@indigoai-us/hq-cloud 6.14.17 → 6.14.19

package/src/bin/sync-runner.test.ts

@@ -33,9 +33,20 @@ import type {
   VaultClientSurface,
   WatcherSurface,
 } from "./sync-runner.js";
-import { FakeClock } from "../watcher.js";
-import { adaptivePollMs } from "./sync-runner-watch-loop.js";
-import { PERSONAL_VAULT_JOURNAL_SLUG } from "../journal.js";
+import {
+  FakeClock,
+  type LocalDeleteSnapshot,
+  type TreeChangeBatch,
+} from "../watcher.js";
+import {
+  adaptivePollMs,
+  journalEntriesForWatcherDelete,
+} from "./sync-runner-watch-loop.js";
+import {
+  PERSONAL_VAULT_JOURNAL_SLUG,
+  readJournal,
+  writeJournal,
+} from "../journal.js";
 import { HQ_CLOUD_VERSION } from "../version.js";
 import { lockPathFor, OPERATION_LOCKED_EXIT } from "../operation-lock.js";
 import { TRANSIENT_NETWORK_EXIT } from "../lib/net-errors.js";
@@ -52,6 +63,11 @@ import type {
 import { VaultAuthError, VaultNotFoundError } from "../vault-client.js";
 import { CognitoRefreshError } from "../cognito-auth.js";
 import type { PushEvent } from "../sync/push-event.js";
+import {
+  reconcileCompanyManifest,
+  type ManifestReconcileOptions,
+} from "../manifest-reconcile.js";
+import yaml from "js-yaml";
 
 // ---------------------------------------------------------------------------
 // Hermetic journal state — the runner now calls migratePersonalVaultJournal()
@@ -226,8 +242,13 @@ function makeDeps(overrides: Partial<RunnerDeps> = {}): TestDeps {
       updated: true,
       embedded: false,
       pendingDirty: false,
+      lockBusy: false,
+      timedOut: false,
+      corruptionQuarantined: false,
     })),
-    reconcileManifest: vi.fn().mockResolvedValue(undefined),
+    reconcileManifest: vi
+      .fn()
+      .mockResolvedValue({ written: false, added: [], updated: [], skipped: [] }),
     ...overrides,
     stdout,
     stderr,
@@ -279,7 +300,9 @@ describe("argv parsing", () => {
     const code = await runRunner(["--companies", "--json"], deps);
     expect(code).toBe(0);
     // Empty memberships → setup-needed, not a parse error
-    expect(deps.stdout.events()).toEqual([{ type: "setup-needed" }]);
+    expect(deps.stdout.events()).toEqual([
+      { type: "setup-needed", reason: "no-memberships" },
+    ]);
   });
 });
 
@@ -618,7 +641,80 @@ describe("claim-dance", () => {
     expect(ensureSpy).not.toHaveBeenCalled();
     expect(claimSpy).not.toHaveBeenCalled();
     // No memberships, no invites — truly empty → setup-needed is correct here.
-    expect(deps.stdout.events()).toEqual([{ type: "setup-needed" }]);
+    expect(deps.stdout.events()).toEqual([
+      { type: "setup-needed", reason: "no-memberships" },
+    ]);
+  });
+
+  // The michelle@boringecom.com shape: an invite exists, the claim attempt does
+  // not convert it into a membership, and the user is told they are solo. The
+  // count is what turns "you have no team" into "you have an invite to accept".
+  it("US-004: carries pendingInviteCount when invites did not become memberships", async () => {
+    const deps = makeDeps({
+      createVaultClient: () =>
+        makeVaultStub({
+          pendingInvites: [{ uid: "inv_1" }, { uid: "inv_2" }] as never,
+          ensurePerson: vi
+            .fn()
+            .mockResolvedValue({ uid: "ent_person" }) as unknown as VaultClientSurface["ensureMyPersonEntity"],
+          claim: vi
+            .fn()
+            .mockResolvedValue(undefined) as unknown as VaultClientSurface["claimPendingInvitesByEmail"],
+        }),
+      getIdTokenClaims: () => claims,
+    });
+
+    expect(await runRunner(["--companies"], deps)).toBe(0);
+    expect(deps.stdout.events()).toEqual([
+      { type: "setup-needed", reason: "no-memberships", pendingInviteCount: 2 },
+    ]);
+  });
+
+  it("US-004: omits pendingInviteCount entirely when there were no invites", async () => {
+    const deps = makeDeps({
+      createVaultClient: () => makeVaultStub({ pendingInvites: [] }),
+      getIdTokenClaims: () => claims,
+    });
+
+    expect(await runRunner(["--companies"], deps)).toBe(0);
+    const [event] = deps.stdout.events();
+    expect(event).toEqual({ type: "setup-needed", reason: "no-memberships" });
+    expect("pendingInviteCount" in event).toBe(false);
+  });
+
+  it("US-004: reports claim-dance skipped as a diagnostic, not a bare stderr line", async () => {
+    const deps = makeDeps({
+      createVaultClient: () =>
+        makeVaultStub({
+          pendingInvites: [{ uid: "inv_1" }] as never,
+          ensurePerson: vi
+            .fn()
+            .mockRejectedValue(
+              new Error("BatchWriteItem denied"),
+            ) as unknown as VaultClientSurface["ensureMyPersonEntity"],
+        }),
+      getIdTokenClaims: () => claims,
+    });
+
+    // Non-throwing by contract: the failure never changes the exit code...
+    expect(await runRunner(["--companies"], deps)).toBe(0);
+    // ...but it is no longer invisible.
+    expect(deps.stderr.raw()).toContain("runner.claim_dance.skipped");
+  });
+
+  it("US-004: a claim-dance that cannot identify the caller still reports the pending invites", async () => {
+    const deps = makeDeps({
+      createVaultClient: () =>
+        makeVaultStub({ pendingInvites: [{ uid: "inv_1" }] as never }),
+      // No sub/name — the claim cannot proceed, but the invites are still real.
+      getIdTokenClaims: () => ({}) as never,
+    });
+
+    expect(await runRunner(["--companies"], deps)).toBe(0);
+    expect(deps.stdout.events()).toEqual([
+      { type: "setup-needed", reason: "no-memberships", pendingInviteCount: 1 },
+    ]);
+    expect(deps.stderr.raw()).toContain("runner.claim_dance.skipped");
   });
 
   it("skips claim-dance entirely when no idToken claims are available", async () => {
@@ -696,7 +792,9 @@ describe("target resolution", () => {
     const deps = makeDeps();
     const code = await runRunner(["--companies"], deps);
     expect(code).toBe(0);
-    expect(deps.stdout.events()).toEqual([{ type: "setup-needed" }]);
+    expect(deps.stdout.events()).toEqual([
+      { type: "setup-needed", reason: "no-memberships" },
+    ]);
     // sync should NOT have been called — no targets
     expect(deps.sync).not.toHaveBeenCalled();
   });
@@ -1031,7 +1129,11 @@ describe("fanout-plan", () => {
       RunnerEvent,
       { type: "fanout-plan" }
     >;
-    expect(plan.companies).toEqual([{ uid: "cmp_live", slug: "live" }]);
+    // The surviving target now also carries the plan-time entity snapshot the
+    // manifest reconciler reads instead of re-fetching (US-002).
+    expect(plan.companies).toEqual([
+      { uid: "cmp_live", slug: "live", entityType: "company", entityStatus: "active" },
+    ]);
   });
 
   it("reconciles after the personal leg completes", async () => {
@@ -1066,6 +1168,7 @@ describe("fanout-plan", () => {
       }),
       reconcileManifest: vi.fn().mockImplementation(async () => {
         order.push("reconcile");
+        return { written: false, added: [], updated: [], skipped: [] };
       }),
     });
 
@@ -2070,6 +2173,9 @@ describe("all-complete aggregate", () => {
       updated: true,
       embedded: false,
       pendingDirty: false,
+      lockBusy: false,
+      timedOut: false,
+      corruptionQuarantined: false,
     }));
     const deps = makeDeps({
       createVaultClient: () =>
@@ -2723,11 +2829,9 @@ describe("personal slot fanout", () => {
     // companies/personal company journal.
     expect(lastEntry.slug).toBe("personal");
     expect(lastEntry.uid).toBe("prs_older");
-    expect((lastEntry as Record<string, unknown>).bucketName).toBe("hq-vault-prs-older");
-    expect((lastEntry as Record<string, unknown>).personalMode).toBe(true);
-    expect((lastEntry as Record<string, unknown>).journalSlug).toBe(
-      PERSONAL_VAULT_JOURNAL_SLUG,
-    );
+    expect(lastEntry.bucketName).toBe("hq-vault-prs-older");
+    expect(lastEntry.personalMode).toBe(true);
+    expect(lastEntry.journalSlug).toBe(PERSONAL_VAULT_JOURNAL_SLUG);
   });
 
   it("B: syncFn invoked with personalMode: true + reserved journalSlug for personal slot", async () => {
@@ -5490,13 +5594,13 @@ describe("runRunnerWithLoop — operation lock", () => {
 // pass (events must never announce bytes that are not in S3 yet).
 
 interface BatchWatcherStub extends WatcherSurface {
-  emit(changedRelPath?: string, batch?: { paths: Map<string, string> }): void;
+  emit(changedRelPath?: string, batch?: TreeChangeBatch): void;
   disposed: boolean;
 }
 
 function makeBatchWatcherStub(): BatchWatcherStub {
   const listeners = new Set<
-    (p?: string, b?: { paths: Map<string, string> }) => void
+    (p?: string, b?: TreeChangeBatch) => void
   >();
   return {
     disposed: false,
@@ -5510,7 +5614,7 @@ function makeBatchWatcherStub(): BatchWatcherStub {
       this.disposed = true;
       listeners.clear();
     },
-    emit(changedRelPath?: string, batch?: { paths: Map<string, string> }) {
+    emit(changedRelPath?: string, batch?: TreeChangeBatch) {
       for (const l of [...listeners]) l(changedRelPath, batch);
     },
   };
@@ -5687,6 +5791,94 @@ describe("runRunnerWithLoop — Phase 3 event-sync wiring (US-017/018/019)", ()
     await loop;
   });
 
+  it("does not publish an exit-zero deletion that the scoped push refused", async () => {
+    const publishBatch = vi.fn();
+    const startEventSync = vi.fn().mockResolvedValue({
+      publishBatch,
+      receiver: { start: async () => {}, dispose: async () => {}, connected: true },
+      ownDeviceId: "dev-test",
+      dispose: vi.fn().mockResolvedValue(undefined),
+    });
+    const runPass = vi
+      .fn()
+      .mockResolvedValueOnce(0)
+      .mockResolvedValueOnce({
+        exitCode: 0,
+        result: {
+          pushPathResults: [{
+            relativePath: "companies/indigo/deleted.md",
+            status: "refused",
+            operation: "delete",
+            reason: "missing-delete-intent",
+          }],
+        },
+      })
+      .mockResolvedValue(0);
+    const { loop, watcher, tick, shutdown } = runLoop({
+      claims: ENROLLED_CLAIMS,
+      startEventSync,
+      runPass,
+    });
+    await microtasks();
+    watcher.emit("companies/indigo/deleted.md", {
+      paths: new Map([[
+        "/tmp/hq/companies/indigo/deleted.md",
+        "companies/indigo/deleted.md",
+      ]]),
+    });
+    tick();
+    await microtasks();
+
+    expect(publishBatch).not.toHaveBeenCalled();
+    shutdown();
+    await loop;
+  });
+
+  it("does not publish unlinkDir when a covered descendant delete was refused", async () => {
+    const publishBatch = vi.fn();
+    const startEventSync = vi.fn().mockResolvedValue({
+      publishBatch,
+      receiver: { start: async () => {}, dispose: async () => {}, connected: true },
+      ownDeviceId: "dev-test",
+      dispose: vi.fn().mockResolvedValue(undefined),
+    });
+    const runPass = vi
+      .fn()
+      .mockResolvedValueOnce(0)
+      .mockResolvedValueOnce({
+        exitCode: 0,
+        result: {
+          pushPathResults: [{
+            relativePath: "companies/indigo/archive/deleted.md",
+            status: "refused",
+            operation: "delete",
+            reason: "missing-delete-intent",
+          }],
+        },
+      })
+      .mockResolvedValue(0);
+    const { loop, watcher, tick, shutdown } = runLoop({
+      claims: ENROLLED_CLAIMS,
+      startEventSync,
+      runPass,
+    });
+    await microtasks();
+    const absolutePath = "/tmp/hq/companies/indigo/archive";
+    watcher.emit("companies/indigo/archive", {
+      paths: new Map([[
+        absolutePath,
+        "companies/indigo/archive",
+      ]]),
+      changes: new Map([[absolutePath, { kind: "unlinkDir" }]]),
+    });
+    tick();
+    await microtasks();
+
+    expect(publishBatch).not.toHaveBeenCalled();
+    shutdown();
+    await loop;
+  });
+
   it("F04: mixed-route watcher batches publish only routes that were pushed", async () => {
     const publishBatch = vi.fn();
     const startEventSync = vi.fn().mockResolvedValue({
@@ -6581,3 +6773,816 @@ describe("US-004 — --personal for an AGENT machine identity (HARD GATE)", () =
     expect(cmp(HQ_CLOUD_VERSION, FLOOR)).toBeGreaterThanOrEqual(0);
   });
 });
+
+// ---------------------------------------------------------------------------
+// US-002 — post-fanout manifest reconciliation wiring
+//
+// The reconciler itself is unit-tested in manifest-reconcile.test.ts. These
+// tests own the SEAM: which run modes reach it, which targets cross it, and
+// what the runner does with the result it hands back.
+// ---------------------------------------------------------------------------
+
+describe("US-002 — manifest reconciliation wiring", () => {
+  const PERSON_ENTITY = {
+    uid: "prs_me",
+    slug: "me",
+    type: "person",
+    status: "active",
+    bucketName: "hq-vault-prs-me",
+    createdAt: "2026-01-01T00:00:00Z",
+  } as unknown as EntityInfo;
+
+  function noopReconcileResult() {
+    return { written: false, added: [], updated: [], skipped: [] };
+  }
+
+  /** A vault stub whose companies all resolve to `cmp_x` → slug `x`. */
+  function companiesClient(companyUids: string[]): VaultClientSurface {
+    return makeVaultStub({
+      memberships: companyUids.map((companyUid) => ({ companyUid })),
+      entityGet: (uid: string) =>
+        Promise.resolve({
+          uid,
+          slug: uid.replace(/^cmp_/, ""),
+          name: `${uid} Inc`,
+          type: "company",
+          status: "active",
+          bucketName: `bucket-${uid}`,
+          createdAt: "2026-01-01T00:00:00Z",
+        } as unknown as EntityInfo),
+      listPersons: () => Promise.resolve([PERSON_ENTITY]),
+    });
+  }
+
+  function reconcileArgs(
+    reconcile: ReturnType<typeof vi.fn>,
+  ): ManifestReconcileOptions {
+    return reconcile.mock.calls[0]![0] as ManifestReconcileOptions;
+  }
+
+  /** Diagnostics ride stderr as ndjson; pick out the manifest ones. */
+  function manifestDiagnostics(stderr: CapturingWriter): Record<string, unknown>[] {
+    return stderr
+      .lines()
+      .flatMap((line) => {
+        try {
+          return [JSON.parse(line) as Record<string, unknown>];
+        } catch {
+          return [];
+        }
+      })
+      .filter((entry) => entry.component === "manifest-reconcile");
+  }
+
+  it("AC2: an errored company is not eligible — only the completing company is", async () => {
+    const reconcile = vi.fn().mockResolvedValue(noopReconcileResult());
+    const deps = makeDeps({
+      createVaultClient: () => companiesClient(["cmp_ok", "cmp_bad"]),
+      sync: vi.fn().mockImplementation(async (options: SyncOptions) => {
+        if (options.company === "cmp_bad") throw new Error("pull leg exploded");
+        return defaultSyncResult();
+      }),
+      reconcileManifest: reconcile,
+    });
+
+    await runRunner(["--companies"], deps);
+
+    expect(reconcile).toHaveBeenCalledTimes(1);
+    const args = reconcileArgs(reconcile);
+    // The completion filter is `completedCompanySlugs`; assert the EFFECTIVE
+    // eligible set, which is what actually reaches the manifest.
+    const eligible = args.targets.filter((target) =>
+      args.completedCompanySlugs.has(target.slug),
+    );
+    expect(eligible.map((target) => target.slug)).toEqual(["ok"]);
+    expect(args.completedCompanySlugs.has("bad")).toBe(false);
+  });
+
+  it("AC3: the personal target is never passed to the reconciler", async () => {
+    const reconcile = vi.fn().mockResolvedValue(noopReconcileResult());
+    const deps = makeDeps({
+      createVaultClient: () => companiesClient(["cmp_acme"]),
+      reconcileManifest: reconcile,
+    });
+
+    expect(await runRunner(["--companies"], deps)).toBe(0);
+
+    const args = reconcileArgs(reconcile);
+    // The personal leg definitely ran — otherwise this assertion is vacuous.
+    const plan = deps.stdout
+      .events()
+      .find((e) => e.type === "fanout-plan") as Extract<
+      RunnerEvent,
+      { type: "fanout-plan" }
+    >;
+    expect(plan.companies.map((t) => t.slug)).toContain("personal");
+
+    expect(args.targets.map((target) => target.slug)).toEqual(["acme"]);
+    expect(args.targets.some((target) => target.personalMode === true)).toBe(false);
+    expect(args.targets.some((target) => target.slug === "personal")).toBe(false);
+  });
+
+  it("AC4: --personal mode does not reconcile", async () => {
+    const reconcile = vi.fn().mockResolvedValue(noopReconcileResult());
+    const deps = makeDeps({
+      createVaultClient: () =>
+        makeVaultStub({ listPersons: () => Promise.resolve([PERSON_ENTITY]) }),
+      reconcileManifest: reconcile,
+    });
+
+    expect(await runRunner(["--personal"], deps)).toBe(0);
+    expect(reconcile).not.toHaveBeenCalled();
+  });
+
+  it("AC4: single-company mode (--company <slug>) does not reconcile", async () => {
+    const reconcile = vi.fn().mockResolvedValue(noopReconcileResult());
+    const deps = makeDeps({
+      createVaultClient: () => companiesClient(["cmp_acme"]),
+      reconcileManifest: reconcile,
+    });
+
+    expect(await runRunner(["--company", "cmp_acme"], deps)).toBe(0);
+    expect(reconcile).not.toHaveBeenCalled();
+  });
+
+  it("AC5: company targets carry the plan-resolved bucketName, so no getEntity is passed", async () => {
+    const reconcile = vi.fn().mockResolvedValue(noopReconcileResult());
+    const deps = makeDeps({
+      createVaultClient: () => companiesClient(["cmp_acme"]),
+      reconcileManifest: reconcile,
+    });
+
+    expect(await runRunner(["--companies"], deps)).toBe(0);
+
+    const args = reconcileArgs(reconcile);
+    expect(args.targets[0]).toMatchObject({
+      uid: "cmp_acme",
+      slug: "acme",
+      name: "cmp_acme Inc",
+      bucketName: "bucket-cmp_acme",
+      // Liveness evidence travels with the target. Dropping the round trip
+      // must not drop the guarantee it used to provide.
+      entityType: "company",
+      entityStatus: "active",
+    });
+    // Zero extra API calls: the runner hands over no entity resolver at all.
+    expect(args.getEntity).toBeUndefined();
+  });
+
+  it("END-TO-END: a suspended company completes its sync leg but never reaches the manifest", async () => {
+    // Exercises the REAL reconciler through the runner — no stub — because the
+    // defect this guards was invisible to every stubbed assertion.
+    const root = fs.mkdtempSync(path.join(os.tmpdir(), "hq-runner-manifest-"));
+    try {
+      fs.mkdirSync(path.join(root, "companies", "live"), { recursive: true });
+      fs.mkdirSync(path.join(root, "companies", "susp"), { recursive: true });
+      const manifestPath = path.join(root, "companies", "manifest.yaml");
+      fs.writeFileSync(manifestPath, "companies: {}\n");
+
+      const deps = makeDeps({
+        createVaultClient: () =>
+          makeVaultStub({
+            memberships: [{ companyUid: "cmp_live" }, { companyUid: "cmp_susp" }],
+            entityGet: (uid: string) =>
+              Promise.resolve({
+                uid,
+                slug: uid === "cmp_live" ? "live" : "susp",
+                type: "company",
+                // The suspended company is still a perfectly syncable target.
+                status: uid === "cmp_live" ? "active" : "suspended",
+                bucketName: `bucket-${uid}`,
+                createdAt: "2026-01-01T00:00:00Z",
+              } as unknown as EntityInfo),
+            listPersons: () => Promise.resolve([PERSON_ENTITY]),
+          }),
+        // The REAL reconciler, not the makeDeps stub — that stub is exactly
+        // what let this defect hide from every other assertion here.
+        reconcileManifest: reconcileCompanyManifest,
+      });
+
+      expect(await runRunner(["--companies", "--hq-root", root], deps)).toBe(0);
+
+      // Both companies synced (the guard must not have leaked into sync).
+      const syncedCompanies = (deps.sync as ReturnType<typeof vi.fn>).mock.calls
+        .map((call) => (call[0] as SyncOptions).company)
+        .filter(Boolean);
+      expect(syncedCompanies).toContain("cmp_live");
+      expect(syncedCompanies).toContain("cmp_susp");
+
+      // ...but only the active one earned a manifest entry.
+      const written = yaml.load(fs.readFileSync(manifestPath, "utf8")) as {
+        companies?: Record<string, unknown>;
+      };
+      expect(Object.keys(written.companies ?? {})).toEqual(["live"]);
+    } finally {
+      fs.rmSync(root, { recursive: true, force: true });
+    }
+  });
+
+  it("US-003: seeds activeCompany from the completed company set", async () => {
+    const seed = vi.fn().mockReturnValue({ written: true, activeCompany: "acme" });
+    const deps = makeDeps({
+      createVaultClient: () => companiesClient(["cmp_acme"]),
+      seedActiveCompany: seed,
+    });
+
+    expect(await runRunner(["--companies"], deps)).toBe(0);
+    expect(seed).toHaveBeenCalledTimes(1);
+    expect(seed.mock.calls[0][0]).toMatchObject({ companySlugs: ["acme"] });
+    expect(deps.stderr.raw()).toContain("active-company-seeded");
+  });
+
+  it("US-003: the personal target is never offered as an activeCompany candidate", async () => {
+    const seed = vi.fn().mockReturnValue({ written: false, skippedReason: "already-set" });
+    const deps = makeDeps({
+      createVaultClient: () => companiesClient(["cmp_acme"]),
+      seedActiveCompany: seed,
+    });
+
+    expect(await runRunner(["--companies"], deps)).toBe(0);
+    expect(seed.mock.calls[0][0].companySlugs).not.toContain("personal");
+  });
+
+  // The two writes are independent repairs. A joiner whose manifest write fails
+  // should still get routed, and vice versa.
+  it("US-003: a failing manifest reconcile does not prevent activeCompany seeding", async () => {
+    const seed = vi.fn().mockReturnValue({ written: true, activeCompany: "acme" });
+    const deps = makeDeps({
+      createVaultClient: () => companiesClient(["cmp_acme"]),
+      reconcileManifest: vi.fn().mockRejectedValue(new Error("manifest write blew up")),
+      seedActiveCompany: seed,
+    });
+
+    expect(await runRunner(["--companies"], deps)).toBe(0);
+    expect(deps.stderr.raw()).toContain("runner.manifest_reconcile.failed");
+    expect(seed).toHaveBeenCalledTimes(1);
+  });
+
+  it("US-003: a throwing seeder still emits all-complete and exits 0", async () => {
+    const deps = makeDeps({
+      createVaultClient: () => companiesClient(["cmp_acme"]),
+      seedActiveCompany: vi.fn().mockImplementation(() => {
+        throw new Error("config write blew up");
+      }),
+    });
+
+    expect(await runRunner(["--companies"], deps)).toBe(0);
+    expect(deps.stdout.events().some((e) => e.type === "all-complete")).toBe(true);
+    expect(deps.stderr.raw()).toContain("runner.active_company.failed");
+  });
+
+  it("US-003: a no-op seeding is silent", async () => {
+    const deps = makeDeps({
+      createVaultClient: () => companiesClient(["cmp_acme"]),
+      seedActiveCompany: vi
+        .fn()
+        .mockReturnValue({ written: false, skippedReason: "already-set" }),
+    });
+
+    expect(await runRunner(["--companies"], deps)).toBe(0);
+    expect(deps.stderr.raw()).not.toContain("active-company-seeded");
+  });
+
+  it("US-003: single-company mode does not seed activeCompany", async () => {
+    const seed = vi.fn();
+    const deps = makeDeps({
+      createVaultClient: () => companiesClient(["cmp_acme"]),
+      seedActiveCompany: seed,
+    });
+
+    await runRunner(["--company", "acme"], deps);
+    expect(seed).not.toHaveBeenCalled();
+  });
+
+  it("AC6: a throwing reconciler still emits all-complete and exits 0", async () => {
+    const deps = makeDeps({
+      createVaultClient: () => companiesClient(["cmp_acme"]),
+      reconcileManifest: vi
+        .fn()
+        .mockRejectedValue(new Error("manifest write blew up")),
+    });
+
+    expect(await runRunner(["--companies"], deps)).toBe(0);
+    expect(deps.stdout.events().some((e) => e.type === "all-complete")).toBe(true);
+    expect(deps.stderr.raw()).toContain("runner.manifest_reconcile.failed");
+  });
+
+  it("AC7: a write emits a manifest-reconciled diagnostic naming the slugs", async () => {
+    const deps = makeDeps({
+      createVaultClient: () => companiesClient(["cmp_acme"]),
+      reconcileManifest: vi.fn().mockResolvedValue({
+        written: true,
+        added: ["acme"],
+        updated: ["beta"],
+        skipped: [],
+      }),
+    });
+
+    expect(await runRunner(["--companies"], deps)).toBe(0);
+
+    const diagnostics = manifestDiagnostics(deps.stderr);
+    expect(diagnostics).toHaveLength(1);
+    expect(diagnostics[0]).toMatchObject({
+      component: "manifest-reconcile",
+      event: "manifest-reconciled",
+      added: ["acme"],
+      updated: ["beta"],
+    });
+  });
+
+  it("AC7: a no-op reconciliation is completely silent (steady-state sync)", async () => {
+    const deps = makeDeps({
+      createVaultClient: () => companiesClient(["cmp_acme"]),
+      reconcileManifest: vi.fn().mockResolvedValue({
+        written: false,
+        added: [],
+        updated: [],
+        skipped: ["weird-slug"],
+      }),
+    });
+
+    expect(await runRunner(["--companies"], deps)).toBe(0);
+    expect(manifestDiagnostics(deps.stderr)).toEqual([]);
+    expect(deps.stderr.raw()).not.toContain("manifest-reconciled");
+  });
+});
+
+describe("watcher delete intents without pre-seeded authorization", () => {
+  function startDeleteHarness(
+    keys: string[],
+    options: { gateInitialPull?: boolean } = {},
+  ) {
+    const hqRoot = fs.mkdtempSync(path.join(os.tmpdir(), "hq-watch-delete-"));
+    const companyRoot = path.join(hqRoot, "companies", "indigo");
+    fs.mkdirSync(companyRoot, { recursive: true });
+    const remote = new Map<string, string>();
+    const files: Record<string, {
+      hash: string; size: number; syncedAt: string; direction: "down";
+      remoteEtag: string; kind: "file";
+    }> = {};
+    for (const key of keys) {
+      const absolutePath = path.join(companyRoot, key);
+      const content = `synced:${key}`;
+      fs.mkdirSync(path.dirname(absolutePath), { recursive: true });
+      fs.writeFileSync(absolutePath, content);
+      remote.set(key, content);
+      files[key] = {
+        hash: `hash:${key}`,
+        size: Buffer.byteLength(content),
+        syncedAt: new Date().toISOString(),
+        direction: "down",
+        remoteEtag: `etag:${key}`,
+        kind: "file",
+      };
+    }
+    writeJournal("indigo", {
+      version: "2", lastSync: new Date().toISOString(), files, pulls: [],
+    });
+
+    const watcher = makeBatchWatcherStub();
+    const sleep = makeSteppableSleep();
+    let capture: ((
+      relativePath: string,
+      kind: "unlink" | "unlinkDir",
+    ) => LocalDeleteSnapshot[]) | undefined;
+    let triggerShutdown = () => {};
+    let downloads = 0;
+    let releaseInitialPull = () => {};
+    const initialPullGate = new Promise<void>((resolve) => {
+      releaseInitialPull = resolve;
+    });
+    let initialPullGated = options.gateInitialPull === true;
+    const runPass = vi.fn(async (argv: string[]) => {
+      const direction = argv[argv.indexOf("--direction") + 1];
+      if (direction === "push") {
+        const journal = readJournal("indigo");
+        const pathResults: Array<{
+          relativePath: string; status: "accepted" | "refused";
+          operation: "delete"; reason?: string;
+        }> = [];
+        const scopes = argv.flatMap((value, index) =>
+          argv[index - 1] === "--scope-path" ? [value] : [],
+        );
+        for (const scope of scopes) {
+          for (const key of Object.keys(journal.files)) {
+            if (key !== scope && !key.startsWith(`${scope}/`)) continue;
+            const absolutePath = path.join(companyRoot, key);
+            const entry = journal.files[key];
+            if (fs.existsSync(absolutePath)) {
+              remote.set(key, fs.readFileSync(absolutePath, "utf8"));
+              continue;
+            }
+            const intent = entry.localDeleteIntent;
+            const current =
+              intent?.remoteEtag === entry.remoteEtag &&
+              intent?.localHash === entry.hash &&
+              intent?.localKind === entry.kind;
+            if (current) {
+              remote.delete(key);
+              delete journal.files[key];
+              pathResults.push({
+                relativePath: `companies/indigo/${key}`,
+                status: "accepted",
+                operation: "delete",
+              });
+            } else {
+              pathResults.push({
+                relativePath: `companies/indigo/${key}`,
+                status: "refused",
+                operation: "delete",
+                reason: "missing-delete-intent",
+              });
+            }
+          }
+          const added = path.join(companyRoot, scope);
+          if (fs.existsSync(added) && fs.lstatSync(added).isFile()) {
+            remote.set(scope, fs.readFileSync(added, "utf8"));
+          }
+        }
+        writeJournal("indigo", journal);
+        return { exitCode: 0, result: { pushPathResults: pathResults } };
+      }
+      if (direction === "pull" || direction === "both") {
+        if (initialPullGated) {
+          initialPullGated = false;
+          await initialPullGate;
+        }
+        const journal = readJournal("indigo");
+        for (const [key, content] of remote) {
+          const absolutePath = path.join(companyRoot, key);
+          if (fs.existsSync(absolutePath)) continue;
+          const entry = journal.files[key];
+          const intent = entry?.localDeleteIntent;
+          const currentIntent =
+            intent?.remoteEtag === entry?.remoteEtag &&
+            intent?.localHash === entry?.hash &&
+            intent?.localKind === entry?.kind;
+          if (currentIntent) continue;
+          fs.mkdirSync(path.dirname(absolutePath), { recursive: true });
+          fs.writeFileSync(absolutePath, content);
+          downloads++;
+        }
+      }
+      return 0;
+    });
+    const loop = runRunnerWithLoop(
+      [
+        "--companies", "--watch", "--event-push", "--direction", "both",
+        "--hq-root", hqRoot, "--poll-remote-ms", "60000",
+      ],
+      {
+        runPass,
+        createWatcher: (opts) => {
+          capture = opts.captureLocalDeleteSnapshots;
+          return watcher;
+        },
+        sleep: sleep.sleep,
+        onShutdownSignal: (handler) => {
+          triggerShutdown = handler;
+          return () => {};
+        },
+      },
+    );
+    return {
+      hqRoot, companyRoot, remote, watcher, loop, tick: sleep.tick,
+      capture: () => capture!, downloads: () => downloads,
+      releaseInitialPull,
+      shutdown: () => triggerShutdown(),
+    };
+  }
+
+  async function settle(): Promise<void> {
+    await flushLoopMicrotasks(12);
+  }
+
+  async function stopHarness(h: ReturnType<typeof startDeleteHarness>) {
+    h.shutdown();
+    h.tick();
+    await h.loop;
+    fs.rmSync(h.hqRoot, { recursive: true, force: true });
+  }
+
+  it("live unlink binds the pre-delete revision, deletes remote, and survives immediate plus later full pulls", async () => {
+    const h = startDeleteHarness(["knowledge/gone.md"]);
+    await settle();
+    const absolutePath = path.join(h.companyRoot, "knowledge/gone.md");
+    fs.unlinkSync(absolutePath);
+    const snapshots = h.capture()(
+      "companies/indigo/knowledge/gone.md", "unlink",
+    );
+    expect(snapshots).toHaveLength(1);
+    expect(readJournal("indigo").files["knowledge/gone.md"]?.localDeleteIntent)
+      .toMatchObject({
+        remoteEtag: "etag:knowledge/gone.md",
+        localHash: "hash:knowledge/gone.md",
+        localKind: "file",
+      });
+    h.watcher.emit("companies/indigo/knowledge/gone.md", {
+      paths: new Map([[absolutePath, "companies/indigo/knowledge/gone.md"]]),
+      changes: new Map([
+        [absolutePath, { kind: "unlink", deleteSnapshots: snapshots }],
+      ]),
+    } as TreeChangeBatch);
+    h.tick();
+    await settle();
+    expect(h.remote.has("knowledge/gone.md")).toBe(false);
+    expect(fs.existsSync(absolutePath)).toBe(false);
+    expect(h.downloads()).toBe(0);
+
+    for (let i = 0; i < 8; i++) {
+      h.tick();
+      await settle();
+    }
+    expect(fs.existsSync(absolutePath)).toBe(false);
+    expect(h.downloads()).toBe(0);
+    await stopHarness(h);
+  });
+
+  it("persists the intent before an in-flight pull plans the missing path", async () => {
+    const h = startDeleteHarness(
+      ["knowledge/in-flight.md"],
+      { gateInitialPull: true },
+    );
+    await settle();
+    const relativePath = "companies/indigo/knowledge/in-flight.md";
+    const absolutePath = path.join(
+      h.companyRoot,
+      "knowledge/in-flight.md",
+    );
+    fs.unlinkSync(absolutePath);
+    const snapshots = h.capture()(relativePath, "unlink");
+
+    expect(snapshots).toHaveLength(1);
+    expect(
+      readJournal("indigo").files["knowledge/in-flight.md"]
+        ?.localDeleteIntent,
+    ).toBeDefined();
+
+    h.watcher.emit(relativePath, {
+      paths: new Map([[absolutePath, relativePath]]),
+      changes: new Map([
+        [absolutePath, { kind: "unlink", deleteSnapshots: snapshots }],
+      ]),
+    } as TreeChangeBatch);
+    h.releaseInitialPull();
+    await settle();
+
+    expect(h.downloads()).toBe(0);
+    expect(fs.existsSync(absolutePath)).toBe(false);
+
+    h.tick();
+    await settle();
+    expect(h.remote.has("knowledge/in-flight.md")).toBe(false);
+    expect(h.downloads()).toBe(0);
+    await stopHarness(h);
+  });
+
+  it("uses direct journal-key lookup for file unlink snapshots", () => {
+    const exactEntry = {
+      hash: "hash",
+      size: 4,
+      syncedAt: new Date().toISOString(),
+      direction: "down" as const,
+      remoteEtag: "etag",
+      kind: "file" as const,
+    };
+    const files = new Proxy(
+      { "knowledge/exact.md": exactEntry },
+      {
+        ownKeys: () => {
+          throw new Error("file unlink must not enumerate the journal");
+        },
+      },
+    );
+
+    expect(
+      journalEntriesForWatcherDelete(
+        files,
+        "knowledge/exact.md",
+        "unlink",
+      ),
+    ).toEqual([["knowledge/exact.md", exactEntry]]);
+  });
+
+  it("keeps a deleted top-level personal file in the scoped push delete roots", async () => {
+    const hqRoot = fs.mkdtempSync(path.join(os.tmpdir(), "hq-personal-delete-"));
+    const key = "personal-note.md";
+    const absolutePath = path.join(hqRoot, key);
+    fs.writeFileSync(absolutePath, "personal content");
+    const remote = new Map([[key, "personal content"]]);
+    writeJournal(PERSONAL_VAULT_JOURNAL_SLUG, {
+      version: "2",
+      lastSync: new Date().toISOString(),
+      pulls: [],
+      files: {
+        [key]: {
+          hash: "personal-hash",
+          size: 16,
+          syncedAt: new Date().toISOString(),
+          direction: "down",
+          remoteEtag: "personal-etag",
+          kind: "file",
+        },
+      },
+    });
+
+    const shareSpy = vi.fn(async (options: ShareOptions) => {
+      const journal = readJournal(PERSONAL_VAULT_JOURNAL_SLUG);
+      const entry = journal.files[key];
+      const intent = entry?.localDeleteIntent;
+      const currentIntent =
+        intent?.remoteEtag === entry?.remoteEtag &&
+        intent?.localHash === entry?.hash &&
+        intent?.localKind === entry?.kind;
+      if (
+        !fs.existsSync(absolutePath) &&
+        options.deleteScopeRoots?.includes(key) &&
+        currentIntent
+      ) {
+        remote.delete(key);
+        delete journal.files[key];
+        writeJournal(PERSONAL_VAULT_JOURNAL_SLUG, journal);
+        return defaultShareResult({
+          filesDeleted: 1,
+          pathResults: [
+            { path: key, status: "accepted", operation: "delete" },
+          ],
+        });
+      }
+      return defaultShareResult();
+    });
+    let downloads = 0;
+    const syncSpy = vi.fn(async () => {
+      if (remote.has(key) && !fs.existsSync(absolutePath)) {
+        const entry =
+          readJournal(PERSONAL_VAULT_JOURNAL_SLUG).files[key];
+        const intent = entry?.localDeleteIntent;
+        const currentIntent =
+          intent?.remoteEtag === entry?.remoteEtag &&
+          intent?.localHash === entry?.hash &&
+          intent?.localKind === entry?.kind;
+        if (!currentIntent) {
+          fs.writeFileSync(absolutePath, remote.get(key)!);
+          downloads++;
+        }
+      }
+      return defaultSyncResult();
+    });
+    const runnerDeps = makeDeps({
+      share: shareSpy,
+      sync: syncSpy,
+      createVaultClient: () =>
+        makeVaultStub({
+          listPersons: () =>
+            Promise.resolve([
+              {
+                uid: "prs_personal",
+                type: "person",
+                bucketName: "hq-vault-personal",
+                status: "active",
+              } as unknown as EntityInfo,
+            ]),
+        }),
+      operationLockAlreadyHeld: true,
+    });
+    const watcher = makeBatchWatcherStub();
+    const sleep = makeSteppableSleep();
+    let capture: ((
+      relativePath: string,
+      kind: "unlink" | "unlinkDir",
+    ) => LocalDeleteSnapshot[]) | undefined;
+    let triggerShutdown = () => {};
+    const loop = runRunnerWithLoop(
+      [
+        "--personal",
+        "--watch",
+        "--event-push",
+        "--direction",
+        "both",
+        "--hq-root",
+        hqRoot,
+        "--poll-remote-ms",
+        "60000",
+      ],
+      {
+        runPass: (passArgv) => runRunner(passArgv, runnerDeps),
+        createWatcher: (options) => {
+          capture = options.captureLocalDeleteSnapshots;
+          return watcher;
+        },
+        sleep: sleep.sleep,
+        onShutdownSignal: (handler) => {
+          triggerShutdown = handler;
+          return () => {};
+        },
+      },
+    );
+    await vi.waitFor(() => expect(syncSpy).toHaveBeenCalled());
+    await settle();
+    shareSpy.mockClear();
+
+    fs.unlinkSync(absolutePath);
+    const snapshots = capture!(key, "unlink");
+    expect(snapshots).toHaveLength(1);
+    expect(snapshots[0].deleteScopeRoot).toBe(key);
+    expect(
+      readJournal(PERSONAL_VAULT_JOURNAL_SLUG).files[key]
+        ?.localDeleteIntent,
+    ).toBeDefined();
+    watcher.emit(key, {
+      paths: new Map([[absolutePath, key]]),
+      changes: new Map([
+        [absolutePath, { kind: "unlink", deleteSnapshots: snapshots }],
+      ]),
+    } as TreeChangeBatch);
+    sleep.tick();
+    await settle();
+
+    expect(remote.has(key)).toBe(false);
+    expect(downloads).toBe(0);
+    expect(fs.existsSync(absolutePath)).toBe(false);
+    const scopedShareOptions = shareSpy.mock.calls.at(-1)?.[0];
+    expect(scopedShareOptions?.paths).not.toContain(absolutePath);
+    expect(scopedShareOptions?.deleteScopeRoots).toEqual([key]);
+
+    triggerShutdown();
+    await loop;
+    fs.rmSync(hqRoot, { recursive: true, force: true });
+  });
+
+  it("rename uploads the new path, deletes the old path, and neither resurrects", async () => {
+    const h = startDeleteHarness(["knowledge/old.md"]);
+    await settle();
+    const oldPath = path.join(h.companyRoot, "knowledge/old.md");
+    const newPath = path.join(h.companyRoot, "knowledge/new.md");
+    const snapshots = h.capture()(
+      "companies/indigo/knowledge/old.md", "unlink",
+    );
+    fs.renameSync(oldPath, newPath);
+    h.watcher.emit("companies/indigo/knowledge/old.md", {
+      paths: new Map([
+        [oldPath, "companies/indigo/knowledge/old.md"],
+        [newPath, "companies/indigo/knowledge/new.md"],
+      ]),
+      changes: new Map([
+        [oldPath, { kind: "unlink", deleteSnapshots: snapshots }],
+        [newPath, { kind: "add" }],
+      ]),
+    } as TreeChangeBatch);
+    h.tick();
+    await settle();
+    expect(h.remote.has("knowledge/old.md")).toBe(false);
+    expect(h.remote.get("knowledge/new.md")).toBe("synced:knowledge/old.md");
+    expect(fs.existsSync(oldPath)).toBe(false);
+    expect(fs.existsSync(newPath)).toBe(true);
+    await stopHarness(h);
+  });
+
+  it("unlinkDir records every tracked descendant across a 12-file breaker-sized subtree", async () => {
+    const keys = Array.from(
+      { length: 12 }, (_, i) => `knowledge/moved/f-${i}.md`,
+    );
+    const h = startDeleteHarness(keys);
+    await settle();
+    const subtree = path.join(h.companyRoot, "knowledge/moved");
+    const snapshots = h.capture()(
+      "companies/indigo/knowledge/moved", "unlinkDir",
+    );
+    expect(snapshots).toHaveLength(12);
+    fs.rmSync(subtree, { recursive: true, force: true });
+    h.watcher.emit("companies/indigo/knowledge/moved", {
+      paths: new Map([[subtree, "companies/indigo/knowledge/moved"]]),
+      changes: new Map([
+        [subtree, { kind: "unlinkDir", deleteSnapshots: snapshots }],
+      ]),
+    } as TreeChangeBatch);
+    h.tick();
+    await settle();
+    expect(h.remote.size).toBe(0);
+    expect(Object.keys(readJournal("indigo").files)).toHaveLength(0);
+    await stopHarness(h);
+  });
+
+  it("concurrent recreation before delete execution invalidates the observation and preserves remote", async () => {
+    const h = startDeleteHarness(["knowledge/race.md"]);
+    await settle();
+    const absolutePath = path.join(h.companyRoot, "knowledge/race.md");
+    fs.unlinkSync(absolutePath);
+    const snapshots = h.capture()(
+      "companies/indigo/knowledge/race.md", "unlink",
+    );
+    h.watcher.emit("companies/indigo/knowledge/race.md", {
+      paths: new Map([[absolutePath, "companies/indigo/knowledge/race.md"]]),
+      changes: new Map([
+        [absolutePath, { kind: "unlink", deleteSnapshots: snapshots }],
+      ]),
+    } as TreeChangeBatch);
+    fs.writeFileSync(absolutePath, "concurrent recreation");
+    h.tick();
+    await settle();
+    expect(h.remote.has("knowledge/race.md")).toBe(true);
+    expect(readJournal("indigo").files["knowledge/race.md"]?.localDeleteIntent)
+      .toBeUndefined();
+    await stopHarness(h);
+  });
+});