activator: align leak guard to canonical dw-leak-scanner denylist (add york/brewster/lillian-august/momentum/versa; drop schumacher); cite source (DTD-B)

eb84eed31acb91dcb8ebf5870b0b8ff1550a985b · 2026-07-21 15:38:11 -0700 · steve@designerwallcoverings.com

Files touched

M rotate-activate.js

Diff

commit eb84eed31acb91dcb8ebf5870b0b8ff1550a985b
Author: steve@designerwallcoverings.com <steve@designerwallcoverings.com>
Date:   Tue Jul 21 15:38:11 2026 -0700

    activator: align leak guard to canonical dw-leak-scanner denylist (add york/brewster/lillian-august/momentum/versa; drop schumacher); cite source (DTD-B)
---
 rotate-activate.js | 26 ++++++++++++++++++--------
 1 file changed, 18 insertions(+), 8 deletions(-)

diff --git a/rotate-activate.js b/rotate-activate.js
index e297b2e..fdffded 100644
--- a/rotate-activate.js
+++ b/rotate-activate.js
@@ -225,15 +225,25 @@ function fiveFieldExtra(n) {
 
 // ── PRIVATE-LABEL LEAK GUARD ──────────────────────────────────────────────
 // A product must NEVER go customer-facing (DRAFT→ACTIVE) with the upstream SOURCE
-// name in its title or vendor. This is the durable fix for the 2026-07-21 incident
-// where the activator flipped Greenland cork duplicates ACTIVE with "| Greenland"
-// still in the title (vendor="Greenland" should be "Phillipe Romano"). Fail-safe:
-// this can only BLOCK an activation, never cause one. See memory dw-leak-scanner.
+// name in its title or vendor. Durable fix for the 2026-07-21 incident where the
+// activator flipped Greenland cork duplicates ACTIVE with "| Greenland" still in
+// the title (vendor="Greenland" should be "Phillipe Romano"). Fail-safe: this can
+// only BLOCK an activation, never cause one.
+//
+// SELF-CONTAINED COPY of the canonical denylist — kept decoupled by design
+// (DTD verdict B, 2026-07-21: a ~/Projects app must not cross-import a portable
+// ~/.claude/skills dir). CANONICAL SOURCE OF TRUTH:
+//   ~/.claude/skills/dw-leak-scanner/denylist.json  (+ memory dw-leak-scanner)
+// When that denylist changes, mirror the change here.
+//
 // HARD tokens are never a legitimate pattern/color name → checked in title AND vendor.
-// VENDOR-only tokens can appear as a real pattern name (e.g. a "Chesapeake" pattern) →
-// blocked only when they are the VENDOR (the source), not merely a word in the title.
-const PL_LEAK_HARD = ['greenland', 'wallquest', 'command54', 'seabrook', 'nextwall', 'desima', 'carlsten'];
-const PL_LEAK_VENDOR = [...PL_LEAK_HARD, 'momentum', 'versa', 'schumacher', 'chesapeake', 'nicolette mayer'];
+// VENDOR-only tokens can appear as a real pattern/place name (e.g. a "Chesapeake"
+// pattern or a "York"/"Seabrook" motif) → blocked only when they are the VENDOR
+// (the source), never merely a word in the title. ('schumacher' is intentionally
+// omitted — the denylist treats it as a legitimately-shown repped brand, not a leak.)
+const PL_LEAK_HARD = ['wallquest', 'nextwall', 'command54', 'command 54', 'desima', 'carlsten',
+  'greenland', 'yorkwall', 'lillian august', 'nicolette mayer', 'versa designed surfaces'];
+const PL_LEAK_VENDOR = [...PL_LEAK_HARD, 'chesapeake', 'seabrook', 'brewster', 'york', 'momentum', 'versa'];
 function leakGuard(title, vendor) {
   const t = (title || '').toLowerCase(), v = (vendor || '').toLowerCase();
   const hit = PL_LEAK_HARD.find((x) => t.includes(x)) || PL_LEAK_VENDOR.find((x) => v.includes(x));

← ade810f activator: private-label leak guard — never activate a produ · back to Dw Rotation Activator · activator: word-boundary leak matching — fixes 'versa' false 3f4f5ae →