@indigoai-us/hq-cloud 6.14.18 → 6.14.20

package/src/bin/sync-runner.ts

@@ -125,7 +125,11 @@ import {
 } from "../lib/net-errors.js";
 import { PARTIAL_SYNC_EXIT } from "../lib/exit-codes.js";
 import { describeError } from "../lib/describe-error.js";
-import type { Clock, TreeChangeBatch } from "../watcher.js";
+import type {
+  Clock,
+  LocalDeleteSnapshot,
+  TreeChangeBatch,
+} from "../watcher.js";
 import type { PushReceiver, SyncEngineFn } from "../sync/push-receiver.js";
 import {
   type EventSyncHandles,
@@ -664,6 +668,8 @@ export interface RunnerDeps {
   operationLockAlreadyHeld?: boolean;
   /** Internal watch-loop result override; one-shot callers keep exit 0. */
   authRequiredExitCode?: number;
+  /** Internal watch-loop callback carrying uncapped per-path push outcomes. */
+  onPassResult?: (result: RunnerPassResult) => void;
   /** Share function (push phase). Defaults to `cli/share.share`. */
   share?: (options: ShareOptions) => Promise<ShareResult>;
   /**
@@ -679,6 +685,20 @@ export interface RunnerDeps {
   telemetryTimeoutMs?: number;
 }
 
+export interface RunnerPassResult {
+  pushPathResults: Array<{
+    relativePath: string;
+    status: "accepted" | "refused";
+    operation: "delete" | "tombstone";
+    reason?: string;
+  }>;
+}
+
+export interface RunnerPassOutcome {
+  exitCode: number;
+  result?: RunnerPassResult;
+}
+
 // ---------------------------------------------------------------------------
 // JWT claim decoder — inlined to avoid pulling a dep just to read an idToken.
 // We do NOT verify the signature here — Cognito already did that when it
@@ -812,6 +832,11 @@ interface ParsedArgs {
   skipPersonal: boolean;
   /** Repeatable company/personal-relative path scope for push-only passes. */
   scopePaths: string[];
+  /**
+   * Internal watcher-only delete roots. Unlike `scopePaths`, these remain
+   * meaningful after the corresponding local file or directory is absent.
+   */
+  deleteScopePaths: string[];
   /**
    * Bounded wait (seconds) for the per-root operation lock when another op is
    * already running. `0` → refuse immediately (pre-wait behavior); omitted →
@@ -832,6 +857,7 @@ function parseArgs(argv: string[]): ParsedArgs | { error: string } {
   let pollRemoteMs: number | undefined;
   let skipPersonal = false;
   const scopePaths: string[] = [];
+  const deleteScopePaths: string[] = [];
   let eventPush = false;
   let lockTimeoutSec: number | undefined;
 
@@ -913,6 +939,12 @@ function parseArgs(argv: string[]): ParsedArgs | { error: string } {
         scopePaths.push(val);
         break;
       }
+      case "--delete-scope-path": {
+        const val = argv[++i];
+        if (!val) return { error: "--delete-scope-path requires a value" };
+        deleteScopePaths.push(val);
+        break;
+      }
       case "--lock-timeout": {
         const val = argv[++i];
         if (!val) return { error: "--lock-timeout requires a value (seconds)" };
@@ -964,6 +996,7 @@ function parseArgs(argv: string[]): ParsedArgs | { error: string } {
     pollRemoteMs,
     skipPersonal,
     scopePaths,
+    deleteScopePaths,
     eventPush,
     lockTimeoutSec,
   };
@@ -1170,8 +1203,9 @@ export async function runRunner(
     (() => getValidAccessToken(DEFAULT_COGNITO, { interactive: false }));
   const clearSession =
     deps.clearSession ?? invalidateCachedTokensByFingerprint;
+  let initialAuthToken: string;
   try {
-    await getAccessToken();
+    initialAuthToken = await getAccessToken();
   } catch (err) {
     if (
       (err instanceof CognitoRefreshError && !err.requiresReauth) ||
@@ -1218,7 +1252,19 @@ export async function runRunner(
   // Resolved here (not inside `parsed.companies`) so single-company runs also
   // get author attribution. `null` is fine — share() simply omits the metadata.
   const getClaims = deps.getIdTokenClaims ?? defaultGetIdTokenClaims;
-  const claims = getClaims();
+  // A machine token is minted immediately above and is an ID token. Make its
+  // entity binding authoritative for this run: a stale human token cache can
+  // otherwise make an authenticated agent look like a person during fanout
+  // planning, which drops the agent's own personal-vault target. Human callers
+  // still retain the cache as their primary claims source because their bearer
+  // is normally an access token without the full ID-token profile.
+  const authenticatedClaims = decodeJwtClaims(initialAuthToken);
+  const authenticatedMachineClaims =
+    authenticatedClaims?.["custom:entityType"] === "agent" &&
+    typeof authenticatedClaims["custom:entityUid"] === "string"
+      ? authenticatedClaims
+      : null;
+  const claims = authenticatedMachineClaims ?? getClaims() ?? authenticatedClaims;
   const uploadAuthor: UploadAuthor | undefined =
     claims?.sub && claims?.email
       ? { userSub: claims.sub, email: claims.email }
@@ -1418,6 +1464,7 @@ export async function runRunner(
       resolveDeletePolicy,
       emit,
       scopePaths: parsed.scopePaths,
+      deleteScopePaths: parsed.deleteScopePaths,
       telemetryClient: client,
       telemetryClaims: claims,
       telemetrySessionId,
@@ -1431,6 +1478,7 @@ export async function runRunner(
     throw err;
   }
   const { errors, allConflicts, meaningfulOutcomeCount } = fanout;
+  deps.onPassResult?.({ pushPathResults: fanout.pushPathResults });
   const rollup = rollupAllComplete(plan, fanout.stateByCompany);
 
   // The personal-vault target runs last and can pull an older copy of the
@@ -1860,7 +1908,7 @@ export interface RunnerLoopDeps {
    * targeted push share one seam and one in-flight guard. The default ignores
    * `deps` and forwards just the argv to `runRunner`.
    */
-  runPass?: (passArgv: string[]) => Promise<number>;
+  runPass?: (passArgv: string[]) => Promise<number | RunnerPassOutcome>;
   /** Stage-0 backup retention backstop: a dry-run only, never a sync-tick action. */
   runBackupPrune?: (hqRoot: string) => Promise<void>;
   /**
@@ -1878,6 +1926,10 @@ export interface RunnerLoopDeps {
     hqRoot: string;
     debounceMs: number;
     clock: Clock;
+    captureLocalDeleteSnapshots: (
+      relativePath: string,
+      kind: "unlink" | "unlinkDir",
+    ) => LocalDeleteSnapshot[];
   }) => WatcherSurface;
   /**
    * Register a one-shot shutdown signal handler. Defaults to listening for
@@ -1955,11 +2007,17 @@ export async function runRunnerWithLoop(
 ): Promise<number> {
   const parsed = parseArgs(argv);
   const runtime = {
-    runPassWithOperationLockAlreadyHeld: (passArgv: string[]) =>
-      runRunner(passArgv, {
+    runPassWithOperationLockAlreadyHeld: async (passArgv: string[]) => {
+      let result: RunnerPassResult | undefined;
+      const exitCode = await runRunner(passArgv, {
         operationLockAlreadyHeld: true,
         authRequiredExitCode: AUTH_REQUIRED_PASS_EXIT,
-      }),
+        onPassResult: (passResult) => {
+          result = passResult;
+        },
+      });
+      return { exitCode, ...(result ? { result } : {}) };
+    },
     authRequiredPassExit: AUTH_REQUIRED_PASS_EXIT,
     defaultGetIdTokenClaims,
     defaultGetAccessToken: () =>

package/src/cli/rescue-core.ts

@@ -1515,6 +1515,31 @@ function masterSyncSymlinkTarget(localPath: string): string | null {
   return tgt.includes("/personal/") || tgt.startsWith("personal/") ? tgt : null;
 }
 
+/**
+ * Drop a reindex symlink with lstat + unlink semantics: treat the path as a
+ * link and remove the link itself, never following or recursing into its
+ * target.
+ *
+ * `fs.rmSync(p, { force: true })` stat-follows on some platforms (notably
+ * macOS): a symlink whose target is a directory is seen as a directory, and
+ * with `recursive` unset it throws `EISDIR` ("Path is a directory"). During a
+ * rescue apply that abort rolls back the whole update — the exact failure this
+ * guards against (a directory-target overlay symlink such as
+ * core/knowledge/<name> -> personal/knowledge/<name>). `unlink(2)` removes the
+ * link regardless of what it points at, so file- and directory-target reindex
+ * symlinks are dropped identically. reindex.sh re-lays the link afterward.
+ *
+ * A missing path is a no-op (force-equivalent); a non-symlink is left untouched
+ * so we can never recurse into or delete a real directory (the classifier only
+ * ever routes real symlinks here — this stays defensive).
+ */
+function dropReindexSymlink(localPath: string): void {
+  const st = lstatOrNull(localPath);
+  if (!st) return; // already gone — nothing to drop
+  if (!st.isSymbolicLink()) return; // never follow/recurse into a real target
+  fs.unlinkSync(localPath);
+}
+
 function isUnderPreserve(cfg: Config, rel: string): boolean {
   for (const sp of cfg.preserveSubpaths) {
     if (rel === sp || rel.startsWith(sp + "/")) return true;
@@ -1972,7 +1997,7 @@ function buildRescueActions(ctx: WalkCtx): RescueAction[] {
         break;
       case "drop-reindex-symlink":
         add(`drop reindex symlink: ${decision.rel}`, [decision.rel], () => {
-          fs.rmSync(localPath, { force: true });
+          dropReindexSymlink(localPath);
           ctx.appendLog(`symlink-dropped\t${decision.rel}\t(reindex regenerable)\n`);
         });
         break;

package/src/cli/rescue-drop-dir-symlink.test.ts

@@ -0,0 +1,224 @@
+/**
+ * Regression for the rescue "drop reindex symlink" fix in
+ * src/cli/rescue-core.ts (dropReindexSymlink).
+ *
+ * The bug: the apply step removed a reindex overlay symlink with
+ * `fs.rmSync(localPath, { force: true })`. `rmSync` stat-FOLLOWS on some
+ * platforms (notably macOS), so a symlink whose target is a directory — e.g.
+ * core/knowledge/ad-creative-engine -> personal/knowledge/ad-creative-engine —
+ * is seen as a directory and, with `recursive` unset, throws `EISDIR`
+ * ("Path is a directory"). During a rescue apply that abort rolls back the
+ * whole update, so /update-hq fails on any install carrying a directory-target
+ * overlay symlink. The fix removes the link with lstat + unlink semantics
+ * (`fs.unlinkSync`), which drops the link itself regardless of what it points
+ * at and never recurses into the target.
+ *
+ * The macOS `rmSync` follow-behavior is not reproducible with a plain path on
+ * Linux CI, so we reproduce it deterministically: `fs` is mocked so `rmSync`
+ * throws `EISDIR` on exactly a directory-target symlink (every other call is
+ * delegated to the real implementation). Under that fault the OLD code aborts
+ * the apply and rolls the whole update back; the fixed code drops the link with
+ * `unlinkSync` and the rescue still succeeds.
+ *
+ * Mirrors rescue-mtime-preserve.test.ts: shim `git clone` to a local fixture
+ * and run the real rescue (non-dry-run, --no-backup) so the overlay lays files
+ * down and the symlink-drop action really runs.
+ */
+import { describe, it, expect, beforeAll, afterAll, vi } from "vitest";
+import { execFileSync } from "child_process";
+import * as fs from "fs";
+import * as os from "os";
+import * as path from "path";
+import { runRescue } from "./rescue-core.js";
+
+// Simulate the reporter's platform (macOS): fs.rmSync stat-follows a
+// symlink-to-directory and throws EISDIR ("Path is a directory"). Only the
+// dir-target symlink trips this; every other rmSync call — and every other fs
+// function — is the real implementation, so clone/overlay/backup all work.
+vi.mock("fs", async (importOriginal) => {
+  const real = await importOriginal<typeof import("fs")>();
+  const patchedRmSync: typeof real.rmSync = ((p: fs.PathLike, opts?: fs.RmOptions) => {
+    try {
+      const lst = real.lstatSync(p as fs.PathLike);
+      if (lst.isSymbolicLink() && real.statSync(p as fs.PathLike).isDirectory()) {
+        const err = new Error(
+          `EISDIR: illegal operation on a directory, Path is a directory: ${String(p)}`,
+        ) as NodeJS.ErrnoException;
+        err.code = "ERR_FS_EISDIR";
+        throw err;
+      }
+    } catch (e) {
+      if ((e as NodeJS.ErrnoException).code === "ERR_FS_EISDIR") throw e;
+      // lstat/stat failed (missing path / broken link) — fall through to real rm.
+    }
+    return real.rmSync(p, opts);
+  }) as typeof real.rmSync;
+  return { ...real, rmSync: patchedRmSync };
+});
+
+function has(bin: string, ...args: string[]): boolean {
+  try {
+    execFileSync(bin, args, { stdio: "ignore" });
+    return true;
+  } catch {
+    return false;
+  }
+}
+const toolsAvailable = has("git", "--version") && has("rsync", "--version");
+
+const EPOCH = 1609459200; // 2021-01-01T00:00:00Z
+
+/** Run the rescue in-process, capturing its stdout/stderr. */
+function runRescueCapture(argv: string[], env: NodeJS.ProcessEnv) {
+  let stdout = "";
+  let stderr = "";
+  const origOut = process.stdout.write.bind(process.stdout);
+  const origErr = process.stderr.write.bind(process.stderr);
+  process.stdout.write = ((chunk: unknown) => {
+    stdout += String(chunk);
+    return true;
+  }) as typeof process.stdout.write;
+  process.stderr.write = ((chunk: unknown) => {
+    stderr += String(chunk);
+    return true;
+  }) as typeof process.stderr.write;
+  let status: number;
+  try {
+    status = runRescue(argv, { env }).status;
+  } finally {
+    process.stdout.write = origOut;
+    process.stderr.write = origErr;
+  }
+  return { status, stdout, stderr };
+}
+
+describe.skipIf(!toolsAvailable)("rescue drops directory-target reindex symlinks", () => {
+  let workDir: string;
+  let upstream: string;
+  let shimDir: string;
+  let floorSha: string;
+  let env: NodeJS.ProcessEnv;
+
+  const gitAt = (cwd: string, ...args: string[]) =>
+    execFileSync("git", args, {
+      cwd,
+      stdio: ["ignore", "pipe", "pipe"],
+      env: {
+        ...process.env,
+        GIT_AUTHOR_NAME: "t",
+        GIT_AUTHOR_EMAIL: "t@t",
+        GIT_COMMITTER_NAME: "t",
+        GIT_COMMITTER_EMAIL: "t@t",
+        GIT_AUTHOR_DATE: `${EPOCH} +0000`,
+        GIT_COMMITTER_DATE: `${EPOCH} +0000`,
+      },
+    })
+      .toString()
+      .trim();
+
+  beforeAll(() => {
+    workDir = fs.mkdtempSync(path.join(os.tmpdir(), "hq-rescue-dirsymlink-"));
+
+    // --- "upstream" repo: a single core/ file so the wipe set includes core/ --
+    upstream = path.join(workDir, "upstream");
+    fs.mkdirSync(path.join(upstream, "core/knowledge"), { recursive: true });
+    gitAt(workDir, "init", "-b", "main", "upstream");
+    fs.writeFileSync(path.join(upstream, "core/knowledge/README.md"), "shipped\n");
+    gitAt(upstream, "add", "-A");
+    gitAt(upstream, "commit", "-m", "floor");
+    floorSha = gitAt(upstream, "rev-parse", "HEAD");
+
+    // --- git shim: redirect `git clone <github-url>` to the local fixture -----
+    const realGit =
+      execFileSync("bash", ["-lc", "command -v git"]).toString().trim() || "/usr/bin/git";
+    shimDir = path.join(workDir, "shim");
+    fs.mkdirSync(shimDir, { recursive: true });
+    const shim = `#!/usr/bin/env bash
+if [ "$1" = "clone" ]; then
+  args=()
+  for a in "$@"; do
+    case "$a" in
+      https://github.com/*) a=${JSON.stringify(upstream)} ;;
+    esac
+    args+=("$a")
+  done
+  exec ${JSON.stringify(realGit)} "\${args[@]}"
+fi
+exec ${JSON.stringify(realGit)} "$@"
+`;
+    fs.writeFileSync(path.join(shimDir, "git"), shim, { mode: 0o755 });
+    env = { ...process.env, PATH: `${shimDir}:${process.env.PATH ?? ""}` };
+  });
+
+  afterAll(() => {
+    if (workDir) fs.rmSync(workDir, { recursive: true, force: true });
+  });
+
+  /**
+   * Build a fresh local HQ root carrying a directory-target reindex symlink
+   * (core/knowledge/ad-creative-engine -> <hqRoot>/personal/knowledge/ad-creative-engine),
+   * whose target directory holds a sentinel file that must survive the drop.
+   */
+  function makeHqRoot(): { hqRoot: string; link: string; targetDir: string; sentinel: string } {
+    const hqRoot = fs.mkdtempSync(path.join(workDir, "hq-"));
+    // HQ-root shape check: companies/ + one of .claude/|core/|personal/.
+    fs.mkdirSync(path.join(hqRoot, "companies"), { recursive: true });
+    fs.mkdirSync(path.join(hqRoot, "core/knowledge"), { recursive: true });
+    // Unchanged vs upstream so the overlay is a no-op for it.
+    fs.writeFileSync(path.join(hqRoot, "core/knowledge/README.md"), "shipped\n");
+
+    const targetDir = path.join(hqRoot, "personal/knowledge/ad-creative-engine");
+    fs.mkdirSync(targetDir, { recursive: true });
+    const sentinel = path.join(targetDir, "brief.md");
+    fs.writeFileSync(sentinel, "authored locally\n");
+
+    const link = path.join(hqRoot, "core/knowledge/ad-creative-engine");
+    // Absolute target that includes "/personal/" — matches the overlay
+    // convention masterSyncSymlinkTarget() recognizes.
+    fs.symlinkSync(targetDir, link);
+
+    return { hqRoot, link, targetDir, sentinel };
+  }
+
+  function rescueArgs(hqRoot: string): string[] {
+    return [
+      "--hq-root", hqRoot,
+      "--source", "test/repo",
+      "--ref", "main",
+      "--floor-sha", floorSha,
+      "--yes",
+      "--no-backup",
+    ];
+  }
+
+  it("sanity: the mocked rmSync reproduces the macOS EISDIR on a dir-target symlink", () => {
+    const { link, targetDir, sentinel } = makeHqRoot();
+    // The old apply path used exactly this call — it must throw under the fault.
+    expect(() => fs.rmSync(link, { force: true })).toThrow(/Path is a directory/);
+    // ...and the fixed path (unlink) removes the link while sparing the target.
+    fs.unlinkSync(link);
+    expect(fs.existsSync(link)).toBe(false);
+    expect(fs.existsSync(targetDir)).toBe(true);
+    expect(fs.readFileSync(sentinel, "utf-8")).toBe("authored locally\n");
+  });
+
+  it("does not abort the apply on a directory-target symlink (drops it, spares the target)", () => {
+    const { hqRoot, link, targetDir, sentinel } = makeHqRoot();
+
+    const r = runRescueCapture(rescueArgs(hqRoot), env);
+
+    // The apply must survive the simulated-macOS rmSync fault: the fix removes
+    // the link with unlink semantics, so the whole update no longer rolls back.
+    // (The old rmSync-based drop throws EISDIR here → non-zero + rollback.)
+    if (r.status !== 0) {
+      throw new Error(`rescue aborted on the dir-target symlink (${r.status}):\n${r.stdout}\n${r.stderr}`);
+    }
+
+    // The link itself is gone (reindex.sh re-lays it later)...
+    expect(fs.existsSync(link)).toBe(false);
+    // ...but the target directory and its contents are untouched — the drop
+    // must never follow/recurse into the target.
+    expect(fs.existsSync(targetDir)).toBe(true);
+    expect(fs.readFileSync(sentinel, "utf-8")).toBe("authored locally\n");
+  });
+});

package/src/cli/share.test.ts

@@ -2008,6 +2008,11 @@ describe("share", () => {
     });
 
     expect(result.filesDeleted).toBe(1);
+    expect(result.pathResults).toContainEqual({
+      path: "knowledge",
+      status: "accepted",
+      operation: "delete",
+    });
     expect(deleteRemoteFile).toHaveBeenCalledWith(expect.anything(), "knowledge");
     const journal = JSON.parse(fs.readFileSync(journalPath, "utf-8"));
     expect(journal.files["knowledge"]).toBeUndefined();
@@ -2198,6 +2203,44 @@ describe("share", () => {
     );
   });
 
+  it("personalMode excludes generated core mirror symlinks but keeps canonical core files", async () => {
+    const packagePolicy = path.join(
+      tmpDir,
+      "core",
+      "packages",
+      "hq-pack-example",
+      "policies",
+      "generated.md",
+    );
+    const generatedMirror = path.join(tmpDir, "core", "policies", "generated.md");
+    const canonicalCoreFile = path.join(tmpDir, "core", "policies", "shipped.md");
+    fs.mkdirSync(path.dirname(packagePolicy), { recursive: true });
+    fs.mkdirSync(path.dirname(generatedMirror), { recursive: true });
+    fs.writeFileSync(packagePolicy, "generated package policy\n");
+    fs.symlinkSync(packagePolicy, generatedMirror);
+    fs.writeFileSync(canonicalCoreFile, "shipped core policy\n");
+
+    const result = await share({
+      paths: [path.join(tmpDir, "core")],
+      entityContext: makeEntityContext({
+        uid: "prs_01PERSONALTEST",
+        slug: "__hq_personal_vault__",
+        bucketName: "hq-vault-prs-01PERSONALTEST",
+      }),
+      hqRoot: tmpDir,
+      personalMode: true,
+      journalSlug: "personal-generated-core-mirror",
+    });
+
+    expect(result.filesExcludedByPolicy).toBe(1);
+    expect(result.filesUploaded).toBe(2);
+    expect(vi.mocked(uploadSymlink)).not.toHaveBeenCalled();
+    expect(vi.mocked(uploadFile).mock.calls.map((call) => call[2]).sort()).toEqual([
+      "core/packages/hq-pack-example/policies/generated.md",
+      "core/policies/shipped.md",
+    ]);
+  });
+
   it(
     "personal-vault override does NOT apply to company vaults: `owned-only` on cmp_ entity still " +
       "refuses to tombstone a direction:'down' entry (multi-user curation intact)",
@@ -3033,7 +3076,7 @@ describe("share", () => {
     });
   });
 
-  it("currency-gated: refuses delete for legacy journal entry with no recorded remoteEtag", async () => {
+  it("daemon-stopped deletion has no watcher intent and is safely refused", async () => {
     const companyRoot = path.join(tmpDir, "companies", "acme");
     fs.mkdirSync(companyRoot, { recursive: true });
     // Journal entry from before remoteEtag tracking — no etag to compare
@@ -3078,6 +3121,12 @@ describe("share", () => {
       reason: "missing-delete-intent",
     });
     expect(result.filesRefusedStale).toBe(1);
+    expect(result.pathResults).toContainEqual({
+      path: "legacy-no-etag.md",
+      status: "refused",
+      operation: "delete",
+      reason: "missing-delete-intent",
+    });
   });
 
   it("currency-gated: real-world /update-hq scenario — direction:'down' delete propagates when current", async () => {
@@ -3351,6 +3400,58 @@ describe("share", () => {
   // passing in the allowed top-level directories — share() trusts its
   // `paths` input.
 
+  it("plans an intent-backed personal delete from an explicit missing scope root", async () => {
+    const key = "deleted-top-level.md";
+    const journalSlug = "personal-scoped-delete";
+    const journalPath = path.join(
+      stateDir,
+      `sync-journal.${journalSlug}.json`,
+    );
+    fs.writeFileSync(
+      journalPath,
+      JSON.stringify({
+        version: "2",
+        lastSync: new Date().toISOString(),
+        pulls: [],
+        files: {
+          [key]: {
+            hash: "captured-hash",
+            size: 8,
+            syncedAt: new Date().toISOString(),
+            direction: "up",
+            remoteEtag: "captured-etag",
+            kind: "file",
+            localDeleteIntent: deleteIntent(
+              "captured-etag",
+              "captured-hash",
+            ),
+          },
+        },
+      }),
+    );
+
+    const result = await share({
+      // computePersonalVaultPaths() has no path to contribute after this
+      // top-level file is gone. The watcher-captured root is the sole scope.
+      paths: [],
+      deleteScopeRoots: [key],
+      company: "acme",
+      vaultConfig: mockConfig,
+      hqRoot: tmpDir,
+      personalMode: true,
+      journalSlug,
+      skipUnchanged: true,
+      propagateDeletes: true,
+      propagateDeletePolicy: "owned-only",
+    });
+
+    expect(result.filesDeleted).toBe(1);
+    expect(deleteRemoteFile).toHaveBeenCalledWith(expect.anything(), key);
+    expect(
+      JSON.parse(fs.readFileSync(journalPath, "utf8")).files[key],
+    ).toBeUndefined();
+  });
+
   // ── Decommission prefixes ──────────────────────────────────────────────────
   //
   // `decommissionPrefixes` is the "company was promoted to its own team
@@ -4059,10 +4160,12 @@ describe("share", () => {
       total,
       missing,
       direction = "up" as "up" | "down",
+      withIntents = true,
     }: {
       total: number;
       missing: number;
       direction?: "up" | "down";
+      withIntents?: boolean;
     }): { companyRoot: string; journalPath: string } {
       const companyRoot = path.join(tmpDir, "companies", "acme");
       fs.mkdirSync(companyRoot, { recursive: true });
@@ -4075,7 +4178,7 @@ describe("share", () => {
           direction: "up" | "down";
           remoteEtag: string;
           kind: "file";
-          localDeleteIntent: ReturnType<typeof deleteIntent>;
+          localDeleteIntent?: ReturnType<typeof deleteIntent>;
         }
       > = {};
       for (let i = 0; i < total; i++) {
@@ -4087,7 +4190,9 @@ describe("share", () => {
           direction,
           remoteEtag: `etag-${i}`,
           kind: "file",
-          localDeleteIntent: deleteIntent(`etag-${i}`, "h"),
+          ...(withIntents
+            ? { localDeleteIntent: deleteIntent(`etag-${i}`, "h") }
+            : {}),
         };
         if (i >= missing) {
           fs.writeFileSync(path.join(companyRoot, key), "hi");
@@ -4110,7 +4215,11 @@ describe("share", () => {
     });
 
     it("trips at the 11/100 boundary (11% > 10%, abs >= 10): refuses every delete and emits bulk-asymmetry event", async () => {
-      const { companyRoot, journalPath } = setupJournal({ total: 100, missing: 11 });
+      const { companyRoot, journalPath } = setupJournal({
+        total: 100,
+        missing: 11,
+        withIntents: false,
+      });
       // currency-gated: remote HEAD would match every journal etag — guard
       // must trip BEFORE any HEAD round-trip occurs.
       vi.mocked(headRemoteFile).mockImplementation(async (_ctx, key) => ({
@@ -4166,6 +4275,33 @@ describe("share", () => {
       expect(perKeyRefusals.length).toBe(11);
     });
 
+    it("intent-backed 11/100 subtree disappearance bypasses the breaker and deletes every covered path", async () => {
+      const { companyRoot } = setupJournal({ total: 100, missing: 11 });
+      vi.mocked(headRemoteFile).mockImplementation(async (_ctx, key) => ({
+        etag: `etag-${parseInt(key.replace(/[^0-9]/g, ""), 10)}`,
+        lastModified: new Date(),
+        size: 5,
+      }));
+      const events: Array<{ type: string }> = [];
+
+      const result = await share({
+        paths: [companyRoot],
+        company: "acme",
+        vaultConfig: mockConfig,
+        hqRoot: tmpDir,
+        skipUnchanged: true,
+        propagateDeletes: true,
+        propagateDeletePolicy: "currency-gated",
+        onEvent: (e) => events.push(e as { type: string }),
+      });
+
+      expect(result.filesDeleted).toBe(11);
+      expect(deleteRemoteFile).toHaveBeenCalledTimes(11);
+      expect(
+        events.find((e) => e.type === "delete-refused-bulk-asymmetry"),
+      ).toBeUndefined();
+    });
+
     it("does NOT trip at 9/100 (below ratio): all candidates delete normally", async () => {
       const { companyRoot } = setupJournal({ total: 100, missing: 9 });
       vi.mocked(headRemoteFile).mockImplementation(async (_ctx, key) => ({
@@ -4232,7 +4368,11 @@ describe("share", () => {
     });
 
     it("fully-empty mirror (100/100) trips the guard — the canonical mass-delete failure mode", async () => {
-      const { companyRoot, journalPath } = setupJournal({ total: 50, missing: 50 });
+      const { companyRoot, journalPath } = setupJournal({
+        total: 50,
+        missing: 50,
+        withIntents: false,
+      });
       vi.mocked(headRemoteFile).mockImplementation(async (_ctx, key) => ({
         etag: `etag-${parseInt(key.replace(/[^0-9]/g, ""), 10)}`,
         lastModified: new Date(),
@@ -4288,7 +4428,11 @@ describe("share", () => {
     });
 
     it("owned-only policy also goes through the guard: 11/100 missing direction:'up' entries refused", async () => {
-      const { companyRoot, journalPath } = setupJournal({ total: 100, missing: 11 });
+      const { companyRoot, journalPath } = setupJournal({
+        total: 100,
+        missing: 11,
+        withIntents: false,
+      });
 
       const events: Array<{ type: string }> = [];
       const result = await share({