[trissim]

External credential locations: two bogus bus declarations → zero

4 files, +62/-11. Follow-up to #3861, found by running the real pending carry against captured live inputs before installation.

Failure and owner repair

The original private-copy run reached the actual installer worker and completed its dry run. StoreBackup.stores_original() then crashed: RootFile.named_paths() included a nonexistent bus/grants.json, and ExternalStore.retained_name() tried to resolve that bus path relative to the external HOME credential file.

Before:

• RootFile.declarations_in() treated every class declaring filename as bus-relative.
• Both ConnectorCredentialsFile and ConnectorStore supplied that filename.
• External-file location and bus-file location were conflated.

After:

• RootFile.root_declaration() owns bus-relative inventory contribution.
• ExternalFile(DurableFile) supplies the external/explicit-location behavior: no bus-relative contribution.
• All ExternalStore members inherit that behavior.
• ConnectorFile(ExternalFile) declares grants.json once; the external resource and selected document reader inherit it.
• Existing ConnectorStore.at(...) fixture/live-verification callers retain their selected-file construction through that inherited filename.

No catch, path filter, credential-name special case or runtime-format fallback was added.

Executed preservation and rollback

The failed epoch is retained under .connector-carry-live-01. The repaired epoch reuses its captured bytes, rather than changing the input until it passes.

The captured live root's complete unfinished chain was exactly connector_access_carry. The run used the actual InstallCommands / TargetProgram / CarryProbe worker exchange, WriterOwnedOpeningProbe, StoreBackup.take/restore, and inherited credential locks.

• 5,736,062 selected bytes captured, including original registry/runtime metadata and the declared external credential resource.
• Dry run: 1 change, original bytes unchanged.
• Apply: 1 change; successor reader opens it.
• Repeat: 0 changes, successor bytes unchanged.
• Preserved: 16 clients, 1 access authority, 1 thread authority, 8 refresh entries, 1 trusted browser; requests/codes were both empty.
• Credential lock remains held through worker execution and rollback, then releases with its lifetime.
• Original SHA256: e7c2eb27f4eb2e76ff3c17218766cdaaa5a04cc0a418a2996a89f35f5b75061b.
• Restored SHA256: identical.

Artifacts:

• /home/ts/.cache/agent-scratch/pi-shell-colleague/termux/connector-carry-live-01.log
• /home/ts/.cache/agent-scratch/pi-shell-colleague/termux/connector-carry-live-02.log
• /home/ts/wt/pi-shell-colleague--08d60541405342efa6d4f3330b320056--agent-comms/.connector-carry-live-02/capture.json
• corresponding result.json records the selected backup names and every result above.

A regression control was added to tests/test_carry_connector_access.py, using the real HOME-selected resource, practice copy, backup, carry and byte-exact restore. That pytest control has not been executed locally; the execution above is the real installer-operation proof, not a pytest result. This is source execution with the installed interpreter/dependencies, not a full candidate-runtime installation or phone proof.

Assumed: the credential file remains the canonical HOME resource declared by ConnectorCredentialsFile; the actual install retains its existing maintenance/borrowed-lock lifetime through rollback.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.