harness: assert matrixAccounts tokenFile basenames start with matrix-token (#1702 BE-3)

nix/templates/harness-base.nix

@@ -784,6 +784,28 @@ in
           "hyperhive.matrixAccounts cannot contain a key named \"main\" "
           + "--- that name is reserved for the hive-internal account.";
       }
+      # Token files must land at the `matrix-token*` name the daemon
+      # path-watcher globs (`/agents/*/state/matrix-token*`), or the account
+      # never gets picked up live (it loads only on a full daemon restart).
+      # Enforce the basename prefix so a deviating name (e.g. the historical
+      # `matrix-catgirl-token`) is caught at build time, not silently.
+      {
+        assertion = lib.all (a: lib.hasPrefix "matrix-token" (baseNameOf a.tokenFile)) (
+          lib.attrValues config.hyperhive.matrixAccounts
+        );
+        message =
+          "every hyperhive.matrixAccounts.<name>.tokenFile basename must start with "
+          + "\"matrix-token\" so the daemon path-watcher glob "
+          + "(/agents/*/state/matrix-token*) picks it up live. Offending: "
+          + lib.concatStringsSep ", " (
+            lib.mapAttrsToList (n: a: "${n}=${baseNameOf a.tokenFile}") (
+              lib.filterAttrs (
+                _n: a: !lib.hasPrefix "matrix-token" (baseNameOf a.tokenFile)
+              ) config.hyperhive.matrixAccounts
+            )
+          )
+          + ".";
+      }
       # hyperhive.frontend.extraFiles[*].target is concatenated into
       # $out during the mergedDist build. The option's strMatching
       # type already rejects leading `/`, leading `.`, and the