fix(ms-ai-architect): RX-OPS2 skrive-sikkerhet i driverne — scoped restore + atomiske skriv [skip-docs]

- backup.mjs restore(relPaths): SCOPED per-fil-rollback erstatter hel-tre rmSync(srcDir)+cpSync.
  Ruller kun tilbake kjøringens egne skriv; parallelle økters skriv til søsken-filer overlever;
  intet destruktivt rm→cp-vindu. Nyskapte filer slettes; prior bytes gjenopprettes atomisk.
- migrate-corpus.mjs: returnert restore() er nå en null-arg closure bundet til kjøringens skrive-
  liste (public API uendret) → scoped. detectStaleRollback aborterer ved forrige krasj-sentinel;
  cleanupOldBackups pruner backups forbi retention etter vellykket batch.
- 5 drivere (backfill-status/-category, dedup-plain-header, relabel-dato/-dialect):
  writeFileSync → atomicWriteSync (crash-safe tmp+rename) + recovery-kontrakt i header.
- backfill-category.mjs: refaktorert importerbar (isMain-guard + run()/planCategoryBackfill/
  categoryForFile/FOLDER_CATEGORY-eksporter, parameterisert root) → testbar uten scan-side-effekt.
- Tester (+16): 6 scoped-restore (parallel-preservering, ny-fil-sletting, throws-guard) erstatter
  2 hel-tre; test-backfill-category (frosset taxonomi + hermetisk plan); test-driver-atomic-writes
  (5 drivere); migrate stale-abort + cleanup-wiring. Suite 859→875 exit 0. validate-plugin 250/0.

tests/kb-update/test-backup-restore.test.mjs

@@ -141,35 +141,95 @@ test('backupDir — writes .backup-meta.json sentinel inside backup', () => {
   });
 });
 
-test('restore — round-trips content after src is mutated', () => {
+// --- restore(relPaths): SCOPED per-file rollback (RX-OPS2) ---
+// The old restore() rm+cp'd the WHOLE srcDir, which deletes a parallel session's
+// writes made after the backup and opens a destructive rm→cp window. restore() now
+// takes the explicit list of relative paths THIS run wrote and rolls back only those.
+
+test('restore(relPaths) — scoped: rolls back only listed files, preserves parallel writes', () => {
   withTmp((tmp) => {
     const src = join(tmp, 'skills');
     const root = join(tmp, '.kb-backup');
-    makeSrc(src, { 'a.md': 'original', 'sub/b.md': 'original-b' });
-    const original = readAll(src);
+    makeSrc(src, { 'a.md': 'orig-a', 'b.md': 'orig-b' });
 
     const handle = backupDir(src, root);
 
-    // Mutate src.
-    writeFileSync(join(src, 'a.md'), 'mutated', 'utf8');
-    writeFileSync(join(src, 'new.md'), 'extra', 'utf8');
-    rmSync(join(src, 'sub'), { recursive: true, force: true });
+    // This run mutates a.md; a PARALLEL session writes b.md AFTER the backup.
+    writeFileSync(join(src, 'a.md'), 'mutated-a', 'utf8');
+    writeFileSync(join(src, 'b.md'), 'parallel-b', 'utf8');
 
-    handle.restore();
+    handle.restore(['a.md']); // roll back ONLY this run's own write
 
-    const restored = readAll(src);
-    assert.deepEqual(restored, original);
+    assert.equal(readFileSync(join(src, 'a.md'), 'utf8'), 'orig-a', 'listed file rolled back');
+    assert.equal(readFileSync(join(src, 'b.md'), 'utf8'), 'parallel-b', "parallel session's write preserved");
   });
 });
 
-test('restore — sentinel is removed after successful restore', () => {
+test('restore(relPaths) — scoped: deletes a file newly created this run', () => {
   withTmp((tmp) => {
     const src = join(tmp, 'skills');
     const root = join(tmp, '.kb-backup');
-    makeSrc(src, { 'foo.md': 'A' });
+    makeSrc(src, { 'a.md': 'orig-a' });
+
     const handle = backupDir(src, root);
-    handle.restore();
-    assert.equal(detectStaleRollback(root), false);
+    writeFileSync(join(src, 'new.md'), 'created', 'utf8'); // absent at backup time
+
+    handle.restore(['new.md']);
+
+    assert.equal(existsSync(join(src, 'new.md')), false, 'file created this run removed on rollback');
+    assert.equal(readFileSync(join(src, 'a.md'), 'utf8'), 'orig-a', 'sibling untouched');
+  });
+});
+
+test('restore(relPaths) — scoped: restores a nested file to its pre-write bytes', () => {
+  withTmp((tmp) => {
+    const src = join(tmp, 'skills');
+    const root = join(tmp, '.kb-backup');
+    makeSrc(src, { 'sub/deep/c.md': 'orig-c', 'sub/other.md': 'orig-other' });
+
+    const handle = backupDir(src, root);
+    writeFileSync(join(src, 'sub/deep/c.md'), 'mutated-c', 'utf8');
+    writeFileSync(join(src, 'sub/other.md'), 'parallel-other', 'utf8');
+
+    handle.restore(['sub/deep/c.md']);
+    assert.equal(readFileSync(join(src, 'sub/deep/c.md'), 'utf8'), 'orig-c', 'nested file rolled back');
+    assert.equal(readFileSync(join(src, 'sub/other.md'), 'utf8'), 'parallel-other', 'unlisted nested sibling preserved');
+  });
+});
+
+test('restore(relPaths) — leaves no atomic-write temp file behind', () => {
+  withTmp((tmp) => {
+    const src = join(tmp, 'skills');
+    const root = join(tmp, '.kb-backup');
+    makeSrc(src, { 'a.md': 'orig-a' });
+    const handle = backupDir(src, root);
+    writeFileSync(join(src, 'a.md'), 'mutated-a', 'utf8');
+    handle.restore(['a.md']);
+    const names = Object.keys(readAll(src));
+    assert.equal(names.some((n) => /\.tmp\./.test(n)), false, 'no restore temp file survived');
+  });
+});
+
+test('restore — throws when relPaths is not an array (rollback must be scoped)', () => {
+  withTmp((tmp) => {
+    const src = join(tmp, 'skills');
+    const root = join(tmp, '.kb-backup');
+    makeSrc(src, { 'a.md': 'A' });
+    const handle = backupDir(src, root);
+    assert.throws(() => handle.restore(), /relPaths|scoped/i);
+    assert.throws(() => handle.restore('a.md'), /relPaths|scoped/i);
+  });
+});
+
+test('restore — sentinel is written then removed after a successful scoped restore', () => {
+  withTmp((tmp) => {
+    const src = join(tmp, 'skills');
+    const root = join(tmp, '.kb-backup');
+    makeSrc(src, { 'a.md': 'orig-a' });
+    const handle = backupDir(src, root);
+    writeFileSync(join(src, 'a.md'), 'mut', 'utf8');
+    handle.restore(['a.md']);
+    assert.equal(detectStaleRollback(root), false, 'sentinel cleared on success');
   });
 });