Tier 0: render what the services already decided, honestly

Claude-Session: https://claude.ai/code/session_01Ms2FbjQy31TVf3CEvQhGM8

tests/quickshell/user-accounts-contract

@@ -279,6 +279,27 @@ grep -q 'confirmingRemoval' "$delete_page" \
 grep -q 'This cannot be undone' "$delete_page" \
     || fail 'the page does not say that deleting an account destroys their files'
 
+# ── The consent names the real directory, or none ───────────────────────────
+#
+# Four sentences, the armed confirmation among them, built "/home/" + userName
+# and presented the result as fact. A home directory is not reliably there: it
+# can be moved, or live on another mount. accountsservice reports the real one
+# and the helper already carries it, unread. The one place the app was most
+# confident was the one place it was guessing, and it was asking for consent to
+# an irreversible deletion at the time.
+grep -Fq '"homeDirectory": str(values.get("HomeDirectory") or "")' "$helper" \
+    || fail 'the helper no longer reports the real home directory'
+grep -Fq 'function homeDirectory(user: var): string' "$service" \
+    || fail 'the service does not expose the reported home directory'
+if grep -q '"/home/"' "$delete_page"; then
+    fail 'the deletion consent constructs a home path instead of reading the reported one'
+fi
+grep -Fq 'UserAccounts.homeDirectory(' "$delete_page" \
+    || fail 'the deletion consent does not read the reported home directory'
+# And an account with no reported path must be described, not invented.
+grep -Fq 'their home directory' "$delete_page" \
+    || fail 'an account with no reported home directory has nothing honest to say about it'
+
 # The page must not offer to change the type of the only administrator either.
 type_page="$(file_calling 'administratorCount')"
 [[ -n "$type_page" ]] || fail 'nothing on the page knows how many administrators there are'