@indigoai-us/hq-cloud 6.14.50 → 6.15.1

package/src/cli/rescue-hq-root-guard.test.ts

@@ -1,232 +0,0 @@
-/**
- * Regression test for the rescue HQ-root sanity gate in src/cli/rescue-core.ts.
- *
- * Bug (DEV-1741): the gate required BOTH `companies/` AND `personal/`. The
- * `personal/` directory was only introduced in v15 — a faithful v14.0.0 install
- * ships NEITHER `personal/` NOR `core/` (its scaffold lived in top-level dirs
- * like `scripts/`, `workers/`, `knowledge/`, plus `.claude/`). So every v14.0.0
- * user hit `error: ... missing companies/ or personal/. Aborting.` (exit 3) and
- * had no supported upgrade path to v15.
- *
- * The gate now anchors on `companies/` plus ANY ONE of `.claude/`, `core/`, or
- * `personal/`. `.claude/` exists on every release from v14 through v15, so the
- * relaxed gate admits the full upgrade range while still rejecting a directory
- * that is not an HQ root at all.
- *
- * Like the sibling drift test, the rescue clones its source from GitHub, so we
- * shim `git clone` to a local fixture repo. All runs are `--dry-run` (no
- * destructive ops, no backup) and we assert on the gate's behavior (exit code +
- * message), not the full overlay.
- */
-import { describe, it, expect, beforeAll, afterAll } from "vitest";
-import { execFileSync } from "child_process";
-import * as fs from "fs";
-import * as os from "os";
-import * as path from "path";
-import { isUsableRescueRoot, runRescue } from "./rescue-core.js";
-
-function hasGit(): boolean {
-  try {
-    execFileSync("git", ["--version"], { stdio: "ignore" });
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-const gitAvailable = hasGit();
-
-/** Run the rescue in-process, capturing its stdout/stderr. */
-function runRescueCapture(argv: string[], env: NodeJS.ProcessEnv) {
-  let stdout = "";
-  let stderr = "";
-  const origOut = process.stdout.write.bind(process.stdout);
-  const origErr = process.stderr.write.bind(process.stderr);
-  process.stdout.write = ((chunk: unknown) => {
-    stdout += String(chunk);
-    return true;
-  }) as typeof process.stdout.write;
-  process.stderr.write = ((chunk: unknown) => {
-    stderr += String(chunk);
-    return true;
-  }) as typeof process.stderr.write;
-  let status: number;
-  try {
-    status = runRescue(argv, { env }).status;
-  } finally {
-    process.stdout.write = origOut;
-    process.stderr.write = origErr;
-  }
-  return { status, stdout, stderr };
-}
-
-describe.skipIf(!gitAvailable)("rescue HQ-root sanity gate", () => {
-  let workDir: string;
-  let upstream: string;
-  let shimDir: string;
-  let floorSha: string;
-  let env: NodeJS.ProcessEnv;
-
-  const git = (cwd: string, ...args: string[]) =>
-    execFileSync("git", args, {
-      cwd,
-      stdio: ["ignore", "pipe", "pipe"],
-      env: {
-        ...process.env,
-        GIT_AUTHOR_NAME: "t",
-        GIT_AUTHOR_EMAIL: "t@t",
-        GIT_COMMITTER_NAME: "t",
-        GIT_COMMITTER_EMAIL: "t@t",
-      },
-    })
-      .toString()
-      .trim();
-
-  beforeAll(() => {
-    workDir = fs.mkdtempSync(path.join(os.tmpdir(), "hq-rescue-gate-"));
-
-    // --- Minimal local "upstream" repo (one core file, floor + HEAD). ---
-    upstream = path.join(workDir, "upstream");
-    fs.mkdirSync(path.join(upstream, "core"), { recursive: true });
-    git(workDir, "init", "-b", "main", "upstream");
-    fs.writeFileSync(path.join(upstream, "core/x.md"), "v1\n");
-    git(upstream, "add", "-A");
-    git(upstream, "commit", "-m", "floor");
-    floorSha = git(upstream, "rev-parse", "HEAD");
-    fs.writeFileSync(path.join(upstream, "core/x.md"), "v2\n");
-    git(upstream, "add", "-A");
-    git(upstream, "commit", "-m", "head");
-
-    // --- git shim: rewrite `git clone <github-url> dest` to the fixture. ---
-    const realGit =
-      execFileSync("bash", ["-lc", "command -v git"]).toString().trim() || "/usr/bin/git";
-    shimDir = path.join(workDir, "shim");
-    fs.mkdirSync(shimDir, { recursive: true });
-    const shim = `#!/usr/bin/env bash
-if [ "$1" = "clone" ]; then
-  args=()
-  for a in "$@"; do
-    case "$a" in
-      https://github.com/*) a=${JSON.stringify(upstream)} ;;
-    esac
-    args+=("$a")
-  done
-  exec ${JSON.stringify(realGit)} "\${args[@]}"
-fi
-exec ${JSON.stringify(realGit)} "$@"
-`;
-    fs.writeFileSync(path.join(shimDir, "git"), shim, { mode: 0o755 });
-    env = { ...process.env, PATH: `${shimDir}:${process.env.PATH ?? ""}` };
-  }, 60_000); // git init + commits can exceed vitest's 10s default under parallel load
-
-  afterAll(() => {
-    if (workDir) fs.rmSync(workDir, { recursive: true, force: true });
-  });
-
-  function makeRoot(name: string, dirs: string[]): string {
-    const root = path.join(workDir, name);
-    for (const d of dirs) fs.mkdirSync(path.join(root, d), { recursive: true });
-    return root;
-  }
-
-  function rescueDry(hqRoot: string) {
-    return runRescueCapture(
-      [
-        "--hq-root", hqRoot,
-        "--source", "test/repo",
-        "--ref", "main",
-        "--floor-sha", floorSha,
-        "--dry-run",
-        "--yes",
-        "--no-backup",
-      ],
-      env,
-    );
-  }
-
-  it("admits a faithful v14.0.0 root (companies/ + .claude/, NO personal/, NO core/)", () => {
-    // Exactly the shape that aborted before the fix.
-    const root = makeRoot("v14", ["companies", ".claude", "repos", "workspace"]);
-    expect(fs.existsSync(path.join(root, "personal"))).toBe(false);
-    expect(fs.existsSync(path.join(root, "core"))).toBe(false);
-
-    const r = rescueDry(root);
-    const out = `${r.stdout}\n${r.stderr}`;
-    // Must get PAST the gate — not the exit-3 abort.
-    expect(r.status, out).not.toBe(3);
-    expect(out).not.toContain("does not look like an HQ root");
-    expect(r.status, out).toBe(0);
-  });
-
-  it("admits a v15 root (companies/ + core/ + personal/)", () => {
-    const root = makeRoot("v15", ["companies", ".claude", "core", "personal", "repos", "workspace"]);
-    const r = rescueDry(root);
-    const out = `${r.stdout}\n${r.stderr}`;
-    expect(r.status, out).toBe(0);
-    expect(out).not.toContain("does not look like an HQ root");
-  });
-
-  it("admits a core-only root (companies/ + core/, no .claude/ or personal/)", () => {
-    const root = makeRoot("coreonly", ["companies", "core"]);
-    const r = rescueDry(root);
-    const out = `${r.stdout}\n${r.stderr}`;
-    expect(r.status, out).not.toBe(3);
-    expect(out).not.toContain("does not look like an HQ root");
-  });
-
-  it("still rejects a non-HQ directory (companies/ only — no scaffold marker)", () => {
-    const root = makeRoot("bare", ["companies"]);
-    const r = rescueDry(root);
-    const out = `${r.stdout}\n${r.stderr}`;
-    expect(r.status, out).toBe(3);
-    expect(out).toContain("does not look like an HQ root");
-    expect(out).toContain("need companies/ plus one of .claude/, core/, or personal/");
-  });
-
-  it("still rejects a directory with a marker but no companies/", () => {
-    const root = makeRoot("nocompanies", [".claude", "core", "personal"]);
-    const r = rescueDry(root);
-    const out = `${r.stdout}\n${r.stderr}`;
-    expect(r.status, out).toBe(3);
-    expect(out).toContain("does not look like an HQ root");
-  });
-
-  // 2026-08-02 Windows field failure: `--hq-root C:` (a path mangled upstream
-  // of this process) crashed with an uncaught EISDIR from fs.realpathSync on
-  // every daily background attempt. The gate must fail CLOSED — clean exit 1,
-  // no throw — and echo the received argv so the log identifies the caller.
-  it("rejects a bare drive letter --hq-root with a clean exit and argv echo", () => {
-    const r = rescueDry("C:");
-    const out = `${r.stdout}\n${r.stderr}`;
-    expect(r.status, out).toBe(1);
-    expect(out).toContain("--hq-root must be an absolute path");
-    expect(out).toContain('"C:"');
-    expect(out).toContain("argv:");
-  });
-
-  it("rejects a relative --hq-root with a clean exit", () => {
-    const r = rescueDry("some/relative/dir");
-    const out = `${r.stdout}\n${r.stderr}`;
-    expect(r.status, out).toBe(1);
-    expect(out).toContain("--hq-root must be an absolute path");
-  });
-});
-
-describe("isUsableRescueRoot (pure)", () => {
-  it("rejects bare drive letters under both path flavors", () => {
-    expect(isUsableRescueRoot("C:", path.win32)).toBe(false);
-    expect(isUsableRescueRoot("z:", path.win32)).toBe(false);
-    expect(isUsableRescueRoot("C:", path.posix)).toBe(false);
-  });
-
-  it("accepts absolute roots for the matching platform", () => {
-    expect(isUsableRescueRoot("C:\\Users\\caio\\HQ", path.win32)).toBe(true);
-    expect(isUsableRescueRoot("/Users/caio/HQ", path.posix)).toBe(true);
-  });
-
-  it("rejects relative and drive-relative paths", () => {
-    expect(isUsableRescueRoot("Users\\caio\\HQ", path.win32)).toBe(false);
-    expect(isUsableRescueRoot("C:Users\\caio\\HQ", path.win32)).toBe(false);
-    expect(isUsableRescueRoot("some/dir", path.posix)).toBe(false);
-  });
-});

package/src/cli/rescue-journal-reconcile.test.ts

@@ -1,215 +0,0 @@
-/**
- * Regression for the rescue <-> sync-journal interaction (6.2.4 semantics).
- *
- * History: 6.2.1/6.2.3 "reconciled" the journal after a rescue by re-stamping
- * changed scaffold entries to the current local hash. That MASKED the rescue's
- * changes from the sync engine: the push leg saw localChanged=false and never
- * uploaded the regenerated scaffold, so the vault silently kept stale bytes
- * while the journal claimed convergence (verified live 2026-06-10: 4 scaffold
- * files byte-diverged from the vault under a 0-conflict sync).
- *
- * Correct semantics (this test): the rescue must NOT touch the personal-vault
- * sync journal at all. Rescue-changed scaffold stays visible as "local
- * changed", the next bidirectional sync pushes it up, and the pull-side
- * byte-identical convergence probe (6.2.0) absorbs cross-machine races.
- *
- * Also covered: the core/core.yaml provenance stamp must be DETERMINISTIC —
- * a pure function of the source SHA (committer time, not wall-clock now) — so
- * every machine rescuing the same release writes byte-identical core.yaml.
- * The wall-clock stamp was the one genuine cross-machine divergence engine
- * behind `core.yaml.conflict-*` mirrors.
- */
-import { describe, it, expect, beforeAll, afterAll } from "vitest";
-import { execFileSync } from "child_process";
-import * as fs from "fs";
-import * as os from "os";
-import * as path from "path";
-import { runRescue } from "./rescue-core.js";
-import {
-  hashFile,
-  readJournal,
-  writeJournal,
-  PERSONAL_VAULT_JOURNAL_SLUG,
-} from "../journal.js";
-
-function hasGit(): boolean {
-  try {
-    execFileSync("git", ["--version"], { stdio: "ignore" });
-    return true;
-  } catch {
-    return false;
-  }
-}
-const gitAvailable = hasGit();
-
-function runRescueCapture(argv: string[], env: NodeJS.ProcessEnv) {
-  let stdout = "";
-  const origOut = process.stdout.write.bind(process.stdout);
-  const origErr = process.stderr.write.bind(process.stderr);
-  process.stdout.write = ((c: unknown) => ((stdout += String(c)), true)) as typeof process.stdout.write;
-  process.stderr.write = (() => true) as typeof process.stderr.write;
-  let status: number;
-  try {
-    status = runRescue(argv, { env }).status;
-  } finally {
-    process.stdout.write = origOut;
-    process.stderr.write = origErr;
-  }
-  return { status, stdout };
-}
-
-const SCAFFOLD = ["core/a.md", "core/docs/b.md", ".claude/c.sh", "core/core.yaml"];
-
-describe.skipIf(!gitAvailable)("rescue leaves the sync journal untouched + stamps core.yaml deterministically", () => {
-  let workDir: string, upstream: string, hqRoot: string, stateDir: string, floorSha: string;
-  let env: NodeJS.ProcessEnv;
-  let savedStateDir: string | undefined;
-  let headCommitterIso: string;
-  let seededHashes: Record<string, string>;
-
-  const git = (cwd: string, ...args: string[]) =>
-    execFileSync("git", args, {
-      cwd,
-      stdio: ["ignore", "pipe", "pipe"],
-      env: { ...process.env, GIT_AUTHOR_NAME: "t", GIT_AUTHOR_EMAIL: "t@t", GIT_COMMITTER_NAME: "t", GIT_COMMITTER_EMAIL: "t@t" },
-    }).toString().trim();
-
-  const w = (root: string, rel: string, body: string) => {
-    const p = path.join(root, rel);
-    fs.mkdirSync(path.dirname(p), { recursive: true });
-    fs.writeFileSync(p, body);
-  };
-
-  beforeAll(() => {
-    workDir = fs.mkdtempSync(path.join(os.tmpdir(), "hq-rescue-journal-"));
-
-    // --- upstream: floor (all scaffold = v1), HEAD advances the 3 docs to v2 ---
-    upstream = path.join(workDir, "upstream");
-    fs.mkdirSync(upstream, { recursive: true });
-    git(workDir, "init", "-b", "main", "upstream");
-    w(upstream, "core/a.md", "v1\n");
-    w(upstream, "core/docs/b.md", "v1\n");
-    w(upstream, ".claude/c.sh", "v1\n");
-    w(upstream, "core/core.yaml", "version: 1\n");
-    git(upstream, "add", "-A"); git(upstream, "commit", "-m", "floor");
-    floorSha = git(upstream, "rev-parse", "HEAD");
-    w(upstream, "core/a.md", "v2\n");
-    w(upstream, "core/docs/b.md", "v2\n");
-    w(upstream, ".claude/c.sh", "v2\n");
-    git(upstream, "add", "-A"); git(upstream, "commit", "-m", "head");
-    headCommitterIso = git(upstream, "show", "-s", "--format=%cI", "HEAD");
-
-    // --- local HQ root: scaffold == floor (overlaid to v2); a pending personal/ edit ---
-    hqRoot = path.join(workDir, "hq");
-    fs.mkdirSync(path.join(hqRoot, "companies"), { recursive: true });
-    w(hqRoot, "core/a.md", "v1\n");
-    w(hqRoot, "core/docs/b.md", "v1\n");
-    w(hqRoot, ".claude/c.sh", "v1\n");
-    w(hqRoot, "core/core.yaml", "version: 1\n");
-    w(hqRoot, "personal/edited.md", "USER_LOCAL\n"); // local pending edit
-
-    // --- state dir + seeded journal: pre-rescue baselines for scaffold + a divergent personal/ entry ---
-    stateDir = path.join(workDir, "state");
-    fs.mkdirSync(stateDir, { recursive: true });
-    savedStateDir = process.env.HQ_STATE_DIR;
-    process.env.HQ_STATE_DIR = stateDir;
-    const entry = (rel: string, hash: string) => ({
-      hash,
-      size: fs.statSync(path.join(hqRoot, rel)).size,
-      syncedAt: new Date(0).toISOString(),
-      direction: "down" as const,
-      remoteEtag: "seed-etag",
-      mtimeMs: fs.statSync(path.join(hqRoot, rel)).mtimeMs,
-    });
-    const files: Record<string, unknown> = {};
-    seededHashes = {};
-    for (const rel of SCAFFOLD) {
-      const h = hashFile(path.join(hqRoot, rel)); // hash of v1/version:1
-      seededHashes[rel] = h;
-      files[rel] = entry(rel, h);
-    }
-    // personal/ pending edit: journal records a DIFFERENT (already-synced) hash than local.
-    files["personal/edited.md"] = { ...entry("personal/edited.md", "remote-side-hash-differs-from-local") };
-    writeJournal(PERSONAL_VAULT_JOURNAL_SLUG, {
-      version: "2", lastSync: new Date(0).toISOString(), files, pulls: [],
-    } as never);
-
-    // --- git shim: redirect clone to the local fixture ---
-    const realGit = execFileSync("bash", ["-lc", "command -v git"]).toString().trim() || "/usr/bin/git";
-    const shimDir = path.join(workDir, "shim");
-    fs.mkdirSync(shimDir, { recursive: true });
-    fs.writeFileSync(
-      path.join(shimDir, "git"),
-      `#!/usr/bin/env bash
-if [ "$1" = "clone" ]; then
-  args=(); for a in "$@"; do case "$a" in https://github.com/*) a=${JSON.stringify(upstream)} ;; esac; args+=("$a"); done
-  exec ${JSON.stringify(realGit)} "\${args[@]}"
-fi
-exec ${JSON.stringify(realGit)} "$@"
-`,
-      { mode: 0o755 },
-    );
-    env = { ...process.env, PATH: `${shimDir}:${process.env.PATH ?? ""}`, HQ_STATE_DIR: stateDir };
-  });
-
-  afterAll(() => {
-    if (savedStateDir === undefined) delete process.env.HQ_STATE_DIR;
-    else process.env.HQ_STATE_DIR = savedStateDir;
-    if (workDir) fs.rmSync(workDir, { recursive: true, force: true });
-  });
-
-  it("leaves EVERY journal entry untouched so the push leg uploads rescue output (vault converges)", () => {
-    const r = runRescueCapture(
-      ["--hq-root", hqRoot, "--source", "test/repo", "--ref", "main", "--floor-sha", floorSha, "--yes", "--no-backup"],
-      env,
-    );
-    expect(r.status, r.stdout).toBe(0);
-
-    // the 3 docs were overlaid v1 -> v2
-    for (const rel of ["core/a.md", "core/docs/b.md", ".claude/c.sh"]) {
-      expect(fs.readFileSync(path.join(hqRoot, rel), "utf-8")).toBe("v2\n");
-    }
-
-    const j = readJournal(PERSONAL_VAULT_JOURNAL_SLUG).files;
-
-    // INVARIANT: the rescue never rewrites journal baselines. Every scaffold
-    // entry still carries its PRE-rescue hash -> localChanged=true on the next
-    // sync -> the push leg uploads the regenerated scaffold and the VAULT
-    // converges to the rescue output. (Masking these — 6.2.1/6.2.3 — left the
-    // vault silently stale.)
-    for (const rel of SCAFFOLD) {
-      expect(j[rel].hash, `${rel} baseline was rewritten`).toBe(seededHashes[rel]);
-      expect(j[rel].remoteEtag, `${rel} remote side touched`).toBe("seed-etag");
-      // and the local file genuinely changed, so the entry is push-visible
-      expect(j[rel].hash).not.toBe(hashFile(path.join(hqRoot, rel)));
-    }
-
-    // SAFETY: the personal/ pending edit is untouched too — still uploads.
-    expect(j["personal/edited.md"].hash).toBe("remote-side-hash-differs-from-local");
-    expect(j["personal/edited.md"].hash).not.toBe(hashFile(path.join(hqRoot, "personal/edited.md")));
-
-    // the masking reconcile is gone
-    expect(r.stdout).not.toContain("Reconciled sync-journal baseline");
-  });
-
-  it("stamps core.yaml deterministically: byte-identical across runs, last_sync_at = source committer time", () => {
-    const coreYaml = path.join(hqRoot, "core/core.yaml");
-    const firstRun = fs.readFileSync(coreYaml, "utf-8");
-
-    // last_sync_at must be derived from the HEAD commit, not wall-clock now.
-    // utcStamp(_, "colon") renders UTC as YYYY-MM-DDTHH:MM:SSZ — compare on
-    // the epoch second, not the string, to stay offset-agnostic.
-    const stamped = /last_sync_at:\s*["']?([0-9TZ:.-]+)["']?/.exec(firstRun);
-    expect(stamped, `no last_sync_at in:\n${firstRun}`).not.toBeNull();
-    expect(new Date(stamped![1]).getTime()).toBe(new Date(headCommitterIso).getTime());
-
-    // a second rescue of the SAME SHA must write byte-identical core.yaml —
-    // this is the cross-machine `core.yaml.conflict-*` mirror regression.
-    const r2 = runRescueCapture(
-      ["--hq-root", hqRoot, "--source", "test/repo", "--ref", "main", "--floor-sha", floorSha, "--yes", "--no-backup"],
-      env,
-    );
-    expect(r2.status, r2.stdout).toBe(0);
-    expect(fs.readFileSync(coreYaml, "utf-8")).toBe(firstRun);
-  });
-});

package/src/cli/rescue-mtime-preserve.test.ts

@@ -1,203 +0,0 @@
-/**
- * Integration regression for the rescue mtime-preservation fix in
- * src/cli/rescue-core.ts.
- *
- * The bug: rescue rebuilds the tree by `git clone` + `rsync -a`. A git
- * checkout stamps every file with clone-time (git stores no per-file mtimes),
- * so the overlay reset EVERY rescued file's mtime to "whenever rescue ran" —
- * collapsing real history onto one instant (the exact fingerprint that flagged
- * this: hundreds of files sharing one mtime, mtime == ctime == birth).
- *
- * The fix has three parts, all asserted below:
- *   - Layer 1: UNCHANGED files are left in place; the overlay excludes them, so
- *     their existing mtime survives.
- *   - Layer 2: files the overlay DOES write (upstream-changed, brand-new) get
- *     the git committer-date of their last-modifying commit, not wall-clock.
- *   - Layer 3: full history is used (history_floor mode clones full history;
- *     the shallow path unshallows) so per-file commit times are real.
- *
- * The rescue clones from GitHub, so we shim `git clone` to a local fixture
- * (same technique as rescue-drift-reconcile.test.ts) and run for real
- * (non-dry-run, --no-backup) so the overlay actually lays files down.
- */
-import { describe, it, expect, beforeAll, afterAll } from "vitest";
-import { execFileSync } from "child_process";
-import * as fs from "fs";
-import * as os from "os";
-import * as path from "path";
-import { runRescue } from "./rescue-core.js";
-
-function has(bin: string, ...args: string[]): boolean {
-  try {
-    execFileSync(bin, args, { stdio: "ignore" });
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-// Needs git (fixture + clone) and rsync (overlay). The mtime restore is now
-// native (fs.utimesSync), so perl is no longer required.
-const toolsAvailable = has("git", "--version") && has("rsync", "--version");
-
-// Fixed commit epochs so assertions are exact and machine-independent.
-const FLOOR_EPOCH = 1577836800; // 2020-01-01T00:00:00Z
-const HEAD_EPOCH = 1609459200; // 2021-01-01T00:00:00Z
-const KEEP_PRESET_EPOCH = 1546300800; // 2019-01-01T00:00:00Z (local, pre-rescue)
-
-/** Run the rescue in-process, capturing its stdout/stderr. */
-function runRescueCapture(argv: string[], env: NodeJS.ProcessEnv) {
-  let stdout = "";
-  let stderr = "";
-  const origOut = process.stdout.write.bind(process.stdout);
-  const origErr = process.stderr.write.bind(process.stderr);
-  process.stdout.write = ((chunk: unknown) => {
-    stdout += String(chunk);
-    return true;
-  }) as typeof process.stdout.write;
-  process.stderr.write = ((chunk: unknown) => {
-    stderr += String(chunk);
-    return true;
-  }) as typeof process.stderr.write;
-  let status: number;
-  try {
-    status = runRescue(argv, { env }).status;
-  } finally {
-    process.stdout.write = origOut;
-    process.stderr.write = origErr;
-  }
-  return { status, stdout, stderr };
-}
-
-describe.skipIf(!toolsAvailable)("rescue preserves mtimes (no clone-time flattening)", () => {
-  let workDir: string;
-  let upstream: string;
-  let hqRoot: string;
-  let shimDir: string;
-  let floorSha: string;
-  let env: NodeJS.ProcessEnv;
-
-  const gitAt = (cwd: string, epoch: number, ...args: string[]) =>
-    execFileSync("git", args, {
-      cwd,
-      stdio: ["ignore", "pipe", "pipe"],
-      env: {
-        ...process.env,
-        GIT_AUTHOR_NAME: "t",
-        GIT_AUTHOR_EMAIL: "t@t",
-        GIT_COMMITTER_NAME: "t",
-        GIT_COMMITTER_EMAIL: "t@t",
-        GIT_AUTHOR_DATE: `${epoch} +0000`,
-        GIT_COMMITTER_DATE: `${epoch} +0000`,
-      },
-    })
-      .toString()
-      .trim();
-
-  const mtimeSec = (p: string) => Math.floor(fs.statSync(p).mtimeMs / 1000);
-
-  beforeAll(() => {
-    workDir = fs.mkdtempSync(path.join(os.tmpdir(), "hq-rescue-mtime-"));
-
-    // --- "upstream" repo ----------------------------------------------------
-    //   floor commit (2020): x.md=v1, edited.md=base, keep.md=same
-    //   HEAD  commit (2021): x.md=v2 (changed) + new.md added; keep.md untouched
-    upstream = path.join(workDir, "upstream");
-    fs.mkdirSync(path.join(upstream, "core"), { recursive: true });
-    gitAt(workDir, FLOOR_EPOCH, "init", "-b", "main", "upstream");
-    fs.writeFileSync(path.join(upstream, "core/x.md"), "v1\n");
-    fs.writeFileSync(path.join(upstream, "core/edited.md"), "base\n");
-    fs.writeFileSync(path.join(upstream, "core/keep.md"), "same\n");
-    gitAt(upstream, FLOOR_EPOCH, "add", "-A");
-    gitAt(upstream, FLOOR_EPOCH, "commit", "-m", "floor");
-    floorSha = gitAt(upstream, FLOOR_EPOCH, "rev-parse", "HEAD");
-    fs.writeFileSync(path.join(upstream, "core/x.md"), "v2\n");
-    fs.writeFileSync(path.join(upstream, "core/new.md"), "fresh\n");
-    gitAt(upstream, HEAD_EPOCH, "add", "-A");
-    gitAt(upstream, HEAD_EPOCH, "commit", "-m", "head");
-
-    // --- local HQ root being rescued ----------------------------------------
-    hqRoot = path.join(workDir, "hq");
-    fs.mkdirSync(path.join(hqRoot, "core"), { recursive: true });
-    fs.mkdirSync(path.join(hqRoot, "personal"), { recursive: true });
-    fs.mkdirSync(path.join(hqRoot, "companies"), { recursive: true });
-    // Unchanged vs floor but upstream advanced v1 -> v2: overlay rewrites it.
-    fs.writeFileSync(path.join(hqRoot, "core/x.md"), "v1\n");
-    // User-edited: rescued to personal/ (not asserted here).
-    fs.writeFileSync(path.join(hqRoot, "core/edited.md"), "MINE\n");
-    // Identical to upstream HEAD: UNCHANGED -> left in place. Pre-stamp an old
-    // mtime that must survive the rescue.
-    const keep = path.join(hqRoot, "core/keep.md");
-    fs.writeFileSync(keep, "same\n");
-    fs.utimesSync(keep, KEEP_PRESET_EPOCH, KEEP_PRESET_EPOCH);
-
-    // --- git shim: redirect `git clone <github-url>` to the local fixture ----
-    const realGit = execFileSync("bash", ["-lc", "command -v git"]).toString().trim() || "/usr/bin/git";
-    shimDir = path.join(workDir, "shim");
-    fs.mkdirSync(shimDir, { recursive: true });
-    const shim = `#!/usr/bin/env bash
-if [ "$1" = "clone" ]; then
-  args=()
-  for a in "$@"; do
-    case "$a" in
-      https://github.com/*) a=${JSON.stringify(upstream)} ;;
-    esac
-    args+=("$a")
-  done
-  exec ${JSON.stringify(realGit)} "\${args[@]}"
-fi
-exec ${JSON.stringify(realGit)} "$@"
-`;
-    fs.writeFileSync(path.join(shimDir, "git"), shim, { mode: 0o755 });
-    env = { ...process.env, PATH: `${shimDir}:${process.env.PATH ?? ""}` };
-
-    // --- run the real rescue (non-dry-run) ----------------------------------
-    const r = runRescueCapture(
-      [
-        "--hq-root", hqRoot,
-        "--source", "test/repo",
-        "--ref", "main",
-        "--floor-sha", floorSha,
-        "--yes",
-        "--no-backup",
-      ],
-      env,
-    );
-    // Surface output on failure for debuggability.
-    if (r.status !== 0) {
-      throw new Error(`rescue failed (${r.status}):\n${r.stdout}\n${r.stderr}`);
-    }
-  });
-
-  afterAll(() => {
-    if (workDir) fs.rmSync(workDir, { recursive: true, force: true });
-  });
-
-  it("rewrites an upstream-changed file with its git commit mtime (not now)", () => {
-    const x = path.join(hqRoot, "core/x.md");
-    expect(fs.readFileSync(x, "utf-8")).toBe("v2\n");
-    expect(mtimeSec(x)).toBe(HEAD_EPOCH);
-  });
-
-  it("creates a brand-new upstream file with its git commit mtime", () => {
-    const n = path.join(hqRoot, "core/new.md");
-    expect(fs.existsSync(n)).toBe(true);
-    expect(mtimeSec(n)).toBe(HEAD_EPOCH);
-  });
-
-  it("leaves an UNCHANGED file in place, preserving its existing mtime (Layer 1)", () => {
-    const keep = path.join(hqRoot, "core/keep.md");
-    expect(fs.readFileSync(keep, "utf-8")).toBe("same\n");
-    expect(mtimeSec(keep)).toBe(KEEP_PRESET_EPOCH);
-  });
-
-  it("never stamps an overlaid file with wall-clock-now (the original bug)", () => {
-    const now = Math.floor(Date.now() / 1000);
-    for (const rel of ["core/x.md", "core/new.md", "core/keep.md"]) {
-      const age = now - mtimeSec(path.join(hqRoot, rel));
-      // Every asserted file predates the run by years; a clone-time stamp
-      // would be within seconds of now.
-      expect(age, `${rel} mtime looks like wall-clock-now`).toBeGreaterThan(60);
-    }
-  });
-});