test: ban device json state regressions

docs/refactor/database-first.md

@@ -1087,6 +1087,16 @@ Add a repo check that fails new runtime writes to legacy state paths:
 - `cron/runs/*.jsonl`
 - `jobs-state.json`
 - `device-pair-notify.json`
+- `devices/pending.json`
+- `devices/paired.json`
+- `devices/bootstrap.json`
+- `nodes/pending.json`
+- `nodes/paired.json`
+- `identity/device.json`
+- `identity/device-auth.json`
+- `push/web-push-subscriptions.json`
+- `push/vapid-keys.json`
+- `push/apns-registrations.json`
 - `session-toggles.json`
 - Memory-core `.dreams/events.jsonl`
 - Memory-core `.dreams/session-corpus/`

scripts/check-database-first-legacy-stores.mjs

@@ -40,6 +40,22 @@ const legacyStoreMarkers = [
   { label: "OpenRouter model cache JSON", pattern: /\bopenrouter-models\.json\b/u },
   { label: "exec approvals JSON", pattern: /\bexec-approvals\.json\b/u },
   { label: "workspace setup JSON", pattern: /\bworkspace-state\.json\b/u },
+  {
+    label: "pairing pending/paired JSON",
+    pattern: /\b(?:devices|nodes)[/\\](?:pending|paired)\.json\b/u,
+  },
+  {
+    label: "device bootstrap JSON",
+    pattern: /\bdevices[/\\]bootstrap\.json\b/u,
+  },
+  { label: "device identity JSON", pattern: /\bidentity[/\\]device\.json\b/u },
+  { label: "device auth JSON", pattern: /\bidentity[/\\]device-auth\.json\b/u },
+  {
+    label: "web push subscription JSON",
+    pattern: /\bpush[/\\]web-push-subscriptions\.json\b/u,
+  },
+  { label: "web push VAPID JSON", pattern: /\bpush[/\\]vapid-keys\.json\b/u },
+  { label: "APNs registration JSON", pattern: /\bpush[/\\]apns-registrations\.json\b/u },
   { label: "ACPX process leases JSON", pattern: /\bprocess-leases\.json\b/u },
   { label: "ACPX gateway instance id file", pattern: /\bgateway-instance-id\b/u },
   {
@@ -180,6 +196,12 @@ const allowedExactPaths = new Set([
   "src/agents/subagent-registry.store.ts",
   "src/config/io.audit.ts",
   "src/cron/store.ts",
+  "src/infra/device-auth-store.ts",
+  "src/infra/device-bootstrap.ts",
+  "src/infra/device-identity.ts",
+  "src/infra/pairing-files.ts",
+  "src/infra/push-apns.ts",
+  "src/infra/push-web.ts",
   "src/infra/voicewake-routing.ts",
   "src/infra/voicewake.ts",
   "src/memory-host-sdk/dreaming-state-migration.ts",