intake: several configured intake channels (mcp, folder, command) all end in quarantine/ (was mcp-upload/), and upload collect pulls the synced-folder and command channels into it (#213); 10.0.0-beta.11

Files changed:
- .gitignore
- CHANGES.md
- VERSION
- docs/explanation/architecture.md
- docs/explanation/pipeline-rationale.md
- docs/how-to/README.md
- docs/how-to/back-up-to-a-synced-folder.md
- docs/how-to/collect-from-a-synced-folder.md
- docs/how-to/ingest-a-source.md
- docs/how-to/set-up-the-mcp-server.md
- docs/reference/commands/README.md
- docs/reference/commands/git.md
- docs/reference/commands/instance-health.md
- docs/reference/commands/raw-material-and-uploads.md
- docs/reference/configuration.md
- instructions/gates.md
- instructions/ingest-queue.md
- instructions/mcp-read-server.md
- instructions/migrations/10.0.0-settings-tiers.md
- instructions/wiki-ingest/SKILL.md
- raw/CONTRACT.md
- tools/CONTRACT.md
- tools/README.md
- tools/chemenu/cli_contract.py
- tools/chemenu/collect.py
- tools/chemenu/commands/backup_cmd.py
- tools/chemenu/commands/docs_verify.py
- tools/chemenu/commands/doctor.py
- tools/chemenu/commands/raw/pending.py
- tools/chemenu/commands/upload_cmd.py
- tools/chemenu/config.py
- tools/chemenu/config_shapes.py
- tools/chemenu/legacy_settings.py
- tools/chemenu/mcp/server.py
- tools/chemenu/reference_doc.py
- tools/chemenu/tests/test_backup.py
- tools/chemenu/tests/test_collect.py
- tools/chemenu/tests/test_config_shapes.py
- tools/chemenu/tests/test_doctor.py
- tools/chemenu/tests/test_legacy_settings.py
- tools/chemenu/tests/test_mcp_server.py
- tools/chemenu/tests/test_upload.py
- tools/chemenu/tests/test_upload_cmd.py
- tools/chemenu/upload.py

Co-Authored-By: Claude Code <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SnAJ7Z3CpVD3PRbN73QtU2

instructions/migrations/10.0.0-settings-tiers.md

@@ -1,7 +1,7 @@
 ---
 type: types/instruction.md
 name: 10.0.0-settings-tiers
-description: Move the settings of the four per-feature files .wikitool-telemetry.json, .wikitool-remotes.json, .wikitool-upload.json and .wikitool-tasks.json into the tiered settings with `wikitool config migrate` - run once per checkout; without it the Publish-Remote Gate and the upload limits are not in effect and the commands that need them exit 42.
+description: Move the settings of the four per-feature files .wikitool-telemetry.json, .wikitool-remotes.json, .wikitool-upload.json and .wikitool-tasks.json into the tiered settings with `wikitool config migrate`, and move the quarantine mcp-upload/ to quarantine/ - run once per checkout; without it the Publish-Remote Gate and the upload limits are not in effect and the commands that need them exit 42.
 manual: true
 migrates_to: 10.0.0
 migration_kind: mechanical
@@ -13,7 +13,8 @@ Until 10.0.0 four features kept their settings in a file of their own at the roo
 checkout: `.wikitool-telemetry.json`, `.wikitool-remotes.json`, `.wikitool-upload.json` and
 `.wikitool-tasks.json`. 10.0.0 reads none of them. The same settings are now sections of the
 [tiered settings](../../docs/reference/configuration.md#tiered-settings) - `telemetry`,
-`remotes`, `upload`, and `tasks` with `superproductivity` and `caldav` - and each field sits in
+`remotes`, `intake` (the old `upload` file becomes its channel `mcp`), and `tasks` with
+`superproductivity` and `caldav` - and each field sits in
 the file its tier names: `wikitool.json` (committed) for what is the same in every clone,
 `.wikitool-local.json` for what is true of one checkout, and for a token or a password the
 secrets file, with only a reference in `wikitool.json`.
@@ -23,6 +24,13 @@ Publish-Remote Gate, no upload limits, no tracker. `wikitool config migrate` mov
 removes the old files. It is `mechanical` because nothing is decided per file: every setting keeps
 its effective value, defaults included.
 
+10.0.0 also renames the quarantine of the intake channels from `mcp-upload/` to `quarantine/`,
+because it no longer holds only what the MCP `submit` tool received. A checkout whose `mcp-upload/`
+still holds submissions that wait for review moves that directory once, by hand - nothing moves it
+automatically, since material that waits for a decision is not the tool's to relocate. Until it
+is moved, `doctor` reports a `FAIL` on `upload-intake` with the command, the `upload` commands
+exit 1 naming it, and the MCP server does not start.
+
 <!-- wikitool:toc -->
 ## Contents
 
@@ -52,8 +60,9 @@ command below.
    tools/wikitool doctor
    ```
 
-   Each old file that is still present is one `legacy-settings` line. None, and the checkout has
-   nothing to move: go to step 4.
+   Each old file that is still present is one `legacy-settings` line, and an `mcp-upload/` that
+   still holds submissions is a `FAIL` on the `upload-intake` line. Neither, and the checkout has
+   nothing to move: go to step 5.
 
 2. **Move it:**
 
@@ -67,18 +76,33 @@ command below.
    removes the old ones; if anything fails, nothing is changed and the old files are as they were.
    A second run says there is nothing to move.
 
-3. **Check it:**
+3. **Move the quarantine, if `mcp-upload/` still holds submissions.** In the instance root:
+
+   ```bash
+   mv mcp-upload quarantine              # POSIX shells
+   Move-Item mcp-upload quarantine       # PowerShell
+   ```
+
+   If `quarantine/` exists already (the new version created it), move the entries of
+   `mcp-upload/` into it one by one - each is a directory named by its id, plus `ledger.jsonl`,
+   which is appended to the existing ledger rather than replacing it - and remove the empty
+   `mcp-upload/` afterwards. Open submissions keep their ids and are listed by `upload list` again.
+   The root `.gitignore` of an instance carries `/quarantine/` from this version on; `dist upgrade`
+   brings the entry, and the quarantine writes its own `.gitignore` as well.
+
+4. **Check it:**
 
    ```bash
    tools/wikitool doctor
    git status --short
    ```
 
-   `doctor` shows no `legacy-settings` line, and the settings lines are `OK`. `git status` shows
+   `doctor` shows no `legacy-settings` line, the `upload-intake` line is not a `FAIL`, and the
+   settings lines are `OK`. `git status` shows
    `wikitool.json` as new or changed: it holds the instance-tier values and the references, and it
    is committed with the next `publish`. `.wikitool-local.json` does not appear, being ignored.
 
-4. **Record it, once per instance** - not once per checkout:
+5. **Record it, once per instance** - not once per checkout:
 
    ```bash
    tools/wikitool migrate done 10.0.0 --pages 0
@@ -89,8 +113,9 @@ command below.
 
 ## How to tell a migrated checkout from an unmigrated one
 
-An unmigrated checkout has at least one of the four files at its root, and `doctor` names each.
-A migrated one has none; `.wikitool-tools.json` is not among them and stays.
+An unmigrated checkout has at least one of the four files at its root, or an `mcp-upload/` that
+still holds submissions; `doctor` names each. A migrated one has none; `.wikitool-tools.json` is
+not among them and stays.
 
 ## Decision points
 
@@ -103,7 +128,8 @@ A migrated one has none; `.wikitool-tools.json` is not among them and stays.
   carried over.
 - **The old Publish-Remote allowlist or upload limits go where?** Into `.wikitool-local.json`:
   both affect a gate, so `config set` does not write them, and the migration is the one command
-  that does. Later changes to them are the user's own edit.
+  that does. The upload limits become the channel `mcp` of the `intake` section. Later changes to
+  them are the user's own edit.
 - **A profile file `WIKITOOL_TASKS_CONFIG` points at still holds a plain token?** It is not
   touched by `config migrate`, and it is no longer read as the old format: a profile has the layout of
   `.wikitool-local.json` and holds references only
@@ -112,6 +138,6 @@ A migrated one has none; `.wikitool-tools.json` is not among them and stays.
 
 ## Scope
 
-The four files named above, in the checkout the command runs in. `.wikitool-tools.json` and the
+The four files named above and the `mcp-upload/` directory, in the checkout the command runs in. `.wikitool-tools.json` and the
 two tiered settings files are not old files. The machinery - the readers, `config migrate`,
 `doctor`'s check - arrived with `dist upgrade` and needs nothing from this document.