@indigoai-us/hq-cloud 6.14.17 → 6.14.19

package/dist/bin/sync-runner.test.js

@@ -12,9 +12,9 @@ import * as os from "os";
 import * as path from "path";
 import { runRunner, runRunnerWithLoop, resolveDeletePolicy, resolveSkipPersonal, selectObjectIOFactory, routeChangeToTarget, buildTargetedPushArgv, resolvePullScope, readPinnedPrefixes, SESSIONS_SCOPE_PREFIX, defaultCollectTelemetry, AUTH_REQUIRED_PASS_EXIT, } from "./sync-runner.js";
 import { PresignObjectIO, S3SdkObjectIO } from "../object-io.js";
-import { FakeClock } from "../watcher.js";
-import { adaptivePollMs } from "./sync-runner-watch-loop.js";
-import { PERSONAL_VAULT_JOURNAL_SLUG } from "../journal.js";
+import { FakeClock, } from "../watcher.js";
+import { adaptivePollMs, journalEntriesForWatcherDelete, } from "./sync-runner-watch-loop.js";
+import { PERSONAL_VAULT_JOURNAL_SLUG, readJournal, writeJournal, } from "../journal.js";
 import { HQ_CLOUD_VERSION } from "../version.js";
 import { lockPathFor, OPERATION_LOCKED_EXIT } from "../operation-lock.js";
 import { TRANSIENT_NETWORK_EXIT } from "../lib/net-errors.js";
@@ -22,6 +22,8 @@ import { PARTIAL_SYNC_EXIT } from "../lib/exit-codes.js";
 import { isCoveredByAny } from "../prefix-coalesce.js";
 import { VaultAuthError, VaultNotFoundError } from "../vault-client.js";
 import { CognitoRefreshError } from "../cognito-auth.js";
+import { reconcileCompanyManifest, } from "../manifest-reconcile.js";
+import yaml from "js-yaml";
 // ---------------------------------------------------------------------------
 // Hermetic journal state — the runner now calls migratePersonalVaultJournal()
 // on every --companies fanout (one-time seed of the reserved vault journal
@@ -152,8 +154,13 @@ function makeDeps(overrides = {}) {
             updated: true,
             embedded: false,
             pendingDirty: false,
+            lockBusy: false,
+            timedOut: false,
+            corruptionQuarantined: false,
         })),
-        reconcileManifest: vi.fn().mockResolvedValue(undefined),
+        reconcileManifest: vi
+            .fn()
+            .mockResolvedValue({ written: false, added: [], updated: [], skipped: [] }),
         ...overrides,
         stdout,
         stderr,
@@ -196,7 +203,9 @@ describe("argv parsing", () => {
         const code = await runRunner(["--companies", "--json"], deps);
         expect(code).toBe(0);
         // Empty memberships → setup-needed, not a parse error
-        expect(deps.stdout.events()).toEqual([{ type: "setup-needed" }]);
+        expect(deps.stdout.events()).toEqual([
+            { type: "setup-needed", reason: "no-memberships" },
+        ]);
     });
 });
 // ---------------------------------------------------------------------------
@@ -499,7 +508,67 @@ describe("claim-dance", () => {
         expect(ensureSpy).not.toHaveBeenCalled();
         expect(claimSpy).not.toHaveBeenCalled();
         // No memberships, no invites — truly empty → setup-needed is correct here.
-        expect(deps.stdout.events()).toEqual([{ type: "setup-needed" }]);
+        expect(deps.stdout.events()).toEqual([
+            { type: "setup-needed", reason: "no-memberships" },
+        ]);
+    });
+    // The michelle@boringecom.com shape: an invite exists, the claim attempt does
+    // not convert it into a membership, and the user is told they are solo. The
+    // count is what turns "you have no team" into "you have an invite to accept".
+    it("US-004: carries pendingInviteCount when invites did not become memberships", async () => {
+        const deps = makeDeps({
+            createVaultClient: () => makeVaultStub({
+                pendingInvites: [{ uid: "inv_1" }, { uid: "inv_2" }],
+                ensurePerson: vi
+                    .fn()
+                    .mockResolvedValue({ uid: "ent_person" }),
+                claim: vi
+                    .fn()
+                    .mockResolvedValue(undefined),
+            }),
+            getIdTokenClaims: () => claims,
+        });
+        expect(await runRunner(["--companies"], deps)).toBe(0);
+        expect(deps.stdout.events()).toEqual([
+            { type: "setup-needed", reason: "no-memberships", pendingInviteCount: 2 },
+        ]);
+    });
+    it("US-004: omits pendingInviteCount entirely when there were no invites", async () => {
+        const deps = makeDeps({
+            createVaultClient: () => makeVaultStub({ pendingInvites: [] }),
+            getIdTokenClaims: () => claims,
+        });
+        expect(await runRunner(["--companies"], deps)).toBe(0);
+        const [event] = deps.stdout.events();
+        expect(event).toEqual({ type: "setup-needed", reason: "no-memberships" });
+        expect("pendingInviteCount" in event).toBe(false);
+    });
+    it("US-004: reports claim-dance skipped as a diagnostic, not a bare stderr line", async () => {
+        const deps = makeDeps({
+            createVaultClient: () => makeVaultStub({
+                pendingInvites: [{ uid: "inv_1" }],
+                ensurePerson: vi
+                    .fn()
+                    .mockRejectedValue(new Error("BatchWriteItem denied")),
+            }),
+            getIdTokenClaims: () => claims,
+        });
+        // Non-throwing by contract: the failure never changes the exit code...
+        expect(await runRunner(["--companies"], deps)).toBe(0);
+        // ...but it is no longer invisible.
+        expect(deps.stderr.raw()).toContain("runner.claim_dance.skipped");
+    });
+    it("US-004: a claim-dance that cannot identify the caller still reports the pending invites", async () => {
+        const deps = makeDeps({
+            createVaultClient: () => makeVaultStub({ pendingInvites: [{ uid: "inv_1" }] }),
+            // No sub/name — the claim cannot proceed, but the invites are still real.
+            getIdTokenClaims: () => ({}),
+        });
+        expect(await runRunner(["--companies"], deps)).toBe(0);
+        expect(deps.stdout.events()).toEqual([
+            { type: "setup-needed", reason: "no-memberships", pendingInviteCount: 1 },
+        ]);
+        expect(deps.stderr.raw()).toContain("runner.claim_dance.skipped");
     });
     it("skips claim-dance entirely when no idToken claims are available", async () => {
         const pendingSpy = vi.fn().mockResolvedValue([]);
@@ -569,7 +638,9 @@ describe("target resolution", () => {
         const deps = makeDeps();
         const code = await runRunner(["--companies"], deps);
         expect(code).toBe(0);
-        expect(deps.stdout.events()).toEqual([{ type: "setup-needed" }]);
+        expect(deps.stdout.events()).toEqual([
+            { type: "setup-needed", reason: "no-memberships" },
+        ]);
         // sync should NOT have been called — no targets
         expect(deps.sync).not.toHaveBeenCalled();
     });
@@ -856,7 +927,11 @@ describe("fanout-plan", () => {
         const plan = deps.stdout
             .events()
             .find((e) => e.type === "fanout-plan");
-        expect(plan.companies).toEqual([{ uid: "cmp_live", slug: "live" }]);
+        // The surviving target now also carries the plan-time entity snapshot the
+        // manifest reconciler reads instead of re-fetching (US-002).
+        expect(plan.companies).toEqual([
+            { uid: "cmp_live", slug: "live", entityType: "company", entityStatus: "active" },
+        ]);
     });
     it("reconciles after the personal leg completes", async () => {
         const order = [];
@@ -887,6 +962,7 @@ describe("fanout-plan", () => {
             }),
             reconcileManifest: vi.fn().mockImplementation(async () => {
                 order.push("reconcile");
+                return { written: false, added: [], updated: [], skipped: [] };
             }),
         });
         expect(await runRunner(["--companies"], deps)).toBe(0);
@@ -1727,6 +1803,9 @@ describe("all-complete aggregate", () => {
             updated: true,
             embedded: false,
             pendingDirty: false,
+            lockBusy: false,
+            timedOut: false,
+            corruptionQuarantined: false,
         }));
         const deps = makeDeps({
             createVaultClient: () => makeVaultStub({
@@ -4583,6 +4662,90 @@ describe("runRunnerWithLoop — Phase 3 event-sync wiring (US-017/018/019)", ()
         shutdown();
         await loop;
     });
+    it("does not publish an exit-zero deletion that the scoped push refused", async () => {
+        const publishBatch = vi.fn();
+        const startEventSync = vi.fn().mockResolvedValue({
+            publishBatch,
+            receiver: { start: async () => { }, dispose: async () => { }, connected: true },
+            ownDeviceId: "dev-test",
+            dispose: vi.fn().mockResolvedValue(undefined),
+        });
+        const runPass = vi
+            .fn()
+            .mockResolvedValueOnce(0)
+            .mockResolvedValueOnce({
+            exitCode: 0,
+            result: {
+                pushPathResults: [{
+                        relativePath: "companies/indigo/deleted.md",
+                        status: "refused",
+                        operation: "delete",
+                        reason: "missing-delete-intent",
+                    }],
+            },
+        })
+            .mockResolvedValue(0);
+        const { loop, watcher, tick, shutdown } = runLoop({
+            claims: ENROLLED_CLAIMS,
+            startEventSync,
+            runPass,
+        });
+        await microtasks();
+        watcher.emit("companies/indigo/deleted.md", {
+            paths: new Map([[
+                    "/tmp/hq/companies/indigo/deleted.md",
+                    "companies/indigo/deleted.md",
+                ]]),
+        });
+        tick();
+        await microtasks();
+        expect(publishBatch).not.toHaveBeenCalled();
+        shutdown();
+        await loop;
+    });
+    it("does not publish unlinkDir when a covered descendant delete was refused", async () => {
+        const publishBatch = vi.fn();
+        const startEventSync = vi.fn().mockResolvedValue({
+            publishBatch,
+            receiver: { start: async () => { }, dispose: async () => { }, connected: true },
+            ownDeviceId: "dev-test",
+            dispose: vi.fn().mockResolvedValue(undefined),
+        });
+        const runPass = vi
+            .fn()
+            .mockResolvedValueOnce(0)
+            .mockResolvedValueOnce({
+            exitCode: 0,
+            result: {
+                pushPathResults: [{
+                        relativePath: "companies/indigo/archive/deleted.md",
+                        status: "refused",
+                        operation: "delete",
+                        reason: "missing-delete-intent",
+                    }],
+            },
+        })
+            .mockResolvedValue(0);
+        const { loop, watcher, tick, shutdown } = runLoop({
+            claims: ENROLLED_CLAIMS,
+            startEventSync,
+            runPass,
+        });
+        await microtasks();
+        const absolutePath = "/tmp/hq/companies/indigo/archive";
+        watcher.emit("companies/indigo/archive", {
+            paths: new Map([[
+                    absolutePath,
+                    "companies/indigo/archive",
+                ]]),
+            changes: new Map([[absolutePath, { kind: "unlinkDir" }]]),
+        });
+        tick();
+        await microtasks();
+        expect(publishBatch).not.toHaveBeenCalled();
+        shutdown();
+        await loop;
+    });
     it("F04: mixed-route watcher batches publish only routes that were pushed", async () => {
         const publishBatch = vi.fn();
         const startEventSync = vi.fn().mockResolvedValue({
@@ -5342,4 +5505,685 @@ describe("US-004 — --personal for an AGENT machine identity (HARD GATE)", () =
         expect(cmp(HQ_CLOUD_VERSION, FLOOR)).toBeGreaterThanOrEqual(0);
     });
 });
+// ---------------------------------------------------------------------------
+// US-002 — post-fanout manifest reconciliation wiring
+//
+// The reconciler itself is unit-tested in manifest-reconcile.test.ts. These
+// tests own the SEAM: which run modes reach it, which targets cross it, and
+// what the runner does with the result it hands back.
+// ---------------------------------------------------------------------------
+describe("US-002 — manifest reconciliation wiring", () => {
+    const PERSON_ENTITY = {
+        uid: "prs_me",
+        slug: "me",
+        type: "person",
+        status: "active",
+        bucketName: "hq-vault-prs-me",
+        createdAt: "2026-01-01T00:00:00Z",
+    };
+    function noopReconcileResult() {
+        return { written: false, added: [], updated: [], skipped: [] };
+    }
+    /** A vault stub whose companies all resolve to `cmp_x` → slug `x`. */
+    function companiesClient(companyUids) {
+        return makeVaultStub({
+            memberships: companyUids.map((companyUid) => ({ companyUid })),
+            entityGet: (uid) => Promise.resolve({
+                uid,
+                slug: uid.replace(/^cmp_/, ""),
+                name: `${uid} Inc`,
+                type: "company",
+                status: "active",
+                bucketName: `bucket-${uid}`,
+                createdAt: "2026-01-01T00:00:00Z",
+            }),
+            listPersons: () => Promise.resolve([PERSON_ENTITY]),
+        });
+    }
+    function reconcileArgs(reconcile) {
+        return reconcile.mock.calls[0][0];
+    }
+    /** Diagnostics ride stderr as ndjson; pick out the manifest ones. */
+    function manifestDiagnostics(stderr) {
+        return stderr
+            .lines()
+            .flatMap((line) => {
+            try {
+                return [JSON.parse(line)];
+            }
+            catch {
+                return [];
+            }
+        })
+            .filter((entry) => entry.component === "manifest-reconcile");
+    }
+    it("AC2: an errored company is not eligible — only the completing company is", async () => {
+        const reconcile = vi.fn().mockResolvedValue(noopReconcileResult());
+        const deps = makeDeps({
+            createVaultClient: () => companiesClient(["cmp_ok", "cmp_bad"]),
+            sync: vi.fn().mockImplementation(async (options) => {
+                if (options.company === "cmp_bad")
+                    throw new Error("pull leg exploded");
+                return defaultSyncResult();
+            }),
+            reconcileManifest: reconcile,
+        });
+        await runRunner(["--companies"], deps);
+        expect(reconcile).toHaveBeenCalledTimes(1);
+        const args = reconcileArgs(reconcile);
+        // The completion filter is `completedCompanySlugs`; assert the EFFECTIVE
+        // eligible set, which is what actually reaches the manifest.
+        const eligible = args.targets.filter((target) => args.completedCompanySlugs.has(target.slug));
+        expect(eligible.map((target) => target.slug)).toEqual(["ok"]);
+        expect(args.completedCompanySlugs.has("bad")).toBe(false);
+    });
+    it("AC3: the personal target is never passed to the reconciler", async () => {
+        const reconcile = vi.fn().mockResolvedValue(noopReconcileResult());
+        const deps = makeDeps({
+            createVaultClient: () => companiesClient(["cmp_acme"]),
+            reconcileManifest: reconcile,
+        });
+        expect(await runRunner(["--companies"], deps)).toBe(0);
+        const args = reconcileArgs(reconcile);
+        // The personal leg definitely ran — otherwise this assertion is vacuous.
+        const plan = deps.stdout
+            .events()
+            .find((e) => e.type === "fanout-plan");
+        expect(plan.companies.map((t) => t.slug)).toContain("personal");
+        expect(args.targets.map((target) => target.slug)).toEqual(["acme"]);
+        expect(args.targets.some((target) => target.personalMode === true)).toBe(false);
+        expect(args.targets.some((target) => target.slug === "personal")).toBe(false);
+    });
+    it("AC4: --personal mode does not reconcile", async () => {
+        const reconcile = vi.fn().mockResolvedValue(noopReconcileResult());
+        const deps = makeDeps({
+            createVaultClient: () => makeVaultStub({ listPersons: () => Promise.resolve([PERSON_ENTITY]) }),
+            reconcileManifest: reconcile,
+        });
+        expect(await runRunner(["--personal"], deps)).toBe(0);
+        expect(reconcile).not.toHaveBeenCalled();
+    });
+    it("AC4: single-company mode (--company <slug>) does not reconcile", async () => {
+        const reconcile = vi.fn().mockResolvedValue(noopReconcileResult());
+        const deps = makeDeps({
+            createVaultClient: () => companiesClient(["cmp_acme"]),
+            reconcileManifest: reconcile,
+        });
+        expect(await runRunner(["--company", "cmp_acme"], deps)).toBe(0);
+        expect(reconcile).not.toHaveBeenCalled();
+    });
+    it("AC5: company targets carry the plan-resolved bucketName, so no getEntity is passed", async () => {
+        const reconcile = vi.fn().mockResolvedValue(noopReconcileResult());
+        const deps = makeDeps({
+            createVaultClient: () => companiesClient(["cmp_acme"]),
+            reconcileManifest: reconcile,
+        });
+        expect(await runRunner(["--companies"], deps)).toBe(0);
+        const args = reconcileArgs(reconcile);
+        expect(args.targets[0]).toMatchObject({
+            uid: "cmp_acme",
+            slug: "acme",
+            name: "cmp_acme Inc",
+            bucketName: "bucket-cmp_acme",
+            // Liveness evidence travels with the target. Dropping the round trip
+            // must not drop the guarantee it used to provide.
+            entityType: "company",
+            entityStatus: "active",
+        });
+        // Zero extra API calls: the runner hands over no entity resolver at all.
+        expect(args.getEntity).toBeUndefined();
+    });
+    it("END-TO-END: a suspended company completes its sync leg but never reaches the manifest", async () => {
+        // Exercises the REAL reconciler through the runner — no stub — because the
+        // defect this guards was invisible to every stubbed assertion.
+        const root = fs.mkdtempSync(path.join(os.tmpdir(), "hq-runner-manifest-"));
+        try {
+            fs.mkdirSync(path.join(root, "companies", "live"), { recursive: true });
+            fs.mkdirSync(path.join(root, "companies", "susp"), { recursive: true });
+            const manifestPath = path.join(root, "companies", "manifest.yaml");
+            fs.writeFileSync(manifestPath, "companies: {}\n");
+            const deps = makeDeps({
+                createVaultClient: () => makeVaultStub({
+                    memberships: [{ companyUid: "cmp_live" }, { companyUid: "cmp_susp" }],
+                    entityGet: (uid) => Promise.resolve({
+                        uid,
+                        slug: uid === "cmp_live" ? "live" : "susp",
+                        type: "company",
+                        // The suspended company is still a perfectly syncable target.
+                        status: uid === "cmp_live" ? "active" : "suspended",
+                        bucketName: `bucket-${uid}`,
+                        createdAt: "2026-01-01T00:00:00Z",
+                    }),
+                    listPersons: () => Promise.resolve([PERSON_ENTITY]),
+                }),
+                // The REAL reconciler, not the makeDeps stub — that stub is exactly
+                // what let this defect hide from every other assertion here.
+                reconcileManifest: reconcileCompanyManifest,
+            });
+            expect(await runRunner(["--companies", "--hq-root", root], deps)).toBe(0);
+            // Both companies synced (the guard must not have leaked into sync).
+            const syncedCompanies = deps.sync.mock.calls
+                .map((call) => call[0].company)
+                .filter(Boolean);
+            expect(syncedCompanies).toContain("cmp_live");
+            expect(syncedCompanies).toContain("cmp_susp");
+            // ...but only the active one earned a manifest entry.
+            const written = yaml.load(fs.readFileSync(manifestPath, "utf8"));
+            expect(Object.keys(written.companies ?? {})).toEqual(["live"]);
+        }
+        finally {
+            fs.rmSync(root, { recursive: true, force: true });
+        }
+    });
+    it("US-003: seeds activeCompany from the completed company set", async () => {
+        const seed = vi.fn().mockReturnValue({ written: true, activeCompany: "acme" });
+        const deps = makeDeps({
+            createVaultClient: () => companiesClient(["cmp_acme"]),
+            seedActiveCompany: seed,
+        });
+        expect(await runRunner(["--companies"], deps)).toBe(0);
+        expect(seed).toHaveBeenCalledTimes(1);
+        expect(seed.mock.calls[0][0]).toMatchObject({ companySlugs: ["acme"] });
+        expect(deps.stderr.raw()).toContain("active-company-seeded");
+    });
+    it("US-003: the personal target is never offered as an activeCompany candidate", async () => {
+        const seed = vi.fn().mockReturnValue({ written: false, skippedReason: "already-set" });
+        const deps = makeDeps({
+            createVaultClient: () => companiesClient(["cmp_acme"]),
+            seedActiveCompany: seed,
+        });
+        expect(await runRunner(["--companies"], deps)).toBe(0);
+        expect(seed.mock.calls[0][0].companySlugs).not.toContain("personal");
+    });
+    // The two writes are independent repairs. A joiner whose manifest write fails
+    // should still get routed, and vice versa.
+    it("US-003: a failing manifest reconcile does not prevent activeCompany seeding", async () => {
+        const seed = vi.fn().mockReturnValue({ written: true, activeCompany: "acme" });
+        const deps = makeDeps({
+            createVaultClient: () => companiesClient(["cmp_acme"]),
+            reconcileManifest: vi.fn().mockRejectedValue(new Error("manifest write blew up")),
+            seedActiveCompany: seed,
+        });
+        expect(await runRunner(["--companies"], deps)).toBe(0);
+        expect(deps.stderr.raw()).toContain("runner.manifest_reconcile.failed");
+        expect(seed).toHaveBeenCalledTimes(1);
+    });
+    it("US-003: a throwing seeder still emits all-complete and exits 0", async () => {
+        const deps = makeDeps({
+            createVaultClient: () => companiesClient(["cmp_acme"]),
+            seedActiveCompany: vi.fn().mockImplementation(() => {
+                throw new Error("config write blew up");
+            }),
+        });
+        expect(await runRunner(["--companies"], deps)).toBe(0);
+        expect(deps.stdout.events().some((e) => e.type === "all-complete")).toBe(true);
+        expect(deps.stderr.raw()).toContain("runner.active_company.failed");
+    });
+    it("US-003: a no-op seeding is silent", async () => {
+        const deps = makeDeps({
+            createVaultClient: () => companiesClient(["cmp_acme"]),
+            seedActiveCompany: vi
+                .fn()
+                .mockReturnValue({ written: false, skippedReason: "already-set" }),
+        });
+        expect(await runRunner(["--companies"], deps)).toBe(0);
+        expect(deps.stderr.raw()).not.toContain("active-company-seeded");
+    });
+    it("US-003: single-company mode does not seed activeCompany", async () => {
+        const seed = vi.fn();
+        const deps = makeDeps({
+            createVaultClient: () => companiesClient(["cmp_acme"]),
+            seedActiveCompany: seed,
+        });
+        await runRunner(["--company", "acme"], deps);
+        expect(seed).not.toHaveBeenCalled();
+    });
+    it("AC6: a throwing reconciler still emits all-complete and exits 0", async () => {
+        const deps = makeDeps({
+            createVaultClient: () => companiesClient(["cmp_acme"]),
+            reconcileManifest: vi
+                .fn()
+                .mockRejectedValue(new Error("manifest write blew up")),
+        });
+        expect(await runRunner(["--companies"], deps)).toBe(0);
+        expect(deps.stdout.events().some((e) => e.type === "all-complete")).toBe(true);
+        expect(deps.stderr.raw()).toContain("runner.manifest_reconcile.failed");
+    });
+    it("AC7: a write emits a manifest-reconciled diagnostic naming the slugs", async () => {
+        const deps = makeDeps({
+            createVaultClient: () => companiesClient(["cmp_acme"]),
+            reconcileManifest: vi.fn().mockResolvedValue({
+                written: true,
+                added: ["acme"],
+                updated: ["beta"],
+                skipped: [],
+            }),
+        });
+        expect(await runRunner(["--companies"], deps)).toBe(0);
+        const diagnostics = manifestDiagnostics(deps.stderr);
+        expect(diagnostics).toHaveLength(1);
+        expect(diagnostics[0]).toMatchObject({
+            component: "manifest-reconcile",
+            event: "manifest-reconciled",
+            added: ["acme"],
+            updated: ["beta"],
+        });
+    });
+    it("AC7: a no-op reconciliation is completely silent (steady-state sync)", async () => {
+        const deps = makeDeps({
+            createVaultClient: () => companiesClient(["cmp_acme"]),
+            reconcileManifest: vi.fn().mockResolvedValue({
+                written: false,
+                added: [],
+                updated: [],
+                skipped: ["weird-slug"],
+            }),
+        });
+        expect(await runRunner(["--companies"], deps)).toBe(0);
+        expect(manifestDiagnostics(deps.stderr)).toEqual([]);
+        expect(deps.stderr.raw()).not.toContain("manifest-reconciled");
+    });
+});
+describe("watcher delete intents without pre-seeded authorization", () => {
+    function startDeleteHarness(keys, options = {}) {
+        const hqRoot = fs.mkdtempSync(path.join(os.tmpdir(), "hq-watch-delete-"));
+        const companyRoot = path.join(hqRoot, "companies", "indigo");
+        fs.mkdirSync(companyRoot, { recursive: true });
+        const remote = new Map();
+        const files = {};
+        for (const key of keys) {
+            const absolutePath = path.join(companyRoot, key);
+            const content = `synced:${key}`;
+            fs.mkdirSync(path.dirname(absolutePath), { recursive: true });
+            fs.writeFileSync(absolutePath, content);
+            remote.set(key, content);
+            files[key] = {
+                hash: `hash:${key}`,
+                size: Buffer.byteLength(content),
+                syncedAt: new Date().toISOString(),
+                direction: "down",
+                remoteEtag: `etag:${key}`,
+                kind: "file",
+            };
+        }
+        writeJournal("indigo", {
+            version: "2", lastSync: new Date().toISOString(), files, pulls: [],
+        });
+        const watcher = makeBatchWatcherStub();
+        const sleep = makeSteppableSleep();
+        let capture;
+        let triggerShutdown = () => { };
+        let downloads = 0;
+        let releaseInitialPull = () => { };
+        const initialPullGate = new Promise((resolve) => {
+            releaseInitialPull = resolve;
+        });
+        let initialPullGated = options.gateInitialPull === true;
+        const runPass = vi.fn(async (argv) => {
+            const direction = argv[argv.indexOf("--direction") + 1];
+            if (direction === "push") {
+                const journal = readJournal("indigo");
+                const pathResults = [];
+                const scopes = argv.flatMap((value, index) => argv[index - 1] === "--scope-path" ? [value] : []);
+                for (const scope of scopes) {
+                    for (const key of Object.keys(journal.files)) {
+                        if (key !== scope && !key.startsWith(`${scope}/`))
+                            continue;
+                        const absolutePath = path.join(companyRoot, key);
+                        const entry = journal.files[key];
+                        if (fs.existsSync(absolutePath)) {
+                            remote.set(key, fs.readFileSync(absolutePath, "utf8"));
+                            continue;
+                        }
+                        const intent = entry.localDeleteIntent;
+                        const current = intent?.remoteEtag === entry.remoteEtag &&
+                            intent?.localHash === entry.hash &&
+                            intent?.localKind === entry.kind;
+                        if (current) {
+                            remote.delete(key);
+                            delete journal.files[key];
+                            pathResults.push({
+                                relativePath: `companies/indigo/${key}`,
+                                status: "accepted",
+                                operation: "delete",
+                            });
+                        }
+                        else {
+                            pathResults.push({
+                                relativePath: `companies/indigo/${key}`,
+                                status: "refused",
+                                operation: "delete",
+                                reason: "missing-delete-intent",
+                            });
+                        }
+                    }
+                    const added = path.join(companyRoot, scope);
+                    if (fs.existsSync(added) && fs.lstatSync(added).isFile()) {
+                        remote.set(scope, fs.readFileSync(added, "utf8"));
+                    }
+                }
+                writeJournal("indigo", journal);
+                return { exitCode: 0, result: { pushPathResults: pathResults } };
+            }
+            if (direction === "pull" || direction === "both") {
+                if (initialPullGated) {
+                    initialPullGated = false;
+                    await initialPullGate;
+                }
+                const journal = readJournal("indigo");
+                for (const [key, content] of remote) {
+                    const absolutePath = path.join(companyRoot, key);
+                    if (fs.existsSync(absolutePath))
+                        continue;
+                    const entry = journal.files[key];
+                    const intent = entry?.localDeleteIntent;
+                    const currentIntent = intent?.remoteEtag === entry?.remoteEtag &&
+                        intent?.localHash === entry?.hash &&
+                        intent?.localKind === entry?.kind;
+                    if (currentIntent)
+                        continue;
+                    fs.mkdirSync(path.dirname(absolutePath), { recursive: true });
+                    fs.writeFileSync(absolutePath, content);
+                    downloads++;
+                }
+            }
+            return 0;
+        });
+        const loop = runRunnerWithLoop([
+            "--companies", "--watch", "--event-push", "--direction", "both",
+            "--hq-root", hqRoot, "--poll-remote-ms", "60000",
+        ], {
+            runPass,
+            createWatcher: (opts) => {
+                capture = opts.captureLocalDeleteSnapshots;
+                return watcher;
+            },
+            sleep: sleep.sleep,
+            onShutdownSignal: (handler) => {
+                triggerShutdown = handler;
+                return () => { };
+            },
+        });
+        return {
+            hqRoot, companyRoot, remote, watcher, loop, tick: sleep.tick,
+            capture: () => capture, downloads: () => downloads,
+            releaseInitialPull,
+            shutdown: () => triggerShutdown(),
+        };
+    }
+    async function settle() {
+        await flushLoopMicrotasks(12);
+    }
+    async function stopHarness(h) {
+        h.shutdown();
+        h.tick();
+        await h.loop;
+        fs.rmSync(h.hqRoot, { recursive: true, force: true });
+    }
+    it("live unlink binds the pre-delete revision, deletes remote, and survives immediate plus later full pulls", async () => {
+        const h = startDeleteHarness(["knowledge/gone.md"]);
+        await settle();
+        const absolutePath = path.join(h.companyRoot, "knowledge/gone.md");
+        fs.unlinkSync(absolutePath);
+        const snapshots = h.capture()("companies/indigo/knowledge/gone.md", "unlink");
+        expect(snapshots).toHaveLength(1);
+        expect(readJournal("indigo").files["knowledge/gone.md"]?.localDeleteIntent)
+            .toMatchObject({
+            remoteEtag: "etag:knowledge/gone.md",
+            localHash: "hash:knowledge/gone.md",
+            localKind: "file",
+        });
+        h.watcher.emit("companies/indigo/knowledge/gone.md", {
+            paths: new Map([[absolutePath, "companies/indigo/knowledge/gone.md"]]),
+            changes: new Map([
+                [absolutePath, { kind: "unlink", deleteSnapshots: snapshots }],
+            ]),
+        });
+        h.tick();
+        await settle();
+        expect(h.remote.has("knowledge/gone.md")).toBe(false);
+        expect(fs.existsSync(absolutePath)).toBe(false);
+        expect(h.downloads()).toBe(0);
+        for (let i = 0; i < 8; i++) {
+            h.tick();
+            await settle();
+        }
+        expect(fs.existsSync(absolutePath)).toBe(false);
+        expect(h.downloads()).toBe(0);
+        await stopHarness(h);
+    });
+    it("persists the intent before an in-flight pull plans the missing path", async () => {
+        const h = startDeleteHarness(["knowledge/in-flight.md"], { gateInitialPull: true });
+        await settle();
+        const relativePath = "companies/indigo/knowledge/in-flight.md";
+        const absolutePath = path.join(h.companyRoot, "knowledge/in-flight.md");
+        fs.unlinkSync(absolutePath);
+        const snapshots = h.capture()(relativePath, "unlink");
+        expect(snapshots).toHaveLength(1);
+        expect(readJournal("indigo").files["knowledge/in-flight.md"]
+            ?.localDeleteIntent).toBeDefined();
+        h.watcher.emit(relativePath, {
+            paths: new Map([[absolutePath, relativePath]]),
+            changes: new Map([
+                [absolutePath, { kind: "unlink", deleteSnapshots: snapshots }],
+            ]),
+        });
+        h.releaseInitialPull();
+        await settle();
+        expect(h.downloads()).toBe(0);
+        expect(fs.existsSync(absolutePath)).toBe(false);
+        h.tick();
+        await settle();
+        expect(h.remote.has("knowledge/in-flight.md")).toBe(false);
+        expect(h.downloads()).toBe(0);
+        await stopHarness(h);
+    });
+    it("uses direct journal-key lookup for file unlink snapshots", () => {
+        const exactEntry = {
+            hash: "hash",
+            size: 4,
+            syncedAt: new Date().toISOString(),
+            direction: "down",
+            remoteEtag: "etag",
+            kind: "file",
+        };
+        const files = new Proxy({ "knowledge/exact.md": exactEntry }, {
+            ownKeys: () => {
+                throw new Error("file unlink must not enumerate the journal");
+            },
+        });
+        expect(journalEntriesForWatcherDelete(files, "knowledge/exact.md", "unlink")).toEqual([["knowledge/exact.md", exactEntry]]);
+    });
+    it("keeps a deleted top-level personal file in the scoped push delete roots", async () => {
+        const hqRoot = fs.mkdtempSync(path.join(os.tmpdir(), "hq-personal-delete-"));
+        const key = "personal-note.md";
+        const absolutePath = path.join(hqRoot, key);
+        fs.writeFileSync(absolutePath, "personal content");
+        const remote = new Map([[key, "personal content"]]);
+        writeJournal(PERSONAL_VAULT_JOURNAL_SLUG, {
+            version: "2",
+            lastSync: new Date().toISOString(),
+            pulls: [],
+            files: {
+                [key]: {
+                    hash: "personal-hash",
+                    size: 16,
+                    syncedAt: new Date().toISOString(),
+                    direction: "down",
+                    remoteEtag: "personal-etag",
+                    kind: "file",
+                },
+            },
+        });
+        const shareSpy = vi.fn(async (options) => {
+            const journal = readJournal(PERSONAL_VAULT_JOURNAL_SLUG);
+            const entry = journal.files[key];
+            const intent = entry?.localDeleteIntent;
+            const currentIntent = intent?.remoteEtag === entry?.remoteEtag &&
+                intent?.localHash === entry?.hash &&
+                intent?.localKind === entry?.kind;
+            if (!fs.existsSync(absolutePath) &&
+                options.deleteScopeRoots?.includes(key) &&
+                currentIntent) {
+                remote.delete(key);
+                delete journal.files[key];
+                writeJournal(PERSONAL_VAULT_JOURNAL_SLUG, journal);
+                return defaultShareResult({
+                    filesDeleted: 1,
+                    pathResults: [
+                        { path: key, status: "accepted", operation: "delete" },
+                    ],
+                });
+            }
+            return defaultShareResult();
+        });
+        let downloads = 0;
+        const syncSpy = vi.fn(async () => {
+            if (remote.has(key) && !fs.existsSync(absolutePath)) {
+                const entry = readJournal(PERSONAL_VAULT_JOURNAL_SLUG).files[key];
+                const intent = entry?.localDeleteIntent;
+                const currentIntent = intent?.remoteEtag === entry?.remoteEtag &&
+                    intent?.localHash === entry?.hash &&
+                    intent?.localKind === entry?.kind;
+                if (!currentIntent) {
+                    fs.writeFileSync(absolutePath, remote.get(key));
+                    downloads++;
+                }
+            }
+            return defaultSyncResult();
+        });
+        const runnerDeps = makeDeps({
+            share: shareSpy,
+            sync: syncSpy,
+            createVaultClient: () => makeVaultStub({
+                listPersons: () => Promise.resolve([
+                    {
+                        uid: "prs_personal",
+                        type: "person",
+                        bucketName: "hq-vault-personal",
+                        status: "active",
+                    },
+                ]),
+            }),
+            operationLockAlreadyHeld: true,
+        });
+        const watcher = makeBatchWatcherStub();
+        const sleep = makeSteppableSleep();
+        let capture;
+        let triggerShutdown = () => { };
+        const loop = runRunnerWithLoop([
+            "--personal",
+            "--watch",
+            "--event-push",
+            "--direction",
+            "both",
+            "--hq-root",
+            hqRoot,
+            "--poll-remote-ms",
+            "60000",
+        ], {
+            runPass: (passArgv) => runRunner(passArgv, runnerDeps),
+            createWatcher: (options) => {
+                capture = options.captureLocalDeleteSnapshots;
+                return watcher;
+            },
+            sleep: sleep.sleep,
+            onShutdownSignal: (handler) => {
+                triggerShutdown = handler;
+                return () => { };
+            },
+        });
+        await vi.waitFor(() => expect(syncSpy).toHaveBeenCalled());
+        await settle();
+        shareSpy.mockClear();
+        fs.unlinkSync(absolutePath);
+        const snapshots = capture(key, "unlink");
+        expect(snapshots).toHaveLength(1);
+        expect(snapshots[0].deleteScopeRoot).toBe(key);
+        expect(readJournal(PERSONAL_VAULT_JOURNAL_SLUG).files[key]
+            ?.localDeleteIntent).toBeDefined();
+        watcher.emit(key, {
+            paths: new Map([[absolutePath, key]]),
+            changes: new Map([
+                [absolutePath, { kind: "unlink", deleteSnapshots: snapshots }],
+            ]),
+        });
+        sleep.tick();
+        await settle();
+        expect(remote.has(key)).toBe(false);
+        expect(downloads).toBe(0);
+        expect(fs.existsSync(absolutePath)).toBe(false);
+        const scopedShareOptions = shareSpy.mock.calls.at(-1)?.[0];
+        expect(scopedShareOptions?.paths).not.toContain(absolutePath);
+        expect(scopedShareOptions?.deleteScopeRoots).toEqual([key]);
+        triggerShutdown();
+        await loop;
+        fs.rmSync(hqRoot, { recursive: true, force: true });
+    });
+    it("rename uploads the new path, deletes the old path, and neither resurrects", async () => {
+        const h = startDeleteHarness(["knowledge/old.md"]);
+        await settle();
+        const oldPath = path.join(h.companyRoot, "knowledge/old.md");
+        const newPath = path.join(h.companyRoot, "knowledge/new.md");
+        const snapshots = h.capture()("companies/indigo/knowledge/old.md", "unlink");
+        fs.renameSync(oldPath, newPath);
+        h.watcher.emit("companies/indigo/knowledge/old.md", {
+            paths: new Map([
+                [oldPath, "companies/indigo/knowledge/old.md"],
+                [newPath, "companies/indigo/knowledge/new.md"],
+            ]),
+            changes: new Map([
+                [oldPath, { kind: "unlink", deleteSnapshots: snapshots }],
+                [newPath, { kind: "add" }],
+            ]),
+        });
+        h.tick();
+        await settle();
+        expect(h.remote.has("knowledge/old.md")).toBe(false);
+        expect(h.remote.get("knowledge/new.md")).toBe("synced:knowledge/old.md");
+        expect(fs.existsSync(oldPath)).toBe(false);
+        expect(fs.existsSync(newPath)).toBe(true);
+        await stopHarness(h);
+    });
+    it("unlinkDir records every tracked descendant across a 12-file breaker-sized subtree", async () => {
+        const keys = Array.from({ length: 12 }, (_, i) => `knowledge/moved/f-${i}.md`);
+        const h = startDeleteHarness(keys);
+        await settle();
+        const subtree = path.join(h.companyRoot, "knowledge/moved");
+        const snapshots = h.capture()("companies/indigo/knowledge/moved", "unlinkDir");
+        expect(snapshots).toHaveLength(12);
+        fs.rmSync(subtree, { recursive: true, force: true });
+        h.watcher.emit("companies/indigo/knowledge/moved", {
+            paths: new Map([[subtree, "companies/indigo/knowledge/moved"]]),
+            changes: new Map([
+                [subtree, { kind: "unlinkDir", deleteSnapshots: snapshots }],
+            ]),
+        });
+        h.tick();
+        await settle();
+        expect(h.remote.size).toBe(0);
+        expect(Object.keys(readJournal("indigo").files)).toHaveLength(0);
+        await stopHarness(h);
+    });
+    it("concurrent recreation before delete execution invalidates the observation and preserves remote", async () => {
+        const h = startDeleteHarness(["knowledge/race.md"]);
+        await settle();
+        const absolutePath = path.join(h.companyRoot, "knowledge/race.md");
+        fs.unlinkSync(absolutePath);
+        const snapshots = h.capture()("companies/indigo/knowledge/race.md", "unlink");
+        h.watcher.emit("companies/indigo/knowledge/race.md", {
+            paths: new Map([[absolutePath, "companies/indigo/knowledge/race.md"]]),
+            changes: new Map([
+                [absolutePath, { kind: "unlink", deleteSnapshots: snapshots }],
+            ]),
+        });
+        fs.writeFileSync(absolutePath, "concurrent recreation");
+        h.tick();
+        await settle();
+        expect(h.remote.has("knowledge/race.md")).toBe(true);
+        expect(readJournal("indigo").files["knowledge/race.md"]?.localDeleteIntent)
+            .toBeUndefined();
+        await stopHarness(h);
+    });
+});
 //# sourceMappingURL=sync-runner.test.js.map