@indigoai-us/hq-cloud 6.14.49 → 6.15.0

package/src/journal.test.ts

@@ -119,7 +119,7 @@ describe("journal", () => {
       expect(roundTripped.pulls).toEqual([]);
     });
 
-    it("F08: recovers the last good journal when the primary JSON is torn", () => {
+    it("migrates a torn v2 primary from its last-good copy into the v3 state store", () => {
       const lastGood: SyncJournal = {
         version: "2",
         lastSync: "2026-06-18T00:00:00.000Z",
@@ -133,11 +133,11 @@ describe("journal", () => {
         },
         pulls: [],
       };
-      writeJournal("indigo", lastGood);
-
-      // Simulate a torn direct write of the primary journal file. The next
-      // read must use the durable last-good copy rather than aborting sync.
       fs.writeFileSync(getJournalPath("indigo"), '{"version":"2","files":');
+      fs.writeFileSync(
+        `${getJournalPath("indigo")}.last-good`,
+        JSON.stringify(lastGood),
+      );
 
       const recovered = readJournal("indigo");
       expect(recovered.version).toBe("2");
@@ -149,23 +149,7 @@ describe("journal", () => {
     });
 
     it("R-F08: surfaces primary IO errors instead of masking them with last-good", () => {
-      const lastGood: SyncJournal = {
-        version: "2",
-        lastSync: "2026-06-18T00:00:00.000Z",
-        files: {
-          "docs/stale.md": {
-            hash: "stale-hash",
-            size: 128,
-            syncedAt: "2026-06-18T00:00:00.000Z",
-            direction: "down",
-          },
-        },
-        pulls: [],
-      };
-      writeJournal("indigo", lastGood);
-
       const journalPath = getJournalPath("indigo");
-      fs.unlinkSync(journalPath);
       fs.mkdirSync(journalPath);
 
       expect(() => readJournal("indigo")).toThrow(/EISDIR|directory/i);
@@ -204,6 +188,20 @@ describe("journal", () => {
       expect(brandstage.files).toHaveProperty("b.md");
       expect(brandstage.files).not.toHaveProperty("a.md");
     });
+
+    it("migrates once, appends authoritative updates, and refreshes the compatibility mirror", () => {
+      const initial: SyncJournal = { version: "2", lastSync: "one", files: {}, pulls: [] };
+      writeJournal("indigo", initial);
+      const locator = fs.readFileSync(getJournalPath("indigo"));
+
+      writeJournal("indigo", { version: "2", lastSync: "two", files: {}, pulls: [] });
+
+      expect(fs.readFileSync(getJournalPath("indigo"))).not.toEqual(locator);
+      expect(
+        JSON.parse(fs.readFileSync(getJournalPath("indigo"), "utf8")) as SyncJournal,
+      ).toMatchObject({ version: "2", lastSync: "two" });
+      expect(readJournal("indigo").lastSync).toBe("two");
+    });
   });
 
   describe("updateEntry", () => {

package/src/journal.ts

@@ -17,8 +17,9 @@ import * as fs from "fs";
 import * as os from "os";
 import * as path from "path";
 import * as crypto from "crypto";
-import type { SyncJournal, JournalEntry, PullRecord } from "./types.js";
+import type { SyncJournal, JournalEntry, PullRecord, V3JournalState, V3JournalWalPayload } from "./types.js";
 import { toPosixKey } from "./s3.js";
+import { StateStore } from "./sync/state-store.js";
 
 /** Tombstone retention. 30 days in milliseconds — roughly two release cycles. */
 export const TOMBSTONE_TTL_MS = 30 * 24 * 60 * 60 * 1000;
@@ -36,6 +37,8 @@ export const MAX_PULLS_PER_COMPANY = 50;
 const JOURNAL_FILE_PREFIX = "sync-journal.";
 const JOURNAL_FILE_SUFFIX = ".json";
 const JOURNAL_LAST_GOOD_SUFFIX = ".last-good";
+const JOURNAL_WAL_RECORD_TYPE = 1;
+
 
 /**
  * Where per-company journals are stored. Honors `HQ_STATE_DIR` for tests and
@@ -135,13 +138,54 @@ export function migratePersonalVaultJournal(): void {
  * installs never pass through v1 on disk.
  */
 export function readJournal(slug: string): SyncJournal {
+  if (StateStore.exists(getStateDir(), journalScopeId(slug))) {
+    return openJournalStore(slug, emptyJournal()).getState().journal;
+  }
   const journalPath = getJournalPath(slug);
+  let legacy: SyncJournal;
   if (fs.existsSync(journalPath)) {
-    return readJournalFileWithLastGood(journalPath);
+    legacy = readJournalFileWithLastGood(journalPath);
+  } else {
+    legacy = emptyJournal();
   }
+  migrateToV2(legacy);
+  return openJournalStore(slug, legacy).getState().journal;
+}
+
+function emptyJournal(): SyncJournal {
   return { version: JOURNAL_VERSION_CURRENT, lastSync: "", files: {}, pulls: [] };
 }
 
+function journalScopeId(slug: string): string {
+  return `journal:${sanitizeSlug(slug)}`;
+}
+
+function openJournalStore(slug: string, initialJournal: SyncJournal): StateStore<V3JournalState> {
+  return StateStore.open({
+    rootDir: getStateDir(),
+    scopeId: journalScopeId(slug),
+    initialState: { journal: initialJournal },
+    reduce: (state, record) => {
+      if (record.type !== JOURNAL_WAL_RECORD_TYPE) {
+        throw new Error(`journal: unexpected v3 WAL record type ${record.type}`);
+      }
+      const payload = record.payload as Partial<V3JournalWalPayload>;
+      if (!payload || typeof payload !== "object" || !isJournal(payload.journal)) {
+        throw new Error("journal: v3 WAL record has an invalid journal payload");
+      }
+      return { ...state, journal: payload.journal };
+    },
+  });
+}
+
+function isJournal(value: unknown): value is SyncJournal {
+  return typeof value === "object" && value !== null &&
+    ((value as SyncJournal).version === "1" || (value as SyncJournal).version === "2") &&
+    typeof (value as SyncJournal).lastSync === "string" &&
+    typeof (value as SyncJournal).files === "object" &&
+    (value as SyncJournal).files !== null;
+}
+
 function parseJournalContent(content: string): SyncJournal {
   if (content.length === 0) {
     throw new SyntaxError("journal JSON is empty");
@@ -225,7 +269,9 @@ export function listJournals(): JournalSummary[] {
     if (!slug) continue; // guard against a stray "sync-journal..json"
     const filePath = path.join(dir, name);
     try {
-      const journal = readJournalFileWithLastGood(filePath);
+      // Prefer the v3 store when this legacy filename is only its immutable
+      // compatibility locator; otherwise this performs the v2 last-good read.
+      const journal = readJournal(slug);
       out.push({ slug, path: filePath, journal });
     } catch (err) {
       if (!isCorruptJournalJson(err)) throw err;
@@ -303,69 +349,56 @@ export function migrateToV2(journal: SyncJournal): SyncJournal {
  */
 export function writeJournal(slug: string, journal: SyncJournal): void {
   migrateToV2(journal);
-  const journalPath = getJournalPath(slug);
-  fs.mkdirSync(path.dirname(journalPath), { recursive: true });
-  const content = JSON.stringify(journal, null, 2);
-  atomicWriteFileSync(journalPath, content);
-  atomicWriteFileSync(lastGoodJournalPath(journalPath), content);
-}
-
-function lastGoodJournalPath(journalPath: string): string {
-  return `${journalPath}${JOURNAL_LAST_GOOD_SUFFIX}`;
+  const store = openJournalStore(slug, journal);
+  // The initial v2 → v3 migration is a durable snapshot. Every normal write
+  // thereafter is one framed append + fdatasync, never a whole-journal rewrite.
+  if (store.wasCreated) {
+    writeLegacyJournalMirror(slug, journal);
+  } else {
+    store.append(JOURNAL_WAL_RECORD_TYPE, { journal });
+    // The JSON file remains a compatibility mirror for shipped CLI/status
+    // consumers that have not moved to StateStore yet. It is never used for
+    // recovery once a v3 generation exists; the framed WAL above is the sole
+    // authority and hot path. Keep the mirror current so those consumers do
+    // not observe stale sync state during the phased migration.
+    writeLegacyJournalMirror(slug, journal);
+  }
 }
 
-function atomicWriteFileSync(filePath: string, content: string): void {
-  const dir = path.dirname(filePath);
-  const tmpPath = path.join(
-    dir,
-    `.${path.basename(filePath)}.${process.pid}.${Date.now()}.${crypto
-      .randomBytes(6)
-      .toString("hex")}.tmp`,
+/**
+ * Keep the v2-shaped filename as a compatibility mirror for older CLI/status
+ * surfaces. The v3 state store is authoritative after migration; this mirror
+ * is atomically replaced only to preserve existing readers until their owner
+ * migrates them. WAL recovery never consults it once a v3 generation exists.
+ */
+function writeLegacyJournalMirror(slug: string, journal: SyncJournal): void {
+  const journalPath = getJournalPath(slug);
+  fs.mkdirSync(path.dirname(journalPath), { recursive: true });
+  const temporary = path.join(
+    path.dirname(journalPath),
+    `.${path.basename(journalPath)}.${process.pid}.${crypto.randomBytes(6).toString("hex")}.tmp`,
   );
   let fd: number | undefined;
   try {
-    fd = fs.openSync(tmpPath, "wx");
-    fs.writeFileSync(fd, content);
-    fs.fsyncSync(fd);
+    fd = fs.openSync(temporary, "wx");
+    fs.writeFileSync(fd, JSON.stringify(journal));
+    fs.fdatasyncSync(fd);
     fs.closeSync(fd);
     fd = undefined;
-    fs.renameSync(tmpPath, filePath);
-    fsyncDirSync(dir);
-  } catch (err) {
-    if (fd !== undefined) {
-      try {
-        fs.closeSync(fd);
-      } catch {
-        /* ignore close failure while surfacing the original write error */
-      }
-    }
-    try {
-      fs.rmSync(tmpPath, { force: true });
-    } catch {
-      /* best-effort cleanup */
-    }
-    throw err;
+    fs.renameSync(temporary, journalPath);
+  } catch (error) {
+    try { fs.rmSync(temporary, { force: true }); } catch { /* preserve mirror write failure */ }
+    throw new Error(`journal: failed to update v3 compatibility mirror ${journalPath}`, { cause: error });
+  } finally {
+    if (fd !== undefined) fs.closeSync(fd);
   }
 }
 
-function fsyncDirSync(dir: string): void {
-  let fd: number | undefined;
-  try {
-    fd = fs.openSync(dir, "r");
-    fs.fsyncSync(fd);
-  } catch {
-    // Directory fsync is unsupported on some platforms/filesystems.
-  } finally {
-    if (fd !== undefined) {
-      try {
-        fs.closeSync(fd);
-      } catch {
-        /* ignore */
-      }
-    }
-  }
+function lastGoodJournalPath(journalPath: string): string {
+  return `${journalPath}${JOURNAL_LAST_GOOD_SUFFIX}`;
 }
 
+
 export function hashFile(filePath: string): string {
   const content = fs.readFileSync(filePath);
   return crypto.createHash("sha256").update(content).digest("hex");

package/src/sync/event-sync.test.ts

@@ -14,7 +14,6 @@
 import { describe, expect, it, vi } from "vitest";
 
 import {
-  EVENT_SYNC_ROLLOUT_EMAILS,
   resolveEventSync,
   subscribeSyncReceive,
   sqsClientFromAwsSdk,
@@ -25,8 +24,6 @@ import {
 import type { SqsClientLike, PushReceiverContext } from "./push-receiver.js";
 import type { PushEvent } from "./push-event.js";
 
-const ENROLLED = "hassaan@getindigo.ai";
-
 function subscribeResponse(
   overrides: Partial<SubscribeSyncResponse["credentials"]> = {},
   queueUrl = "https://sqs.us-east-1.amazonaws.com/000000000000/sync-push-prs_t-dev1",
@@ -46,48 +43,16 @@ function subscribeResponse(
 
 // ─── resolveEventSync (US-019) ──────────────────────────────────────────────
 
-describe("resolveEventSync — exact-email rollout gate", () => {
-  it("enrolls exactly the allowlisted address (case-insensitive, trimmed)", () => {
-    expect(EVENT_SYNC_ROLLOUT_EMAILS.has(ENROLLED)).toBe(true);
-    expect(resolveEventSync(ENROLLED, undefined)).toBe(true);
-    expect(resolveEventSync("HASSAAN@GetIndigo.AI", undefined)).toBe(true);
-    expect(resolveEventSync(`  ${ENROLLED}  `, undefined)).toBe(true);
-  });
-
-  it("never matches look-alikes — exact full address, not suffix/superset", () => {
-    expect(resolveEventSync("xhassaan@getindigo.ai", undefined)).toBe(false);
-    expect(resolveEventSync("hassaan@getindigo.ai.evil.com", undefined)).toBe(
-      false,
-    );
-    expect(resolveEventSync("hassaan@evil-getindigo.ai", undefined)).toBe(
-      false,
-    );
-    expect(resolveEventSync("corey@getindigo.ai", undefined)).toBe(false);
-    expect(resolveEventSync(undefined, undefined)).toBe(false);
-    expect(resolveEventSync("", undefined)).toBe(false);
-  });
-
-  it.each(["1", "true", "yes", "on", " ON "])(
-    "override %j forces ON for unenrolled accounts",
-    (o) => {
-      expect(resolveEventSync("nobody@example.com", o)).toBe(true);
-      expect(resolveEventSync(undefined, o)).toBe(true);
-    },
-  );
-
+describe("resolveEventSync — local disable only", () => {
   it.each(["0", "false", "no", "off"])(
-    "override %j forces OFF even for the enrolled account",
-    (o) => {
-      expect(resolveEventSync(ENROLLED, o)).toBe(false);
-    },
+    "override %j keeps the event path dormant",
+    (override) => expect(resolveEventSync(override)).toBe(false),
   );
 
-  it("unset/blank/garbage override falls through to the email check", () => {
-    expect(resolveEventSync(ENROLLED, undefined)).toBe(true);
-    expect(resolveEventSync(ENROLLED, "")).toBe(true);
-    expect(resolveEventSync(ENROLLED, "maybe")).toBe(true);
-    expect(resolveEventSync("nobody@example.com", "maybe")).toBe(false);
-  });
+  it.each([undefined, "", "1", "true", "yes", "on", "indigo"])(
+    "override %j cannot grant authority",
+    (override) => expect(resolveEventSync(override)).toBe(true),
+  );
 });
 
 // ─── subscribeSyncReceive ───────────────────────────────────────────────────
@@ -567,7 +532,7 @@ describe("startEventSync", () => {
     }
   });
 
-  it("returns null (poll-only) when subscribe fails — never throws", async () => {
+  it("does not create live handles when authenticated legacy inventory fails", async () => {
     const logged: string[] = [];
     const handles = await startEventSync({
       ...happyOpts([]),
@@ -581,7 +546,7 @@ describe("startEventSync", () => {
     expect(logged.join("\n")).toContain("subscribe 503");
   });
 
-  it("returns null (poll-only) when tenant resolution fails", async () => {
+  it("does not create live handles when identity resolution fails", async () => {
     const logged: string[] = [];
     const handles = await startEventSync({
       ...happyOpts([]),

package/src/sync/event-sync.ts

@@ -5,12 +5,10 @@
  * Phases 1–2 built every piece but left them unconnected: the watcher runs
  * targeted *push passes* (S3 upload) but never publishes a PushEvent, and the
  * runner's receiver seam defaults to {@link NoopPushReceiver}. This module is
- * the connective tissue that turns both on for enrolled accounts:
+ * the connective tissue that turns both on after a server grant:
  *
- *  - {@link resolveEventSync} — the rollout gate. EXACT-email allowlist (full
- *    address, not a domain suffix) + `HQ_SYNC_EVENT_SYNC` env override in both
- *    directions. ONE gate governs publish AND receive so a device is never
- *    publish-only or receive-only in a half-rolled state.
+ *  - {@link resolveEventSync} — a negative-only local kill switch. A server
+ *    grant remains the only positive authority for publish and receive.
  *  - {@link subscribeSyncReceive} — `POST /v1/sync/subscribe` (US-015/US-016):
  *    mints the per-device queue and returns `{queueUrl, region, credentials}`,
  *    where `credentials` are short-lived STS creds scoped to receive/delete on
@@ -22,7 +20,7 @@
  *    retry on an expiry-class error. The queue URL is stable across re-vends
  *    (same device → same queue, idempotent endpoint); only creds rotate.
  *  - {@link startEventSync} — the wiring entry the runner calls from the
- *    `--event-push` watch block when the gate is ON. Resolves tenant + device
+ *    `--event-push` watch block unless locally disabled. Resolves tenant + device
  *    identity, builds the {@link HttpPushTransport} + {@link PushEventEmitter}
  *    (publish leg) and the {@link SqsPushReceiver} (receive leg, self-echo
  *    filtered), and returns handles. Any startup failure degrades to
@@ -57,42 +55,16 @@ import {
   createSyncLatencyMetricPublisher,
   type SyncMetricCredentials,
 } from "./metrics.js";
-
-// ─── US-019: rollout gate ───────────────────────────────────────────────────
+import { isEventSyncLocallyDisabled } from "./feature-flags.js";
 
 /**
- * Accounts enrolled in event-driven sync (publish + receive).
+ * Decide whether the client may request event-sync authority from the server.
  *
- * EXACT full-address matching, case-insensitive — NOT a domain suffix. The
- * single-account Phase 3 rollout (2026-06-10) targets the operator's own
- * devices; `xhassaan@getindigo.ai` and `hassaan@getindigo.ai.evil.com` must
- * never match. Broadening later is an entry here, then a domain set, then a
- * GA default-on switch (the same rollout path the presigned-URL sync transport
- * already took to GA).
+ * This is negative-only. An unset value or a former force-on value merely
+ * permits the authenticated server request; it cannot authorize event sync.
  */
-export const EVENT_SYNC_ROLLOUT_EMAILS: ReadonlySet<string> = new Set([
-  "hassaan@getindigo.ai",
-]);
-
-/**
- * Decide whether this session runs event-driven sync (publish + receive).
- *
- * Env-override-in-both-directions precedence: `HQ_SYNC_EVENT_SYNC`
- * overrides (`1`/`true`/`yes`/`on` → force on,
- * `0`/`false`/`no`/`off` → force off) so unenrolled testers can exercise it
- * and enrolled accounts can be rolled back without a release. An unset/blank
- * override falls through to the exact-email check; an unrecognized override
- * value is ignored (email check wins).
- */
-export function resolveEventSync(
-  email: string | undefined,
-  override: string | undefined,
-): boolean {
-  const o = (override ?? "").trim().toLowerCase();
-  if (o === "1" || o === "true" || o === "yes" || o === "on") return true;
-  if (o === "0" || o === "false" || o === "no" || o === "off") return false;
-  if (typeof email !== "string") return false;
-  return EVENT_SYNC_ROLLOUT_EMAILS.has(email.trim().toLowerCase());
+export function resolveEventSync(override: string | undefined): boolean {
+  return !isEventSyncLocallyDisabled(override);
 }
 
 // ─── US-018: subscribe + credentials ────────────────────────────────────────
@@ -454,6 +426,19 @@ export async function startEventSync(
     const tenantId = await opts.resolveTenantId();
     const deviceId = opts.deviceId;
 
+    // The subscription response is the authenticated legacy inventory/grant.
+    // No email, environment, tenant, or queued hint can reach the live path
+    // without this server-issued queue and credential material.
+    const subscribe =
+      opts.subscribe ??
+      ((dev: string) =>
+        subscribeSyncReceive({
+          apiUrl: opts.apiUrl,
+          authToken: opts.authToken,
+          deviceId: dev,
+        }));
+    const initial = await subscribe(deviceId);
+
     // ── publish leg (US-017) ──
     const transport =
       opts.transport ??
@@ -467,8 +452,9 @@ export async function startEventSync(
       originTenantId: tenantId,
       originDeviceId: deviceId,
       transport,
-      // The rollout gate (resolveEventSync) already said yes — the emitter's
-      // per-tenant env flag is a server-side convention, not the client gate.
+      // This adapter represents the authenticated server grant above. It is
+      // created only after the grant succeeds and ignores the tenant argument;
+      // it is not a tenant-derived client selector.
       flagProvider: { isEnabled: () => true },
       // Wall-clock sequence numbers: monotonic per device ACROSS daemon
       // restarts (the emitter's default in-process counter restarts at 0,
@@ -485,15 +471,6 @@ export async function startEventSync(
     });
 
     // ── receive leg (US-018) ──
-    const subscribe =
-      opts.subscribe ??
-      ((dev: string) =>
-        subscribeSyncReceive({
-          apiUrl: opts.apiUrl,
-          authToken: opts.authToken,
-          deviceId: dev,
-        }));
-    const initial = await subscribe(deviceId);
     const publishMetric: PublishMetricFn = initial.cloudWatch
       ? createSyncLatencyMetricPublisher(initial.cloudWatch)
       : async () => undefined;
@@ -515,9 +492,6 @@ export async function startEventSync(
         await opts.syncFn(ctx);
       },
       publishMetric,
-      // The client rollout gate is the authority; the env-driven per-tenant
-      // flag provider is a server-side convention not set on user machines.
-      enabled: true,
     });
     await receiver.start();
 

package/src/sync/feature-flags.test.ts

@@ -28,11 +28,8 @@ import path from "node:path";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 
 import {
-  EnvTenantListFlagProvider,
-  FEATURE_FLAG_LEGACY_GLOBAL_ENV_VAR,
-  FEATURE_FLAG_TENANTS_ENV_VAR,
-  StaticFlagProvider,
-  defaultFlagProvider,
+  EVENT_SYNC_LOCAL_DISABLE_ENV_VAR,
+  isEventSyncLocallyDisabled,
 } from "./feature-flags.js";
 import {
   HttpPushTransport,
@@ -79,72 +76,25 @@ function makeFetch(
   return { fetch, calls };
 }
 
-// ─── 1. Flag gating (feature-flags.ts) ────────────────────────────────────────
+// ─── 1. Local disable (feature-flags.ts) ─────────────────────────────────────
 
-describe("EventDrivenPush feature flags — gating", () => {
-  it("StaticFlagProvider enables only listed tenants", () => {
-    const p = new StaticFlagProvider(["indigo"]);
-    expect(p.isEnabled("indigo")).toBe(true);
-    expect(p.isEnabled("acme")).toBe(false);
-  });
-
-  it("env tenant list: empty/unset → all tenants OFF (default)", () => {
-    expect(new EnvTenantListFlagProvider({ env: {} }).isEnabled("indigo")).toBe(
-      false,
-    );
-    expect(
-      new EnvTenantListFlagProvider({
-        env: { [FEATURE_FLAG_TENANTS_ENV_VAR]: "" },
-      }).isEnabled("indigo"),
-    ).toBe(false);
-  });
-
-  it("env tenant list enables exact, case-sensitive matches only", () => {
-    const p = new EnvTenantListFlagProvider({
-      env: { [FEATURE_FLAG_TENANTS_ENV_VAR]: " indigo , acme " },
-    });
-    expect(p.isEnabled("indigo")).toBe(true);
-    expect(p.isEnabled("acme")).toBe(true);
-    expect(p.isEnabled("Indigo")).toBe(false);
-    expect(p.isEnabled("other")).toBe(false);
-    expect(p.enabledTenants).toEqual(new Set(["indigo", "acme"]));
-  });
+const serverGranted = { isEnabled: () => true };
+const serverDenied = { isEnabled: () => false };
 
-  it("legacy global=true overrides → every tenant enabled", () => {
-    const p = new EnvTenantListFlagProvider({
-      env: { [FEATURE_FLAG_LEGACY_GLOBAL_ENV_VAR]: "true" },
-    });
-    expect(p.isEnabled("anything")).toBe(true);
-    expect(p.globalOverride).toBe(true);
-  });
-
-  it("trailing/empty commas dropped silently; internal-whitespace warn-and-skipped (no throw)", () => {
-    const warn = vi.fn();
-    const p = new EnvTenantListFlagProvider({
-      env: { [FEATURE_FLAG_TENANTS_ENV_VAR]: ",,indigo,,bad tenant," },
-      warn,
-    });
-    expect(p.isEnabled("indigo")).toBe(true);
-    expect(p.isEnabled("bad tenant")).toBe(false);
-    expect(warn).toHaveBeenCalledTimes(1);
-    expect(warn.mock.calls[0][1]).toMatchObject({ rawEntry: "bad tenant" });
+describe("Event sync local control", () => {
+  it("exports only the local disable control", () => {
+    expect(EVENT_SYNC_LOCAL_DISABLE_ENV_VAR).toBe("HQ_SYNC_EVENT_SYNC");
   });
 
-  it("defaultFlagProvider reads from the supplied env snapshot", () => {
-    const p = defaultFlagProvider({
-      [FEATURE_FLAG_TENANTS_ENV_VAR]: "indigo",
-    });
-    expect(p.isEnabled("indigo")).toBe(true);
-    expect(p.isEnabled("acme")).toBe(false);
-  });
+  it.each(["0", "false", "no", "off", " OFF "])(
+    "recognizes %j as a local disable",
+    (value) => expect(isEventSyncLocallyDisabled(value)).toBe(true),
+  );
 
-  it("enabledTenants returns a defensive copy (mutation does not corrupt cache)", () => {
-    const p = new EnvTenantListFlagProvider({
-      env: { [FEATURE_FLAG_TENANTS_ENV_VAR]: "indigo" },
-    });
-    (p.enabledTenants as Set<string>).add("acme");
-    expect(p.isEnabled("acme")).toBe(false);
-  });
+  it.each([undefined, "", "1", "true", "yes", "on", "indigo,acme"])(
+    "%j does not grant authority",
+    (value) => expect(isEventSyncLocallyDisabled(value)).toBe(false),
+  );
 });
 
 // ─── 2. POST (HttpPushTransport) ──────────────────────────────────────────────
@@ -307,7 +257,7 @@ describe("PushEventEmitter — emit, gating, failure handling", () => {
       originTenantId: "indigo",
       originDeviceId: "dev-1",
       transport: spyTransport,
-      flagProvider: new StaticFlagProvider(["indigo"]),
+      flagProvider: serverGranted,
       now: () => new Date("2026-05-21T00:00:00.000Z"),
     });
 
@@ -331,7 +281,7 @@ describe("PushEventEmitter — emit, gating, failure handling", () => {
       originTenantId: "indigo",
       originDeviceId: "dev-1",
       transport: { start: async () => {}, dispose: async () => {}, connected: true, publish: async (e) => { published.push(e); } },
-      flagProvider: new StaticFlagProvider(["indigo"]),
+      flagProvider: serverGranted,
     });
     writeFileSync(path.join(dir, "b.md"), "second");
     await emitter.emitForBatch(batchFor(REL));
@@ -345,7 +295,7 @@ describe("PushEventEmitter — emit, gating, failure handling", () => {
       originTenantId: "indigo",
       originDeviceId: "dev-1",
       transport: { start: async () => {}, dispose: async () => {}, connected: false, publish },
-      flagProvider: new StaticFlagProvider([]), // indigo NOT enabled
+      flagProvider: serverDenied, // indigo NOT enabled
     });
     expect(emitter.enabled).toBe(false);
     await emitter.emitForBatch(batchFor(REL));
@@ -370,7 +320,7 @@ describe("PushEventEmitter — emit, gating, failure handling", () => {
           throw new Error("network down");
         },
       },
-      flagProvider: new StaticFlagProvider(["indigo"]),
+      flagProvider: serverGranted,
       onError,
     });
     // Must not reject — the daemon stays alive.
@@ -387,7 +337,7 @@ describe("PushEventEmitter — emit, gating, failure handling", () => {
       originTenantId: "indigo",
       originDeviceId: "dev-1",
       transport: { start: async () => {}, dispose: async () => {}, connected: true, publish: async (e) => { published.push(e); } },
-      flagProvider: new StaticFlagProvider(["indigo"]),
+      flagProvider: serverGranted,
       onError,
     });
     // REL exists; "ghost.md" does not.
@@ -414,7 +364,7 @@ describe("PushEventEmitter — emit, gating, failure handling", () => {
       originTenantId: "indigo",
       originDeviceId: "dev-1",
       transport,
-      flagProvider: new StaticFlagProvider(["indigo"]),
+      flagProvider: serverGranted,
     });
     await transport.start();
     await emitter.emitForBatch(batchFor(REL));