unitbob 0.6.2 → 0.7.0

package/dist/cli.js

@@ -27,7 +27,7 @@ import { validateBuild } from "./verbs/validateBuild.js";
 import { fixPrepare } from "./verbs/fixPrepare.js";
 import { contractPrompt } from "./verbs/contractPrompt.js";
 import { suiteReviewPrepare } from "./verbs/suiteReviewPrepare.js";
-import { validateWorkerPlan } from "./verbs/validateWorkerPlan.js";
+import { acceptWorkerPlan } from "./verbs/acceptWorkerPlan.js";
 import { validateWorkerCheckpoints } from "./verbs/validateWorkerCheckpoints.js";
 import { installCodexAgents } from "./verbs/codexInstall.js";
 const USAGE = `unitbob — thin local hands for the Unitbob server.
@@ -53,7 +53,8 @@ Verbs:
   suite-review-prepare Internal: bind an independent BDD quality review to the built behavioral candidate.
   validate-build       Internal: check the host's suite answer against the request, locally, before
                        uploading. Reports every problem at once; put-suite-build runs it too.
-  validate-worker-plan Internal: validate the exact request-bound worker plan before fan-out.
+  accept-worker-plan   Internal: check the exact request-bound worker plan and seed a checkpoint for
+                       every slice it names, before fan-out.
   validate-worker-checkpoints
                        Internal: validate every worker checkpoint before assembly or repair.
   put-suite-build      Internal: upload the host-built guardrail suite (whole spec file + test_metadata),
@@ -120,8 +121,8 @@ export async function main(argv, deps = { ensureLinked }) {
             case 'validate-build':
                 await validateBuild(await linked(), args);
                 return 0;
-            case 'validate-worker-plan':
-                await validateWorkerPlan(await linked(), args);
+            case 'accept-worker-plan':
+                await acceptWorkerPlan(await linked(), args);
                 return 0;
             case 'validate-worker-checkpoints':
                 await validateWorkerCheckpoints(await linked(), args);

package/dist/files/guardrails.js

@@ -67,7 +67,7 @@ abort 'unitbob_helper: refusing to run against a non-test environment' unless Ra
 // runs need no connector-written support files here (the runtime pytest.ini
 // lives outside this directory and is written by the pytest runner).
 //
-// Every file, not just the main one (spec 43, §6.4). The directory is wiped
+// Every file, not just the main one (spec one-place-per-rule, §6.4). The directory is wiped
 // first and only the main file was written back, so a published suite of four
 // files came back as one and the run that followed it silently protected a
 // quarter of what the map claimed.

package/dist/files/packets.js

@@ -0,0 +1,319 @@
+import { existsSync, mkdirSync, readFileSync, realpathSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { dirname, join, resolve, sep } from 'node:path';
+import { graphNodes, methodNameOf } from "../surfaces/graph.js";
+import { assertUnitbobPath } from "./artifactPath.js";
+import { surfacesPath } from "./mapBuild.js";
+// Spec 37-1. A worker used to receive names — `User#get_token`, `POST /api/tokens` —
+// and spend its first two thirds finding the code behind them. On microblog,
+// 2026-08-23, that was 474 of 674 worker turns and 63% of their input, once per
+// worker, for an application whose entire source is 92 KB.
+//
+// Resolving a name to a file is a dictionary lookup against two artifacts that
+// are already on this machine, so it costs no tokens and asks no model. What it
+// finds is copied whole: the packet carries exactly what the worker would have
+// opened anyway, which is why it cannot inflate a run.
+//
+// Nothing here goes up the wire. Spec 22 keeps the source on the vibecoder's
+// machine, and a packet is a local file the worker opens by path.
+export const PACKETS_DIR = '.unitbob/suite-build/packets';
+// The fuse, not a setting. It exists for the five-thousand-line controller
+// whose file is not "what a worker would have read anyway" — there the packet
+// carries the path and says so, and the worker opens the part it needs. There
+// is nowhere for this number to live except this source file: the size of a
+// packet is not a fact about the project, it is a fact about what fits.
+export const MAX_PACKET_BYTES = 200_000;
+export function packetsDir(projectRoot) {
+    return join(projectRoot, '.unitbob', 'suite-build', 'packets');
+}
+export function packetIndexPath(projectRoot) {
+    return join(packetsDir(projectRoot), 'index.json');
+}
+export function readPacketIndex(projectRoot) {
+    const path = packetIndexPath(projectRoot);
+    if (!existsSync(path))
+        return null;
+    try {
+        const parsed = JSON.parse(readFileSync(path, 'utf8'));
+        if (!Array.isArray(parsed?.targets))
+            return null;
+        // Entries, not just the array: a hand-edited index must not throw out of a
+        // verb whose whole policy is that a bad index costs the packets and nothing
+        // else.
+        return { targets: parsed.targets.filter((target) => !!asRecord(target) && asString(target?.id) !== undefined) };
+    }
+    catch {
+        // A packet index we cannot read is the same as none: the worker searches,
+        // as it did before this spec. It is never a reason to fail a build.
+        return null;
+    }
+}
+// Build every packet for this request. Called right after `request.json` is
+// written, and before any plan exists: the entrypoints are known from the
+// request, the workers are not, so a packet belongs to an entrypoint and two
+// entrypoints in one file share one packet.
+export function writeSuitePackets(projectRoot, request) {
+    const targets = targetsOf(request);
+    const lookup = buildLookup(projectRoot);
+    const notes = new Map();
+    // Regenerated whole, every run. A packet left over from a previous assignment
+    // sits under an authoritative name with nothing on it saying how old it is.
+    const dir = packetsDir(projectRoot);
+    rmSync(dir, { recursive: true, force: true });
+    mkdirSync(dir, { recursive: true });
+    const written = new Map();
+    const refused = new Map();
+    for (const target of targets) {
+        const sourceFile = lookup(target.entrypoint);
+        if (!sourceFile) {
+            target.note = 'no single file in graph.json or surfaces.json answers to this name — find it yourself';
+            count(notes, 'did not resolve to one file');
+            continue;
+        }
+        // The path travels even when the contents do not: a worker told which file
+        // to open has still been saved the search.
+        target.source_file = sourceFile;
+        // Two entrypoints in one file get one packet, written once, referenced twice.
+        if (!written.has(sourceFile) && !refused.has(sourceFile)) {
+            const copied = copyPacket(projectRoot, sourceFile);
+            if (typeof copied === 'number')
+                written.set(sourceFile, copied);
+            else
+                refused.set(sourceFile, copied);
+        }
+        const bytes = written.get(sourceFile);
+        if (bytes === undefined) {
+            const refusal = refused.get(sourceFile);
+            target.note = refusal.note;
+            count(notes, refusal.kind);
+            continue;
+        }
+        target.packet = `${PACKETS_DIR}/${sourceFile}`;
+        target.bytes = bytes;
+    }
+    writeFileSync(packetIndexPath(projectRoot), `${JSON.stringify({ targets }, null, 2)}\n`);
+    return {
+        targets: targets.length,
+        located: targets.filter((target) => target.source_file).length,
+        resolved: targets.filter((target) => target.packet).length,
+        files: written.size,
+        bytes: [...written.values()].reduce((sum, bytes) => sum + bytes, 0),
+        notes: [...notes].map(([note, count]) => `${count} × ${note}`),
+    };
+}
+// The two names a request carries. Structural interfaces name methods
+// (`User#get_token`); behavioral capabilities name addresses (`POST /api/tokens`).
+// Both are entrypoints, both resolve to a file, and both produce the same kind
+// of packet — a worker on either branch opens the same thing the same way.
+function targetsOf(request) {
+    const targets = [];
+    for (const branch of request.branches) {
+        const assignment = branch.assignment;
+        for (const block of asArray(assignment?.blocks)) {
+            for (const iface of asArray(asRecord(block)?.interfaces)) {
+                const record = asRecord(iface);
+                const id = asString(record?.interface_id);
+                if (!id)
+                    continue;
+                for (const entrypoint of asArray(record?.entrypoints)) {
+                    const name = asString(entrypoint);
+                    if (name)
+                        targets.push({ branch: branch.suite_kind, id, entrypoint: name });
+                }
+            }
+        }
+        for (const capability of asArray(assignment?.capabilities)) {
+            const record = asRecord(capability);
+            const id = asString(record?.capability_id);
+            if (!id)
+                continue;
+            for (const surface of asArray(record?.surfaces)) {
+                const name = asString(surface);
+                if (name)
+                    targets.push({ branch: branch.suite_kind, id, entrypoint: name });
+            }
+        }
+    }
+    return targets;
+}
+// One name in, at most one file out. Two local artifacts answer, both of them
+// built from the graph rather than from anybody's spelling rule:
+//
+//   `surfaces.json` — the addresses the router declared, each already carrying
+//   the file that serves it. It answers a behavioral surface (`POST /api/tokens`)
+//   by its id and a structural entrypoint (`MainRoutes.export_posts`) by the
+//   handler label, which is the router's own wording, not a name we built.
+//
+//   `graph.json` — every symbol graphify saw, matched by method name. A name
+//   alone is not enough: `User#get_token` and `ApiTokens.get_token` are two
+//   different entrypoints and graphify saw only one `get_token()`. So the owner
+//   the entrypoint named has to agree with the file before it is believed.
+//
+// Ambiguity ends in silence, never in a first match, and neither does a name
+// that resolves to a file its owner has nothing to do with. A packet holding
+// the wrong file is worse than no packet: the worker reads it, believes it, and
+// writes a test about code that does not serve this entrypoint. On microblog,
+// 2026-08-23, matching on the bare name alone sent both `ApiTokens` entrypoints
+// to `app/models.py`, whose `get_token` belongs to `User`.
+function buildLookup(projectRoot) {
+    const byAddress = new Map();
+    for (const surface of readSurfaces(projectRoot)) {
+        const record = asRecord(surface);
+        const file = normalisePath(asString(record?.source_file));
+        if (!file)
+            continue;
+        for (const key of [asString(record?.id), asString(record?.handler_label)]) {
+            if (key)
+                remember(byAddress, key, file);
+        }
+    }
+    const byMethod = new Map();
+    const byLabel = new Map();
+    for (const node of graphNodes(projectRoot)) {
+        const file = normalisePath(typeof node.source_file === 'string' ? node.source_file : undefined);
+        if (typeof node.label !== 'string' || !file)
+            continue;
+        remember(byMethod, methodNameOf(node.label), file);
+        remember(byLabel, node.label, file);
+    }
+    // The owner and the file agree if graphify put something of the owner's name
+    // in that file, or if the owner is the file — `ApiAuth` and `app/api/auth.py`
+    // are the same thing said twice, once in the map's words and once in the
+    // filesystem's. This confirms a file we already found; it never builds a path
+    // out of a name, which would be us maintaining somebody else's naming rule.
+    const agrees = (owner, file) => byLabel.get(owner)?.has(file) === true ||
+        byMethod.get(owner)?.has(file) === true ||
+        squash(file).includes(squash(owner));
+    return (entrypoint) => {
+        const declared = only(byAddress.get(entrypoint));
+        if (declared)
+            return declared;
+        // An address is the router's word, not a symbol, and must not fall through
+        // to symbol matching: `GET /users` would resolve by the name `users` to
+        // whatever single thing answers to it — a helper, a model, anything.
+        if (/\s/.test(entrypoint))
+            return undefined;
+        const named = byMethod.get(methodNameOf(entrypoint));
+        if (!named)
+            return undefined;
+        const owner = ownerNameOf(entrypoint);
+        if (!owner)
+            return only(named);
+        return only(new Set([...named].filter((file) => agrees(owner, file))));
+    };
+}
+// The name the entrypoint hangs its method on: `User` in `User#get_token`,
+// `Invoice` in `Billing::Invoice#total`. Split exactly as `methodNameOf` splits,
+// so the two never disagree about where a name ends.
+function ownerNameOf(entrypoint) {
+    const parts = entrypoint.replace(/\(.*\)\s*$/, '').split(/::|[#./]/).filter(Boolean);
+    return parts.length > 1 ? parts[parts.length - 2] : undefined;
+}
+function squash(value) {
+    return value.toLowerCase().replace(/[^a-z0-9]/g, '');
+}
+// graphify writes a path the way its host does. `app\models.rb` and
+// `./app/models.rb` are the same file as `app/models.rb`, and treating them as
+// three keys makes one file look like three and one method look ambiguous.
+function normalisePath(value) {
+    const normalised = value?.replace(/\\/g, '/').replace(/^\.\//, '');
+    return normalised || undefined;
+}
+function remember(into, key, file) {
+    const seen = into.get(key) ?? new Set();
+    seen.add(file);
+    into.set(key, seen);
+}
+function count(notes, note) {
+    notes.set(note, (notes.get(note) ?? 0) + 1);
+}
+function only(files) {
+    return files && files.size === 1 ? [...files][0] : undefined;
+}
+function readSurfaces(projectRoot) {
+    const path = surfacesPath(projectRoot);
+    if (!existsSync(path))
+        return [];
+    try {
+        const parsed = JSON.parse(readFileSync(path, 'utf8'));
+        return asArray(parsed?.surfaces);
+    }
+    catch {
+        return [];
+    }
+}
+// Copy one source file into the packets folder, keeping the path it has in the
+// checkout so the worker recognises it. Returns the byte count, or why there is
+// no copy to make. It never throws: one unreadable file out of a hundred is one
+// worker searching, not a run without packets.
+function copyPacket(projectRoot, sourceFile) {
+    const relative = `${PACKETS_DIR}/${sourceFile}`;
+    try {
+        assertUnitbobPath(relative, PACKETS_DIR);
+    }
+    catch {
+        return {
+            note: `graph.json names a path we will not write (${sourceFile}) — find the file yourself`,
+            kind: 'named a path we will not write',
+        };
+    }
+    try {
+        // The path came from graphify's output, not from us. A symlink or an
+        // absolute path there must not turn "copy a project file" into "copy
+        // anything on this machine", so the file is required to really live inside
+        // the checkout. `realpathSync` resolves every component, so a symlinked
+        // directory in the middle of the path is caught the same way.
+        const root = realpathSync(projectRoot);
+        let onDisk;
+        try {
+            onDisk = realpathSync(resolve(projectRoot, sourceFile));
+        }
+        catch {
+            return {
+                note: `${sourceFile} is named in graph.json but is not on disk — find the file yourself`,
+                kind: 'named a file that is not on disk',
+            };
+        }
+        if (onDisk !== root && !onDisk.startsWith(root + sep)) {
+            return {
+                note: `${sourceFile} resolves outside the project — find the file yourself`,
+                kind: 'resolved outside the project',
+            };
+        }
+        const stat = statSync(onDisk);
+        // A directory passes the size check comfortably and then throws EISDIR on
+        // read. Said here rather than caught below, so the words name the cause.
+        if (!stat.isFile()) {
+            return {
+                note: `${sourceFile} is not a file — find the code yourself`,
+                kind: 'named something that is not a file',
+            };
+        }
+        if (stat.size > MAX_PACKET_BYTES) {
+            return {
+                note: `${sourceFile} is ${stat.size.toLocaleString('en-US')} bytes, over the ${MAX_PACKET_BYTES.toLocaleString('en-US')}-byte packet fuse — open it at that path instead`,
+                kind: 'over the packet fuse — the path travels instead',
+            };
+        }
+        // The bytes we actually wrote, not the size we saw a moment ago.
+        const body = readFileSync(onDisk);
+        const destination = join(projectRoot, relative);
+        mkdirSync(dirname(destination), { recursive: true });
+        writeFileSync(destination, body);
+        return body.length;
+    }
+    catch (err) {
+        return {
+            note: `${sourceFile} could not be copied (${err.message}) — find the file yourself`,
+            kind: 'could not be copied',
+        };
+    }
+}
+function asArray(value) {
+    return Array.isArray(value) ? value : [];
+}
+function asRecord(value) {
+    return value && typeof value === 'object' ? value : undefined;
+}
+function asString(value) {
+    return typeof value === 'string' && value.trim() !== '' ? value : undefined;
+}

package/dist/files/suiteBuild.js

@@ -1,4 +1,4 @@
-import { existsSync, mkdirSync, readFileSync, realpathSync, writeFileSync } from 'node:fs';
+import { existsSync, mkdirSync, readFileSync, realpathSync, renameSync, rmSync, writeFileSync } from 'node:fs';
 import { createHash } from 'node:crypto';
 import { dirname, join, sep } from 'node:path';
 import { assertUnitbobPath } from "./artifactPath.js";
@@ -18,6 +18,38 @@ export function reviewRequestPath(projectRoot) {
 export function candidateRunPath(projectRoot) {
     return join(projectRoot, '.unitbob', 'suite-build', 'candidate-run.json');
 }
+// Spec 37-2, criterion 3. What a new build leaves behind, in the order a reader
+// meets it: the plan, the checkpoints written against that plan, and the answer
+// assembled from them. All three are bound to the `request.json` this run is
+// about to overwrite, so from the next line on they are a previous run's papers
+// wearing this run's filenames — which is exactly the confusion the coordinator
+// used to spend a turn untangling before fan-out.
+const PREVIOUS_RUN_ARTIFACTS = ['worker-plan.json', 'checkpoints', 'suite_output.json'];
+const PREVIOUS_DIR = 'previous';
+// Moved, never removed. A run costs hours and real money, and one interrupt plus
+// one restart must not be able to spend that twice — `previous/` is one line
+// more than `rmSync` and it is the line that makes a restart survivable.
+//
+// Replaced one artifact at a time rather than by clearing `previous/` first. The
+// tidier version — wipe, then move whatever exists — loses a complete previous
+// run to a partial one: a build interrupted between writing the plan and seeding
+// its checkpoints displaces only `worker-plan.json`, and clearing would take the
+// finished checkpoints and answer of the run before it with no way back. A
+// `previous/` holding pieces of two runs is worth strictly more than an empty
+// one, and every piece in it is named by the file it kept.
+export function movePreviousRunAside(projectRoot) {
+    const buildDir = join(projectRoot, '.unitbob', 'suite-build');
+    const found = PREVIOUS_RUN_ARTIFACTS.filter((name) => existsSync(join(buildDir, name)));
+    if (found.length === 0)
+        return [];
+    const previous = join(buildDir, PREVIOUS_DIR);
+    mkdirSync(previous, { recursive: true });
+    for (const name of found) {
+        rmSync(join(previous, name), { recursive: true, force: true });
+        renameSync(join(buildDir, name), join(previous, name));
+    }
+    return found;
+}
 export function writeBehavioralReviewRequest(projectRoot, output, candidateRun, knownDefectContext = { status: 'not_supplied' }, fixedCandidateRun) {
     const metadata = output.test_metadata;
     const candidateDigest = suiteCandidateDigest(output);
@@ -83,7 +115,7 @@ export function branchRunner(output) {
     return runner;
 }
 // What the reviewer actually read: the suite files, and the manifest that runs
-// them. Nothing else (spec 43, §4).
+// them. Nothing else (spec one-place-per-rule, §4).
 //
 // `test_metadata` used to be in here, and the server's copy of this formula
 // stripped the review's own keys back out to match — two lists that had to stay

package/dist/files/suiteBuildUpload.js

@@ -2,7 +2,7 @@ import { readBehavioralReview } from "./suiteBuild.js";
 // What travels to the server, and what "published" means when it answers. One
 // module, because two commands ask those questions: `put-suite-build` sends the
 // batch, and `validate-build` sends the same batch as a dry run so the server's
-// verdict is about the exact bytes the publish will carry (spec 43, §3).
+// verdict is about the exact bytes the publish will carry (spec one-place-per-rule, §3).
 //
 // A second assembly would be a second answer to "what are we uploading", and the
 // dry run would then be checking something the publish does not send — which is

package/dist/files/workerPlan.js

@@ -1,6 +1,6 @@
 import { createHash } from 'node:crypto';
-import { existsSync, readFileSync } from 'node:fs';
-import { join } from 'node:path';
+import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
 import { detectStructuralRunner } from "../runner/precheck.js";
 import { assertUnitbobPath } from "./artifactPath.js";
 export function workerPlanPath(projectRoot) {
@@ -34,6 +34,75 @@ export function readWorkerPlan(projectRoot) {
     }
     return parsed;
 }
+export const SUPERSEDED_DIR = 'superseded';
+export function seedWorkerCheckpoints(projectRoot) {
+    const plan = readWorkerPlan(projectRoot);
+    const request_digest = requestDigest(projectRoot);
+    const plan_digest = workerPlanDigest(projectRoot);
+    const written = [];
+    const kept = [];
+    const superseded = [];
+    for (const item of plan.workers) {
+        const path = checkpointPath(projectRoot, item);
+        const label = `${item.branch}:${item.worker_id}`;
+        // Left alone when it already belongs to this plan: the coordinator's facts
+        // and a worker's finished slice both live in this file, and a run costs
+        // hours.
+        if (belongsToPlan(path, plan_digest)) {
+            kept.push(label);
+            continue;
+        }
+        // Everything else needs a fresh seed — but the file being replaced is not
+        // necessarily worthless. `plan_digest` is a digest of the whole
+        // `worker-plan.json`, so editing one slice invalidates every checkpoint at
+        // once, including finished ones; and replanning after the first slice comes
+        // back is a documented, ordinary move. Overwriting in place would have made
+        // this verb the one thing in the build that destroys hours of work, on the
+        // most ordinary path there is. Moved for the same reason `suite-prepare`
+        // moves the previous run rather than deleting it.
+        if (existsSync(path)) {
+            const aside = join(dirname(path), SUPERSEDED_DIR, `${item.branch}-${item.worker_id}.json`);
+            mkdirSync(dirname(aside), { recursive: true });
+            rmSync(aside, { force: true });
+            renameSync(path, aside);
+            superseded.push(label);
+        }
+        mkdirSync(dirname(path), { recursive: true });
+        writeFileSync(path, `${JSON.stringify(seedFor(item, request_digest, plan_digest), null, 2)}\n`);
+        written.push(label);
+    }
+    return { written, kept, superseded };
+}
+function belongsToPlan(path, planDigest) {
+    if (!existsSync(path))
+        return false;
+    try {
+        const parsed = JSON.parse(readFileSync(path, 'utf8'));
+        return parsed?.plan_digest === planDigest;
+    }
+    catch {
+        return false;
+    }
+}
+function seedFor(item, request_digest, plan_digest) {
+    return {
+        request_digest,
+        plan_digest,
+        branch: item.branch,
+        worker_id: item.worker_id,
+        // Every promise starts unresolved: the slice has not been worked yet, and
+        // the gate wants each one accounted for exactly once.
+        unresolved_promises: [...item.promises],
+        completed_promises: [],
+        written_paths: [],
+        decisions: [],
+        known_problems: [],
+        // Behavioral only, and absent rather than empty elsewhere — it joins Gherkin
+        // Scenarios to addresses, and the structural branch has no Scenarios.
+        ...(item.branch === 'behavioral' ? { surface_coverage: [] } : {}),
+        facts: [],
+    };
+}
 const RUBY_HARNESS = {
     behavioral: '.unitbob/behavioral/step_definitions/00_unitbob_world.rb',
     structural: '.unitbob/structural/unitbob_helper.rb',
@@ -70,6 +139,14 @@ export function validateWorkerPlanFiles(projectRoot) {
         const label = workerLabel(item, index);
         if (!isNonEmptyString(item?.branch) || !expectedByBranch.has(item.branch))
             errors.push(`${label}: branch is not in the request`);
+        // Both halves of the checkpoint filename, held to the same rule. `worker_id`
+        // has always been checked; `branch` never was, because it only ever came
+        // from `request.json` and was only ever read. Since spec 37-2 the pair is
+        // also a path this connector *writes*, and `request.json` is a file on the
+        // vibecoder's disk — so a `suite_kind` of `../../..` would have put a
+        // seeded checkpoint outside the project.
+        else if (!/^[a-zA-Z0-9_-]+$/.test(item.branch))
+            errors.push(`${label}: branch must be a filename-safe name`);
         if (!isNonEmptyString(item?.worker_id) || !/^[a-zA-Z0-9_-]+$/.test(item.worker_id))
             errors.push(`${label}: worker_id must be a stable filename-safe id`);
         else if (seenWorkers.has(item.worker_id))
@@ -109,9 +186,6 @@ export function validateWorkerPlanFiles(projectRoot) {
         if (!expectedHarness && isNonEmptyString(item?.harness_path) && !item.harness_path.startsWith('.unitbob/')) {
             errors.push(`${label}: harness_path must be a connector-owned path under .unitbob/ (got "${item.harness_path}")`);
         }
-        if (!item?.limits || item.limits.planned_cases !== item.planned_cases?.length) {
-            errors.push(`${label}: limits.planned_cases must equal planned_cases.length`);
-        }
         for (const ownedPath of Array.isArray(item?.owned_paths) ? item.owned_paths : []) {
             if (!isNonEmptyString(ownedPath)) {
                 errors.push(`${label}: owned path must be a non-empty string`);