From 998cef4e4016ecd8a777d7f1970087dd53df0eac Mon Sep 17 00:00:00 2001
From: Peter Steinberger <steipete@gmail.com>
Date: Sat, 9 May 2026 01:30:43 +0100
Subject: [PATCH] test: ban device json state regressions

---
 docs/refactor/database-first.md               | 10 +++++++++
 .../check-database-first-legacy-stores.mjs    | 22 +++++++++++++++++++
 2 files changed, 32 insertions(+)

diff --git a/docs/refactor/database-first.md b/docs/refactor/database-first.md
index 6baff7c5a91..c0a035daf6e 100644
--- a/docs/refactor/database-first.md
+++ b/docs/refactor/database-first.md
@@ -1087,6 +1087,16 @@ Add a repo check that fails new runtime writes to legacy state paths:
 - `cron/runs/*.jsonl`
 - `jobs-state.json`
 - `device-pair-notify.json`
+- `devices/pending.json`
+- `devices/paired.json`
+- `devices/bootstrap.json`
+- `nodes/pending.json`
+- `nodes/paired.json`
+- `identity/device.json`
+- `identity/device-auth.json`
+- `push/web-push-subscriptions.json`
+- `push/vapid-keys.json`
+- `push/apns-registrations.json`
 - `session-toggles.json`
 - Memory-core `.dreams/events.jsonl`
 - Memory-core `.dreams/session-corpus/`
diff --git a/scripts/check-database-first-legacy-stores.mjs b/scripts/check-database-first-legacy-stores.mjs
index 51167caaa86..831e9fe5780 100644
--- a/scripts/check-database-first-legacy-stores.mjs
+++ b/scripts/check-database-first-legacy-stores.mjs
@@ -40,6 +40,22 @@ const legacyStoreMarkers = [
   { label: "OpenRouter model cache JSON", pattern: /\bopenrouter-models\.json\b/u },
   { label: "exec approvals JSON", pattern: /\bexec-approvals\.json\b/u },
   { label: "workspace setup JSON", pattern: /\bworkspace-state\.json\b/u },
+  {
+    label: "pairing pending/paired JSON",
+    pattern: /\b(?:devices|nodes)[/\\](?:pending|paired)\.json\b/u,
+  },
+  {
+    label: "device bootstrap JSON",
+    pattern: /\bdevices[/\\]bootstrap\.json\b/u,
+  },
+  { label: "device identity JSON", pattern: /\bidentity[/\\]device\.json\b/u },
+  { label: "device auth JSON", pattern: /\bidentity[/\\]device-auth\.json\b/u },
+  {
+    label: "web push subscription JSON",
+    pattern: /\bpush[/\\]web-push-subscriptions\.json\b/u,
+  },
+  { label: "web push VAPID JSON", pattern: /\bpush[/\\]vapid-keys\.json\b/u },
+  { label: "APNs registration JSON", pattern: /\bpush[/\\]apns-registrations\.json\b/u },
   { label: "ACPX process leases JSON", pattern: /\bprocess-leases\.json\b/u },
   { label: "ACPX gateway instance id file", pattern: /\bgateway-instance-id\b/u },
   {
@@ -180,6 +196,12 @@ const allowedExactPaths = new Set([
   "src/agents/subagent-registry.store.ts",
   "src/config/io.audit.ts",
   "src/cron/store.ts",
+  "src/infra/device-auth-store.ts",
+  "src/infra/device-bootstrap.ts",
+  "src/infra/device-identity.ts",
+  "src/infra/pairing-files.ts",
+  "src/infra/push-apns.ts",
+  "src/infra/push-web.ts",
   "src/infra/voicewake-routing.ts",
   "src/infra/voicewake.ts",
   "src/memory-host-sdk/dreaming-state-migration.ts",