Plan 00055: relocate acceptance script into plan folder + add deploy/triage

Apply the new plan-local-scripts convention to Plan 00055:

- git mv scripts/acceptance-container-watch.bash → CLAUDE/Plan/00055-.../acceptance.bash
  (now resolves repo root via `git rev-parse --show-toplevel` instead of a
  fixed ../ hop, since it sits deeper in the tree).
- Add deploy.bash (runs the opt-in play on the HOST) and triage.bash
  (forces a scan, shows the timer schedule + findings). Both fail-fast,
  bash -n + shellcheck clean.
- Update PLAN.md / testing.md / testing-checklist.md references to the new
  in-folder path.
- Task 4.2 → In Progress: deploy confirmed on HOST (timer registered + fired,
  oneshot service runs, status/list OK — 0 findings). Panel + L2/L3 HOST runs
  still pending.

The permanent no-kill QA gate stays at scripts/qa-nokill-containerwatch.bash
and the regression suite stays under tests/helpers/containerwatch/ — those are
persistent deliverables, not plan scaffolding.

Refs: CLAUDE/Plan/00055-container-process-watchdog

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: LTSCommerce

CLAUDE/Plan/00055-container-process-watchdog/PLAN.md

@@ -144,8 +144,14 @@ decisions.
   every file). If instead using an explicit per-file loop (like `play-speech-to-text.yml`),
   **enumerate every file** (`extension.js` + `metadata.json` + any `prefs.js`/schemas) —
   any file omitted from the loop silently never deploys.
-- [ ] ⬜ **Task 4.2**: (On HOST, not CCY) deploy + verify timer fires, report
-  generates, panel + CLI both show a synthetic finding.
+- [ ] 🔄 **Task 4.2**: (On HOST, not CCY) deploy + verify. Use the plan-local
+  `deploy.bash` (runs the play) then `triage.bash` (forces a scan, shows the timer
+  schedule + findings). **Partially confirmed on HOST**: deploy succeeded, the
+  `container-watch.timer` is registered and has fired, the oneshot service runs, and
+  `container-watch status`/`list` work (`OK — 0 findings`, the healthy steady state).
+  **Still to confirm**: panel + notification react to a finding (drive via
+  `container-watch scan --inject` per `testing-checklist.md`), i.e. the L3 visual
+  pass and the L2 `acceptance.bash` run on the HOST.
 
 ### Phase 5: Testing & acceptance (full process in [`testing.md`](testing.md))
 
@@ -184,7 +190,7 @@ decisions.
   workspace path, or argv captured from an actual incident. (`report.json` itself is a
   runtime artifact under `$XDG_RUNTIME_DIR`, never committed — the leak surface is the
   committed fixtures, which can bypass the email/IP-shaped commit scanner.)
-- [x] ✅ **Task 5.3**: L2 host integration — `scripts/acceptance-container-watch.bash`
+- [x] ✅ **Task 5.3**: L2 host integration — `acceptance.bash` (in this plan folder)
   written (threshold-overridden `CW_AGE_S=1 CW_CPU_PCT=5`, engine-gated, spins a
   throwaway CPU-burner per available engine and asserts flag + attribution +
   `exec_hint` + NSpid + the behavioural **safety** assert (burner survives) +
@@ -341,7 +347,7 @@ decisions.
 
 ### 2026-06-24 (implementation — Phase 5 L2 + L3 authored; all in-container work done)
 
-- **Phase 5 L2**: `scripts/acceptance-container-watch.bash` — host-only,
+- **Phase 5 L2**: `acceptance.bash` (in this plan folder) — host-only,
   engine-gated, fail-fast acceptance test (burner per engine, full assertion set
   incl. the behavioural survive-assert, allowlist, DBus, `systemd-analyze --user verify`, trap cleanup). `bash -n` + shellcheck clean; in `qa-all.bash` bash gate.
 - **Phase 5 L3**: `testing-checklist.md` — numbered nested-GNOME visual checklist
@@ -353,6 +359,23 @@ decisions.
   **In Progress** because the remaining work is HOST-only and cannot run in this
   container: **Task 4.2** (`ansible-playbook play-container-watch.yml`, then confirm
   the timer fires + panel/CLI show a finding) and the **HOST execution** of L2
-  (`scripts/acceptance-container-watch.bash`) and L3 (`testing-checklist.md`). Once
+  (`acceptance.bash`) and L3 (`testing-checklist.md`). Once
   those pass on the HOST, mark Task 4.2 ✅, set the plan Complete, and move it to
   `CLAUDE/Plan/Completed/`.
+
+### 2026-06-24 (HOST deploy confirmed + plan-local-scripts convention)
+
+- **Deployed on HOST**: `deploy.bash` ran the play cleanly; `container-watch.timer`
+  is registered and has fired; the oneshot service runs; `container-watch status`/`list` return `OK — 0 findings` (correct healthy state — no runaway
+  containers present). Task 4.2 moved to 🔄 (deploy/timer/CLI confirmed; panel +
+  acceptance run still pending on HOST).
+- **New convention — plan-local scripts (set in stone)**: the L2 script was
+  relocated `scripts/acceptance-container-watch.bash` →
+  `acceptance.bash` (this folder), and `deploy.bash` + `triage.bash` were added
+  here. Transient, plan-specific scripts/artifacts now live in the plan folder, not
+  the repo root; only persistently-useful tooling (e.g. the permanent
+  `scripts/qa-nokill-containerwatch.bash` gate, the `tests/helpers/containerwatch/`
+  regression suite) stays in its normal home. The rule is encoded in
+  `CLAUDE/PlanWorkflow.md` and `CLAUDE/Plan/CLAUDE.md`. All three plan scripts
+  resolve the repo root via `git rev-parse --show-toplevel` and pass `bash -n` +
+  shellcheck (error-level).

CLAUDE/Plan/00055-container-process-watchdog/acceptance.bash

@@ -101,7 +101,12 @@ need jq
 need timeout
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+# This script lives in its plan folder (CLAUDE/Plan/NNNNN-*/), not at repo root,
+# so resolve the repo root via git rather than a fixed parent-dir hop.
+if ! REPO_ROOT="$(cd "$SCRIPT_DIR" && git rev-parse --show-toplevel 2>&1)"; then
+    echo "Cannot locate repo root (not a git checkout?): $REPO_ROOT" >&2
+    exit 1
+fi
 
 # Resolve the CLI robustly: prefer the deployed wrapper on PATH; else the module
 # form. CW[] is the argv prefix every invocation reuses.

CLAUDE/Plan/00055-container-process-watchdog/deploy.bash

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+# Plan 00055 — deploy the container-process watchdog on the HOST.
+#
+# HOST-ONLY: this runs Ansible. NEVER run it inside the CCY container (/workspace)
+# — per CLAUDE/ContainerRules.md the container is edit-only; deployment happens on
+# the Fedora host. Runs the opt-in play that installs the helper, the
+# container-watch CLI wrapper, the systemd --user timer, and the GNOME panel
+# extension. Idempotent — safe to re-run. Extra args pass through to
+# ansible-playbook (e.g. --check, --diff, -t <tag>).
+#
+#   ./CLAUDE/Plan/00055-container-process-watchdog/deploy.bash
+#   ./CLAUDE/Plan/00055-container-process-watchdog/deploy.bash --check --diff
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+if ! REPO_ROOT="$(cd "$SCRIPT_DIR" && git rev-parse --show-toplevel 2>&1)"; then
+    echo "Cannot locate repo root (not a git checkout?): $REPO_ROOT" >&2
+    exit 1
+fi
+cd "$REPO_ROOT"
+
+exec ansible-playbook playbooks/imports/optional/common/play-container-watch.yml "$@"

CLAUDE/Plan/00055-container-process-watchdog/testing-checklist.md

@@ -7,7 +7,7 @@ react, and was the guidance usable?* Everything else is covered by L0/L1/L2.
 
 > **Prerequisite**: L0 (`./scripts/qa-all.bash`, ESLint, `check_extension_compat`,
 > the no-kill guard), L1 (`./scripts/qa-helper-tests.bash`), and L2
-> (`./scripts/acceptance-container-watch.bash`) are all green. This checklist is
+> (`acceptance.bash` in this plan folder) are all green. This checklist is
 > the **final** gate, run only after the automated layers pass.
 
 > **Public-repo note**: every identifier below is a reserved placeholder

CLAUDE/Plan/00055-container-process-watchdog/testing.md

@@ -150,7 +150,7 @@ is a fixture `proc_root` directory with `<pid>/{cgroup,stat,status,cmdline}` fil
 
 ## 4. L2 — Host integration acceptance script (HOST, 100% automated)
 
-A single fail-fast script, e.g. `scripts/acceptance-container-watch.bash`
+A single fail-fast script, `acceptance.bash` in this plan folder
 (host-only — **not** in the CCY container; it starts real containers). It prints a
 PASS/FAIL line per assertion and exits non-zero on any failure. It overrides
 thresholds (`CW_AGE_S=1 CW_CPU_PCT=5`) so nothing waits.
@@ -238,7 +238,7 @@ auditable.
   guard**.
 - [ ] L1 green: unit suite via `./scripts/qa-helper-tests.bash` — full attribution
   matrix (all engines) + detection + schema + `comm`/NSpid/allowlist cases.
-- [ ] L2 green: `scripts/acceptance-container-watch.bash` PASS for every **present**
+- [ ] L2 green: `acceptance.bash` (this plan folder) PASS for every **present**
   engine, incl. the behavioural **safety** assert (process survives) and DBus +
   systemd checks; no stray test containers left.
 - [ ] L3 confirmed: GNOME panel/notification visual pass (5a) + one real guided

CLAUDE/Plan/00055-container-process-watchdog/triage.bash

@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+# Plan 00055 — post-deploy triage for the container-process watchdog.
+#
+# HOST-ONLY: confirms the deployed watchdog is healthy on the Fedora host. Run it
+# after deploy.bash (and any time you want to re-check). It forces one scan and
+# prints the timer schedule + current findings. The watchdog is reporting-only, so
+# "forcing a scan" only writes a report + emits a signal — it never kills anything.
+#
+# Healthy output with no runaway containers is "OK - 0 findings": that is a PASS,
+# not a problem — it means nothing in any container is currently long-running AND
+# CPU-pinned.
+#
+#   ./CLAUDE/Plan/00055-container-process-watchdog/triage.bash
+set -euo pipefail
+
+if ! command -v container-watch >/dev/null; then
+    echo "container-watch not on PATH — has deploy.bash run, and is ~/.local/bin on PATH?" >&2
+    exit 1
+fi
+
+echo "== run a scan now (oneshot service) =="
+systemctl --user start container-watch.service
+
+echo
+echo "== timer schedule =="
+systemctl --user list-timers container-watch.timer --no-pager --all
+
+echo
+echo "== current findings =="
+container-watch status
+container-watch list
+
+echo
+echo "Triage OK. (0 findings is the healthy steady state — a finding only appears"
+echo "when a container process is BOTH >= CW_AGE_S old AND CPU-pinned.)"