app guides night: R-1089..R-1092 (found writing the guides), R-1088 extended; read_credential.py refuses to overwrite the credentials file (red-proved); STATUS; batch evidence

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

scripts/test_read_credential.py

@@ -125,9 +125,46 @@ def test_the_value_is_never_printed():
     os.unlink(out)
 
 
+# --- the outfile can never be the credentials file -------------------------------------------------
+#
+# THE INCIDENT THIS PINS (2026-10-15 night, CC on DooPlex): `read_credential.py HUB_TOKEN ~/.config/credentials`
+# — the credentials path given as the OUTFILE — truncated the operator's credentials file to one value.
+# RED-PROOF (recorded in the app-guides night's evidence): delete the samefile guard in `main` and the three
+# „unchanged" checks below fail.
+def test_the_outfile_can_never_be_the_credentials_file():
+    print("TestCredentialsFileIsNeverTheOutfile")
+    body = "PASSWORD='abcdefghijklm'\nOTHER='kept'\n"
+    p = writefile(body)
+    rcode = rc.main(["PASSWORD", p, "--credentials", p])
+    with open(p, encoding="utf-8") as fh:
+        after = fh.read()
+    check("same path is REFUSED", rcode == 2, "rc=%s" % rcode)
+    check("same path: the credentials file is unchanged", after == body, repr(after))
+    link = p + ".link"
+    os.symlink(p, link)
+    rcode = rc.main(["PASSWORD", link, "--credentials", p])
+    with open(p, encoding="utf-8") as fh:
+        after = fh.read()
+    check("a symlink to it is REFUSED", rcode == 2, "rc=%s" % rcode)
+    check("symlink: the credentials file is unchanged", after == body, repr(after))
+    hard = p + ".hard"
+    os.link(p, hard)
+    rcode = rc.main(["PASSWORD", hard, "--credentials", p])
+    with open(p, encoding="utf-8") as fh:
+        after = fh.read()
+    check("a hard link to it is REFUSED", rcode == 2, "rc=%s" % rcode)
+    check("hard link: the credentials file is unchanged", after == body, repr(after))
+    # Negative control: a real temp outfile still works.
+    out = tempfile.mkstemp()[1]
+    check("a separate outfile is still accepted", rc.main(["PASSWORD", out, "--credentials", p]) == 0)
+    for f in (p, link, hard, out):
+        os.unlink(f)
+
+
 if __name__ == "__main__":
     test_r404_credential_length_mismatch_fails_loudly()
     test_the_value_is_never_printed()
+    test_the_outfile_can_never_be_the_credentials_file()
     if FAILURES:
         print("\nFAILED: %d" % len(FAILURES))
         sys.exit(1)