fix(ms-ai-architect): RX-OPS2 skrive-sikkerhet i driverne — scoped restore + atomiske skriv [skip-docs]

- backup.mjs restore(relPaths): SCOPED per-fil-rollback erstatter hel-tre rmSync(srcDir)+cpSync.
  Ruller kun tilbake kjøringens egne skriv; parallelle økters skriv til søsken-filer overlever;
  intet destruktivt rm→cp-vindu. Nyskapte filer slettes; prior bytes gjenopprettes atomisk.
- migrate-corpus.mjs: returnert restore() er nå en null-arg closure bundet til kjøringens skrive-
  liste (public API uendret) → scoped. detectStaleRollback aborterer ved forrige krasj-sentinel;
  cleanupOldBackups pruner backups forbi retention etter vellykket batch.
- 5 drivere (backfill-status/-category, dedup-plain-header, relabel-dato/-dialect):
  writeFileSync → atomicWriteSync (crash-safe tmp+rename) + recovery-kontrakt i header.
- backfill-category.mjs: refaktorert importerbar (isMain-guard + run()/planCategoryBackfill/
  categoryForFile/FOLDER_CATEGORY-eksporter, parameterisert root) → testbar uten scan-side-effekt.
- Tester (+16): 6 scoped-restore (parallel-preservering, ny-fil-sletting, throws-guard) erstatter
  2 hel-tre; test-backfill-category (frosset taxonomi + hermetisk plan); test-driver-atomic-writes
  (5 drivere); migrate stale-abort + cleanup-wiring. Suite 859→875 exit 0. validate-plugin 250/0.

tests/kb-update/test-backfill-category.test.mjs

@@ -0,0 +1,93 @@
+// tests/kb-update/test-backfill-category.test.mjs
+// TDD for the Category-backfill driver (R20). RX-OPS2 makes it importable (isMain
+// guard + extracted run()/planCategoryBackfill) so its deterministic contract can be
+// pinned without executing the corpus scan as an import side effect, and routes its
+// writes through the crash-safe atomic writer. The pure, frozen contract:
+//   - FOLDER_CATEGORY: the 5 operator-approved folder→category entries (2026-07-06).
+//   - categoryForFile: immediate-parent-folder lookup; unknown folder → null.
+//   - planCategoryBackfill: reads a corpus root, plans insert-only Category lines behind
+//     the same one-line/byte-identical invariant as the sibling drivers; files that
+//     already carry Category are idempotently skipped; unknown folders are unmatched
+//     (never written).
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, dirname } from 'node:path';
+import {
+  FOLDER_CATEGORY,
+  categoryForFile,
+  planCategoryBackfill,
+} from '../../scripts/kb-update/backfill-category.mjs';
+
+function withTmp(fn) {
+  const dir = mkdtempSync(join(tmpdir(), 'bcat-test-'));
+  try {
+    return fn(dir);
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+}
+
+function writeFile(root, rel, content) {
+  const path = join(root, rel);
+  mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(path, content, 'utf8');
+}
+
+test('FOLDER_CATEGORY — frozen operator-approved taxonomy (5 folders, 2026-07-06)', () => {
+  assert.deepEqual(FOLDER_CATEGORY, {
+    architecture: 'Solution Architecture & Advisory',
+    platforms: 'Microsoft AI Platforms',
+    development: 'Microsoft AI Platforms',
+    'responsible-ai': 'Responsible AI & Governance',
+    'mlops-genaiops': 'MLOps & GenAIOps',
+  });
+});
+
+test('categoryForFile — maps immediate-parent folder; unknown folder → null', () => {
+  assert.equal(categoryForFile('skills/x/references/architecture/foo.md'), 'Solution Architecture & Advisory');
+  assert.equal(categoryForFile('skills/x/references/mlops-genaiops/bar.md'), 'MLOps & GenAIOps');
+  assert.equal(categoryForFile('skills/x/references/responsible-ai/baz.md'), 'Responsible AI & Governance');
+  assert.equal(categoryForFile('skills/x/references/unknown-folder/qux.md'), null);
+});
+
+test('planCategoryBackfill — plans a Category-less file in a known folder (one line, right value)', () => {
+  withTmp((root) => {
+    writeFile(
+      root,
+      'skills/ms-ai-engineering/references/mlops-genaiops/x.md',
+      '# X\n\n**Status:** Reference\n\n---\n\nBody.\n',
+    );
+    const { planned, unmatched } = planCategoryBackfill(root);
+    assert.equal(unmatched.length, 0);
+    assert.equal(planned.length, 1);
+    assert.equal(planned[0].cat, 'MLOps & GenAIOps');
+    // Insert-only invariant: exactly one extra line, the Category line.
+    assert.match(planned[0].out, /^\*\*Category:\*\* MLOps & GenAIOps$/m);
+  });
+});
+
+test('planCategoryBackfill — file already carrying Category is skipped (idempotent)', () => {
+  withTmp((root) => {
+    writeFile(
+      root,
+      'skills/ms-ai-engineering/references/mlops-genaiops/x.md',
+      '# X\n\n**Category:** MLOps & GenAIOps\n**Status:** Reference\n\n---\n\nBody.\n',
+    );
+    const { planned, unmatched } = planCategoryBackfill(root);
+    assert.equal(planned.length, 0);
+    assert.equal(unmatched.length, 0);
+  });
+});
+
+test('planCategoryBackfill — file in an unknown folder is unmatched, never planned for a write', () => {
+  withTmp((root) => {
+    writeFile(root, 'skills/ms-ai-x/references/mystery/x.md', '# X\n\n**Status:** Reference\n\n---\n\nBody.\n');
+    const { planned, unmatched } = planCategoryBackfill(root);
+    assert.equal(planned.length, 0);
+    assert.equal(unmatched.length, 1);
+    assert.match(unmatched[0], /mystery/);
+  });
+});

tests/kb-update/test-backup-restore.test.mjs

@@ -141,35 +141,95 @@ test('backupDir — writes .backup-meta.json sentinel inside backup', () => {
   });
 });
 
-test('restore — round-trips content after src is mutated', () => {
+// --- restore(relPaths): SCOPED per-file rollback (RX-OPS2) ---
+// The old restore() rm+cp'd the WHOLE srcDir, which deletes a parallel session's
+// writes made after the backup and opens a destructive rm→cp window. restore() now
+// takes the explicit list of relative paths THIS run wrote and rolls back only those.
+
+test('restore(relPaths) — scoped: rolls back only listed files, preserves parallel writes', () => {
   withTmp((tmp) => {
     const src = join(tmp, 'skills');
     const root = join(tmp, '.kb-backup');
-    makeSrc(src, { 'a.md': 'original', 'sub/b.md': 'original-b' });
-    const original = readAll(src);
+    makeSrc(src, { 'a.md': 'orig-a', 'b.md': 'orig-b' });
 
     const handle = backupDir(src, root);
 
-    // Mutate src.
-    writeFileSync(join(src, 'a.md'), 'mutated', 'utf8');
-    writeFileSync(join(src, 'new.md'), 'extra', 'utf8');
-    rmSync(join(src, 'sub'), { recursive: true, force: true });
+    // This run mutates a.md; a PARALLEL session writes b.md AFTER the backup.
+    writeFileSync(join(src, 'a.md'), 'mutated-a', 'utf8');
+    writeFileSync(join(src, 'b.md'), 'parallel-b', 'utf8');
 
-    handle.restore();
+    handle.restore(['a.md']); // roll back ONLY this run's own write
 
-    const restored = readAll(src);
-    assert.deepEqual(restored, original);
+    assert.equal(readFileSync(join(src, 'a.md'), 'utf8'), 'orig-a', 'listed file rolled back');
+    assert.equal(readFileSync(join(src, 'b.md'), 'utf8'), 'parallel-b', "parallel session's write preserved");
   });
 });
 
-test('restore — sentinel is removed after successful restore', () => {
+test('restore(relPaths) — scoped: deletes a file newly created this run', () => {
   withTmp((tmp) => {
     const src = join(tmp, 'skills');
     const root = join(tmp, '.kb-backup');
-    makeSrc(src, { 'foo.md': 'A' });
+    makeSrc(src, { 'a.md': 'orig-a' });
+
     const handle = backupDir(src, root);
-    handle.restore();
-    assert.equal(detectStaleRollback(root), false);
+    writeFileSync(join(src, 'new.md'), 'created', 'utf8'); // absent at backup time
+
+    handle.restore(['new.md']);
+
+    assert.equal(existsSync(join(src, 'new.md')), false, 'file created this run removed on rollback');
+    assert.equal(readFileSync(join(src, 'a.md'), 'utf8'), 'orig-a', 'sibling untouched');
+  });
+});
+
+test('restore(relPaths) — scoped: restores a nested file to its pre-write bytes', () => {
+  withTmp((tmp) => {
+    const src = join(tmp, 'skills');
+    const root = join(tmp, '.kb-backup');
+    makeSrc(src, { 'sub/deep/c.md': 'orig-c', 'sub/other.md': 'orig-other' });
+
+    const handle = backupDir(src, root);
+    writeFileSync(join(src, 'sub/deep/c.md'), 'mutated-c', 'utf8');
+    writeFileSync(join(src, 'sub/other.md'), 'parallel-other', 'utf8');
+
+    handle.restore(['sub/deep/c.md']);
+    assert.equal(readFileSync(join(src, 'sub/deep/c.md'), 'utf8'), 'orig-c', 'nested file rolled back');
+    assert.equal(readFileSync(join(src, 'sub/other.md'), 'utf8'), 'parallel-other', 'unlisted nested sibling preserved');
+  });
+});
+
+test('restore(relPaths) — leaves no atomic-write temp file behind', () => {
+  withTmp((tmp) => {
+    const src = join(tmp, 'skills');
+    const root = join(tmp, '.kb-backup');
+    makeSrc(src, { 'a.md': 'orig-a' });
+    const handle = backupDir(src, root);
+    writeFileSync(join(src, 'a.md'), 'mutated-a', 'utf8');
+    handle.restore(['a.md']);
+    const names = Object.keys(readAll(src));
+    assert.equal(names.some((n) => /\.tmp\./.test(n)), false, 'no restore temp file survived');
+  });
+});
+
+test('restore — throws when relPaths is not an array (rollback must be scoped)', () => {
+  withTmp((tmp) => {
+    const src = join(tmp, 'skills');
+    const root = join(tmp, '.kb-backup');
+    makeSrc(src, { 'a.md': 'A' });
+    const handle = backupDir(src, root);
+    assert.throws(() => handle.restore(), /relPaths|scoped/i);
+    assert.throws(() => handle.restore('a.md'), /relPaths|scoped/i);
+  });
+});
+
+test('restore — sentinel is written then removed after a successful scoped restore', () => {
+  withTmp((tmp) => {
+    const src = join(tmp, 'skills');
+    const root = join(tmp, '.kb-backup');
+    makeSrc(src, { 'a.md': 'orig-a' });
+    const handle = backupDir(src, root);
+    writeFileSync(join(src, 'a.md'), 'mut', 'utf8');
+    handle.restore(['a.md']);
+    assert.equal(detectStaleRollback(root), false, 'sentinel cleared on success');
   });
 });
 

tests/kb-update/test-driver-atomic-writes.test.mjs

@@ -0,0 +1,29 @@
+// tests/kb-update/test-driver-atomic-writes.test.mjs
+// RX-OPS2 acceptance: every corpus-writing driver routes its writes through the
+// crash-safe atomicWriteSync (tmp+rename), never a bare writeFileSync that can leave a
+// half-written reference file. Mirrors the existing migrate-corpus source guard
+// (test-migrate-apply.test.mjs) for the five standalone drivers.
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const KB = join(dirname(fileURLToPath(import.meta.url)), '..', '..', 'scripts', 'kb-update');
+
+const DRIVERS = [
+  'backfill-status.mjs',
+  'backfill-category.mjs',
+  'dedup-plain-header.mjs',
+  'relabel-dato.mjs',
+  'relabel-dialect.mjs',
+];
+
+for (const driver of DRIVERS) {
+  test(`${driver} — writes corpus files via atomicWriteSync, never bare writeFileSync`, () => {
+    const src = readFileSync(join(KB, driver), 'utf8');
+    assert.match(src, /atomicWriteSync/, `${driver} must import/use the atomic writer`);
+    assert.doesNotMatch(src, /\bwriteFileSync\b/, `${driver} must not call writeFileSync directly`);
+  });
+}

tests/kb-update/test-migrate-apply.test.mjs

@@ -279,3 +279,44 @@ test('migrateCorpus — post-write parse assertion catches a deep-preamble (>500
     assert.deepEqual(readAll(root), original);
   });
 });
+
+// --- RX-OPS2: backup hygiene wired into the applier ---
+
+test('migrateCorpus — aborts when a stale rollback sentinel is present (prior crash)', () => {
+  withTmp((tmp) => {
+    const root = join(tmp, 'skills');
+    const backupRoot = join(tmp, '.kb-backup');
+    makeCorpus(root, { 'ms-ai-engineering/references/a.md': REF_SMALL });
+    mkdirSync(backupRoot, { recursive: true });
+    // A previous run crashed mid-restore and left its sentinel behind.
+    writeFileSync(join(backupRoot, '.rollback-in-progress'), JSON.stringify({ started_at: '2026-07-01T00:00:00Z' }), 'utf8');
+    const manifest = { [key('ms-ai-engineering/references/a.md')]: { type: 'reference', source: 'https://learn.microsoft.com/x' } };
+    assert.throws(
+      () => migrateCorpus({ root, backupRoot, manifest, write: true }),
+      /stale|rollback|recover/i,
+    );
+    // Aborted before any write — corpus untouched.
+    assert.equal(readFileSync(join(root, 'ms-ai-engineering/references/a.md'), 'utf8'), REF_SMALL);
+  });
+});
+
+test('migrateCorpus — prunes backups older than retention after a successful write', () => {
+  withTmp((tmp) => {
+    const root = join(tmp, 'skills');
+    const backupRoot = join(tmp, '.kb-backup');
+    makeCorpus(root, { 'ms-ai-engineering/references/a.md': REF_SMALL });
+    // Seed an old backup dir (>7 days) that cleanup must remove after a good run.
+    const oldDir = join(backupRoot, '2026-01-01T00-00-00');
+    mkdirSync(oldDir, { recursive: true });
+    writeFileSync(
+      join(oldDir, '.backup-meta.json'),
+      JSON.stringify({ created_at: '2026-01-01T00:00:00.000Z', schema_version: 1 }),
+      'utf8',
+    );
+    const manifest = { [key('ms-ai-engineering/references/a.md')]: { type: 'reference', source: 'https://learn.microsoft.com/x' } };
+    const report = migrateCorpus({ root, backupRoot, manifest, write: true });
+    assert.equal(report.counts.written, 1);
+    assert.equal(existsSync(oldDir), false, 'stale-age backup pruned after successful write');
+    assert.ok(existsSync(report.backupPath), "this run's fresh backup retained");
+  });
+});