fix: scope Door A's ownership scan to its own filename prefix

The §3 ownership scan globbed every *.md file regardless of which door
wrote it, then unconditionally unlinked whatever _is_ingest_owned agreed
to. Because _is_ingest_owned reads through the line-oriented parser that
flattens nested blocks (pinned in
test_two_nested_block_mappings_sharing_a_key_collide_in_the_scalar_parser),
a Door B/C file whose nested content happened to share a key name with
the ownership markers (generated, ingest_manifest) could get promoted to
top level and spoof ownership -- silently deleting content this door
never wrote.

Scoping the glob to ingest_prefix closes this by construction: a Door
B/C file is never even a candidate for the scan, regardless of what its
frontmatter parses to. Traced from a coordination tip from
portfolio-optimiser-claude about the same flattening mechanism hitting
their `type` field.
This commit is contained in:
Kjell Tore Guttormsen 2026-08-01 20:18:57 +02:00
commit 7c608bed1a
3 changed files with 48 additions and 6 deletions

View file

@ -164,10 +164,11 @@ def test_profile_paths_and_index_name_reach_disk(file_setup: tuple[Path, Path])
def test_second_synthetic_run_replaces_rather_than_colliding(
file_setup: tuple[Path, Path],
) -> None:
"""The §3 ownership scan globs `*{concept_suffix}` and excludes `index.name`.
Left on `DEFAULT`, the glob finds nothing under a renamed suffix, `owned` is
empty, and the gate refuses to overwrite the file this same code just wrote.
The index must also not gain a second link for the same target.
"""The §3 ownership scan globs `{ingest_prefix}*{concept_suffix}` and
excludes `index.name`. Left on `DEFAULT`, the glob finds nothing under a
renamed prefix and suffix, `owned` is empty, and the gate refuses to
overwrite the file this same code just wrote. The index must also not
gain a second link for the same target.
"""
manifest_path, bundle = file_setup
materialize_bundle(manifest_path, bundle, INGESTED_AT, profile=_SYNTHETIC)