@rubytech/create-maxy-code 0.1.487 → 0.1.489

package/payload/platform/scripts/__tests__/account-schema-owned-dirs.test.sh

@@ -73,6 +73,20 @@ ALLOWED_MX="$(awk '/^```allowed-top-level$/{f=1;next} /^```$/{f=0} f' "$A_MX/SCH
 assert_nogrep "quoting" "$ALLOWED_MX" "mx-no-quoting"
 assert_nogrep "Plugin-owned top-level workspaces" "$(cat "$A_MX/SCHEMA.md")" "mx-no-section"
 
+# --- platform plugins declare pages (storage-broker) + archive (memory) ---
+# Task 1891: these two plugin-owned root dirs must land in the allowed block so
+# the account-dir reconcile stops quarantining them. Symlink the real plugin
+# dirs so the case exercises the shipped PLUGIN.md declaration.
+T_PA="$(make_tree '[]')"
+ln -s "$REAL_PROJECT_DIR/plugins/storage-broker" "$T_PA/platform/plugins/storage-broker"
+ln -s "$REAL_PROJECT_DIR/plugins/memory" "$T_PA/platform/plugins/memory"
+A_PA="$(make_account "$T_PA")"
+export PROJECT_DIR="$T_PA/platform"
+merge_owned_dirs_into_schema "$A_PA" >/dev/null
+ALLOWED_PA="$(awk '/^```allowed-top-level$/{f=1;next} /^```$/{f=0} f' "$A_PA/SCHEMA.md")"
+assert_grep "pages" "$ALLOWED_PA" "pa-allowlist-has-pages"
+assert_grep "archive" "$ALLOWED_PA" "pa-allowlist-has-archive"
+
 # --- reconcile: present=false on bare schema, present=true after merge ---
 A_RC="$(make_account "$T_SD")"
 export PROJECT_DIR="$T_SD/platform"
@@ -117,11 +131,11 @@ OUT_C="$(merge_owned_dirs_into_schema "$A_C")"
 # Match a non-empty derived list, not the bare key (which prints even for zero).
 assert_grep "domainBuckets=jobs" "$OUT_C" "con-domain-log"
 # Summary reports the full root set and the job-owned entities with their parent.
-assert_grep "roots=jobs,customers,customer-sites,assets,parts,ppm-contracts" "$OUT_C" "con-roots-log"
+assert_grep "roots=jobs,customers,customer-sites,assets,parts,suppliers,ppm-contracts" "$OUT_C" "con-roots-log"
 assert_grep "nested=Visit<-Job,Quote<-Job,PurchaseOrder<-Job" "$OUT_C" "con-nested-log"
 ALLOWED_C="$(awk '/^```allowed-top-level$/{f=1;next} /^```$/{f=0} f' "$A_C/SCHEMA.md")"
 # Root entities (blank Owner) get a top-level bucket.
-for d in jobs customers customer-sites assets parts ppm-contracts; do
+for d in jobs customers customer-sites assets parts ppm-contracts suppliers; do
   assert_grep "$d" "$ALLOWED_C" "con-allow-$d"
 done
 # Job-owned entities (Owner=Job) do NOT get a root bucket.
@@ -137,6 +151,10 @@ assert_grep '`Quote` records live under `jobs/` (owned by `Job`), not a root buc
 B_C="$(shasum "$A_C/SCHEMA.md" | awk '{print $1}')"
 merge_owned_dirs_into_schema "$A_C" >/dev/null
 assert_eq "$(shasum "$A_C/SCHEMA.md" | awk '{print $1}')" "$B_C" "con-idempotent"
+# Supplier is a root bucket (Task 1892): received invoices file under
+# suppliers/<supplier>/Invoices/, not a stray top-level inbound-invoices/.
+RCS="$(PROJECT_DIR="$PROJECT_DIR" python3 "$PLAT_SCRIPTS/lib/account-schema-owned-dirs.py" reconcile "$A_C")"
+assert_grep "ontologyEntity=Supplier bucket=suppliers present=true" "$RCS" "con-supplier-root-present"
 
 # --- estate-agent vertical: root buckets only, listing-owned entities nested ---
 T_E="$(make_vertical_tree '["real-agent"]' 'schema-estate-agent')"; A_E="$(make_account "$T_E")"
@@ -151,6 +169,8 @@ for d in viewings offers; do
   assert_nogrep "$d" "$ALLOWED_E" "ea-noroot-$d"
 done
 assert_nogrep "jobs" "$ALLOWED_E" "ea-no-sitedesk-jobs"
+# The suppliers/ bucket is construction-only; it must not leak into another vertical.
+assert_nogrep "suppliers" "$ALLOWED_E" "ea-no-suppliers"
 
 # --- no vertical declared: generic base only ---
 T_N="$(make_tree '[]')"; A_N="$(make_account "$T_N")"

package/payload/platform/scripts/__tests__/quarantine-restore.test.sh

@@ -0,0 +1,143 @@
+#!/usr/bin/env bash
+# Tests the one-shot quarantine restore (Task 1899): a free target is moved back,
+# an occupied target is skipped with both copies surviving, an already-restored
+# entry reports absent, a malformed line reports unparsable, and --dry-run
+# changes nothing on disk.
+set -uo pipefail
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+RESTORE="$SCRIPT_DIR/../quarantine-restore.mjs"
+PASS=0; FAIL=0; FAILED=()
+assert_grep()   { if printf '%s' "$2" | grep -qF "$1"; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); FAILED+=("$3: expected to find [$1]"); fi; }
+assert_nogrep() { if printf '%s' "$2" | grep -qF "$1"; then FAIL=$((FAIL+1)); FAILED+=("$3: expected NOT to find [$1]"); else PASS=$((PASS+1)); fi; }
+assert_file()   { if [ -e "$1" ]; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); FAILED+=("$2: expected file [$1]"); fi; }
+assert_nofile() { if [ -e "$1" ]; then FAIL=$((FAIL+1)); FAILED+=("$2: expected NO file [$1]"); else PASS=$((PASS+1)); fi; }
+assert_eq()     { if [ "$1" = "$2" ]; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); FAILED+=("$3: expected [$2] got [$1]"); fi; }
+
+# One accounts root with a single account whose manifest covers all four cases.
+make_tree() {
+  local T; T="$(mktemp -d)"
+  local A="$T/acct-1"
+  mkdir -p "$A/.quarantine"
+  printf '{}' > "$A/account.json"
+
+  # (a) free target: quarantined copy exists, nothing at the root.
+  printf 'portal' > "$A/.quarantine/data-portal.json"
+  # (b) occupied target: quarantined copy AND a live copy the platform rewrote.
+  printf 'old' > "$A/.quarantine/wa-channel-bindings.json"
+  printf 'live' > "$A/wa-channel-bindings.json"
+  # (c) already restored by hand: manifest names a source that is gone.
+  printf 'restored' > "$A/session-titles.json"
+
+  cat > "$A/.quarantine/manifest.jsonl" <<'EOF'
+{"name":"data-portal.json","originalPath":"data-portal.json","reason":"top-level","quarantinePath":".quarantine/data-portal.json","movedAt":"2026-07-21T19:16:05.216Z"}
+{"name":"session-titles.json","originalPath":"session-titles.json","reason":"top-level","quarantinePath":".quarantine/session-titles.json","movedAt":"2026-07-21T19:20:00.000Z"}
+not json at all
+{"name":"wa-channel-bindings.json","originalPath":"wa-channel-bindings.json","reason":"top-level","quarantinePath":".quarantine/wa-channel-bindings.json","movedAt":"2026-07-21T20:45:00.000Z"}
+EOF
+  printf '%s' "$T"
+}
+
+# --- dry run changes nothing -------------------------------------------------
+T="$(make_tree)"; A="$T/acct-1"
+OUT="$(node "$RESTORE" --accounts-root "$T" --dry-run 2>&1)"
+assert_grep 'result=moved' "$OUT" "dry-run reports the move it would make"
+assert_grep 'dry-run=1' "$OUT" "dry-run marks its lines"
+assert_nofile "$A/data-portal.json" "dry-run leaves the root untouched"
+assert_file "$A/.quarantine/data-portal.json" "dry-run leaves the quarantined copy"
+assert_nofile "$A/.quarantine/restored.jsonl" "dry-run writes no restored.jsonl"
+rm -rf "$T"
+
+# --- real run ----------------------------------------------------------------
+T="$(make_tree)"; A="$T/acct-1"
+OUT="$(node "$RESTORE" --accounts-root "$T" 2>&1)"
+
+assert_grep 'op=restore account=acct-1 name=data-portal.json result=moved' "$OUT" "free target moved"
+assert_file "$A/data-portal.json" "free target is back at the root"
+assert_nofile "$A/.quarantine/data-portal.json" "free target no longer in quarantine"
+
+assert_grep 'name=wa-channel-bindings.json result=skipped-live-copy' "$OUT" "occupied target skipped"
+assert_grep 'live' "$(cat "$A/wa-channel-bindings.json")" "live copy still wins"
+assert_file "$A/.quarantine/wa-channel-bindings.json" "quarantined copy survives the skip"
+
+assert_grep 'name=session-titles.json result=absent' "$OUT" "already-restored source reports absent"
+assert_grep 'restored' "$(cat "$A/session-titles.json")" "hand-restored copy untouched"
+
+assert_grep 'line=3 result=unparsable' "$OUT" "malformed manifest line is reported"
+
+assert_file "$A/.quarantine/manifest.jsonl" "manifest is left intact"
+RESTORED="$(cat "$A/.quarantine/restored.jsonl")"
+assert_grep 'data-portal.json' "$RESTORED" "restored.jsonl records the move"
+assert_nogrep 'wa-channel-bindings.json' "$RESTORED" "restored.jsonl records only moves"
+assert_nogrep 'session-titles.json' "$RESTORED" "restored.jsonl records only moves"
+rm -rf "$T"
+
+# --- a name quarantined twice restores the NEWEST copy ------------------------
+# The sweep took wa-channel-bindings.json up to four times on one live account,
+# the platform rewriting it between each. The deleted quarantineDest() took the
+# unsuffixed name first and appended .1 to the next collision, so .1 IS the newer
+# copy. Walking the append-only manifest oldest-first would put the stalest copy
+# back, and the newer record would then find the target occupied.
+T="$(mktemp -d)"; A="$T/acct-2"
+mkdir -p "$A/.quarantine"
+printf '{}' > "$A/account.json"
+printf 'OLDER' > "$A/.quarantine/data-portal.json"
+printf 'NEWER' > "$A/.quarantine/data-portal.json.1"
+cat > "$A/.quarantine/manifest.jsonl" <<'EOF'
+{"name":"data-portal.json","originalPath":"data-portal.json","quarantinePath":".quarantine/data-portal.json","movedAt":"2026-07-21T19:16:05.216Z"}
+{"name":"data-portal.json","originalPath":"data-portal.json","quarantinePath":".quarantine/data-portal.json.1","movedAt":"2026-07-21T20:45:00.000Z"}
+EOF
+OUT="$(node "$RESTORE" --accounts-root "$T" 2>&1)"
+assert_grep 'NEWER' "$(cat "$A/data-portal.json")" "newest quarantined copy is the one restored"
+# The target was created by THIS run, not by a live platform rewrite. Calling it
+# skipped-live-copy would tell the operator the platform holds a current copy.
+assert_grep 'result=skipped-superseded' "$OUT" "the older copy is superseded, not live"
+assert_nogrep 'result=skipped-live-copy' "$OUT" "no live copy existed on this tree"
+assert_file "$A/.quarantine/data-portal.json" "the older copy is left in quarantine, never deleted"
+rm -rf "$T"
+
+# --- a record pointing outside its account is refused -------------------------
+# .quarantine is in the write guard's allowed-top-level set, so an account-scoped
+# agent can append to its own manifest. This script runs as the platform user
+# across every account, so an escaping path would move one account's live data
+# into another.
+T="$(mktemp -d)"
+mkdir -p "$T/acct-a/.quarantine" "$T/acct-b"
+printf '{}' > "$T/acct-a/account.json"
+printf '{}' > "$T/acct-b/account.json"
+printf 'LIVE' > "$T/acct-b/wa-channel-bindings.json"
+printf 'x' > "$T/acct-a/.quarantine/evil.json"
+cat > "$T/acct-a/.quarantine/manifest.jsonl" <<'EOF'
+{"name":"evil.json","originalPath":"../acct-b/planted.json","quarantinePath":".quarantine/evil.json"}
+{"name":"steal","originalPath":"stolen.json","quarantinePath":"../acct-b/wa-channel-bindings.json"}
+EOF
+OUT="$(node "$RESTORE" --accounts-root "$T" 2>&1)"; RC=$?
+assert_grep 'result=refused-outside-account' "$OUT" "escaping record is refused"
+assert_grep 'refused=2' "$OUT" "both escaping records are counted"
+assert_nofile "$T/acct-b/planted.json" "nothing is planted in the other account"
+assert_nofile "$T/acct-a/stolen.json" "nothing is stolen from the other account"
+assert_file "$T/acct-b/wa-channel-bindings.json" "the other account's live file is untouched"
+assert_eq "$RC" "1" "a refused record makes the run exit non-zero"
+rm -rf "$T"
+
+# --- a failed rename reaches the summary and the exit code --------------------
+# A restore that cannot complete leaves data in quarantine. The operator runs
+# this once and reads the tail line, so a clean summary with a silent stderr
+# line would be the same silent-skip failure this task exists to end.
+T="$(mktemp -d)"; A="$T/acct-3"
+mkdir -p "$A/.quarantine"
+printf '{}' > "$A/account.json"
+printf 'x' > "$A/.quarantine/orphan.json"
+# The target's parent bucket no longer exists, so the target itself is absent
+# (not a live copy) and the rename fails with ENOENT.
+cat > "$A/.quarantine/manifest.jsonl" <<'EOF'
+{"name":"orphan.json","originalPath":"gone-bucket/orphan.json","quarantinePath":".quarantine/orphan.json","movedAt":"2026-07-21T19:16:05.216Z"}
+EOF
+OUT="$(node "$RESTORE" --accounts-root "$T" 2>&1)"; RC=$?
+assert_grep 'result=failed' "$OUT" "the failed rename is reported"
+assert_grep 'failed=1' "$OUT" "the failure reaches the summary line"
+assert_eq "$RC" "1" "a failed restore makes the run exit non-zero"
+rm -rf "$T"
+
+# --- summary -----------------------------------------------------------------
+echo "PASS=$PASS FAIL=$FAIL"
+if [ "$FAIL" -gt 0 ]; then printf '%s\n' "${FAILED[@]}"; exit 1; fi

package/payload/platform/scripts/quarantine-restore.mjs

@@ -0,0 +1,175 @@
+#!/usr/bin/env node
+// Task 1899 — one-shot restore of everything the account-dir schema reconcile
+// moved into <account>/.quarantine/ before it was made report-only. The sweep's
+// allowed-list never matched what the platform and its agents write at an
+// account root, so it took live features and live data dark with no error: the
+// portal config, live signed agreements, the channel bindings.
+//
+// Per account it walks .quarantine/manifest.jsonl NEWEST-FIRST (the manifest is
+// append-only, so that is reverse file order). Newest-first is what makes the
+// occupied case correct for a name quarantined more than once: the most recent
+// copy is considered first, and every older copy of that name then finds the
+// target occupied. The live copy always wins, because the platform rewrote it
+// after the move — four wa-channel-bindings.json records on one account prove
+// that happened.
+//
+// Never deletes. The manifest is left intact so the history of what moved and
+// what came back both survive.
+//
+// Usage: node quarantine-restore.mjs --accounts-root <dir> [--dry-run]
+
+import { existsSync, readdirSync, readFileSync, renameSync, appendFileSync } from 'node:fs'
+import { join, resolve, sep } from 'node:path'
+
+const TAG = '[quarantine-restore]'
+const QUARANTINE_DIR = '.quarantine'
+
+/** True when `path` is `root` itself or lives underneath it. Both arguments must
+ *  already be absolute. */
+function isInside(root, path) {
+  return path === root || path.startsWith(root + sep)
+}
+
+function parseArgs(argv) {
+  let accountsRoot = null
+  let dryRun = false
+  for (let i = 0; i < argv.length; i++) {
+    if (argv[i] === '--accounts-root') {
+      accountsRoot = argv[i + 1] ?? null
+      i++
+    } else if (argv[i] === '--dry-run') {
+      dryRun = true
+    }
+  }
+  return { accountsRoot, dryRun }
+}
+
+const { accountsRoot, dryRun } = parseArgs(process.argv.slice(2))
+if (!accountsRoot) {
+  console.error(`${TAG} usage: quarantine-restore.mjs --accounts-root <dir> [--dry-run]`)
+  process.exit(1)
+}
+if (!existsSync(accountsRoot)) {
+  console.error(`${TAG} accounts root not found: ${accountsRoot}`)
+  process.exit(1)
+}
+
+const suffix = dryRun ? ' dry-run=1' : ''
+const totals = {
+  moved: 0,
+  'skipped-live-copy': 0,
+  'skipped-superseded': 0,
+  absent: 0,
+  unparsable: 0,
+  refused: 0,
+  failed: 0,
+}
+let accounts = 0
+
+for (const entry of readdirSync(accountsRoot)) {
+  const accountDir = join(accountsRoot, entry)
+  const accountRoot = resolve(accountDir)
+  const quarantineRoot = resolve(accountDir, QUARANTINE_DIR)
+  const manifestPath = join(accountDir, QUARANTINE_DIR, 'manifest.jsonl')
+  if (!existsSync(manifestPath)) continue
+  accounts++
+
+  // Names this run put back at the account root. A later record naming one of
+  // them found the target occupied by THIS run, not by a live copy the platform
+  // rewrote — two different states that must not share one outcome label.
+  const restoredThisRun = new Set()
+
+  let lines
+  try {
+    lines = readFileSync(manifestPath, 'utf-8').split('\n')
+  } catch (err) {
+    totals.failed++
+    console.error(
+      `${TAG} op=restore account=${entry} result=manifest-unreadable error=${err.message}`,
+    )
+    continue
+  }
+
+  // Newest-first: the manifest is append-only, so walk it backwards. The 1-based
+  // file line number is carried so an unparsable line can be pointed at.
+  const numbered = lines.map((text, i) => ({ text, lineNo: i + 1 })).filter((l) => l.text.trim())
+  for (const { text, lineNo } of numbered.reverse()) {
+    let rec
+    try {
+      rec = JSON.parse(text)
+    } catch {
+      rec = null
+    }
+    if (!rec || typeof rec.originalPath !== 'string' || typeof rec.quarantinePath !== 'string') {
+      // Reported, never silently skipped: a line dropped without a word is the
+      // exact failure class this task exists to end.
+      totals.unparsable++
+      console.log(`${TAG} op=restore account=${entry} line=${lineNo} result=unparsable${suffix}`)
+      continue
+    }
+
+    const source = resolve(accountDir, rec.quarantinePath)
+    const target = resolve(accountDir, rec.originalPath)
+    const name = rec.originalPath
+
+    // The manifest is a file inside the account, and .quarantine is in the write
+    // guard's allowed-top-level set, so an account-scoped agent can append to it.
+    // This script runs as the platform user across every account, so a record
+    // whose paths escape the account would move one account's live data into
+    // another. Every record the reconcile ever wrote was a bare basename plus a
+    // path under .quarantine/, so this refuses nothing genuine.
+    if (!isInside(quarantineRoot, source) || !isInside(accountRoot, target)) {
+      totals.refused++
+      console.error(
+        `${TAG} op=restore account=${entry} line=${lineNo} result=refused-outside-account${suffix}`,
+      )
+      continue
+    }
+
+    if (!existsSync(source)) {
+      totals.absent++
+      console.log(`${TAG} op=restore account=${entry} name=${name} result=absent${suffix}`)
+      continue
+    }
+    if (existsSync(target) || restoredThisRun.has(target)) {
+      // A target this run created is superseded, not live. Calling both
+      // skipped-live-copy would tell the operator the platform holds a current
+      // copy when what is really left is an older copy still in quarantine.
+      const outcome = restoredThisRun.has(target) ? 'skipped-superseded' : 'skipped-live-copy'
+      totals[outcome]++
+      console.log(`${TAG} op=restore account=${entry} name=${name} result=${outcome}${suffix}`)
+      continue
+    }
+
+    if (dryRun) {
+      totals.moved++
+      restoredThisRun.add(target)
+      console.log(`${TAG} op=restore account=${entry} name=${name} result=moved${suffix}`)
+      continue
+    }
+    try {
+      renameSync(source, target)
+      appendFileSync(
+        join(accountDir, QUARANTINE_DIR, 'restored.jsonl'),
+        JSON.stringify({ ...rec, restoredAt: new Date().toISOString() }) + '\n',
+      )
+      totals.moved++
+      restoredThisRun.add(target)
+      console.log(`${TAG} op=restore account=${entry} name=${name} result=moved`)
+    } catch (err) {
+      totals.failed++
+      console.error(
+        `${TAG} op=restore account=${entry} name=${name} result=failed error=${err.message}`,
+      )
+    }
+  }
+}
+
+console.log(
+  `${TAG} accounts=${accounts} moved=${totals.moved} skipped-live-copy=${totals['skipped-live-copy']} skipped-superseded=${totals['skipped-superseded']} absent=${totals.absent} unparsable=${totals.unparsable} refused=${totals.refused} failed=${totals.failed}${suffix}`,
+)
+
+// A rename that failed, a manifest that would not open, and a record refused for
+// pointing outside its account all leave data in quarantine. The operator runs
+// this once and reads the tail line, so the exit code has to say so too.
+if (totals.failed > 0 || totals.refused > 0) process.exitCode = 1

package/payload/platform/services/claude-session-manager/dist/account-dir-schema-reconcile.d.ts

@@ -1,9 +1,17 @@
 export interface ReconcileCounts {
     strayTopLevel: number;
     overDeep: number;
-    quarantined: number;
     badName: number;
 }
+export interface ReconcileResult extends ReconcileCounts {
+    /** The account-root entries counted as strays, by name — the same set
+     *  strayTopLevel counts, so PROTECTED_TOP_LEVEL entries and dot-prefixed
+     *  entries are absent from it, and an account that failed the SCHEMA.md
+     *  fail-open check returns it empty. A count alone cannot distinguish six
+     *  pieces of debris from a live plugin config; this list is what makes the
+     *  report-only posture actionable. */
+    strayNames: string[];
+}
 /** The single per-run summary line body. A non-zero count is the standing signal
  *  that an agent authored folders the hard guards could not prevent. Pure
  *  formatter so the emitter and its test share one wording. */
@@ -14,18 +22,27 @@ export declare function formatReconcileLine(c: ReconcileCounts): string;
 export declare function parseAllowedTopLevel(schemaText: string): Set<string>;
 /** Reconcile one account dir. Reads its SCHEMA.md allowed set; an absent/empty
  *  set skips the account (fail open, like the hook — an un-seeded legacy account
- *  must not have its whole root quarantined). Moves stray top-level entries to
- *  .quarantine/ with a manifest line; counts over-deep files without moving. */
-export declare function reconcileAccount(accountDir: string, now: () => number): ReconcileCounts;
+ *  must not have its whole root reported as stray). Counts and names stray
+ *  top-level entries; counts over-deep files and bad names. Moves nothing. */
+export declare function reconcileAccount(accountDir: string): ReconcileResult;
 export interface ReconcileDeps {
     accountsRoot: string;
     logger: (line: string) => void;
-    now?: () => number;
 }
-/** One reconcile pass over every account under the accounts root, then emit the
+/** One reconcile pass over every account under the accounts root: one op=strays
+ *  line naming the unaccounted-for entries of each account that has any, then the
  *  single summary line. An account is any child dir with an account.json (the
  *  account marker the census uses). Per-account errors are swallowed so one bad
- *  account never aborts the run. */
+ *  account never aborts the run.
+ *
+ *  The op=strays line is the standing signal. When a feature that reads an
+ *  account-root file goes dark, seeing that file named here says the schema does
+ *  not account for it and it is still on disk, so declare it. The absence of its
+ *  name reads as "gone" only for a file that could have been named at all: an
+ *  entry in PROTECTED_TOP_LEVEL, a dot-prefixed entry, and every entry of an
+ *  account whose SCHEMA.md is missing or has an empty allowed block are never
+ *  named whether they are present or not. Check the account root itself before
+ *  concluding a file is gone. */
 export declare function runReconcile(deps: ReconcileDeps): void;
 export interface AccountDirSchemaReconcile {
     start(): void;

package/payload/platform/services/claude-session-manager/dist/account-dir-schema-reconcile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account-dir-schema-reconcile.d.ts","sourceRoot":"","sources":["../src/account-dir-schema-reconcile.ts"],"names":[],"mappings":"AA2FA,MAAM,WAAW,eAAe;IAC9B,aAAa,EAAE,MAAM,CAAA;IACrB,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,OAAO,EAAE,MAAM,CAAA;CAChB;AAED;;+DAE+D;AAC/D,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,eAAe,GAAG,MAAM,CAE9D;AAED;;8EAE8E;AAC9E,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAcpE;AA0FD;;;gFAGgF;AAChF,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,MAAM,GAAG,eAAe,CAwDvF;AAED,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IAC9B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CACnB;AAED;;;oCAGoC;AACpC,wBAAgB,YAAY,CAAC,IAAI,EAAE,aAAa,GAAG,IAAI,CAwBtD;AAED,MAAM,WAAW,yBAAyB;IACxC,KAAK,IAAI,IAAI,CAAA;IACb,IAAI,IAAI,IAAI,CAAA;CACb;AAED;oDACoD;AACpD,wBAAgB,+BAA+B,CAC7C,IAAI,EAAE,aAAa,GAAG;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,GAC3C,yBAAyB,CAiB3B"}
+{"version":3,"file":"account-dir-schema-reconcile.d.ts","sourceRoot":"","sources":["../src/account-dir-schema-reconcile.ts"],"names":[],"mappings":"AAqFA,MAAM,WAAW,eAAe;IAC9B,aAAa,EAAE,MAAM,CAAA;IACrB,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,eAAgB,SAAQ,eAAe;IACtD;;;;;0CAKsC;IACtC,UAAU,EAAE,MAAM,EAAE,CAAA;CACrB;AAED;;+DAE+D;AAC/D,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,eAAe,GAAG,MAAM,CAE9D;AAED;;8EAE8E;AAC9E,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAcpE;AA+ED;;;8EAG8E;AAC9E,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,eAAe,CAoCpE;AAED,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;CAC/B;AAED;;;;;;;;;;;;;iCAaiC;AACjC,wBAAgB,YAAY,CAAC,IAAI,EAAE,aAAa,GAAG,IAAI,CAyBtD;AAED,MAAM,WAAW,yBAAyB;IACxC,KAAK,IAAI,IAAI,CAAA;IACb,IAAI,IAAI,IAAI,CAAA;CACb;AAED;oDACoD;AACpD,wBAAgB,+BAA+B,CAC7C,IAAI,EAAE,aAAa,GAAG;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,GAC3C,yBAAyB,CAiB3B"}

package/payload/platform/services/claude-session-manager/dist/account-dir-schema-reconcile.js

@@ -11,43 +11,45 @@
 // the flat operator-data buckets, mirroring fs-schema-guard.sh's own depth rule
 // exactly (projects/contacts/documents cap at 3 path segments; every other
 // tool-owned bucket is unbounded and not walked), and (c) bad-named folders and
-// files under those same buckets, mirroring the guard's name convention. Stray
-// top-level entries are QUARANTINED (moved to <account>/.quarantine/ with a
-// manifest recording the original path, reason, and quarantine path so the move
-// is auditable and reversible); over-deep files and bad names are counted only.
-// Nothing is deleted, nothing is silently rewritten, and re-filing quarantined
-// content or renaming a bad name to its schema-correct home is the data-manager
-// specialist's job on dispatch, not this pass.
+// files under those same buckets, mirroring the guard's name convention. All
+// three are REPORTED, never moved: the pass used to quarantine stray top-level
+// entries, and because its allowed-list lagged what the platform and its agents
+// actually write at an account root, a mismatch on an entry something still read
+// took that feature or that data dark with no error anywhere (Task 1899 — the
+// portal config, live signed agreements and the channel bindings all went for
+// exactly that reason). Nothing is moved, nothing is
+// deleted, nothing is silently rewritten; re-filing a stray to its schema-correct
+// home is the data-manager specialist's job on dispatch, not this pass.
 //
 // Shape mirrors the standing-audit family (rootless-client-audit.ts): a pure
 // formatter (unit-tested) + an impure per-account collector + a start/stop
 // factory whose setInterval is unref'd. Purely filesystem — no Neo4j, no graph
 // writes, no deletes. Best-effort by construction: a per-account error is caught
 // so one bad account never aborts the run.
-import { existsSync, mkdirSync, readdirSync, readFileSync, renameSync, appendFileSync, statSync, } from 'node:fs';
+import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs';
 import { join, relative, sep } from 'node:path';
 const TAG = '[fs-reconcile]';
 const QUARANTINE_DIR = '.quarantine';
-/** Platform control-plane entries the reconcile NEVER quarantines, regardless of
- *  what an account's SCHEMA.md allowed set says. provision-account-dir.sh makes
+/** Platform control-plane entries the reconcile NEVER counts as strays, regardless
+ *  of what an account's SCHEMA.md allowed set says. provision-account-dir.sh makes
  *  the account dir a git root (`.git`) and writes its hook-enforcement settings
- *  into `.claude/`, and the account's identity lives in account.json; moving any
- *  of these into .quarantine would brick the account (lost git root, disabled
- *  hooks, unresolvable identity). SCHEMA.md is refreshed on every provision, but
- *  an account carrying a stale/older-template/hand-edited schema whose allowed
- *  block omits one of these must not have it moved. This is a fail-SAFE belt on
- *  the control plane, the mirror of the guard's fail-OPEN on a missing schema —
- *  operator strays are still quarantined; the account's own machinery is not.
+ *  into `.claude/`, and the account's identity lives in account.json. SCHEMA.md is
+ *  refreshed on every provision, but an account carrying a stale/older-template/
+ *  hand-edited schema whose allowed block omits one of these must not be reported
+ *  on every run for machinery it is required to have.
  *
  *  The second group is platform-written control-plane FILES the platform reads
  *  and writes at the account root every run. Unlike the tool-owned buckets, no
- *  plugin declares them into the SCHEMA.md allowed-top-level block, so without
- *  this belt the sweep quarantines them and the feature that reads each one goes
- *  dark: calendar-availability.json is the booking page's availability config (a
- *  quarantine froze a live booking page, Task 1877 fix); wa/webchat/telegram
- *  -channel-bindings.json route each channel's inbound; canonical-webchat-session
- *  .json pins the webchat session; session-titles.json holds operator renames.
- *  Each is `join(accountDir, <name>)` in platform code, none is operator data. */
+ *  plugin declares them into the SCHEMA.md allowed-top-level block: calendar-
+ *  availability.json is the booking page's availability config (quarantining it
+ *  froze a live booking page, Task 1877 fix); wa/webchat/telegram-channel-
+ *  bindings.json route each channel's inbound; canonical-webchat-session.json
+ *  pins the webchat session; session-titles.json holds operator renames. Each is
+ *  `join(accountDir, <name>)` in platform code, none is operator data.
+ *
+ *  Since Task 1899 this belt no longer protects anything from being moved,
+ *  because nothing moves. It keeps the account's own machinery out of the stray
+ *  count so the standing op=strays line names only what an operator must act on. */
 const PROTECTED_TOP_LEVEL = new Set([
     '.git',
     '.claude',
@@ -79,7 +81,7 @@ const FILE_NAME_RE = /^[a-z0-9-]+(\.[a-z0-9-]+)*$/;
  *  that an agent authored folders the hard guards could not prevent. Pure
  *  formatter so the emitter and its test share one wording. */
 export function formatReconcileLine(c) {
-    return `${TAG} stray-top-level=${c.strayTopLevel} over-deep=${c.overDeep} quarantined=${c.quarantined} bad-name=${c.badName}`;
+    return `${TAG} stray-top-level=${c.strayTopLevel} over-deep=${c.overDeep} bad-name=${c.badName}`;
 }
 /** Parse the fenced ```allowed-top-level block from an account's SCHEMA.md —
  *  the same structured set fs-schema-guard.sh parses with awk. Returns the
@@ -189,22 +191,12 @@ function countBadNameEntries(accountDir, bucket) {
     walk(bucketRoot);
     return count;
 }
-/** Pick a non-colliding destination name inside .quarantine for a stray. */
-function quarantineDest(quarantineRoot, name) {
-    let candidate = join(quarantineRoot, name);
-    let n = 1;
-    while (existsSync(candidate)) {
-        candidate = join(quarantineRoot, `${name}.${n}`);
-        n++;
-    }
-    return candidate;
-}
 /** Reconcile one account dir. Reads its SCHEMA.md allowed set; an absent/empty
  *  set skips the account (fail open, like the hook — an un-seeded legacy account
- *  must not have its whole root quarantined). Moves stray top-level entries to
- *  .quarantine/ with a manifest line; counts over-deep files without moving. */
-export function reconcileAccount(accountDir, now) {
-    const empty = { strayTopLevel: 0, overDeep: 0, quarantined: 0, badName: 0 };
+ *  must not have its whole root reported as stray). Counts and names stray
+ *  top-level entries; counts over-deep files and bad names. Moves nothing. */
+export function reconcileAccount(accountDir) {
+    const empty = { strayTopLevel: 0, overDeep: 0, badName: 0, strayNames: [] };
     const schemaPath = join(accountDir, 'SCHEMA.md');
     if (!existsSync(schemaPath))
         return empty;
@@ -224,47 +216,36 @@ export function reconcileAccount(accountDir, now) {
     catch {
         return empty;
     }
-    const strays = rootEntries.filter((name) => !PROTECTED_TOP_LEVEL.has(name) && !allowed.has(name));
-    let quarantined = 0;
-    if (strays.length > 0) {
-        const quarantineRoot = join(accountDir, QUARANTINE_DIR);
-        const manifestPath = join(quarantineRoot, 'manifest.jsonl');
-        for (const name of strays) {
-            try {
-                mkdirSync(quarantineRoot, { recursive: true });
-                const dest = quarantineDest(quarantineRoot, name);
-                renameSync(join(accountDir, name), dest);
-                const record = {
-                    name,
-                    originalPath: name,
-                    reason: 'top-level',
-                    quarantinePath: relative(accountDir, dest),
-                    movedAt: new Date(now()).toISOString(),
-                };
-                appendFileSync(manifestPath, JSON.stringify(record) + '\n');
-                quarantined++;
-            }
-            catch {
-                // Move failed (permissions, race). Counted as a detected stray below,
-                // not as quarantined — the summary line stays honest.
-            }
-        }
-    }
+    // A dot-prefixed top-level entry is tool/system state, never operator data —
+    // the same judgement countBadNameEntries applies when it skips dotfiles. The
+    // stray check must agree, or it reports .remember/.superpowers/.wrangler on
+    // every run (Task 1891). .git/.claude/.quarantine stay covered by
+    // PROTECTED_TOP_LEVEL regardless.
+    const strays = rootEntries.filter((name) => !name.startsWith('.') && !PROTECTED_TOP_LEVEL.has(name) && !allowed.has(name));
     let overDeep = 0;
     let badName = 0;
     for (const bucket of DEPTH_CHECKED_BUCKETS) {
         overDeep += countOverDeepFiles(accountDir, bucket);
         badName += countBadNameEntries(accountDir, bucket);
     }
-    return { strayTopLevel: strays.length, overDeep, quarantined, badName };
+    return { strayTopLevel: strays.length, overDeep, badName, strayNames: strays };
 }
-/** One reconcile pass over every account under the accounts root, then emit the
+/** One reconcile pass over every account under the accounts root: one op=strays
+ *  line naming the unaccounted-for entries of each account that has any, then the
  *  single summary line. An account is any child dir with an account.json (the
  *  account marker the census uses). Per-account errors are swallowed so one bad
- *  account never aborts the run. */
+ *  account never aborts the run.
+ *
+ *  The op=strays line is the standing signal. When a feature that reads an
+ *  account-root file goes dark, seeing that file named here says the schema does
+ *  not account for it and it is still on disk, so declare it. The absence of its
+ *  name reads as "gone" only for a file that could have been named at all: an
+ *  entry in PROTECTED_TOP_LEVEL, a dot-prefixed entry, and every entry of an
+ *  account whose SCHEMA.md is missing or has an empty allowed block are never
+ *  named whether they are present or not. Check the account root itself before
+ *  concluding a file is gone. */
 export function runReconcile(deps) {
-    const now = deps.now ?? (() => Date.now());
-    const total = { strayTopLevel: 0, overDeep: 0, quarantined: 0, badName: 0 };
+    const total = { strayTopLevel: 0, overDeep: 0, badName: 0 };
     let entries;
     try {
         entries = readdirSync(deps.accountsRoot);
@@ -278,10 +259,12 @@ export function runReconcile(deps) {
         if (!existsSync(join(accountDir, 'account.json')))
             continue;
         try {
-            const c = reconcileAccount(accountDir, now);
+            const c = reconcileAccount(accountDir);
+            if (c.strayNames.length > 0) {
+                deps.logger(`${TAG} op=strays account=${entry} names=${c.strayNames.join(',')}`);
+            }
             total.strayTopLevel += c.strayTopLevel;
             total.overDeep += c.overDeep;
-            total.quarantined += c.quarantined;
             total.badName += c.badName;
         }
         catch {