DC-050 harden dataDir + add image-layer migration

Three-part fix for the silent data-loss failure mode that survives DC-039:
If SERVICES_FILE env was unset, platformPaths.dataDir resolved to /etc/dashcaddy
(image-layer path), and audit/license/error logs would silently land there and
vanish on every container recreate.

1. platform-paths.assertSafe({mode:'production'}) — throws FATAL on forbidden
   zones (/app/src,routes,scripts,utils,managers,security + /etc/* + /usr + /var).
   Bypassed with SKIP_DATA_DIR_GUARD=1.
2. server.js calls assertSafe() before any runtime work.
3. start.sh one-time migration: scans 6 known image-layer zombie paths,
   copies non-empty content to bind mount with 'migrated-' prefix,
   gated by sentinel file. Survives set -e per-file failures.

19/19 platform-paths tests + 5/5 shell migration tests.
Suite: 1066/1067 (1 pre-existing public-routes-drift failure from in-flight
auth refactor, untouched by this commit).

Verified live on DNS2: live audit log at /app/data/audit-log.json (315KB,
active) is unaffected; vestigial 2-byte /app/src/security/audit-log.json +
140KB /app/src/utils/error.log (pre-DC-039 era) will be recovered on next
container recreate.

dashcaddy-api/__tests__/platform-paths.test.js

@@ -112,6 +112,98 @@ describe('Platform Paths — cross-platform path resolution', () => {
     }
   });
 
+  // ============================================================================
+  // dataDir safety guard — DC-046 follow-up to DC-039. Catches the silent
+  // failure mode where SERVICES_FILE isn't set as an env var and resolution
+  // falls back to a path inside the Docker image layer.
+  // ============================================================================
+  describe('assertSafe (DC-046 follow-up to DC-039)', () => {
+    if (process.platform !== 'linux') {
+      it('is a no-op on non-Linux platforms (Windows uses different path tree)', () => {
+        const paths = loadPaths();
+        expect(() => paths.assertSafe({ mode: 'production' })).not.toThrow();
+      });
+      return;
+    }
+
+    it('throws when SERVICES_FILE unset and CADDY_BASE resolves to /etc/dashcaddy', () => {
+      delete process.env.SERVICES_FILE;
+      delete process.env.DATA_DIR;
+      process.env.SKIP_DATA_DIR_GUARD = '';   // ensure guard active
+      const paths = loadPaths();
+      // Force /etc/dashcaddy via env vars to simulate the regression path
+      process.env.CADDY_BASE = '/etc/dashcaddy';
+      const loaded = loadPaths();
+      expect(() => loaded.assertSafe({ mode: 'production' })).toThrow(/forbidden image-layer/);
+    });
+
+    it('throws when dataDir resolves into /app/src', () => {
+      process.env.SERVICES_FILE = '/app/src/security/foo.json';
+      const paths = loadPaths();
+      expect(() => paths.assertSafe({ mode: 'production' })).toThrow(/forbidden image-layer/);
+    });
+
+    it('throws when dataDir resolves into /app/routes', () => {
+      process.env.SERVICES_FILE = '/app/routes/auth/services.json';
+      const paths = loadPaths();
+      expect(() => paths.assertSafe({ mode: 'production' })).toThrow(/forbidden image-layer/);
+    });
+
+    it('allows dataDir at /app/data (the standard production bind mount)', () => {
+      process.env.SERVICES_FILE = '/app/data/services.json';
+      const paths = loadPaths();
+      expect(() => paths.assertSafe({ mode: 'production' })).not.toThrow();
+    });
+
+    it('allows dataDir at /opt/some-bind-mount', () => {
+      process.env.SERVICES_FILE = '/opt/dashcaddy/dashcaddy-api/data/services.json';
+      const paths = loadPaths();
+      expect(() => paths.assertSafe({ mode: 'production' })).not.toThrow();
+    });
+
+    it('is a no-op when mode !== production (dev/test path)', () => {
+      process.env.SERVICES_FILE = '/app/src/security/foo.json';  // would otherwise throw
+      const paths = loadPaths();
+      expect(() => paths.assertSafe({ mode: 'development' })).not.toThrow();
+      expect(() => paths.assertSafe({ mode: 'test' })).not.toThrow();
+      // Default mode is 'production' → a forbidden path MUST throw.
+      expect(() => paths.assertSafe()).toThrow(/forbidden image-layer/);
+    });
+
+    it('is bypassed when SKIP_DATA_DIR_GUARD is set (escape hatch for legacy setups)', () => {
+      process.env.SERVICES_FILE = '/app/src/security/foo.json';
+      process.env.SKIP_DATA_DIR_GUARD = '1';
+      const paths = loadPaths();
+      expect(paths.assertSafe).toBeDefined();
+      // Loader short-circuits if SKIP_DATA_DIR_GUARD was active at module load;
+      // verify via fresh require after re-setting it
+      delete require.cache[require.resolve('../platform-paths')];
+      const loaded = require('../platform-paths');
+      expect(() => loaded.assertSafe({ mode: 'production' })).not.toThrow();
+    });
+  });
+
+  describe('isMountedCheck', () => {
+    it('returns false for non-existent paths', () => {
+      const paths = loadPaths();
+      expect(paths.isMountedCheck('/this/does/not/exist/at/all/abc123')).toBe(false);
+    });
+
+    it('returns true for /tmp (writable on every Linux system)', () => {
+      const paths = loadPaths();
+      expect(paths.isMountedCheck('/tmp')).toBe(true);
+    });
+
+    it('returns false for /app alone (image layer without /app/data sub-mount)', () => {
+      const paths = loadPaths();
+      // In a Docker container this would be /app/data being a separate fs.
+      // In a plain Linux test env, /app likely doesn't exist anyway.
+      // Either way, the predicate should not throw and should return a boolean.
+      const result = paths.isMountedCheck('/app');
+      expect(typeof result).toBe('boolean');
+    });
+  });
+
   describe('Windows-specific defaults', () => {
     if (process.platform === 'win32') {
       it('caddyBase defaults to C:/caddy', () => {

dashcaddy-api/platform-paths.js

@@ -111,4 +111,105 @@ paths.toDockerMountPath = function(hostPath) {
   return hostPath;
 };
 
+// ============================================================================
+// dataDir safety guard — DC-046 follow-up to DC-039
+// ============================================================================
+// The DC-039 fix routed every runtime-data default through `platformPaths.dataDir`
+// (derived from SERVICES_FILE → path.dirname(SERVICES_FILE)). That worked because
+// /opt/dashcaddy/dashcaddy-api/data is bind-mounted at /app/data in production.
+//
+// The silent failure mode that survived: if SERVICES_FILE isn't set as an env
+// var AND no `services.json` exists in the production bind-mount path, the
+// resolution falls back to `path.join(CADDY_BASE, 'services.json')` — and on
+// Linux that resolves to `/etc/dashcaddy/services.json` → dataDir = `/etc/dashcaddy`
+// which is the IMAGE LAYER, not a bind mount. Audit-log / error-log / license
+// files would silently land in the image and vanish on the next recreate.
+//
+// `assertSafe()` is the structural guard. Called once from server.js startup
+// in production mode (NODE_ENV=production). Throws → container refuses to boot
+// loudly, instead of running with a path that loses data silently.
+//
+// Forbidden zones (Docker image layer; recovered only by rebuild):
+//   /app/src/, /app/routes/, /app/scripts/, /app/*.js (literally /app itself
+//   when no subdir — the WORKDIR in Dockerfile is /app and a misdirected write
+//   to /app/audit-log.json would be the same problem)
+//
+// Permitted zones (bind-mounted in production, mount-relative in dev):
+//   /app/data, any non-/app or non-/etc path that resolves onto a real fs
+//
+// On non-Linux platforms, the guard only checks the Linux-style image zones.
+// Windows installs use the E:/ + C:/ ETree and never run inside the Docker image.
+
+const FORBIDDEN_DATA_DIRS = (process.platform === 'linux' && !process.env.SKIP_DATA_DIR_GUARD) ? [
+  // DC-039-era broken defaults. Hits only when SERVICES_FILE is unset AND no
+  // bind mount at /app/data resolves.
+  '/app/src',
+  '/app/routes',
+  '/app/scripts',
+  '/app/utils',
+  '/app/managers',
+  '/app/security',
+  // system dirs that should never be a dataDir
+  '/etc',
+  '/etc/caddy',
+  '/etc/dashcaddy',
+  '/usr',
+  '/usr/local',
+  '/var',
+  '/var/lib/caddy',
+] : [];
+
+paths.isMountedCheck = function(dir) {
+  // Heuristic: a "mounted" dir on Linux is reachable AND writable AND not the
+  // Docker image layer. Returning `false` lets start.sh skip migration cleanly
+  // rather than crashing.
+  if (!fs.existsSync(dir)) return false;
+  try {
+    fs.accessSync(dir, fs.constants.W_OK);
+  } catch {
+    return false;
+  }
+  // On Linux Docker, /app is a baked image layer; /app/data is bind-mounted.
+  // Detect /app without /app/data being a separate mountpoint.
+  if (process.platform === 'linux' && dir === '/app') {
+    return fs.existsSync('/app/data')
+      && fs.statSync('/app/data').dev !== fs.statSync('/app').dev;
+  }
+  return true;
+};
+
+paths.assertSafe = function({ mode = 'production' } = {}) {
+  if (mode !== 'production') return;  // dev / test pass-through
+
+  const dataDirResolved = path.resolve(paths.dataDir);
+  const norm = (p) => p.replace(/\\/g, '/').replace(/\/+$/, '');
+
+  // Zone membership is by first segment, not arbitrary substring matches.
+  // `/app/data` is allowed because `/app/data` is the bind mount; `/app/src`
+  // is forbidden because that's where the source tree lives.
+  for (const forbidden of FORBIDDEN_DATA_DIRS) {
+    if (norm(dataDirResolved) === norm(forbidden)
+        || norm(dataDirResolved).startsWith(norm(forbidden) + '/')) {
+      throw new Error(
+        `[platform-paths] FATAL: dataDir resolved to forbidden image-layer path ` +
+        `"${dataDirResolved}". This is a DC-039-class regression: runtime state would ` +
+        `be written into the Docker image and lost on next container recreate. ` +
+        `Set SERVICES_FILE=/app/data/services.json (or equivalent bind-mounted path) ` +
+        `in your container env. To bypass during local dev, set SKIP_DATA_DIR_GUARD=1.`
+      );
+    }
+  }
+
+  // Second check: dataDir should be on a writable, persistent mount.
+  if (!paths.isMountedCheck(dataDirResolved)) {
+    // Not fatal — but loud. Some Windows + dev workflows have ambiguous
+    // writability. Warn instead of throw so we don't break the install path
+    // for fresh users on Windows.
+    console.warn(
+      `[platform-paths] WARNING: dataDir "${dataDirResolved}" is not writable ` +
+      `or doesn't exist. Runtime writes may fail or land in unexpected places.`
+    );
+  }
+};
+
 module.exports = paths;

dashcaddy-api/server.js

@@ -33,6 +33,13 @@ process.on('uncaughtException', (error) => {
     const SERVICES_FILE = process.env.SERVICES_FILE || platformPaths.servicesFile;
     const CONFIG_FILE = process.env.CONFIG_FILE || platformPaths.servicesFile.replace('services.json', 'config.json');
 
+    // dataDir safety guard — DC-046 follow-up to DC-039. Refuse to boot in
+    // production if dataDir resolved into the Docker image layer (audit-log,
+    // license keys, error logs etc. would silently land there and vanish on
+    // the next container recreate). Throws → no crash-loop, just a clear
+    // fatal error message before any runtime state can be written.
+    platformPaths.assertSafe({ mode: process.env.NODE_ENV === 'production' ? 'production' : 'development' });
+
     // Validate startup configuration
     const { validateStartupConfig } = require('./src/utilities/startup-validator');
     await validateStartupConfig({