@indigoai-us/hq-cloud 6.11.19 → 6.12.0

package/src/cli/share.test.ts

@@ -993,7 +993,7 @@ describe("share", () => {
     expect(putKeys).not.toContain("projects/.gitkeep");
   });
 
-  it("scoped push defense-in-depth: a 403 on HEAD skips that key (named error) instead of aborting the company", async () => {
+  it("scoped push defense-in-depth: a 403 on HEAD skips that key as scope-excluded without an error event", async () => {
     // Belt-and-suspenders: even if a key slips past the prefix filter (a grant
     // that changed mid-run, a pin outside the grant, prefix-coalesce
     // imprecision), the server's correct 403 on the HEAD must NOT abort the
@@ -1017,7 +1017,7 @@ describe("share", () => {
       return null;
     });
 
-    const events: Array<{ type?: string; path?: string; message?: string }> = [];
+    const events: Array<{ type?: string; path?: string; message?: string; count?: number; samplePaths?: string[] }> = [];
     const result = await share({
       paths: [okFile, blockedFile],
       company: "acme",
@@ -1031,21 +1031,85 @@ describe("share", () => {
     expect(result.filesUploaded).toBe(1);
     const putKeys = vi.mocked(uploadFile).mock.calls.map((c) => c[2]);
     expect(putKeys).toEqual(["in-scope.md"]);
-    // The blocked key surfaced as a path-named, scope-clear error event.
+    expect(result.filesExcludedByScope).toBe(1);
+    const scopeEv = events.find((e) => e.type === "scope-excluded") as
+      | { count: number; samplePaths: string[] }
+      | undefined;
+    expect(scopeEv).toBeDefined();
+    expect(scopeEv!.count).toBe(1);
+    expect(scopeEv!.samplePaths).toEqual(["out-of-reach.md"]);
+    expect(events.some((e) => e.type === "error")).toBe(false);
+  });
+
+  it("scoped push defense-in-depth: a 403 on PUT skips that key as scope-excluded without an error event", async () => {
+    const companyRoot = path.join(tmpDir, "companies", "acme");
+    fs.mkdirSync(companyRoot, { recursive: true });
+    const blockedFile = path.join(companyRoot, "put-denied.md");
+    fs.writeFileSync(blockedFile, "denied\n");
+
+    vi.mocked(uploadFile).mockImplementation(async (_ctx, _abs, key) => {
+      if (key === "put-denied.md") {
+        const err = new Error("access denied");
+        (err as { name: string }).name = "AccessDenied";
+        throw err;
+      }
+      return { etag: '"upload-etag"' };
+    });
+
+    const events: Array<{ type?: string; path?: string; message?: string; count?: number; samplePaths?: string[] }> = [];
+    const result = await share({
+      paths: [blockedFile],
+      company: "acme",
+      vaultConfig: mockConfig,
+      hqRoot: tmpDir,
+      onEvent: (e) => events.push(e as { type?: string }),
+    });
+
+    expect(result.aborted).toBe(false);
+    expect(result.filesUploaded).toBe(0);
+    expect(result.filesExcludedByScope).toBe(1);
+    const scopeEv = events.find((e) => e.type === "scope-excluded") as
+      | { count: number; samplePaths: string[] }
+      | undefined;
+    expect(scopeEv).toBeDefined();
+    expect(scopeEv!.count).toBe(1);
+    expect(scopeEv!.samplePaths).toEqual(["put-denied.md"]);
+    expect(events.some((e) => e.type === "error")).toBe(false);
+  });
+
+  it("scoped push defense-in-depth: a non-access-denied PUT failure still emits an error event", async () => {
+    const companyRoot = path.join(tmpDir, "companies", "acme");
+    fs.mkdirSync(companyRoot, { recursive: true });
+    const failedFile = path.join(companyRoot, "put-failed.md");
+    fs.writeFileSync(failedFile, "failed\n");
+
+    vi.mocked(uploadFile).mockRejectedValueOnce(new Error("S3 down"));
+
+    const events: Array<{ type?: string; path?: string; message?: string }> = [];
+    const result = await share({
+      paths: [failedFile],
+      company: "acme",
+      vaultConfig: mockConfig,
+      hqRoot: tmpDir,
+      onEvent: (e) => events.push(e as { type?: string }),
+    });
+
+    expect(result.filesUploaded).toBe(0);
+    expect(result.filesExcludedByScope).toBe(0);
     const errs = events.filter((e) => e.type === "error") as Array<{ path?: string; message?: string }>;
     expect(errs).toHaveLength(1);
-    expect(errs[0].path).toBe("out-of-reach.md");
-    expect(errs[0].message).toMatch(/outside granted ACL scope/i);
+    expect(errs[0].path).toBe("put-failed.md");
+    expect(errs[0].message).toBe("S3 down");
   });
 
-  it("a Forbidden HEAD (presigned-transport denial) skips the key — NEVER an unconditional PUT", async () => {
+  it("a Forbidden HEAD (presigned-transport denial) skips the key as scope-excluded — NEVER an unconditional PUT", async () => {
     // Regression for the 2026-06-10..12 vault regression storm: the presigned
     // transport used to map per-key denials and signed-GET 403s to `null`,
     // which `processUploadItem` read as "no remote object" — skipping every
     // conflict guard and blind-PUTting this machine's (possibly stale) bytes
     // over a newer remote. The transport now throws `name: "Forbidden"`
     // (SDK HeadObject parity); this locks the share side of that contract:
-    // a Forbidden HEAD must skip the key, emit a named error, and issue NO PUT.
+    // a Forbidden HEAD must skip the key as scope-excluded and issue NO PUT.
     const companyRoot = path.join(tmpDir, "companies", "acme");
     fs.mkdirSync(companyRoot, { recursive: true });
     const staleFile = path.join(companyRoot, "stale-local.md");
@@ -1059,7 +1123,7 @@ describe("share", () => {
       throw err;
     });
 
-    const events: Array<{ type?: string; path?: string; message?: string }> = [];
+    const events: Array<{ type?: string; path?: string; message?: string; count?: number; samplePaths?: string[] }> = [];
     const result = await share({
       paths: [staleFile],
       company: "acme",
@@ -1072,9 +1136,13 @@ describe("share", () => {
     expect(vi.mocked(uploadFile)).not.toHaveBeenCalled();
     expect(result.filesUploaded).toBe(0);
     expect(result.aborted).toBe(false);
-    const errs2 = events.filter((e) => e.type === "error") as Array<{ path?: string }>;
-    expect(errs2).toHaveLength(1);
-    expect(errs2[0].path).toBe("stale-local.md");
+    expect(result.filesExcludedByScope).toBe(1);
+    const scopeEv = events.find((e) => e.type === "scope-excluded") as
+      | { count: number; samplePaths: string[] }
+      | undefined;
+    expect(scopeEv).toBeDefined();
+    expect(scopeEv!.samplePaths).toEqual(["stale-local.md"]);
+    expect(events.some((e) => e.type === "error")).toBe(false);
   });
 
   it("uploads (no conflict) when only the local side changed since last sync", async () => {

package/src/cli/share.ts

@@ -1156,14 +1156,7 @@ async function executeUploads(
       remoteMeta = await headRemoteFile(run.ctx, relativePath);
     } catch (headErr) {
       if (isAccessDenied(headErr)) {
-        run.emit({
-          type: "error",
-          path: relativePath,
-          message:
-            "skipped: outside granted ACL scope (server returned 403 " +
-            "SCOPE_EXCEEDS_PARENT / access denied on HEAD). Grant this path " +
-            "to push it, or it stays local-only.",
-        });
+        run.scopeExcludedSet.add(relativePath);
         return;
       }
       throw headErr;
@@ -1325,16 +1318,14 @@ async function executeUploads(
         counters.filesSkipped++;
         return;
       }
+      if (isAccessDenied(err)) {
+        run.scopeExcludedSet.add(relativePath);
+        return;
+      }
       run.emit({
         type: "error",
         path: relativePath,
-        message: isAccessDenied(err)
-          ? "skipped: outside granted ACL scope (server returned 403 " +
-            "SCOPE_EXCEEDS_PARENT / access denied on PUT). Grant this path " +
-            "to push it, or it stays local-only."
-          : err instanceof Error
-            ? err.message
-            : String(err),
+        message: err instanceof Error ? err.message : String(err),
       });
     }
   };
@@ -2256,12 +2247,25 @@ async function computeDeletePlan(
   for (let i = 0; i < headCandidates.length; i += DELETE_PLAN_HEAD_CONCURRENCY) {
     const chunk = headCandidates.slice(i, i + DELETE_PLAN_HEAD_CONCURRENCY);
     const results = await Promise.all(
-      chunk.map(async (c) => ({
-        candidate: c,
-        remote: await headRemoteFile(ctx, c.key),
-      })),
+      chunk.map(async (c) => {
+        try {
+          return {
+            candidate: c,
+            remote: await headRemoteFile(ctx, c.key),
+            scopeExcluded: false,
+          };
+        } catch (err) {
+          if (isAccessDenied(err)) {
+            return { candidate: c, remote: null, scopeExcluded: true };
+          }
+          throw err;
+        }
+      }),
     );
-    for (const { candidate, remote } of results) {
+    for (const { candidate, remote, scopeExcluded } of results) {
+      if (scopeExcluded) {
+        continue;
+      }
       if (remote === null) {
         plan.toTombstone.push(candidate.key);
         continue;

package/src/cli/sync.test.ts

@@ -895,7 +895,7 @@ describe("sync", () => {
     expect(fs.existsSync(journalPath)).toBe(false);
   });
 
-  it("personalMode: true skips companies/* keys and downloads root keys to hqRoot", async () => {
+  it("personalMode: downloads local companies/* keys and root keys to hqRoot by default", async () => {
     vi.mocked(s3Module.listRemoteFiles).mockResolvedValueOnce([
       { key: "companies/foo/bar.md", size: 50, lastModified: new Date(), etag: '"xyz789"' },
       { key: "docs/readme.md",       size: 30, lastModified: new Date(), etag: '"abc000"' },
@@ -906,22 +906,24 @@ describe("sync", () => {
       vaultConfig: mockConfig,
       hqRoot: tmpDir,
       personalMode: true,
+      // No teamSyncedSlugs → foo is a local (non-cloud) company, downloaded.
     });
 
-    // Exact counts (regression-tight)
-    expect(result.filesSkipped).toBe(1);
-    expect(result.filesDownloaded).toBe(1);
+    // Exact counts (regression-tight): local company + root key both land.
+    expect(result.filesSkipped).toBe(0);
+    expect(result.filesDownloaded).toBe(2);
 
-    // companies/* must NOT land anywhere
+    // companies/foo (local, non-cloud) lands at <hqRoot>/companies/foo/bar.md,
+    // NOT double-nested under <hqRoot>/companies/<slug>/companies/...
+    expect(fs.existsSync(path.join(tmpDir, "companies", "foo", "bar.md"))).toBe(true);
     expect(fs.existsSync(path.join(tmpDir, "companies", "acme", "companies", "foo", "bar.md"))).toBe(false);
-    expect(fs.existsSync(path.join(tmpDir, "companies", "foo", "bar.md"))).toBe(false);
 
     // docs/readme.md MUST land at <hqRoot>/docs/readme.md (NOT <hqRoot>/companies/<slug>/docs/readme.md)
     expect(fs.existsSync(path.join(tmpDir, "docs", "readme.md"))).toBe(true);
     expect(fs.existsSync(path.join(tmpDir, "companies", "acme", "docs", "readme.md"))).toBe(false);
   });
 
-  it("personalMode: downloads + journals companies/manifest.yaml (carve-out round-trips) while still skipping other companies/* keys", async () => {
+  it("personalMode: downloads + journals companies/manifest.yaml (carve-out round-trips) while still skipping team-synced orphan keys", async () => {
     vi.mocked(s3Module.listRemoteFiles).mockResolvedValueOnce([
       { key: "companies/foo/bar.md",    size: 50, lastModified: new Date(), etag: '"xyz789"' },
       { key: "companies/manifest.yaml", size: 40, lastModified: new Date(), etag: '"man111"' },
@@ -932,10 +934,12 @@ describe("sync", () => {
       vaultConfig: mockConfig,
       hqRoot: tmpDir,
       personalMode: true,
+      // foo is now cloud-backed (team-synced) → its key is a stale orphan.
+      teamSyncedSlugs: new Set(["foo"]),
     });
 
-    // The manifest is the lone companies/* exemption: it downloads; other
-    // companies/* keys are still dropped.
+    // The manifest always downloads (routing source-of-truth carve-out);
+    // the team-synced orphan key is dropped.
     expect(result.filesSkipped).toBe(1);
     expect(result.filesDownloaded).toBe(1);
     expect(fs.existsSync(path.join(tmpDir, "companies", "manifest.yaml"))).toBe(true);
@@ -1080,13 +1084,12 @@ describe("sync", () => {
     expect(kept.thread_path).toBe("workspace/threads/T-machineB.json");
   });
 
-  it("personalMode + includeLocalCompanies: downloads companies/{cloud-false-slug}/... keys when slug NOT in teamSyncedSlugs", async () => {
-    // The symmetric flip for the cloud:false → personal-bucket fallback.
-    // Machine A pushed `companies/free-co/notes.md` to the personal bucket
-    // (because the operator set `HQ_SYNC_LOCAL_COMPANIES_TO_PERSONAL=1`
-    // AND `company.yaml` declares `cloud: false`). Machine B subscribes:
-    // pull must allow these keys through the personalMode filter, otherwise
-    // the feature is push-only and the destination machine never sees them.
+  it("personalMode: downloads companies/{local-slug}/... keys by default when slug NOT in teamSyncedSlugs", async () => {
+    // Local (non-cloud) companies sync to the personal vault by default.
+    // Machine A pushed `companies/free-co/notes.md` to the personal bucket;
+    // machine B subscribes: pull must allow these keys through the
+    // personalMode filter, otherwise the feature is push-only and the
+    // destination machine never sees them.
     vi.mocked(s3Module.listRemoteFiles).mockResolvedValueOnce([
       { key: "companies/free-co/notes.md", size: 50, lastModified: new Date(), etag: '"abc"' },
       { key: "docs/readme.md",             size: 30, lastModified: new Date(), etag: '"def"' },
@@ -1097,7 +1100,6 @@ describe("sync", () => {
       vaultConfig: mockConfig,
       hqRoot: tmpDir,
       personalMode: true,
-      includeLocalCompanies: true,
       teamSyncedSlugs: new Set(),  // empty → no slug is "orphan"
     });
 
@@ -1107,21 +1109,20 @@ describe("sync", () => {
     expect(fs.existsSync(path.join(tmpDir, "docs", "readme.md"))).toBe(true);
   });
 
-  it("personalMode + includeLocalCompanies: drops companies/{team-synced-slug}/... keys as orphans (symmetric to push-side decommission)", async () => {
-    // The orphan-cleanup half. Once a company has been promoted from
-    // cloud:false fallback to its own team bucket, the operator gains
-    // an active Membership for it (slug enters teamSyncedSlugs). Any
-    // leftover `companies/{that-slug}/...` keys in the personal bucket
-    // are stale residue — downloading them would clash with the team-
-    // bucket pull at the same disk path. Filter drops them silently.
-    // Push-side `decommissionPrefixes` eventually removes them from the
+  it("personalMode: drops companies/{team-synced-slug}/... keys as orphans (company became cloud-true)", async () => {
+    // The orphan-cleanup half. Once a company becomes cloud-true, the
+    // operator gains an active Membership for it (slug enters
+    // teamSyncedSlugs). Any leftover `companies/{that-slug}/...` keys in
+    // the personal bucket are stale residue — downloading them would clash
+    // with the team-bucket pull at the same disk path. Filter drops them
+    // silently. Push-side `decommissionPrefixes` removes them from the
     // bucket; this filter keeps the local tree clean in the meantime
     // (especially important for pull-only mode where decommission never
     // runs).
     vi.mocked(s3Module.listRemoteFiles).mockResolvedValueOnce([
       // Orphan: this slug is now team-synced — drop the key.
       { key: "companies/acme/file.md",    size: 50, lastModified: new Date(), etag: '"old"' },
-      // Legitimate cloud:false content: download.
+      // Legitimate local content: download.
       { key: "companies/free-co/notes.md", size: 30, lastModified: new Date(), etag: '"new"' },
     ]);
 
@@ -1130,7 +1131,6 @@ describe("sync", () => {
       vaultConfig: mockConfig,
       hqRoot: tmpDir,
       personalMode: true,
-      includeLocalCompanies: true,
       teamSyncedSlugs: new Set(["acme"]),
     });
 
@@ -1142,18 +1142,16 @@ describe("sync", () => {
     expect(fs.existsSync(path.join(tmpDir, "companies", "free-co", "notes.md"))).toBe(true);
   });
 
-  it("personalMode WITHOUT includeLocalCompanies: legacy behavior preserved — ALL companies/... keys dropped", async () => {
-    // Regression for the legacy contract. Pre-5.20 (and any operator who
-    // hasn't opted into HQ_SYNC_LOCAL_COMPANIES_TO_PERSONAL=1), the
-    // personal bucket should never contain `companies/...` keys. If they
-    // do exist (stale data, manual S3 console intervention, an old bug),
-    // the pull-side filter drops them as a safety net. This test pins
-    // that contract under the new option shape: includeLocalCompanies
-    // omitted → behaves identically to the original filter, even if
-    // teamSyncedSlugs is supplied.
+  it("personalMode: companies/manifest.yaml always downloads (routing source-of-truth), even when other slugs are team-synced", async () => {
+    // The manifest is the one `companies/...` key carved into the personal
+    // vault unconditionally. It must round-trip on pull even when the
+    // operator has team-synced slugs (its key segment `manifest.yaml` is
+    // not a real slug and must never be treated as an orphan).
     vi.mocked(s3Module.listRemoteFiles).mockResolvedValueOnce([
-      { key: "companies/anything/file.md", size: 50, lastModified: new Date(), etag: '"x"' },
-      { key: "docs/readme.md",             size: 30, lastModified: new Date(), etag: '"y"' },
+      { key: "companies/manifest.yaml", size: 40, lastModified: new Date(), etag: '"m"' },
+      // A team-synced orphan that must still be dropped.
+      { key: "companies/acme/file.md",  size: 50, lastModified: new Date(), etag: '"o"' },
+      { key: "docs/readme.md",          size: 30, lastModified: new Date(), etag: '"d"' },
     ]);
 
     const result = await sync({
@@ -1161,13 +1159,13 @@ describe("sync", () => {
       vaultConfig: mockConfig,
       hqRoot: tmpDir,
       personalMode: true,
-      // includeLocalCompanies omitted → defaults to false
-      teamSyncedSlugs: new Set(["unrelated"]),
+      teamSyncedSlugs: new Set(["acme"]),
     });
 
-    expect(result.filesDownloaded).toBe(1);
+    expect(result.filesDownloaded).toBe(2);
     expect(result.filesSkipped).toBe(1);
-    expect(fs.existsSync(path.join(tmpDir, "companies", "anything", "file.md"))).toBe(false);
+    expect(fs.existsSync(path.join(tmpDir, "companies", "manifest.yaml"))).toBe(true);
+    expect(fs.existsSync(path.join(tmpDir, "companies", "acme", "file.md"))).toBe(false);
     expect(fs.existsSync(path.join(tmpDir, "docs", "readme.md"))).toBe(true);
   });
 

package/src/cli/sync.ts

@@ -323,35 +323,21 @@ export interface SyncOptions {
   onEvent?: (event: SyncProgressEvent) => void;
   /**
    * When true, the caller is syncing against the caller's person-entity
-   * bucket. Pulled keys whose path starts with `companies/` are dropped
-   * by default (belt-and-braces — the person bucket should never contain
-   * those, and the runner must not write them into the user's company
-   * folders). See `includeLocalCompanies` for the opt-in escape hatch.
+   * bucket. Pulled keys whose path starts with `companies/` are local
+   * (non-cloud) companies that sync to the personal vault by default —
+   * they are allowed through EXCEPT for slugs in `teamSyncedSlugs` (which
+   * are cloud-backed orphans, see below). `companies/manifest.yaml` is
+   * always allowed (routing source-of-truth).
    */
   personalMode?: boolean;
-  /**
-   * Opt-in: when `personalMode === true`, allow `companies/{slug}/...` keys
-   * through the pull filter EXCEPT for slugs in `teamSyncedSlugs` (which
-   * are orphan remnants from a company that was promoted to its own team
-   * bucket and remain pre-decommission). Mirrors the push-side
-   * `HQ_SYNC_LOCAL_COMPANIES_TO_PERSONAL=1` gate: when an operator opts
-   * into the cloud:false → personal-bucket fallback on their machine,
-   * pull must also know about the new key shape on the OTHER machine that
-   * subscribes to those keys. Without this, the feature is push-only —
-   * the destination machine never sees the keys.
-   *
-   * Default false preserves the pre-5.20 behavior (drop all
-   * `companies/...` keys in personalMode).
-   */
-  includeLocalCompanies?: boolean;
   /**
    * Slugs of companies the operator has an active team-bucket Membership
-   * for. Only consulted when `personalMode === true` AND
-   * `includeLocalCompanies === true`: keys under `companies/{slug}/...`
-   * for any slug in this set are dropped as orphans from a pre-promotion
-   * personal-bucket fallback. The push-side decommission cycle eventually
-   * removes these from the bucket; this filter prevents them from
-   * re-downloading into the same disk paths the team-bucket pull manages.
+   * for. Only consulted when `personalMode === true`: keys under
+   * `companies/{slug}/...` for any slug in this set are dropped as orphans
+   * from a pre-promotion personal-bucket fallback (the company became
+   * cloud-true). The push-side decommission cycle removes these from the
+   * bucket; this filter prevents them from re-downloading into the same
+   * disk paths the team-bucket pull manages.
    */
   teamSyncedSlugs?: ReadonlySet<string>;
   /**
@@ -798,7 +784,6 @@ function planPull(run: PullRunContext): PullPlan {
     run.companyRoot,
     run.shouldSync,
     run.options.personalMode === true,
-    run.options.includeLocalCompanies === true,
     run.options.teamSyncedSlugs ?? null,
     run.currentPrefixSet,
     run.fileTombstones,
@@ -1729,7 +1714,6 @@ function computePullPlan(
   companyRoot: string,
   shouldSync: (filePath: string, isDir?: boolean) => boolean,
   personalMode: boolean,
-  includeLocalCompanies: boolean,
   teamSyncedSlugs: ReadonlySet<string> | null,
   // Coalesced, company-relative prefixes the pull is scoped to (US-005).
   // `[""]` (the `all`-mode value) covers everything via `isCoveredByAny`, so
@@ -1774,18 +1758,13 @@ function computePullPlan(
       // fall through to download + journal like any personal file.
       remoteFile.key !== PERSONAL_VAULT_MANIFEST_KEY
     ) {
-      // Default: drop every `companies/...` key — the legacy contract
-      // is that the personal bucket should never contain them.
-      //
-      // EXCEPTION: when the operator has opted into the cloud:false →
-      // personal-bucket fallback (HQ_SYNC_LOCAL_COMPANIES_TO_PERSONAL=1
-      // on this machine), keys under `companies/{slug}/...` are
-      // legitimate — they're content a peer machine pushed for a
-      // company whose `company.yaml` declares `cloud: false`. Allow
-      // them through EXCEPT for slugs the operator has an active team-
-      // bucket Membership for: those are orphan remnants from before
-      // the company was promoted, and downloading them would clash
-      // with the team-bucket pull at the same disk path.
+      // Local (non-cloud) companies sync to the personal vault: keys under
+      // `companies/{slug}/...` are legitimate content a peer machine pushed
+      // for a company that is not cloud-backed. Allow them through EXCEPT
+      // for slugs the operator has an active team-bucket Membership for:
+      // those are orphan remnants from before the company became cloud-true,
+      // and downloading them would clash with the team-bucket pull at the
+      // same disk path.
       //
       // Symmetric to the push-side `decommissionPrefixes` logic in
       // share.ts — both target the same orphan class, both honor the
@@ -1794,7 +1773,7 @@ function computePullPlan(
       const slug = remoteFile.key.split("/")[1] ?? "";
       const isTeamSyncedOrphan =
         teamSyncedSlugs !== null && slug !== "" && teamSyncedSlugs.has(slug);
-      if (!includeLocalCompanies || isTeamSyncedOrphan) {
+      if (isTeamSyncedOrphan) {
         items.push({ action: "skip-personal-mode", remoteFile, localPath });
         continue;
       }
@@ -2138,12 +2117,16 @@ function computePullPlan(
     if (remoteKeySet.has(posixKey)) continue;
     const localPath = resolveContainedVaultPath(companyRoot, key);
     if (localPath === null) continue;
-    // PersonalMode key gating — mirror the download branch.
+    // PersonalMode key gating — mirror the download branch. Local (non-cloud)
+    // company keys are tombstone-eligible (a peer's delete should propagate),
+    // but team-synced orphans are left alone (the team-bucket pull owns those
+    // disk paths), and the manifest — the routing source-of-truth — is never
+    // auto-tombstoned out of the personal vault.
     if (personalMode && key.startsWith("companies/")) {
       const slug = key.split("/")[1] ?? "";
       const isTeamSyncedOrphan =
         teamSyncedSlugs !== null && slug !== "" && teamSyncedSlugs.has(slug);
-      if (!includeLocalCompanies || isTeamSyncedOrphan) continue;
+      if (isTeamSyncedOrphan || key === PERSONAL_VAULT_MANIFEST_KEY) continue;
     }
     // Ephemeral keys are filtered both directions; never tombstone-
     // propagate a conflict-mirror.

package/src/company-resolver.test.ts

@@ -4,7 +4,7 @@
  * the trailing-slash sibling boundary, and the unattributed (no-match) path.
  */
 
-import { describe, it, expect, beforeEach, afterEach } from "vitest";
+import { describe, it, expect, afterEach } from "vitest";
 import * as fs from "fs";
 import * as os from "os";
 import * as path from "path";

package/src/lib/conflict-file.ts

@@ -76,6 +76,6 @@ export function buildConflictId(
   detectedAt: string,
 ): string {
   const safeTs = detectedAt.replace(/:/g, "-").replace(/\.\d+/, "");
-  const safePath = originalRelative.replace(/[\/\\.]/g, "-");
+  const safePath = originalRelative.replace(/[/\\.]/g, "-");
   return `${safePath}-${safeTs}`;
 }