] WARNING: skipping defaultEnabled plugin "{plugin}" — unmet requires: {unmet}')
+    else:
+        validated.append(plugin)
+
+with open(account_path) as f:
+    account = json.load(f)
+
+existing = account.get('enabledPlugins', [])
+existing_set = set(existing)
+added = [p for p in validated if p not in existing_set]
+account['enabledPlugins'] = existing + added
+
+with open(account_path, 'w') as f:
+    json.dump(account, f, indent=2)
+    f.write('\n')
+
+if not existing:
+    print(f'  [setup] seeded enabledPlugins: {validated}')
+elif added:
+    print(f'  [setup] merged into enabledPlugins: +{added} (existing: {existing})')
+else:
+    print(f'  [setup] enabledPlugins already contains all defaultEnabled entries')
+PY
+  fi
+
+  # --- stamp install owner into admins[] (idempotent) ------------------------
+  if [ -n "${USERS_FILE:-}" ] && [ -f "$USERS_FILE" ]; then
+    local USER_ID
+    USER_ID=$(python3 -c "import json; print(json.load(open('$USERS_FILE'))[0]['userId'])" 2>/dev/null || true)
+    if [ -n "$USER_ID" ] && [ -f "$ACCOUNT_DIR/account.json" ]; then
+      USER_ID="$USER_ID" python3 - "$ACCOUNT_DIR/account.json" <<'PY'
+import json, os, sys
+path = sys.argv[1]
+uid = os.environ["USER_ID"]
+with open(path) as f:
+    cfg = json.load(f)
+cfg.setdefault("admins", [])
+if not any(a.get("userId") == uid for a in cfg["admins"]):
+    cfg["admins"].append({"userId": uid, "role": "owner"})
+    with open(path, "w") as f:
+        json.dump(cfg, f, indent=2); f.write("\n")
+    print(f"  Stamped userId={uid} as owner in account.json admins")
+PY
+    fi
+  fi
+
+  echo "  Account $ACCOUNT_ID at $ACCOUNT_DIR (role=$ROLE)"
+}

package/payload/platform/scripts/lib/resolve-account-dir.sh

@@ -1,184 +1,131 @@
-# resolve-account-dir.sh — identity-aware account resolver + orphan sweeper
+# resolve-account-dir.sh — house-account resolver + registry-membership reporter
 # Sourced by setup-account.sh and seed-neo4j.sh. Defines `resolve_and_sweep_account_dir`.
 #
+# Multi-account managed-service model (Task 983): an install may host N accounts
+# under data/accounts/ — exactly one carries role:"house", the rest role:"client".
+# The registry is the set of dirs holding a parseable account.json. EVERY
+# registered account is durable: this resolver never trashes a dir with an
+# account.json. It resolves ACCOUNT_DIR/ACCOUNT_ID to the single role:"house"
+# account (or the sole account in the pre-migration window, before
+# setup-account.sh stamps role:"house").
+#
+# Sweep is LOG-ONLY this sprint. The destructive `mv` to .trash/ was removed to
+# eliminate any chance of deleting a registered account during the multi-account
+# rollout; restoring a guarded destructive sweep is tracked as a follow-up task.
+# Orphan dirs (no account.json) are reported, never moved.
+#
 # Invariant: the TypeScript `resolveAccount()` at platform/ui/app/lib/claude-agent.ts
-# is READ-ONLY. This bash helper is the SOLE sweep surface, because seed-time is
-# the only safe moment to mutate filesystem layout. Any future "share the logic"
-# refactor must preserve that asymmetry.
+# is READ-ONLY. This bash helper is the SOLE filesystem-mutation surface for the
+# account layout, because seed-time is the only safe moment to mutate it.
 #
 # Contract (inputs via env vars):
 #   ACCOUNTS_DIR — {installDir}/data/accounts
-#   USERS_FILE   — $HOME/<brand.configDir>/users.json
+#   USERS_FILE   — $HOME/<brand.configDir>/users.json   (read-tolerant; unused for sweep)
 #
 # Contract (outputs via env vars):
-#   ACCOUNT_ID   — resolved uuid (existing kept, or freshly minted)
-#   ACCOUNT_DIR  — full path to the live account dir
+#   ACCOUNT_ID   — resolved house uuid (existing kept, or freshly minted on fresh install)
+#   ACCOUNT_DIR  — full path to the live house account dir
 #
 # Exit:
-#   0 on success; non-zero on abort (multi-candidate + no unique identity match).
+#   0 on success; non-zero on abort (registry drift: zero-house with >1 candidate,
+#   or multiple houses).
 
-# Helper: classify account.json at $1 against userId $2.
-# Exit codes are trichotomous so callers can distinguish "definitely not a match"
-# from "could not determine" — the latter is a doctrine-level loud failure, not
-# a silent fall-through to orphan-classification.
-#   0 = admins[] contains userId (match)
-#   1 = account.json readable and parsed; userId absent from admins[] (no match)
-#   2 = account.json missing, unreadable, or unparseable (undetermined — caller must abort)
-_account_dir_matches() {
+# Helper: print the `role` field of the account.json at $1, or empty string when
+# absent/unparseable. Trichotomy is unnecessary here — a missing role just means
+# "not a house candidate"; corruption discipline lives in the enumeration step.
+_account_dir_role() {
   local config="$1/account.json"
-  local uid="$2"
-  [ -f "$config" ] || return 2
-  python3 - "$config" "$uid" <<'PY'
+  [ -f "$config" ] || { echo ""; return 0; }
+  python3 - "$config" <<'PY' 2>/dev/null || echo ""
 import json, sys
 try:
     cfg = json.load(open(sys.argv[1]))
 except Exception:
-    sys.exit(2)
-admins = cfg.get('admins') or []
-uid = sys.argv[2]
-for a in admins:
-    if isinstance(a, dict) and a.get('userId') == uid:
-        sys.exit(0)
-sys.exit(1)
+    print(""); sys.exit(0)
+print(cfg.get("role") or "")
 PY
 }
 
-# Two-pass resolver: enumerate+classify all candidates, then act.
-# Never mutates filesystem before the full classification is complete.
+# House-account resolver. Enumerate registered candidates (dirs with account.json),
+# classify by role, resolve the house (or sole-unlabelled), report orphans, and
+# emit the registry snapshot. Never mutates the filesystem layout.
 resolve_and_sweep_account_dir() {
   mkdir -p "$ACCOUNTS_DIR"
 
   # Enumerate candidates: direct children with account.json, basenames not starting with '.'
-  local candidates=()
+  local candidates=() orphans=()
   local dir base
   for dir in "$ACCOUNTS_DIR"/*/; do
     [ -d "$dir" ] || continue
     base="$(basename "$dir")"
     case "$base" in .*) continue ;; esac
-    [ -f "$dir/account.json" ] || continue
-    candidates+=("$base")
+    if [ -f "$dir/account.json" ]; then
+      candidates+=("$base")
+    else
+      orphans+=("$base")
+    fi
   done
 
-  # Read target userId from users.json (if present and valid)
-  local target_user_id=""
-  if [ -f "$USERS_FILE" ]; then
-    target_user_id=$(python3 - "$USERS_FILE" <<'PY' 2>/dev/null || true
-import json, sys
-try:
-    data = json.load(open(sys.argv[1]))
-    if isinstance(data, list) and data and isinstance(data[0], dict):
-        uid = data[0].get('userId')
-        if uid:
-            print(uid)
-except Exception:
-    pass
-PY
-)
-  fi
-
   local n=${#candidates[@]}
 
   # Case 0: no candidates — fresh install, mint new UUID.
-  # sub-scope F — atomic-mint discipline: refuse to mint a new
-  # accountId if any stub dir (subdir present, account.json missing) exists
-  # under data/accounts/. The root cause is install 1 minting accountId X
-  # then losing X/account.json (cron stamped X/logs/ first); the next
-  # install sees zero candidates and mints Y, orphaning X/logs/. The
-  # guard turns that silent regression into an operator-actionable abort.
+  # Atomic-mint discipline: refuse to mint if any stub dir (subdir present,
+  # account.json missing) exists — a half-provisioned account from a crashed
+  # prior install must be operator-repaired, not silently orphaned.
   if [ "$n" -eq 0 ]; then
-    local stub_dirs=()
-    for dir in "$ACCOUNTS_DIR"/*/; do
-      [ -d "$dir" ] || continue
-      base="$(basename "$dir")"
-      case "$base" in .*) continue ;; esac
-      [ -f "$dir/account.json" ] && continue
-      stub_dirs+=("$base")
-    done
-    if [ "${#stub_dirs[@]}" -gt 0 ]; then
-      echo "==> [seed] FAIL phase=mint reason=\"stub-account-dirs present (no account.json): ${stub_dirs[*]}\" — refusing to mint a fresh accountId; remove or repair the stub before re-running install" >&2
+    if [ "${#orphans[@]}" -gt 0 ]; then
+      echo "==> [seed] FAIL phase=mint reason=\"stub-account-dirs present (no account.json): ${orphans[*]}\" — refusing to mint a fresh accountId; remove or repair the stub before re-running install" >&2
       return 1
     fi
     ACCOUNT_ID="$(cat /proc/sys/kernel/random/uuid 2>/dev/null || python3 -c 'import uuid; print(uuid.uuid4())')"
     ACCOUNT_DIR="$ACCOUNTS_DIR/$ACCOUNT_ID"
+    echo "==> [seed] op=registry-snapshot houses=0 clients=0"
     return 0
   fi
 
-  # Case 1: single candidate — accept (preserves legacy + fresh-install-pre-users.json).
-  # Log identity-match on exact match; WARN on mismatch (mirrors TS resolveAccount line 653 —
-  # accept-with-flag rather than abort because the users.json regeneration on PIN
-  # change would otherwise brick legitimate installs).
-  if [ "$n" -eq 1 ]; then
-    ACCOUNT_ID="${candidates[0]}"
-    ACCOUNT_DIR="$ACCOUNTS_DIR/$ACCOUNT_ID"
-    if [ -n "$target_user_id" ]; then
-      local rc=0
-      _account_dir_matches "$ACCOUNT_DIR" "$target_user_id" || rc=$?
-      case "$rc" in
-        0) echo "==> [seed] identity-match: kept=${ACCOUNT_ID:0:8} via userId=${target_user_id:0:8}" ;;
-        1) echo "==> [seed] WARN: single account does not match users.json userId=${target_user_id:0:8} — accepting but flagging" >&2 ;;
-        *) echo "==> [seed] identity-match FAILED: sole candidate $ACCOUNT_ID has unreadable or unparseable account.json — aborting" >&2
-           return 1 ;;
-      esac
-    fi
-    return 0
-  fi
-
-  # Case 2+: multi-candidate — identity-match-or-abort.
-  # First classify everything, THEN decide and act.
-  if [ -z "$target_user_id" ]; then
-    echo "==> [seed] identity-match FAILED: users.json missing or unreadable, $n candidates — aborting" >&2
-    for uuid in "${candidates[@]}"; do echo "    candidate: $uuid" >&2; done
-    return 1
-  fi
-
-  local matches=()
-  local orphans=()
-  local rc
+  # Classify candidates by role.
+  local houses=() clients=() uuid role
   for uuid in "${candidates[@]}"; do
-    rc=0
-    _account_dir_matches "$ACCOUNTS_DIR/$uuid" "$target_user_id" || rc=$?
-    case "$rc" in
-      0) matches+=("$uuid") ;;
-      1) orphans+=("$uuid") ;;
-      *) echo "==> [seed] identity-match FAILED: candidate $uuid has unreadable or unparseable account.json — aborting" >&2
-         for u in "${candidates[@]}"; do echo "    candidate: $u" >&2; done
-         return 1 ;;
+    role="$(_account_dir_role "$ACCOUNTS_DIR/$uuid")"
+    case "$role" in
+      house) houses+=("$uuid") ;;
+      *)     clients+=("$uuid") ;;   # client OR unlabelled (legacy)
     esac
   done
 
-  if [ "${#matches[@]}" -eq 0 ]; then
-    echo "==> [seed] identity-match FAILED: $n candidates, none match users.json userId=${target_user_id:0:8} — aborting" >&2
-    for uuid in "${candidates[@]}"; do echo "    candidate: $uuid" >&2; done
-    return 1
-  fi
+  # Pre-action registry snapshot — the count the post-seed census must match.
+  echo "==> [seed] op=registry-snapshot houses=${#houses[@]} clients=${#clients[@]}"
 
-  if [ "${#matches[@]}" -gt 1 ]; then
-    echo "==> [seed] identity-match FAILED: $n candidates, ${#matches[@]} match userId=${target_user_id:0:8} (ambiguous) — aborting" >&2
-    for uuid in "${candidates[@]}"; do echo "    candidate: $uuid" >&2; done
-    return 1
+  # Report orphans (dirs with no account.json). Log-only — never moved this sprint.
+  # Guard the empty-array expansion: under `set -u` (setup-account.sh uses
+  # `set -euo pipefail`), bash 3.2 treats "${orphans[@]}" on an empty array as an
+  # unbound variable and aborts.
+  local ts; ts=$(date -u +%Y%m%dT%H%M%SZ 2>/dev/null || echo unknown)
+  if [ "${#orphans[@]}" -gt 0 ]; then
+    for uuid in "${orphans[@]}"; do
+      echo "==> [seed] op=sweep uuid=${uuid:0:8} registered=false action=skipped-guarded ts=$ts"
+    done
   fi
 
-  ACCOUNT_ID="${matches[0]}"
-  ACCOUNT_DIR="$ACCOUNTS_DIR/$ACCOUNT_ID"
-  echo "==> [seed] identity-match: kept=${ACCOUNT_ID:0:8} via userId=${target_user_id:0:8}"
+  # Resolve the house.
+  if [ "${#houses[@]}" -eq 1 ]; then
+    ACCOUNT_ID="${houses[0]}"
+    ACCOUNT_DIR="$ACCOUNTS_DIR/$ACCOUNT_ID"
+    echo "==> [seed] house-resolved: ${ACCOUNT_ID:0:8}"
+    return 0
+  fi
 
-  # Sweep orphans. mv is the only destructive op; abort loud on failure before any further state change.
-  local trash_dir="$ACCOUNTS_DIR/.trash"
-  mkdir -p "$trash_dir"
-  local ts; ts=$(date -u +%Y%m%dT%H%M%SZ)
-  local moved=0 uuid dest
-  for uuid in "${orphans[@]}"; do
-    dest="$trash_dir/${uuid}-${ts}"
-    if ! mv "$ACCOUNTS_DIR/$uuid" "$dest"; then
-      echo "==> [seed] ERROR: failed to move $uuid → $dest — aborting" >&2
-      return 1
-    fi
-    echo "==> [seed] swept orphan: ${uuid:0:8} → .trash/${uuid:0:8}-${ts}"
-    moved=$((moved + 1))
-  done
-  if [ "$moved" -gt 0 ]; then
-    echo "==> [seed] orphan sweep: moved $moved → $ACCOUNTS_DIR/.trash/"
+  # Pre-migration tolerance: zero labelled house but exactly one account → it is
+  # the house (setup-account.sh stamps role:"house" on it).
+  if [ "${#houses[@]}" -eq 0 ] && [ "$n" -eq 1 ]; then
+    ACCOUNT_ID="${candidates[0]}"
+    ACCOUNT_DIR="$ACCOUNTS_DIR/$ACCOUNT_ID"
+    echo "==> [seed] house-resolved: ${ACCOUNT_ID:0:8} (sole account, pre-migration)"
+    return 0
   fi
 
-  return 0
+  # Genuine drift — loud-fail.
+  echo "==> [seed] FAIL phase=resolve-house reason=\"houses=${#houses[@]} total=$n — expected exactly one role:house (or a single unlabelled account)\" — aborting" >&2
+  for uuid in "${candidates[@]}"; do echo "    candidate: $uuid role=$(_account_dir_role "$ACCOUNTS_DIR/$uuid")" >&2; done
+  return 1
 }

package/payload/platform/scripts/seed-neo4j.sh

@@ -190,4 +190,22 @@ else
   echo "  No users.json found — skipping AdminUser seed (set-pin POST creates it)"
 fi
 
+# ------------------------------------------------------------------
+# 5. Standing reconcile — Property-hub invariant (estate-agent vertical)
+# ------------------------------------------------------------------
+# :Property is the obligatory parent of every :Listing. The schema-apply step
+# above runs the one-shot backfill that relinks any pre-inversion listing-only
+# data; this per-deploy count proves it reached zero and catches a write path
+# that later regresses the inversion. orphanListings=0 is healthy. A fresh
+# non-estate install has zero :Listing nodes (orphanListings=0 total=0). This
+# is a visibility signal only — never install-blocking, so failures here do not
+# exit non-zero.
+ESTATE_ORPHANS=$("$CYPHER_SHELL" -u "$NEO4J_USER" -p "$NEO4J_PASSWORD" -a "$NEO4J_URI" \
+    --format plain \
+    "MATCH (l:Listing {accountId: '$ACCOUNT_ID'}) WHERE NOT ( (:Property)-[:HAS_LISTING]->(l) ) RETURN count(l)" 2>/dev/null | tail -1 | tr -d ' \r')
+ESTATE_TOTAL=$("$CYPHER_SHELL" -u "$NEO4J_USER" -p "$NEO4J_PASSWORD" -a "$NEO4J_URI" \
+    --format plain \
+    "MATCH (l:Listing {accountId: '$ACCOUNT_ID'}) RETURN count(l)" 2>/dev/null | tail -1 | tr -d ' \r')
+echo "  [estate-reconcile] accountId=${ACCOUNT_ID:0:8} orphanListings=${ESTATE_ORPHANS:-0} total=${ESTATE_TOTAL:-0}"
+
 echo "  Done."