fix(recovery): distinguish malformed paths from outside-folder denial

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a13eab-1e6a-7b33-9c37-372e90ada3a2

tests/test_identity_offsite.py

@@ -157,3 +157,28 @@ def test_bootstrap_dispatcher_handoff_help_and_missing_checkout(tmp_path):
     env=dict(os.environ,NETKINGDOM_RECOVERY_ROOT=str(tmp_path/'missing'))
     failure=subprocess.run(['bash',str(bootstrap/'bin/railiance'),'identity-recovery','--transfer-receipt','missing','--receipt','new'],env=env,capture_output=True)
     assert failure.returncode==1 and b'Missing reviewed NetKingdom' in failure.stderr
+
+
+@pytest.mark.parametrize('parent_status,outside_status,accepted',[(400,401,True),(400,200,False),(500,401,False)])
+def test_provider_parent_400_requires_independent_outside_folder_denial(monkeypatch,parent_status,outside_status,accepted):
+    store={};owner_auth=('owner','fixture');token=TOKEN
+    def request(client,url,auth,method='GET',body=None,extra=None):
+        if '%2e%2e' in url:return parent_status,b''
+        if url.endswith('/r01-net-kingdom-pg/'):return outside_status,b''
+        name=url.rsplit('/',1)[-1]
+        if method=='PUT':
+            if name in store:return 403,b''
+            store[name]=body;return 201,b''
+        if method=='DELETE':return 403,b''
+        return 200,store[name]
+    def remove(client,url,auth,expected):
+        name=url.rsplit('/',1)[-1];assert auth==owner_auth and store[name]==expected;del store[name]
+    monkeypatch.setattr(setup,'request',request);monkeypatch.setattr(setup,'remove_fixture',remove)
+    receipt={}
+    if accepted:
+        setup.boundary(None,owner_auth,token,'publisher',receipt)
+        assert receipt['provider_boundary_verified'] and receipt['other_account_folder_status']==401
+    else:
+        with pytest.raises(setup.Refused):setup.boundary(None,owner_auth,token,'publisher',receipt)
+        assert not receipt.get('provider_boundary_verified')
+    assert not store