@rubytech/create-maxy-code 0.1.488 → 0.1.489

package/payload/platform/scripts/__tests__/quarantine-restore.test.sh

@@ -0,0 +1,143 @@
+#!/usr/bin/env bash
+# Tests the one-shot quarantine restore (Task 1899): a free target is moved back,
+# an occupied target is skipped with both copies surviving, an already-restored
+# entry reports absent, a malformed line reports unparsable, and --dry-run
+# changes nothing on disk.
+set -uo pipefail
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+RESTORE="$SCRIPT_DIR/../quarantine-restore.mjs"
+PASS=0; FAIL=0; FAILED=()
+assert_grep()   { if printf '%s' "$2" | grep -qF "$1"; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); FAILED+=("$3: expected to find [$1]"); fi; }
+assert_nogrep() { if printf '%s' "$2" | grep -qF "$1"; then FAIL=$((FAIL+1)); FAILED+=("$3: expected NOT to find [$1]"); else PASS=$((PASS+1)); fi; }
+assert_file()   { if [ -e "$1" ]; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); FAILED+=("$2: expected file [$1]"); fi; }
+assert_nofile() { if [ -e "$1" ]; then FAIL=$((FAIL+1)); FAILED+=("$2: expected NO file [$1]"); else PASS=$((PASS+1)); fi; }
+assert_eq()     { if [ "$1" = "$2" ]; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); FAILED+=("$3: expected [$2] got [$1]"); fi; }
+
+# One accounts root with a single account whose manifest covers all four cases.
+make_tree() {
+  local T; T="$(mktemp -d)"
+  local A="$T/acct-1"
+  mkdir -p "$A/.quarantine"
+  printf '{}' > "$A/account.json"
+
+  # (a) free target: quarantined copy exists, nothing at the root.
+  printf 'portal' > "$A/.quarantine/data-portal.json"
+  # (b) occupied target: quarantined copy AND a live copy the platform rewrote.
+  printf 'old' > "$A/.quarantine/wa-channel-bindings.json"
+  printf 'live' > "$A/wa-channel-bindings.json"
+  # (c) already restored by hand: manifest names a source that is gone.
+  printf 'restored' > "$A/session-titles.json"
+
+  cat > "$A/.quarantine/manifest.jsonl" <<'EOF'
+{"name":"data-portal.json","originalPath":"data-portal.json","reason":"top-level","quarantinePath":".quarantine/data-portal.json","movedAt":"2026-07-21T19:16:05.216Z"}
+{"name":"session-titles.json","originalPath":"session-titles.json","reason":"top-level","quarantinePath":".quarantine/session-titles.json","movedAt":"2026-07-21T19:20:00.000Z"}
+not json at all
+{"name":"wa-channel-bindings.json","originalPath":"wa-channel-bindings.json","reason":"top-level","quarantinePath":".quarantine/wa-channel-bindings.json","movedAt":"2026-07-21T20:45:00.000Z"}
+EOF
+  printf '%s' "$T"
+}
+
+# --- dry run changes nothing -------------------------------------------------
+T="$(make_tree)"; A="$T/acct-1"
+OUT="$(node "$RESTORE" --accounts-root "$T" --dry-run 2>&1)"
+assert_grep 'result=moved' "$OUT" "dry-run reports the move it would make"
+assert_grep 'dry-run=1' "$OUT" "dry-run marks its lines"
+assert_nofile "$A/data-portal.json" "dry-run leaves the root untouched"
+assert_file "$A/.quarantine/data-portal.json" "dry-run leaves the quarantined copy"
+assert_nofile "$A/.quarantine/restored.jsonl" "dry-run writes no restored.jsonl"
+rm -rf "$T"
+
+# --- real run ----------------------------------------------------------------
+T="$(make_tree)"; A="$T/acct-1"
+OUT="$(node "$RESTORE" --accounts-root "$T" 2>&1)"
+
+assert_grep 'op=restore account=acct-1 name=data-portal.json result=moved' "$OUT" "free target moved"
+assert_file "$A/data-portal.json" "free target is back at the root"
+assert_nofile "$A/.quarantine/data-portal.json" "free target no longer in quarantine"
+
+assert_grep 'name=wa-channel-bindings.json result=skipped-live-copy' "$OUT" "occupied target skipped"
+assert_grep 'live' "$(cat "$A/wa-channel-bindings.json")" "live copy still wins"
+assert_file "$A/.quarantine/wa-channel-bindings.json" "quarantined copy survives the skip"
+
+assert_grep 'name=session-titles.json result=absent' "$OUT" "already-restored source reports absent"
+assert_grep 'restored' "$(cat "$A/session-titles.json")" "hand-restored copy untouched"
+
+assert_grep 'line=3 result=unparsable' "$OUT" "malformed manifest line is reported"
+
+assert_file "$A/.quarantine/manifest.jsonl" "manifest is left intact"
+RESTORED="$(cat "$A/.quarantine/restored.jsonl")"
+assert_grep 'data-portal.json' "$RESTORED" "restored.jsonl records the move"
+assert_nogrep 'wa-channel-bindings.json' "$RESTORED" "restored.jsonl records only moves"
+assert_nogrep 'session-titles.json' "$RESTORED" "restored.jsonl records only moves"
+rm -rf "$T"
+
+# --- a name quarantined twice restores the NEWEST copy ------------------------
+# The sweep took wa-channel-bindings.json up to four times on one live account,
+# the platform rewriting it between each. The deleted quarantineDest() took the
+# unsuffixed name first and appended .1 to the next collision, so .1 IS the newer
+# copy. Walking the append-only manifest oldest-first would put the stalest copy
+# back, and the newer record would then find the target occupied.
+T="$(mktemp -d)"; A="$T/acct-2"
+mkdir -p "$A/.quarantine"
+printf '{}' > "$A/account.json"
+printf 'OLDER' > "$A/.quarantine/data-portal.json"
+printf 'NEWER' > "$A/.quarantine/data-portal.json.1"
+cat > "$A/.quarantine/manifest.jsonl" <<'EOF'
+{"name":"data-portal.json","originalPath":"data-portal.json","quarantinePath":".quarantine/data-portal.json","movedAt":"2026-07-21T19:16:05.216Z"}
+{"name":"data-portal.json","originalPath":"data-portal.json","quarantinePath":".quarantine/data-portal.json.1","movedAt":"2026-07-21T20:45:00.000Z"}
+EOF
+OUT="$(node "$RESTORE" --accounts-root "$T" 2>&1)"
+assert_grep 'NEWER' "$(cat "$A/data-portal.json")" "newest quarantined copy is the one restored"
+# The target was created by THIS run, not by a live platform rewrite. Calling it
+# skipped-live-copy would tell the operator the platform holds a current copy.
+assert_grep 'result=skipped-superseded' "$OUT" "the older copy is superseded, not live"
+assert_nogrep 'result=skipped-live-copy' "$OUT" "no live copy existed on this tree"
+assert_file "$A/.quarantine/data-portal.json" "the older copy is left in quarantine, never deleted"
+rm -rf "$T"
+
+# --- a record pointing outside its account is refused -------------------------
+# .quarantine is in the write guard's allowed-top-level set, so an account-scoped
+# agent can append to its own manifest. This script runs as the platform user
+# across every account, so an escaping path would move one account's live data
+# into another.
+T="$(mktemp -d)"
+mkdir -p "$T/acct-a/.quarantine" "$T/acct-b"
+printf '{}' > "$T/acct-a/account.json"
+printf '{}' > "$T/acct-b/account.json"
+printf 'LIVE' > "$T/acct-b/wa-channel-bindings.json"
+printf 'x' > "$T/acct-a/.quarantine/evil.json"
+cat > "$T/acct-a/.quarantine/manifest.jsonl" <<'EOF'
+{"name":"evil.json","originalPath":"../acct-b/planted.json","quarantinePath":".quarantine/evil.json"}
+{"name":"steal","originalPath":"stolen.json","quarantinePath":"../acct-b/wa-channel-bindings.json"}
+EOF
+OUT="$(node "$RESTORE" --accounts-root "$T" 2>&1)"; RC=$?
+assert_grep 'result=refused-outside-account' "$OUT" "escaping record is refused"
+assert_grep 'refused=2' "$OUT" "both escaping records are counted"
+assert_nofile "$T/acct-b/planted.json" "nothing is planted in the other account"
+assert_nofile "$T/acct-a/stolen.json" "nothing is stolen from the other account"
+assert_file "$T/acct-b/wa-channel-bindings.json" "the other account's live file is untouched"
+assert_eq "$RC" "1" "a refused record makes the run exit non-zero"
+rm -rf "$T"
+
+# --- a failed rename reaches the summary and the exit code --------------------
+# A restore that cannot complete leaves data in quarantine. The operator runs
+# this once and reads the tail line, so a clean summary with a silent stderr
+# line would be the same silent-skip failure this task exists to end.
+T="$(mktemp -d)"; A="$T/acct-3"
+mkdir -p "$A/.quarantine"
+printf '{}' > "$A/account.json"
+printf 'x' > "$A/.quarantine/orphan.json"
+# The target's parent bucket no longer exists, so the target itself is absent
+# (not a live copy) and the rename fails with ENOENT.
+cat > "$A/.quarantine/manifest.jsonl" <<'EOF'
+{"name":"orphan.json","originalPath":"gone-bucket/orphan.json","quarantinePath":".quarantine/orphan.json","movedAt":"2026-07-21T19:16:05.216Z"}
+EOF
+OUT="$(node "$RESTORE" --accounts-root "$T" 2>&1)"; RC=$?
+assert_grep 'result=failed' "$OUT" "the failed rename is reported"
+assert_grep 'failed=1' "$OUT" "the failure reaches the summary line"
+assert_eq "$RC" "1" "a failed restore makes the run exit non-zero"
+rm -rf "$T"
+
+# --- summary -----------------------------------------------------------------
+echo "PASS=$PASS FAIL=$FAIL"
+if [ "$FAIL" -gt 0 ]; then printf '%s\n' "${FAILED[@]}"; exit 1; fi

package/payload/platform/scripts/quarantine-restore.mjs

@@ -0,0 +1,175 @@
+#!/usr/bin/env node
+// Task 1899 — one-shot restore of everything the account-dir schema reconcile
+// moved into <account>/.quarantine/ before it was made report-only. The sweep's
+// allowed-list never matched what the platform and its agents write at an
+// account root, so it took live features and live data dark with no error: the
+// portal config, live signed agreements, the channel bindings.
+//
+// Per account it walks .quarantine/manifest.jsonl NEWEST-FIRST (the manifest is
+// append-only, so that is reverse file order). Newest-first is what makes the
+// occupied case correct for a name quarantined more than once: the most recent
+// copy is considered first, and every older copy of that name then finds the
+// target occupied. The live copy always wins, because the platform rewrote it
+// after the move — four wa-channel-bindings.json records on one account prove
+// that happened.
+//
+// Never deletes. The manifest is left intact so the history of what moved and
+// what came back both survive.
+//
+// Usage: node quarantine-restore.mjs --accounts-root <dir> [--dry-run]
+
+import { existsSync, readdirSync, readFileSync, renameSync, appendFileSync } from 'node:fs'
+import { join, resolve, sep } from 'node:path'
+
+const TAG = '[quarantine-restore]'
+const QUARANTINE_DIR = '.quarantine'
+
+/** True when `path` is `root` itself or lives underneath it. Both arguments must
+ *  already be absolute. */
+function isInside(root, path) {
+  return path === root || path.startsWith(root + sep)
+}
+
+function parseArgs(argv) {
+  let accountsRoot = null
+  let dryRun = false
+  for (let i = 0; i < argv.length; i++) {
+    if (argv[i] === '--accounts-root') {
+      accountsRoot = argv[i + 1] ?? null
+      i++
+    } else if (argv[i] === '--dry-run') {
+      dryRun = true
+    }
+  }
+  return { accountsRoot, dryRun }
+}
+
+const { accountsRoot, dryRun } = parseArgs(process.argv.slice(2))
+if (!accountsRoot) {
+  console.error(`${TAG} usage: quarantine-restore.mjs --accounts-root <dir> [--dry-run]`)
+  process.exit(1)
+}
+if (!existsSync(accountsRoot)) {
+  console.error(`${TAG} accounts root not found: ${accountsRoot}`)
+  process.exit(1)
+}
+
+const suffix = dryRun ? ' dry-run=1' : ''
+const totals = {
+  moved: 0,
+  'skipped-live-copy': 0,
+  'skipped-superseded': 0,
+  absent: 0,
+  unparsable: 0,
+  refused: 0,
+  failed: 0,
+}
+let accounts = 0
+
+for (const entry of readdirSync(accountsRoot)) {
+  const accountDir = join(accountsRoot, entry)
+  const accountRoot = resolve(accountDir)
+  const quarantineRoot = resolve(accountDir, QUARANTINE_DIR)
+  const manifestPath = join(accountDir, QUARANTINE_DIR, 'manifest.jsonl')
+  if (!existsSync(manifestPath)) continue
+  accounts++
+
+  // Names this run put back at the account root. A later record naming one of
+  // them found the target occupied by THIS run, not by a live copy the platform
+  // rewrote — two different states that must not share one outcome label.
+  const restoredThisRun = new Set()
+
+  let lines
+  try {
+    lines = readFileSync(manifestPath, 'utf-8').split('\n')
+  } catch (err) {
+    totals.failed++
+    console.error(
+      `${TAG} op=restore account=${entry} result=manifest-unreadable error=${err.message}`,
+    )
+    continue
+  }
+
+  // Newest-first: the manifest is append-only, so walk it backwards. The 1-based
+  // file line number is carried so an unparsable line can be pointed at.
+  const numbered = lines.map((text, i) => ({ text, lineNo: i + 1 })).filter((l) => l.text.trim())
+  for (const { text, lineNo } of numbered.reverse()) {
+    let rec
+    try {
+      rec = JSON.parse(text)
+    } catch {
+      rec = null
+    }
+    if (!rec || typeof rec.originalPath !== 'string' || typeof rec.quarantinePath !== 'string') {
+      // Reported, never silently skipped: a line dropped without a word is the
+      // exact failure class this task exists to end.
+      totals.unparsable++
+      console.log(`${TAG} op=restore account=${entry} line=${lineNo} result=unparsable${suffix}`)
+      continue
+    }
+
+    const source = resolve(accountDir, rec.quarantinePath)
+    const target = resolve(accountDir, rec.originalPath)
+    const name = rec.originalPath
+
+    // The manifest is a file inside the account, and .quarantine is in the write
+    // guard's allowed-top-level set, so an account-scoped agent can append to it.
+    // This script runs as the platform user across every account, so a record
+    // whose paths escape the account would move one account's live data into
+    // another. Every record the reconcile ever wrote was a bare basename plus a
+    // path under .quarantine/, so this refuses nothing genuine.
+    if (!isInside(quarantineRoot, source) || !isInside(accountRoot, target)) {
+      totals.refused++
+      console.error(
+        `${TAG} op=restore account=${entry} line=${lineNo} result=refused-outside-account${suffix}`,
+      )
+      continue
+    }
+
+    if (!existsSync(source)) {
+      totals.absent++
+      console.log(`${TAG} op=restore account=${entry} name=${name} result=absent${suffix}`)
+      continue
+    }
+    if (existsSync(target) || restoredThisRun.has(target)) {
+      // A target this run created is superseded, not live. Calling both
+      // skipped-live-copy would tell the operator the platform holds a current
+      // copy when what is really left is an older copy still in quarantine.
+      const outcome = restoredThisRun.has(target) ? 'skipped-superseded' : 'skipped-live-copy'
+      totals[outcome]++
+      console.log(`${TAG} op=restore account=${entry} name=${name} result=${outcome}${suffix}`)
+      continue
+    }
+
+    if (dryRun) {
+      totals.moved++
+      restoredThisRun.add(target)
+      console.log(`${TAG} op=restore account=${entry} name=${name} result=moved${suffix}`)
+      continue
+    }
+    try {
+      renameSync(source, target)
+      appendFileSync(
+        join(accountDir, QUARANTINE_DIR, 'restored.jsonl'),
+        JSON.stringify({ ...rec, restoredAt: new Date().toISOString() }) + '\n',
+      )
+      totals.moved++
+      restoredThisRun.add(target)
+      console.log(`${TAG} op=restore account=${entry} name=${name} result=moved`)
+    } catch (err) {
+      totals.failed++
+      console.error(
+        `${TAG} op=restore account=${entry} name=${name} result=failed error=${err.message}`,
+      )
+    }
+  }
+}
+
+console.log(
+  `${TAG} accounts=${accounts} moved=${totals.moved} skipped-live-copy=${totals['skipped-live-copy']} skipped-superseded=${totals['skipped-superseded']} absent=${totals.absent} unparsable=${totals.unparsable} refused=${totals.refused} failed=${totals.failed}${suffix}`,
+)
+
+// A rename that failed, a manifest that would not open, and a record refused for
+// pointing outside its account all leave data in quarantine. The operator runs
+// this once and reads the tail line, so the exit code has to say so too.
+if (totals.failed > 0 || totals.refused > 0) process.exitCode = 1

package/payload/platform/services/claude-session-manager/dist/account-dir-schema-reconcile.d.ts

@@ -1,9 +1,17 @@
 export interface ReconcileCounts {
     strayTopLevel: number;
     overDeep: number;
-    quarantined: number;
     badName: number;
 }
+export interface ReconcileResult extends ReconcileCounts {
+    /** The account-root entries counted as strays, by name — the same set
+     *  strayTopLevel counts, so PROTECTED_TOP_LEVEL entries and dot-prefixed
+     *  entries are absent from it, and an account that failed the SCHEMA.md
+     *  fail-open check returns it empty. A count alone cannot distinguish six
+     *  pieces of debris from a live plugin config; this list is what makes the
+     *  report-only posture actionable. */
+    strayNames: string[];
+}
 /** The single per-run summary line body. A non-zero count is the standing signal
  *  that an agent authored folders the hard guards could not prevent. Pure
  *  formatter so the emitter and its test share one wording. */
@@ -14,18 +22,27 @@ export declare function formatReconcileLine(c: ReconcileCounts): string;
 export declare function parseAllowedTopLevel(schemaText: string): Set<string>;
 /** Reconcile one account dir. Reads its SCHEMA.md allowed set; an absent/empty
  *  set skips the account (fail open, like the hook — an un-seeded legacy account
- *  must not have its whole root quarantined). Moves stray top-level entries to
- *  .quarantine/ with a manifest line; counts over-deep files without moving. */
-export declare function reconcileAccount(accountDir: string, now: () => number): ReconcileCounts;
+ *  must not have its whole root reported as stray). Counts and names stray
+ *  top-level entries; counts over-deep files and bad names. Moves nothing. */
+export declare function reconcileAccount(accountDir: string): ReconcileResult;
 export interface ReconcileDeps {
     accountsRoot: string;
     logger: (line: string) => void;
-    now?: () => number;
 }
-/** One reconcile pass over every account under the accounts root, then emit the
+/** One reconcile pass over every account under the accounts root: one op=strays
+ *  line naming the unaccounted-for entries of each account that has any, then the
  *  single summary line. An account is any child dir with an account.json (the
  *  account marker the census uses). Per-account errors are swallowed so one bad
- *  account never aborts the run. */
+ *  account never aborts the run.
+ *
+ *  The op=strays line is the standing signal. When a feature that reads an
+ *  account-root file goes dark, seeing that file named here says the schema does
+ *  not account for it and it is still on disk, so declare it. The absence of its
+ *  name reads as "gone" only for a file that could have been named at all: an
+ *  entry in PROTECTED_TOP_LEVEL, a dot-prefixed entry, and every entry of an
+ *  account whose SCHEMA.md is missing or has an empty allowed block are never
+ *  named whether they are present or not. Check the account root itself before
+ *  concluding a file is gone. */
 export declare function runReconcile(deps: ReconcileDeps): void;
 export interface AccountDirSchemaReconcile {
     start(): void;

package/payload/platform/services/claude-session-manager/dist/account-dir-schema-reconcile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account-dir-schema-reconcile.d.ts","sourceRoot":"","sources":["../src/account-dir-schema-reconcile.ts"],"names":[],"mappings":"AA2FA,MAAM,WAAW,eAAe;IAC9B,aAAa,EAAE,MAAM,CAAA;IACrB,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,OAAO,EAAE,MAAM,CAAA;CAChB;AAED;;+DAE+D;AAC/D,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,eAAe,GAAG,MAAM,CAE9D;AAED;;8EAE8E;AAC9E,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAcpE;AA0FD;;;gFAGgF;AAChF,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,MAAM,GAAG,eAAe,CA6DvF;AAED,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IAC9B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CACnB;AAED;;;oCAGoC;AACpC,wBAAgB,YAAY,CAAC,IAAI,EAAE,aAAa,GAAG,IAAI,CAwBtD;AAED,MAAM,WAAW,yBAAyB;IACxC,KAAK,IAAI,IAAI,CAAA;IACb,IAAI,IAAI,IAAI,CAAA;CACb;AAED;oDACoD;AACpD,wBAAgB,+BAA+B,CAC7C,IAAI,EAAE,aAAa,GAAG;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,GAC3C,yBAAyB,CAiB3B"}
+{"version":3,"file":"account-dir-schema-reconcile.d.ts","sourceRoot":"","sources":["../src/account-dir-schema-reconcile.ts"],"names":[],"mappings":"AAqFA,MAAM,WAAW,eAAe;IAC9B,aAAa,EAAE,MAAM,CAAA;IACrB,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,eAAgB,SAAQ,eAAe;IACtD;;;;;0CAKsC;IACtC,UAAU,EAAE,MAAM,EAAE,CAAA;CACrB;AAED;;+DAE+D;AAC/D,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,eAAe,GAAG,MAAM,CAE9D;AAED;;8EAE8E;AAC9E,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAcpE;AA+ED;;;8EAG8E;AAC9E,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,eAAe,CAoCpE;AAED,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;CAC/B;AAED;;;;;;;;;;;;;iCAaiC;AACjC,wBAAgB,YAAY,CAAC,IAAI,EAAE,aAAa,GAAG,IAAI,CAyBtD;AAED,MAAM,WAAW,yBAAyB;IACxC,KAAK,IAAI,IAAI,CAAA;IACb,IAAI,IAAI,IAAI,CAAA;CACb;AAED;oDACoD;AACpD,wBAAgB,+BAA+B,CAC7C,IAAI,EAAE,aAAa,GAAG;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,GAC3C,yBAAyB,CAiB3B"}

package/payload/platform/services/claude-session-manager/dist/account-dir-schema-reconcile.js

@@ -11,43 +11,45 @@
 // the flat operator-data buckets, mirroring fs-schema-guard.sh's own depth rule
 // exactly (projects/contacts/documents cap at 3 path segments; every other
 // tool-owned bucket is unbounded and not walked), and (c) bad-named folders and
-// files under those same buckets, mirroring the guard's name convention. Stray
-// top-level entries are QUARANTINED (moved to <account>/.quarantine/ with a
-// manifest recording the original path, reason, and quarantine path so the move
-// is auditable and reversible); over-deep files and bad names are counted only.
-// Nothing is deleted, nothing is silently rewritten, and re-filing quarantined
-// content or renaming a bad name to its schema-correct home is the data-manager
-// specialist's job on dispatch, not this pass.
+// files under those same buckets, mirroring the guard's name convention. All
+// three are REPORTED, never moved: the pass used to quarantine stray top-level
+// entries, and because its allowed-list lagged what the platform and its agents
+// actually write at an account root, a mismatch on an entry something still read
+// took that feature or that data dark with no error anywhere (Task 1899 — the
+// portal config, live signed agreements and the channel bindings all went for
+// exactly that reason). Nothing is moved, nothing is
+// deleted, nothing is silently rewritten; re-filing a stray to its schema-correct
+// home is the data-manager specialist's job on dispatch, not this pass.
 //
 // Shape mirrors the standing-audit family (rootless-client-audit.ts): a pure
 // formatter (unit-tested) + an impure per-account collector + a start/stop
 // factory whose setInterval is unref'd. Purely filesystem — no Neo4j, no graph
 // writes, no deletes. Best-effort by construction: a per-account error is caught
 // so one bad account never aborts the run.
-import { existsSync, mkdirSync, readdirSync, readFileSync, renameSync, appendFileSync, statSync, } from 'node:fs';
+import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs';
 import { join, relative, sep } from 'node:path';
 const TAG = '[fs-reconcile]';
 const QUARANTINE_DIR = '.quarantine';
-/** Platform control-plane entries the reconcile NEVER quarantines, regardless of
- *  what an account's SCHEMA.md allowed set says. provision-account-dir.sh makes
+/** Platform control-plane entries the reconcile NEVER counts as strays, regardless
+ *  of what an account's SCHEMA.md allowed set says. provision-account-dir.sh makes
  *  the account dir a git root (`.git`) and writes its hook-enforcement settings
- *  into `.claude/`, and the account's identity lives in account.json; moving any
- *  of these into .quarantine would brick the account (lost git root, disabled
- *  hooks, unresolvable identity). SCHEMA.md is refreshed on every provision, but
- *  an account carrying a stale/older-template/hand-edited schema whose allowed
- *  block omits one of these must not have it moved. This is a fail-SAFE belt on
- *  the control plane, the mirror of the guard's fail-OPEN on a missing schema —
- *  operator strays are still quarantined; the account's own machinery is not.
+ *  into `.claude/`, and the account's identity lives in account.json. SCHEMA.md is
+ *  refreshed on every provision, but an account carrying a stale/older-template/
+ *  hand-edited schema whose allowed block omits one of these must not be reported
+ *  on every run for machinery it is required to have.
  *
  *  The second group is platform-written control-plane FILES the platform reads
  *  and writes at the account root every run. Unlike the tool-owned buckets, no
- *  plugin declares them into the SCHEMA.md allowed-top-level block, so without
- *  this belt the sweep quarantines them and the feature that reads each one goes
- *  dark: calendar-availability.json is the booking page's availability config (a
- *  quarantine froze a live booking page, Task 1877 fix); wa/webchat/telegram
- *  -channel-bindings.json route each channel's inbound; canonical-webchat-session
- *  .json pins the webchat session; session-titles.json holds operator renames.
- *  Each is `join(accountDir, <name>)` in platform code, none is operator data. */
+ *  plugin declares them into the SCHEMA.md allowed-top-level block: calendar-
+ *  availability.json is the booking page's availability config (quarantining it
+ *  froze a live booking page, Task 1877 fix); wa/webchat/telegram-channel-
+ *  bindings.json route each channel's inbound; canonical-webchat-session.json
+ *  pins the webchat session; session-titles.json holds operator renames. Each is
+ *  `join(accountDir, <name>)` in platform code, none is operator data.
+ *
+ *  Since Task 1899 this belt no longer protects anything from being moved,
+ *  because nothing moves. It keeps the account's own machinery out of the stray
+ *  count so the standing op=strays line names only what an operator must act on. */
 const PROTECTED_TOP_LEVEL = new Set([
     '.git',
     '.claude',
@@ -79,7 +81,7 @@ const FILE_NAME_RE = /^[a-z0-9-]+(\.[a-z0-9-]+)*$/;
  *  that an agent authored folders the hard guards could not prevent. Pure
  *  formatter so the emitter and its test share one wording. */
 export function formatReconcileLine(c) {
-    return `${TAG} stray-top-level=${c.strayTopLevel} over-deep=${c.overDeep} quarantined=${c.quarantined} bad-name=${c.badName}`;
+    return `${TAG} stray-top-level=${c.strayTopLevel} over-deep=${c.overDeep} bad-name=${c.badName}`;
 }
 /** Parse the fenced ```allowed-top-level block from an account's SCHEMA.md —
  *  the same structured set fs-schema-guard.sh parses with awk. Returns the
@@ -189,22 +191,12 @@ function countBadNameEntries(accountDir, bucket) {
     walk(bucketRoot);
     return count;
 }
-/** Pick a non-colliding destination name inside .quarantine for a stray. */
-function quarantineDest(quarantineRoot, name) {
-    let candidate = join(quarantineRoot, name);
-    let n = 1;
-    while (existsSync(candidate)) {
-        candidate = join(quarantineRoot, `${name}.${n}`);
-        n++;
-    }
-    return candidate;
-}
 /** Reconcile one account dir. Reads its SCHEMA.md allowed set; an absent/empty
  *  set skips the account (fail open, like the hook — an un-seeded legacy account
- *  must not have its whole root quarantined). Moves stray top-level entries to
- *  .quarantine/ with a manifest line; counts over-deep files without moving. */
-export function reconcileAccount(accountDir, now) {
-    const empty = { strayTopLevel: 0, overDeep: 0, quarantined: 0, badName: 0 };
+ *  must not have its whole root reported as stray). Counts and names stray
+ *  top-level entries; counts over-deep files and bad names. Moves nothing. */
+export function reconcileAccount(accountDir) {
+    const empty = { strayTopLevel: 0, overDeep: 0, badName: 0, strayNames: [] };
     const schemaPath = join(accountDir, 'SCHEMA.md');
     if (!existsSync(schemaPath))
         return empty;
@@ -226,50 +218,34 @@ export function reconcileAccount(accountDir, now) {
     }
     // A dot-prefixed top-level entry is tool/system state, never operator data —
     // the same judgement countBadNameEntries applies when it skips dotfiles. The
-    // stray check must agree, or it quarantines .remember/.superpowers/.wrangler
-    // and breaks the tool that owns each (Task 1891). .git/.claude/.quarantine
-    // stay covered by PROTECTED_TOP_LEVEL regardless.
+    // stray check must agree, or it reports .remember/.superpowers/.wrangler on
+    // every run (Task 1891). .git/.claude/.quarantine stay covered by
+    // PROTECTED_TOP_LEVEL regardless.
     const strays = rootEntries.filter((name) => !name.startsWith('.') && !PROTECTED_TOP_LEVEL.has(name) && !allowed.has(name));
-    let quarantined = 0;
-    if (strays.length > 0) {
-        const quarantineRoot = join(accountDir, QUARANTINE_DIR);
-        const manifestPath = join(quarantineRoot, 'manifest.jsonl');
-        for (const name of strays) {
-            try {
-                mkdirSync(quarantineRoot, { recursive: true });
-                const dest = quarantineDest(quarantineRoot, name);
-                renameSync(join(accountDir, name), dest);
-                const record = {
-                    name,
-                    originalPath: name,
-                    reason: 'top-level',
-                    quarantinePath: relative(accountDir, dest),
-                    movedAt: new Date(now()).toISOString(),
-                };
-                appendFileSync(manifestPath, JSON.stringify(record) + '\n');
-                quarantined++;
-            }
-            catch {
-                // Move failed (permissions, race). Counted as a detected stray below,
-                // not as quarantined — the summary line stays honest.
-            }
-        }
-    }
     let overDeep = 0;
     let badName = 0;
     for (const bucket of DEPTH_CHECKED_BUCKETS) {
         overDeep += countOverDeepFiles(accountDir, bucket);
         badName += countBadNameEntries(accountDir, bucket);
     }
-    return { strayTopLevel: strays.length, overDeep, quarantined, badName };
+    return { strayTopLevel: strays.length, overDeep, badName, strayNames: strays };
 }
-/** One reconcile pass over every account under the accounts root, then emit the
+/** One reconcile pass over every account under the accounts root: one op=strays
+ *  line naming the unaccounted-for entries of each account that has any, then the
  *  single summary line. An account is any child dir with an account.json (the
  *  account marker the census uses). Per-account errors are swallowed so one bad
- *  account never aborts the run. */
+ *  account never aborts the run.
+ *
+ *  The op=strays line is the standing signal. When a feature that reads an
+ *  account-root file goes dark, seeing that file named here says the schema does
+ *  not account for it and it is still on disk, so declare it. The absence of its
+ *  name reads as "gone" only for a file that could have been named at all: an
+ *  entry in PROTECTED_TOP_LEVEL, a dot-prefixed entry, and every entry of an
+ *  account whose SCHEMA.md is missing or has an empty allowed block are never
+ *  named whether they are present or not. Check the account root itself before
+ *  concluding a file is gone. */
 export function runReconcile(deps) {
-    const now = deps.now ?? (() => Date.now());
-    const total = { strayTopLevel: 0, overDeep: 0, quarantined: 0, badName: 0 };
+    const total = { strayTopLevel: 0, overDeep: 0, badName: 0 };
     let entries;
     try {
         entries = readdirSync(deps.accountsRoot);
@@ -283,10 +259,12 @@ export function runReconcile(deps) {
         if (!existsSync(join(accountDir, 'account.json')))
             continue;
         try {
-            const c = reconcileAccount(accountDir, now);
+            const c = reconcileAccount(accountDir);
+            if (c.strayNames.length > 0) {
+                deps.logger(`${TAG} op=strays account=${entry} names=${c.strayNames.join(',')}`);
+            }
             total.strayTopLevel += c.strayTopLevel;
             total.overDeep += c.overDeep;
-            total.quarantined += c.quarantined;
             total.badName += c.badName;
         }
         catch {

package/payload/platform/services/claude-session-manager/dist/account-dir-schema-reconcile.js.map

@@ -1 +1 @@
-{"version":3,"file":"account-dir-schema-reconcile.js","sourceRoot":"","sources":["../src/account-dir-schema-reconcile.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,gFAAgF;AAChF,8EAA8E;AAC9E,iFAAiF;AACjF,iFAAiF;AACjF,kFAAkF;AAClF,kDAAkD;AAClD,EAAE;AACF,iFAAiF;AACjF,gFAAgF;AAChF,gFAAgF;AAChF,2EAA2E;AAC3E,gFAAgF;AAChF,+EAA+E;AAC/E,4EAA4E;AAC5E,gFAAgF;AAChF,gFAAgF;AAChF,+EAA+E;AAC/E,gFAAgF;AAChF,+CAA+C;AAC/C,EAAE;AACF,6EAA6E;AAC7E,2EAA2E;AAC3E,+EAA+E;AAC/E,iFAAiF;AACjF,2CAA2C;AAE3C,OAAO,EACL,UAAU,EACV,SAAS,EACT,WAAW,EACX,YAAY,EACZ,UAAU,EACV,cAAc,EACd,QAAQ,GACT,MAAM,SAAS,CAAA;AAChB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AAE/C,MAAM,GAAG,GAAG,gBAAgB,CAAA;AAC5B,MAAM,cAAc,GAAG,aAAa,CAAA;AAEpC;;;;;;;;;;;;;;;;;;;kFAmBkF;AAClF,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,MAAM;IACN,SAAS;IACT,cAAc;IACd,WAAW;IACX,cAAc;IACd,WAAW;IACX,4BAA4B;IAC5B,0BAA0B;IAC1B,+BAA+B;IAC/B,gCAAgC;IAChC,gCAAgC;IAChC,qBAAqB;CACtB,CAAC,CAAA;AAEF;;;uBAGuB;AACvB,MAAM,qBAAqB,GAAG,CAAC,UAAU,EAAE,UAAU,EAAE,WAAW,CAAC,CAAA;AACnE,MAAM,gBAAgB,GAAG,CAAC,CAAA;AAE1B;;;;4DAI4D;AAC5D,MAAM,cAAc,GAAG,cAAc,CAAA;AACrC,MAAM,YAAY,GAAG,6BAA6B,CAAA;AASlD;;+DAE+D;AAC/D,MAAM,UAAU,mBAAmB,CAAC,CAAkB;IACpD,OAAO,GAAG,GAAG,oBAAoB,CAAC,CAAC,aAAa,cAAc,CAAC,CAAC,QAAQ,gBAAgB,CAAC,CAAC,WAAW,aAAa,CAAC,CAAC,OAAO,EAAE,CAAA;AAC/H,CAAC;AAED;;8EAE8E;AAC9E,MAAM,UAAU,oBAAoB,CAAC,UAAkB;IACrD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACpC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAA;IAC7B,IAAI,OAAO,GAAG,KAAK,CAAA;IACnB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QACrB,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,IAAI,CAAC,KAAK,sBAAsB;gBAAE,OAAO,GAAG,IAAI,CAAA;YAChD,SAAQ;QACV,CAAC;QACD,IAAI,CAAC,KAAK,KAAK;YAAE,MAAK;QACtB,IAAI,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;IACnB,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;oDAGoD;AACpD,SAAS,kBAAkB,CAAC,UAAkB,EAAE,MAAc;IAC5D,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAA;IAC3C,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,CAAC,CAAA;IACrC,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,MAAM,IAAI,GAAG,CAAC,GAAW,EAAQ,EAAE;QACjC,IAAI,OAAiB,CAAA;QACrB,IAAI,CAAC;YACH,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,OAAM;QACR,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;YAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;YAC5B,IAAI,EAAE,CAAA;YACN,IAAI,CAAC;gBACH,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAA;YACrB,CAAC;YAAC,MAAM,CAAC;gBACP,SAAQ;YACV,CAAC;YACD,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;gBACrB,IAAI,CAAC,IAAI,CAAC,CAAA;YACZ,CAAC;iBAAM,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC;gBACvB,MAAM,GAAG,GAAG,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;gBACtC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAA;gBACnC,IAAI,KAAK,GAAG,gBAAgB;oBAAE,KAAK,EAAE,CAAA;YACvC,CAAC;QACH,CAAC;IACH,CAAC,CAAA;IACD,IAAI,CAAC,UAAU,CAAC,CAAA;IAChB,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;uCAMuC;AACvC,SAAS,mBAAmB,CAAC,UAAkB,EAAE,MAAc;IAC7D,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAA;IAC3C,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,CAAC,CAAA;IACrC,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,MAAM,IAAI,GAAG,CAAC,GAAW,EAAQ,EAAE;QACjC,IAAI,OAAiB,CAAA;QACrB,IAAI,CAAC;YACH,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,OAAM;QACR,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;YAC3B,uEAAuE;YACvE,uEAAuE;YACvE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,SAAQ;YAClC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;YAC5B,IAAI,EAAE,CAAA;YACN,IAAI,CAAC;gBACH,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAA;YACrB,CAAC;YAAC,MAAM,CAAC;gBACP,SAAQ;YACV,CAAC;YACD,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;gBACrB,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;oBAAE,KAAK,EAAE,CAAA;gBACvC,IAAI,CAAC,IAAI,CAAC,CAAA;YACZ,CAAC;iBAAM,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC;gBACvB,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;oBAAE,KAAK,EAAE,CAAA;YACvC,CAAC;QACH,CAAC;IACH,CAAC,CAAA;IACD,IAAI,CAAC,UAAU,CAAC,CAAA;IAChB,OAAO,KAAK,CAAA;AACd,CAAC;AAED,4EAA4E;AAC5E,SAAS,cAAc,CAAC,cAAsB,EAAE,IAAY;IAC1D,IAAI,SAAS,GAAG,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,CAAA;IAC1C,IAAI,CAAC,GAAG,CAAC,CAAA;IACT,OAAO,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,SAAS,GAAG,IAAI,CAAC,cAAc,EAAE,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC,CAAA;QAChD,CAAC,EAAE,CAAA;IACL,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;gFAGgF;AAChF,MAAM,UAAU,gBAAgB,CAAC,UAAkB,EAAE,GAAiB;IACpE,MAAM,KAAK,GAAoB,EAAE,aAAa,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAA;IAC5F,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAA;IAChD,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,KAAK,CAAA;IACzC,IAAI,OAAoB,CAAA;IACxB,IAAI,CAAC;QACH,OAAO,GAAG,oBAAoB,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAA;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IAEpC,IAAI,WAAqB,CAAA;IACzB,IAAI,CAAC;QACH,WAAW,GAAG,WAAW,CAAC,UAAU,CAAC,CAAA;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;IAED,6EAA6E;IAC7E,6EAA6E;IAC7E,6EAA6E;IAC7E,2EAA2E;IAC3E,kDAAkD;IAClD,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAC/B,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CACxF,CAAA;IAED,IAAI,WAAW,GAAG,CAAC,CAAA;IACnB,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,CAAA;QACvD,MAAM,YAAY,GAAG,IAAI,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAA;QAC3D,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;YAC1B,IAAI,CAAC;gBACH,SAAS,CAAC,cAAc,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;gBAC9C,MAAM,IAAI,GAAG,cAAc,CAAC,cAAc,EAAE,IAAI,CAAC,CAAA;gBACjD,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,CAAA;gBACxC,MAAM,MAAM,GAAG;oBACb,IAAI;oBACJ,YAAY,EAAE,IAAI;oBAClB,MAAM,EAAE,WAAW;oBACnB,cAAc,EAAE,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC;oBAC1C,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE;iBACvC,CAAA;gBACD,cAAc,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAA;gBAC3D,WAAW,EAAE,CAAA;YACf,CAAC;YAAC,MAAM,CAAC;gBACP,sEAAsE;gBACtE,sDAAsD;YACxD,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,GAAG,CAAC,CAAA;IAChB,IAAI,OAAO,GAAG,CAAC,CAAA;IACf,KAAK,MAAM,MAAM,IAAI,qBAAqB,EAAE,CAAC;QAC3C,QAAQ,IAAI,kBAAkB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAA;QAClD,OAAO,IAAI,mBAAmB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAA;IACpD,CAAC;IAED,OAAO,EAAE,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,CAAA;AACzE,CAAC;AAQD;;;oCAGoC;AACpC,MAAM,UAAU,YAAY,CAAC,IAAmB;IAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;IAC1C,MAAM,KAAK,GAAoB,EAAE,aAAa,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAA;IAC5F,IAAI,OAAiB,CAAA;IACrB,IAAI,CAAC;QACH,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAA;QACvC,OAAM;IACR,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAA;QACjD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;YAAE,SAAQ;QAC3D,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,gBAAgB,CAAC,UAAU,EAAE,GAAG,CAAC,CAAA;YAC3C,KAAK,CAAC,aAAa,IAAI,CAAC,CAAC,aAAa,CAAA;YACtC,KAAK,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAA;YAC5B,KAAK,CAAC,WAAW,IAAI,CAAC,CAAC,WAAW,CAAA;YAClC,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,CAAA;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,wDAAwD;QAC1D,CAAC;IACH,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAA;AACzC,CAAC;AAOD;oDACoD;AACpD,MAAM,UAAU,+BAA+B,CAC7C,IAA4C;IAE5C,IAAI,KAAK,GAA0B,IAAI,CAAA;IACvC,OAAO;QACL,KAAK;YACH,IAAI,KAAK;gBAAE,OAAM;YACjB,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;gBACvB,YAAY,CAAC,IAAI,CAAC,CAAA;YACpB,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;YACnB,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,UAAU;gBAAE,KAAK,CAAC,KAAK,EAAE,CAAA;QACtD,CAAC;QACD,IAAI;YACF,IAAI,KAAK,EAAE,CAAC;gBACV,aAAa,CAAC,KAAK,CAAC,CAAA;gBACpB,KAAK,GAAG,IAAI,CAAA;YACd,CAAC;QACH,CAAC;KACF,CAAA;AACH,CAAC"}
+{"version":3,"file":"account-dir-schema-reconcile.js","sourceRoot":"","sources":["../src/account-dir-schema-reconcile.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,gFAAgF;AAChF,8EAA8E;AAC9E,iFAAiF;AACjF,iFAAiF;AACjF,kFAAkF;AAClF,kDAAkD;AAClD,EAAE;AACF,iFAAiF;AACjF,gFAAgF;AAChF,gFAAgF;AAChF,2EAA2E;AAC3E,gFAAgF;AAChF,6EAA6E;AAC7E,+EAA+E;AAC/E,gFAAgF;AAChF,iFAAiF;AACjF,8EAA8E;AAC9E,8EAA8E;AAC9E,qDAAqD;AACrD,kFAAkF;AAClF,wEAAwE;AACxE,EAAE;AACF,6EAA6E;AAC7E,2EAA2E;AAC3E,+EAA+E;AAC/E,iFAAiF;AACjF,2CAA2C;AAE3C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AACzE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AAE/C,MAAM,GAAG,GAAG,gBAAgB,CAAA;AAC5B,MAAM,cAAc,GAAG,aAAa,CAAA;AAEpC;;;;;;;;;;;;;;;;;;;oFAmBoF;AACpF,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,MAAM;IACN,SAAS;IACT,cAAc;IACd,WAAW;IACX,cAAc;IACd,WAAW;IACX,4BAA4B;IAC5B,0BAA0B;IAC1B,+BAA+B;IAC/B,gCAAgC;IAChC,gCAAgC;IAChC,qBAAqB;CACtB,CAAC,CAAA;AAEF;;;uBAGuB;AACvB,MAAM,qBAAqB,GAAG,CAAC,UAAU,EAAE,UAAU,EAAE,WAAW,CAAC,CAAA;AACnE,MAAM,gBAAgB,GAAG,CAAC,CAAA;AAE1B;;;;4DAI4D;AAC5D,MAAM,cAAc,GAAG,cAAc,CAAA;AACrC,MAAM,YAAY,GAAG,6BAA6B,CAAA;AAkBlD;;+DAE+D;AAC/D,MAAM,UAAU,mBAAmB,CAAC,CAAkB;IACpD,OAAO,GAAG,GAAG,oBAAoB,CAAC,CAAC,aAAa,cAAc,CAAC,CAAC,QAAQ,aAAa,CAAC,CAAC,OAAO,EAAE,CAAA;AAClG,CAAC;AAED;;8EAE8E;AAC9E,MAAM,UAAU,oBAAoB,CAAC,UAAkB;IACrD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACpC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAA;IAC7B,IAAI,OAAO,GAAG,KAAK,CAAA;IACnB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QACrB,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,IAAI,CAAC,KAAK,sBAAsB;gBAAE,OAAO,GAAG,IAAI,CAAA;YAChD,SAAQ;QACV,CAAC;QACD,IAAI,CAAC,KAAK,KAAK;YAAE,MAAK;QACtB,IAAI,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;IACnB,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;oDAGoD;AACpD,SAAS,kBAAkB,CAAC,UAAkB,EAAE,MAAc;IAC5D,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAA;IAC3C,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,CAAC,CAAA;IACrC,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,MAAM,IAAI,GAAG,CAAC,GAAW,EAAQ,EAAE;QACjC,IAAI,OAAiB,CAAA;QACrB,IAAI,CAAC;YACH,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,OAAM;QACR,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;YAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;YAC5B,IAAI,EAAE,CAAA;YACN,IAAI,CAAC;gBACH,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAA;YACrB,CAAC;YAAC,MAAM,CAAC;gBACP,SAAQ;YACV,CAAC;YACD,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;gBACrB,IAAI,CAAC,IAAI,CAAC,CAAA;YACZ,CAAC;iBAAM,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC;gBACvB,MAAM,GAAG,GAAG,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;gBACtC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAA;gBACnC,IAAI,KAAK,GAAG,gBAAgB;oBAAE,KAAK,EAAE,CAAA;YACvC,CAAC;QACH,CAAC;IACH,CAAC,CAAA;IACD,IAAI,CAAC,UAAU,CAAC,CAAA;IAChB,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;uCAMuC;AACvC,SAAS,mBAAmB,CAAC,UAAkB,EAAE,MAAc;IAC7D,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAA;IAC3C,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,CAAC,CAAA;IACrC,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,MAAM,IAAI,GAAG,CAAC,GAAW,EAAQ,EAAE;QACjC,IAAI,OAAiB,CAAA;QACrB,IAAI,CAAC;YACH,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,OAAM;QACR,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;YAC3B,uEAAuE;YACvE,uEAAuE;YACvE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,SAAQ;YAClC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;YAC5B,IAAI,EAAE,CAAA;YACN,IAAI,CAAC;gBACH,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAA;YACrB,CAAC;YAAC,MAAM,CAAC;gBACP,SAAQ;YACV,CAAC;YACD,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;gBACrB,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;oBAAE,KAAK,EAAE,CAAA;gBACvC,IAAI,CAAC,IAAI,CAAC,CAAA;YACZ,CAAC;iBAAM,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC;gBACvB,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;oBAAE,KAAK,EAAE,CAAA;YACvC,CAAC;QACH,CAAC;IACH,CAAC,CAAA;IACD,IAAI,CAAC,UAAU,CAAC,CAAA;IAChB,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;8EAG8E;AAC9E,MAAM,UAAU,gBAAgB,CAAC,UAAkB;IACjD,MAAM,KAAK,GAAoB,EAAE,aAAa,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAA;IAC5F,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAA;IAChD,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,KAAK,CAAA;IACzC,IAAI,OAAoB,CAAA;IACxB,IAAI,CAAC;QACH,OAAO,GAAG,oBAAoB,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAA;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IAEpC,IAAI,WAAqB,CAAA;IACzB,IAAI,CAAC;QACH,WAAW,GAAG,WAAW,CAAC,UAAU,CAAC,CAAA;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;IAED,6EAA6E;IAC7E,6EAA6E;IAC7E,4EAA4E;IAC5E,kEAAkE;IAClE,kCAAkC;IAClC,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAC/B,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CACxF,CAAA;IAED,IAAI,QAAQ,GAAG,CAAC,CAAA;IAChB,IAAI,OAAO,GAAG,CAAC,CAAA;IACf,KAAK,MAAM,MAAM,IAAI,qBAAqB,EAAE,CAAC;QAC3C,QAAQ,IAAI,kBAAkB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAA;QAClD,OAAO,IAAI,mBAAmB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAA;IACpD,CAAC;IAED,OAAO,EAAE,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,CAAA;AAChF,CAAC;AAOD;;;;;;;;;;;;;iCAaiC;AACjC,MAAM,UAAU,YAAY,CAAC,IAAmB;IAC9C,MAAM,KAAK,GAAoB,EAAE,aAAa,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAA;IAC5E,IAAI,OAAiB,CAAA;IACrB,IAAI,CAAC;QACH,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAA;QACvC,OAAM;IACR,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAA;QACjD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;YAAE,SAAQ;QAC3D,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAA;YACtC,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5B,IAAI,CAAC,MAAM,CAAC,GAAG,GAAG,sBAAsB,KAAK,UAAU,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YAClF,CAAC;YACD,KAAK,CAAC,aAAa,IAAI,CAAC,CAAC,aAAa,CAAA;YACtC,KAAK,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAA;YAC5B,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,CAAA;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,wDAAwD;QAC1D,CAAC;IACH,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAA;AACzC,CAAC;AAOD;oDACoD;AACpD,MAAM,UAAU,+BAA+B,CAC7C,IAA4C;IAE5C,IAAI,KAAK,GAA0B,IAAI,CAAA;IACvC,OAAO;QACL,KAAK;YACH,IAAI,KAAK;gBAAE,OAAM;YACjB,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;gBACvB,YAAY,CAAC,IAAI,CAAC,CAAA;YACpB,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;YACnB,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,UAAU;gBAAE,KAAK,CAAC,KAAK,EAAE,CAAA;QACtD,CAAC;QACD,IAAI;YACF,IAAI,KAAK,EAAE,CAAC;gBACV,aAAa,CAAC,KAAK,CAAC,CAAA;gBACpB,KAAK,GAAG,IAAI,CAAA;YACd,CAAC;QACH,CAAC;KACF,CAAA;AACH,CAAC"}

package/payload/platform/services/claude-session-manager/dist/index.js

@@ -794,14 +794,17 @@ async function main() {
         logger: log,
     });
     xacctCensus.start();
-    // Task 1877 — standing account-dir schema reconcile. The fs-schema-guard path
-    // hook never sees Bash, and the immediate Bash hooks only catch strays a live
-    // command newly creates; neither retroactively catches the backlog an agent
-    // authored before the hooks existed. Folder creation through Bash is a
-    // no-event failure, so this periodic filesystem pass is the only signal: it
-    // quarantines stray top-level entries into <account>/.quarantine/ (manifest
-    // recorded, nothing deleted) and counts over-deep files, emitting one
-    // [fs-reconcile] metric line per run. Purely filesystem — no Neo4j.
+    // Task 1877 / Task 1899 — standing account-dir schema reconcile. The
+    // fs-schema-guard path hook never sees Bash, and the immediate Bash hooks only
+    // catch strays a live command newly creates; neither retroactively catches the
+    // backlog an agent authored before the hooks existed. Folder creation through
+    // Bash is a no-event failure, so this periodic filesystem pass is the only
+    // signal. It REPORTS and never moves: each run emits one [fs-reconcile]
+    // op=strays line per account carrying entries the schema does not account for,
+    // naming them, then one [fs-reconcile] summary line counting those entries
+    // alongside over-deep files and bad names. It used to quarantine
+    // strays, and because a closed allowed-list always lags what the platform
+    // writes, that turned a metric into data loss. Purely filesystem — no Neo4j.
     const schemaReconcile = createAccountDirSchemaReconcile({
         accountsRoot: dirname(config.accountDir),
         logger: log,