app guides night: R-1089..R-1092 (found writing the guides), R-1088 extended; read_credential.py refuses to overwrite the credentials file (red-proved); STATUS; batch evidence

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

scripts/read_credential.py

@@ -2,6 +2,7 @@
 """Read ONE value out of ~/.config/credentials, correctly, and refuse loudly when it is not.
 
 Run:  python3 scripts/read_credential.py <KEY> <OUTFILE> [--credentials PATH]
+      (OUTFILE is where the value GOES — a temp file. It is refused if it is the credentials file itself.)
 
 WHY THIS FILE EXISTS — it is the third occurrence that earned it.
 
@@ -88,6 +89,17 @@ def main(argv=None):
     ap.add_argument("--expect-length", type=int, default=None,
                     help="refuse unless the value is exactly this long (a caller-side second opinion)")
     args = ap.parse_args(argv)
+    # THE OUTFILE MUST NOT BE THE CREDENTIALS FILE (2026-10-15 night). `read_credential.py KEY ~/.config/credentials`
+    # reads like „read KEY from the credentials file" and is the argument order a hurried caller types — and the
+    # O_TRUNC write below then replaced the whole credentials file with one value: every other line was lost, on the
+    # operator's DooPlex, by CC. Refused before anything is read or written; the same file through a symlink or a
+    # second path is the same file. Pinned by test_the_outfile_can_never_be_the_credentials_file.
+    if os.path.realpath(args.outfile) == os.path.realpath(args.credentials) or (
+            os.path.exists(args.outfile) and os.path.exists(args.credentials)
+            and os.path.samefile(args.outfile, args.credentials)):
+        print("CREDENTIAL READ REFUSED [%s]: the output file IS the credentials file (%s) — writing the value there "
+              "would erase every other line. Give a temp file as OUTFILE." % (args.key, args.outfile), file=sys.stderr)
+        return 2
     try:
         value = read(args.credentials, args.key)
     except (CredentialError, OSError) as exc: