From 8ba0abcf271a0d3e86040cb850a49c37d4f33082 Mon Sep 17 00:00:00 2001
From: damocles <damocles@hyperhive.local>
Date: Mon, 15 Jun 2026 21:16:53 +0200
Subject: [PATCH] matrixAccounts: assert no extra named 'main' (reserved for
 hive account)

---
 nix/templates/harness-base.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/nix/templates/harness-base.nix b/nix/templates/harness-base.nix
index 0e3fda97..8d3b91ee 100644
--- a/nix/templates/harness-base.nix
+++ b/nix/templates/harness-base.nix
@@ -770,6 +770,14 @@ in
           + "(the extras extend the hive-internal `main` account, which only "
           + "exists when matrix is enabled).";
       }
+      # `main` is reserved for the synthesized hive-internal account; a
+      # declared extra by that name would silently collide with it.
+      {
+        assertion = !builtins.hasAttr "main" config.hyperhive.matrixAccounts;
+        message =
+          "hyperhive.matrixAccounts cannot contain a key named \"main\" "
+          + "--- that name is reserved for the hive-internal account.";
+      }
       # hyperhive.frontend.extraFiles[*].target is concatenated into
       # $out during the mergedDist build. The option's strMatching
       # type already rejects leading `/`, leading `.`, and the