fiveonecode
diff --git a/‎CHANGELOG.md‎
Lines changed: 10 additions & 7 deletions b/‎CHANGELOG.md‎
Lines changed: 10 additions & 7 deletions
diff --git a/‎broker-core/index.mjs‎
Lines changed: 42 additions & 0 deletions b/‎broker-core/index.mjs‎
Lines changed: 42 additions & 0 deletions
diff --git a/‎broker-core/test/broker-core.test.mjs‎
Lines changed: 105 additions & 0 deletions b/‎broker-core/test/broker-core.test.mjs‎
Lines changed: 105 additions & 0 deletions
diff --git a/‎spec/tasks/guided-simbroker-setup.md‎
Lines changed: 16 additions & 8 deletions b/‎spec/tasks/guided-simbroker-setup.md‎
Lines changed: 16 additions & 8 deletions
@@ -25,13 +25,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - Guided setup binds existing-host confirmation to the requested `--host-id`,
   uses the separate device-type inventory when a runtime omits
-  `supportedDeviceTypes`, and fails closed when known-projects or lease/pin
-  JSON cannot be loaded or is not a complete identity record instead of
-  reporting `ready`. A missing host-config with an existing registry, lease,
-  or pin record in the selected state root is blocked rather than treated as
-  a confirmable fresh plan. Preview probes service identity even when no host
-  is configured yet, so a socket occupied by a different broker is blocked
-  before device creation.
+  `supportedDeviceTypes`, and fails closed when known-projects, registry, or
+  lease/pin JSON cannot be loaded or is not a complete identity record instead
+  of reporting `ready`. Incomplete live leases that omit snapshot-required
+  fields, pins that omit project identity, and persisted registry alias data
+  with an unrecognized `health` value or no configured host aliases stay
+  blocked instead of being normalized during automatic finishing. A missing
+  host-config with an existing registry, lease, or pin record in the selected
+  state root is blocked rather than treated as a confirmable fresh plan.
+  Preview probes service identity even when no host is configured yet, so a
+  socket occupied by a different broker is blocked before device creation.
   `ready` also requires the app snapshot to be at least as new as
   known-projects, lease/pin records, and the lease/pin directories, and to
   match the current doctor-record set, so deletions are finishing work rather
 
@@ -1688,6 +1688,7 @@ function setupExistingHostState(paths, inventory, options = {}) {
       registryMissing = true;
       registry = normalizeRegistry(null, hostConfig, nowIso(options.now));
     } else {
+      assertValidPersistedRegistry(persistedRegistry, hostConfig);
       registry = normalizeRegistry(persistedRegistry, hostConfig, nowIso(options.now));
     }
   } catch (error) {
@@ -2154,6 +2155,37 @@ function normalizeKnownProjects(rawKnownProjects, timestamp) {
   };
 }
 
+function assertValidPersistedRegistry(rawRegistry, hostConfig) {
+  requireObject(rawRegistry, "registry");
+  const rawAliases = requireObject(rawRegistry.aliases, "registry.aliases");
+  if (
+    hostConfig.aliases.length > 0
+    && !hostConfig.aliases.some((hostAlias) => Object.hasOwn(rawAliases, hostAlias.alias))
+  ) {
+    throw new BrokerError("registry.aliases must include at least one configured host alias.", {
+      field: "registry.aliases",
+      reasonCode: "invalid-config",
+    });
+  }
+  for (const hostAlias of hostConfig.aliases) {
+    if (!Object.hasOwn(rawAliases, hostAlias.alias)) {
+      continue;
+    }
+    const fieldPrefix = `registry.aliases.${hostAlias.alias}`;
+    const entry = requireObject(rawAliases[hostAlias.alias], fieldPrefix);
+    if (Object.hasOwn(entry, "health") && !ALLOWED_HEALTH_STATES.has(entry.health)) {
+      throw new BrokerError(
+        `${fieldPrefix}.health must be one of ${[...ALLOWED_HEALTH_STATES].join(", ")}.`,
+        {
+          field: `${fieldPrefix}.health`,
+          reasonCode: "invalid-config",
+        },
+      );
+    }
+  }
+  return rawRegistry;
+}
+
 function normalizeRegistry(rawRegistry, hostConfig, timestamp) {
   if (rawRegistry === null) {
     rawRegistry = {
@@ -2411,7 +2443,11 @@ function assertValidLeaseRecord(record) {
   requireString(record.actorType, "lease.actorType");
   requireString(record.actorId, "lease.actorId");
   requireString(record.projectId, "lease.projectId");
+  requireString(record.projectName, "lease.projectName");
   requireString(record.purposeId, "lease.purposeId");
+  requireString(record.displayName, "lease.displayName");
+  requireString(record.leaseKind, "lease.leaseKind");
+  requireString(record.repoRoot, "lease.repoRoot");
   requireString(record.startedAt, "lease.startedAt");
   requirePositiveIntegerField(record.ownerPid, "lease.ownerPid");
   return record;
@@ -2421,6 +2457,12 @@ function assertValidPinRecord(record) {
   requireObject(record, "pin");
   requireString(record.pinId, "pin.pinId");
   requireString(record.alias, "pin.alias");
+  requireString(record.projectId, "pin.projectId");
+  requireString(record.projectName, "pin.projectName");
+  requireString(record.actorId, "pin.actorId");
+  requireString(record.actorType, "pin.actorType");
+  requireString(record.createdAt, "pin.createdAt");
+  requireString(record.repoRoot, "pin.repoRoot");
   return record;
 }
 
 
@@ -1234,6 +1234,111 @@ test("setup blocks an existing host when doctor-relevant state files are malform
   assert.equal(fs.existsSync(path.join(resolvedPaths.leasesDir, "partial-lease.json")), true);
 });
 
+test("setup blocks snapshot-incomplete leases, pins, and schema-invalid registry alias data", () => {
+  const paths = makePaths();
+  const resolvedPaths = brokerPaths(paths);
+  const preview = previewSetupBroker(resolvedPaths, {
+    hostId: "snapshot-schema-setup",
+    simctlAdapter: paths.simctl.adapter,
+  });
+  applySetupBroker(resolvedPaths, {
+    confirmPlanId: preview.planId,
+    hostId: "snapshot-schema-setup",
+    simctlAdapter: paths.simctl.adapter,
+  });
+
+  const incompleteLeasePath = path.join(resolvedPaths.leasesDir, "incomplete-snapshot-lease.json");
+  writeJson(incompleteLeasePath, {
+    actorId: "agent:1",
+    actorType: "agent",
+    alias: "ui-1",
+    leaseId: "incomplete-snapshot-lease",
+    ownerPid: process.pid,
+    projectId: "demo-app",
+    purposeId: "agent-ui-session",
+    simulatorId: "sim-ui-1",
+    startedAt: "2026-01-01T00:00:00.000Z",
+  });
+  const incompleteLeaseBlocked = previewSetupBroker(resolvedPaths, {
+    simctlAdapter: paths.simctl.adapter,
+  });
+  assert.equal(incompleteLeaseBlocked.status, "blocked");
+  assert.ok(incompleteLeaseBlocked.prerequisites.some((issue) =>
+    issue.id === "leases" && issue.status === "blocked"));
+  assert.throws(() => applySetupBroker(resolvedPaths, {
+    confirmPlanId: incompleteLeaseBlocked.planId,
+    simctlAdapter: paths.simctl.adapter,
+  }), (error) => error.payload?.reasonCode === "setup-prerequisite-failed");
+  assert.equal(fs.existsSync(incompleteLeasePath), true);
+  fs.rmSync(incompleteLeasePath);
+
+  const incompletePinPath = path.join(resolvedPaths.pinsDir, "incomplete-pin.json");
+  writeJson(incompletePinPath, {
+    alias: "ui-1",
+    pinId: "incomplete-pin",
+  });
+  const incompletePinBlocked = previewSetupBroker(resolvedPaths, {
+    simctlAdapter: paths.simctl.adapter,
+  });
+  assert.equal(incompletePinBlocked.status, "blocked");
+  assert.ok(incompletePinBlocked.prerequisites.some((issue) =>
+    issue.id === "leases" && issue.status === "blocked"));
+  assert.throws(() => applySetupBroker(resolvedPaths, {
+    confirmPlanId: incompletePinBlocked.planId,
+    simctlAdapter: paths.simctl.adapter,
+  }), (error) => error.payload?.reasonCode === "setup-prerequisite-failed");
+  assert.deepEqual(readJson(incompletePinPath), {
+    alias: "ui-1",
+    pinId: "incomplete-pin",
+  });
+  fs.rmSync(incompletePinPath);
+
+  const originalRegistry = readJson(resolvedPaths.registryPath);
+  const invalidHealthRegistry = structuredClone(originalRegistry);
+  invalidHealthRegistry.aliases["ui-1"].health = "not-a-health";
+  writeJson(resolvedPaths.registryPath, invalidHealthRegistry);
+  const invalidHealthBlocked = previewSetupBroker(resolvedPaths, {
+    simctlAdapter: paths.simctl.adapter,
+  });
+  assert.equal(invalidHealthBlocked.status, "blocked");
+  assert.ok(invalidHealthBlocked.prerequisites.some((issue) =>
+    issue.id === "registry" && issue.status === "blocked"));
+  assert.throws(() => applySetupBroker(resolvedPaths, {
+    confirmPlanId: invalidHealthBlocked.planId,
+    simctlAdapter: paths.simctl.adapter,
+  }), (error) => error.payload?.reasonCode === "setup-prerequisite-failed");
+  assert.equal(readJson(resolvedPaths.registryPath).aliases["ui-1"].health, "not-a-health");
+
+  writeJson(resolvedPaths.registryPath, {
+    aliases: {},
+    updatedAt: originalRegistry.updatedAt,
+    version: originalRegistry.version,
+  });
+  const emptyAliasMapBlocked = previewSetupBroker(resolvedPaths, {
+    simctlAdapter: paths.simctl.adapter,
+  });
+  assert.equal(emptyAliasMapBlocked.status, "blocked");
+  assert.ok(emptyAliasMapBlocked.prerequisites.some((issue) =>
+    issue.id === "registry" && issue.status === "blocked"));
+  assert.throws(() => applySetupBroker(resolvedPaths, {
+    confirmPlanId: emptyAliasMapBlocked.planId,
+    simctlAdapter: paths.simctl.adapter,
+  }), (error) => error.payload?.reasonCode === "setup-prerequisite-failed");
+  assert.deepEqual(readJson(resolvedPaths.registryPath).aliases, {});
+
+  const missingHealthRegistry = structuredClone(originalRegistry);
+  delete missingHealthRegistry.aliases["ui-1"].health;
+  writeJson(resolvedPaths.registryPath, missingHealthRegistry);
+  const missingHealthAllowed = previewSetupBroker(resolvedPaths, {
+    simctlAdapter: paths.simctl.adapter,
+  });
+  assert.notEqual(missingHealthAllowed.status, "blocked");
+  assert.equal(
+    missingHealthAllowed.prerequisites.some((issue) => issue.id === "registry" && issue.status === "blocked"),
+    false,
+  );
+});
+
 test("setup blocks a missing host config when the state root already has broker records", () => {
   const paths = makePaths();
   const resolvedPaths = brokerPaths(paths);
 
@@ -1,7 +1,7 @@
 # Guided `simbroker setup`
 
 > **Document ID:** `GSB-SETUP-001`
-> **Version:** `1.0.8`
+> **Version:** `1.0.9`
 > **Last Updated:** `2026-08-25`
 > **Status:** `Active`
 > **Owner:** `spec-steward`, `ios-dev`
@@ -184,13 +184,20 @@ Apply performs, in order:
 - Health failure preserves host/service and reports doctor issues plus exact
   per-alias repair commands.
 - Existing invalid/unhealthy host is blocked without repair/replacement,
-  lease/pin mutation, or retirement. Invalid known-projects or lease/pin JSON
-  is the same class of existing-host failure: diagnose with `simbroker doctor`,
-  do not report `ready`. Valid JSON that is not a complete lease or pin
-  identity record, such as `{}` or a lease with only `leaseId` and `alias`,
-  is invalid existing-host state. Setup does not treat a missing host-config
-  as a confirmable fresh plan when the selected state root already contains a
-  registry file or lease/pin JSON.
+  lease/pin mutation, or retirement. Invalid known-projects, registry, or
+  lease/pin JSON is the same class of existing-host failure: diagnose with
+  `simbroker doctor`, do not report `ready`. Valid JSON that is not a complete
+  lease or pin identity record, such as `{}`, a lease with only `leaseId` and
+  `alias`, a live lease that omits snapshot-required fields such as
+  `displayName`, `leaseKind`, `projectName`, or `repoRoot`, or a pin that has
+  `pinId` and `alias` but omits `projectId`, `projectName`, `actorId`,
+  `actorType`, `createdAt`, or `repoRoot`, is invalid existing-host state.
+  Persisted registry alias data that is schema-invalid, such as an
+  unrecognized `health` value or an alias map that contains none of the
+  configured host aliases, is also invalid; setup must not normalize it into a
+  `ready` host. Setup does not treat a missing host-config as a confirmable
+  fresh plan when the selected state root already contains a registry file or
+  lease/pin JSON.
 - Preview probes the requested service socket even when no host is configured
   yet. A running broker with a different host-config, state-root, or socket
   identity is a `service-identity` blocker and is not confirmable, so apply
@@ -418,6 +425,7 @@ long-running plan/handoff/evaluation, and a passing `agent:complete`.
 
 | Version | Date | Author | Changes |
 |---|---|---|---|
+| 1.0.9 | 2026-08-25 | `spec-steward`, `ios-dev` | Fail closed on snapshot-incomplete lease/pin records and schema-invalid persisted registry alias data instead of normalizing them to `ready` |
 | 1.0.8 | 2026-08-25 | `spec-steward`, `ios-dev` | Block partial lease records and missing-host state roots that already contain registry/lease/pin artifacts, keep selected paths on service-identity retries, and refresh the app dashboard on an already-ready setup preview |
 | 1.0.7 | 2026-08-25 | `spec-steward`, `ios-dev` | App Stop/timeout SIGTERM window includes rollback attribution inventory and the extra inventory after an indeterminate create failure |
 | 1.0.6 | 2026-08-25 | `spec-steward`, `ios-dev` | Fail closed on schema-invalid lease/pin JSON, keep fallback device types order-stable, exclude automatic finishing from the setup sheet, treat doctor-record deletions as snapshot finishing work, and preserve selected path overrides in recovery commands |