test(architecture): refuse ignored MSBuild user hooks

Do not treat .user files as inert machine artifacts: the SDK can
import .csproj.user targets after the evaluation-only source census.
Keep those formats refused and plant ignored-file negative controls.

Record the second independent review counterexample without changing
production behavior or expanding supported build shapes.

Author: cemililik

backend/tests/LearnStack.Tests.Architecture/DomainGenericityTests.DemoIdentities.cs

@@ -125,8 +125,13 @@ public void Demo_Literal_Fence_Detects_Decoded_Identities_And_Admits_Platform_Da
             IsDemoLocalArtifact(local).Should().BeTrue();
             OmitIgnoredDemoLocalFile(local).Should().BeTrue("the actual Git rules omit known machine files");
         }
-        foreach (var name in new[] { ".env.hidden.cs", ".env.hidden.json", "hidden.resx" })
+        foreach (var name in new[] { ".env.hidden.cs", ".env.hidden.json", "hidden.resx", "Probe.csproj.user" })
             IsDemoLocalArtifact(Path.Combine(project, name)).Should().BeFalse("ignored source/unknown formats are not machine-file exemptions");
+        // MSBuild automatically imports .csproj.user, so ignore rules cannot exempt it.
+        OmitIgnoredDemoLocalFile(Path.Combine(RepositoryPaths.BackendSrc(), "LearnStack.Api", "Probe.csproj.user"))
+            .Should().BeFalse();
+        Action ignoredBuildHook = () => _ = BackendDemoSourceKind(Path.Combine(project, "Probe.csproj.user"), generated);
+        ignoredBuildHook.Should().Throw<InvalidOperationException>();
         Action unknownFormat = () => _ = BackendDemoSourceKind(Path.Combine(project, "Probe.resx"), generated);
         unknownFormat.Should().Throw<InvalidOperationException>();
         Action linkedInput = () => RequireCompileCoverage([Path.Combine(project, "Probe.cs")], ["/repo/shared/Linked.cs"]);

backend/tests/LearnStack.Tests.Architecture/DomainGenericityTests.SourceCensus.cs

@@ -33,7 +33,7 @@ private static string[] DemoProductionSourceCensus()
     private static bool IsDemoLocalArtifact(string path) => Path.GetFileName(path) is
         ".env" or ".env.local" or ".env.development" or ".env.test" or ".env.production"
         or ".env.development.local" or ".env.test.local" or ".env.production.local" or ".DS_Store" or "Thumbs.db"
-        || Path.GetExtension(path) is ".swp" or ".log" or ".user" or ".suo" or ".rsuser";
+        || Path.GetExtension(path) is ".swp" or ".log" or ".suo" or ".rsuser";
 
     private static bool OmitIgnoredDemoLocalFile(string path)
     {

docs/roadmap/phase-02d-walking-skeleton.md

@@ -6440,7 +6440,11 @@ source `4541d63`, including 2,964 backend and 1,537 frontend cases, the real
 ignored `.env.local` and OS/editor files reached raw filesystem classification.
 The follow-up admits only explicitly known machine filenames that Git also
 ignores. Ignored source files, unknown formats and compiler coverage retain
-fail-closed behavior. Focused reviews and replacement final-head CI are pending.
+fail-closed behavior. The first independent round approved `d16d2d7`. The fresh
+second round reproduced an automatically imported `.csproj.user` build hook;
+`.user` is therefore excluded from the machine-file exemption, with explicit
+refusal controls. The same reviewer must verify this fix before closeout.
+Replacement final-head CI remains required.
 
 **Other finding dispositions.** The gzip adapter equality checks wiring; the
 independent Script observer checks source-window coverage, not a second byte

frontend/apps/web/src/test/demo-genericity-sources.ts

@@ -137,7 +137,7 @@ export function omitIgnoredDemoLocalFile(
     (environment.has(name) ||
       name === '.DS_Store' ||
       name === 'Thumbs.db' ||
-      /\.(?:swp|log|user|suo|rsuser)$/.test(name)) &&
+      /\.(?:swp|log|suo|rsuser)$/.test(name)) &&
     ignored(path)
   );
 }

frontend/apps/web/src/test/demo-genericity.test.ts

@@ -286,8 +286,21 @@ describe('P02d-7 exact demo identity boundary', () => {
       });
       expect(result.status).toBe(0);
     }
-    for (const name of ['.env.hidden.ts', '.env.hidden.json', 'hidden.vue', 'hidden.resx'])
+    for (const name of [
+      '.env.hidden.ts',
+      '.env.hidden.json',
+      'hidden.vue',
+      'hidden.resx',
+      'Probe.csproj.user',
+    ])
       expect(omitIgnoredDemoLocalFile(`frontend/apps/web/${name}`, () => true)).toBe(false);
+    // MSBuild automatically imports this ignored format; it is not inert machine data.
+    expect(
+      spawnSync('git', ['check-ignore', '--quiet', '--', 'frontend/apps/web/Probe.csproj.user'], {
+        cwd: root,
+        stdio: 'ignore',
+      }).status,
+    ).toBe(0);
     expect(() => demoSourceClassification('frontend/apps/web/hidden.vue')).toThrow('Unclassified');
   });
   it('refuses unclassified production roots and formats while retaining declared non-runtime ownership', () => {