D124 — machine_path distinguishes client-local paths from a Map's operational target paths

Status: implemented.

Context. The machine_path lint (D75 WP6) flagged every /home/... occurrence as a client-local path needing a {{repo:<key>}}/{{path:<nome>}} placeholder. In practice several real KB pages cite absolute paths that are operational and identical on every reader's machine — an image-defined home (/home/nonroot/.headroom), a container cache (/home/ubuntu/.cache/huggingface), a remote node's runtime path (/home/agent/agent-runs) — and replacing those with a client-side placeholder would resolve to the wrong thing on the reader's own machine. A workstation path such as /Users/beppetemp/tmp/... remains a genuine client-local finding.

Decision. A Map may declare machine_path_allow_prefixes in _map.md (D107 contract seam): a list of absolute path prefixes — POSIX (/...) or Windows drive-absolute (C:\.../C:/...) — that lint treats as this Map's operational target paths rather than client-local paths. lint (internal/lint) enumerates every home-anchored candidate in body order instead of stopping at the first regex match; a candidate is skipped when it lies inside a URL with a parsed scheme, or when it is contained by an allowed prefix using literal, segment-boundary comparison (/home/nonroot covers /home/nonroot/.headroom but not /home/nonroot2). Scanning continues past an allowed match, so a later disallowed match in the same body still surfaces as machine_path. With no allowlist, matching is unchanged from D75 WP6 for the four home-anchored forms (~/..., /Users/..., /home/..., C:\Users\...); URL containment is a strict false-positive removal, not a behavior change for genuine paths. Malformed entries (empty, duplicate, relative, a drive-less Windows form, or the wrong frontmatter type) produce one contract_malformed info finding per malformed key, same as the existing required_fields/require_index_entry contract keys (D107), and never silently broaden an invalid prefix. map_create gained the matching machine_path_allow_prefixes parameter; lint and gate_check consume the same parsed MapContract, cached once per map per run.

Correction to D75. "In shared content, never absolute paths" was too broad: it already carved out container/cluster absolute paths (/etc/..., /var/...) as legitimate because machinePathRe never matched them, but said nothing about home-anchored operational paths that do match the pattern. The accurate statement, and the one docs/sync.md already used, is client-local paths — a path only valid on the machine that wrote it — never a blanket ban on every absolute path shape.

Rationale. Per-Map operational prefixes keep the server free of hardcoded usernames or domain assumptions while letting the KB that actually knows its container/remote layout declare it once. Reusing the D107 contract seam (cached per map, tolerant of malformed entries, informational rather than blocking) keeps the lint deterministic and LLM-free and gives operators one mental model for every map-level lint contract instead of a bespoke mechanism for this one rule.