@indigoai-us/hq-cloud 6.15.0 → 6.15.2

package/test/e2e/sync/cross-tenant-isolation.test.ts

@@ -1,630 +0,0 @@
-/**
- * US-010 — E2E acceptance test: cross-tenant isolation invariant (BLOCKING).
- *
- * ╔══════════════════════════════════════════════════════════════════════╗
- * ║  A FAILURE OF THIS TEST IS A P0 INCIDENT.                              ║
- * ║                                                                        ║
- * ║  Cross-tenant data leakage kills the event-driven-sync project        ║
- * ║  regardless of any latency win. If this test goes red, STOP — do not  ║
- * ║  merge, do not deploy, do not flip a feature flag. Treat it as a      ║
- * ║  security incident: root-cause it, record it in the project journal   ║
- * ║  (companies/indigo/projects/event-driven-sync-menubar), and only      ║
- * ║  re-enable the pipeline once the leak path is closed AND this test    ║
- * ║  is green again. (PRD US-010 AC#4 — "A failure is treated as a P0".)  ║
- * ╚══════════════════════════════════════════════════════════════════════╝
- *
- * What this pins (the CLIENT-side invariant)
- * ───────────────────────────────────────────
- * This is the hq-cloud CLIENT mirror of hq-pro PR #112's server-side
- * `cross-tenant-isolation` gate. Where the server proves its push handler
- * rejects a forged cross-tenant `originTenantId`, THIS test proves the
- * client pipeline — the US-008 {@link PushEventEmitter} push side and the
- * US-009 receiver pull side — can never let one tenant's data reach another
- * tenant's device. The invariant, verbatim from the PRD `e2eTests`:
- *
- *   "Given two tenants with two devices each, when tenant A saves a file,
- *    then no tenant B device observes it via push or pull within 60s."
- *
- * Two-tenant, two-device-each pair-work simulation
- * ─────────────────────────────────────────────────
- * Built entirely on the REAL client seams shipped by US-007/008/009 — no
- * production code is re-implemented here:
- *
- *   • Each tenant owns ONE fanout ({@link InMemoryFanout}) — the in-process
- *     analogue of that tenant's SNS topic → per-client SQS queue. This is
- *     the subscription boundary the whole isolation argument rests on.
- *   • A tenant's outbound device ships PushEvents through a
- *     {@link PushEventEmitter} (US-008) wired to a tenant-scoped
- *     {@link PushTransport}. The transport routes a published event ONLY
- *     into ITS OWN tenant's fanout AND refuses to ship any event whose
- *     `originTenantId` is not its tenant — this models the server's
- *     topic-per-tenant + cross-tenant rejection. So a tenant-A device
- *     physically cannot publish onto tenant B's fanout.
- *   • Each tenant's TWO devices run a {@link InMemoryPushReceiver} (US-009)
- *     subscribed ONLY to their own tenant's fanout. A receiver never reads
- *     another tenant's queue; isolation is enforced at the subscription
- *     boundary, never by post-hoc filtering.
- *
- * Assertions (map to PRD US-010 acceptanceCriteria + e2eTests)
- * ─────────────────────────────────────────────────────────────
- *   AC#1  Tenant A device saves a file; NO PushEvent reaches ANY tenant-B
- *         device over a simulated 60s window. We model the save by emitting
- *         through tenant A's emitter, then advance fake timers across a full
- *         60s window and assert every tenant-B receiver's syncFn fired ZERO
- *         times and no tenant-B receiver advanced its dedupe/seen state.
- *   AC#2  Tenant B's receiver never PULLS a tenant-A file: a tenant-B
- *         {@link SqsPushReceiver} polling ITS OWN (empty) per-tenant queue —
- *         while tenant A's queue is full of A's messages — drains zero
- *         tenant-A events. Cross-tenant messages are filtered by the
- *         subscription boundary (own-tenant queue only).
- *   AC#3  Positive control: a tenant-A device emits and a SECOND tenant-A
- *         device DOES receive it — proving the machinery is alive and the
- *         negative assertions are load-bearing, not trivially-passing.
- *   AC#4  Meta: the BLOCKING `cross-tenant-isolation` CI job in
- *         .github/workflows/ci.yml still references THIS test file. A future
- *         PR that silently drops the gate fails the very test it tried to
- *         skip.
- *
- * Fake timers (no real 60s wait)
- * ───────────────────────────────
- * The PRD says "over a simulated 60s window". We use `vi.useFakeTimers()`
- * and `vi.advanceTimersByTimeAsync(60_000)` so the 60s observation window
- * elapses instantly. The receivers' fanout delivery is synchronous on
- * publish; the SQS poll loop uses an injected fake `sqs` + injected fast
- * `sleep`, so nothing in the test depends on wall-clock. For the negative
- * assertion ("nothing reached tenant B") there is no event to wait FOR —
- * absence is proven by advancing through the whole window and asserting the
- * tenant-B counters stayed at zero.
- */
-
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-import { fileURLToPath } from "node:url";
-import { readFile as fsReadFile } from "node:fs/promises";
-import path from "node:path";
-
-import {
-  StaticFlagProvider,
-  PushEventEmitter,
-  encodePushEvent,
-  type PushEvent,
-  type PushTransport,
-} from "../../../src/index.js";
-// The US-009 receiver/fanout seams are surfaced via the sync barrel (they are
-// intentionally not part of the top-level public package surface yet — the
-// production SQS path ships behind a noop default). Import them from the same
-// barrel the rest of the sync code uses.
-import {
-  InMemoryFanout,
-  InMemoryPushReceiver,
-  SqsPushReceiver,
-  type PushReceiverContext,
-  type SqsClientLike,
-  type SqsMessageLike,
-} from "../../../src/sync/index.js";
-
-// ─── Test doubles ────────────────────────────────────────────────────────────
-
-const ZERO_HASH =
-  "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855";
-
-/**
- * A tenant-scoped {@link PushTransport} that ships an emitted PushEvent into
- * exactly ONE tenant's fanout — and ONLY when the event's `originTenantId`
- * matches this transport's bound tenant. This models the server's
- * topic-per-tenant boundary plus its cross-tenant-origin rejection: a device
- * physically cannot publish onto a foreign tenant's fanout, and a forged
- * `originTenantId` is dropped (recorded as `rejectedCount` for assertions).
- */
-class TenantScopedTransport implements PushTransport {
-  private _connected = false;
-  publishedCount = 0;
-  rejectedCount = 0;
-
-  constructor(
-    private readonly tenantId: string,
-    private readonly fanout: InMemoryFanout,
-  ) {}
-
-  get connected(): boolean {
-    return this._connected;
-  }
-
-  async start(): Promise<void> {
-    this._connected = true;
-  }
-
-  async publish(event: PushEvent): Promise<void> {
-    // Server-side topic-per-tenant + cross-tenant-origin rejection, modeled
-    // client-side: a forged originTenantId never lands on any fanout.
-    if (event.originTenantId !== this.tenantId) {
-      this.rejectedCount += 1;
-      throw new Error(
-        `TenantScopedTransport(${this.tenantId}): refusing cross-tenant ` +
-          `originTenantId=${event.originTenantId}`,
-      );
-    }
-    this.publishedCount += 1;
-    this.fanout.publish(encodePushEvent(event));
-  }
-
-  async dispose(): Promise<void> {
-    this._connected = false;
-  }
-}
-
-/**
- * A fake {@link SqsClientLike} backed by an in-memory per-queue buffer. Models
- * the per-client SQS queue: `receiveMessage` drains from this queue ONLY
- * (never any other tenant's). `seed` pre-loads a queue. `receiveMessage`
- * resolves promptly on abort so `dispose()` never blocks. No real AWS.
- */
-class FakeSqs implements SqsClientLike {
-  /** queueUrl → message buffer */
-  private readonly queues = new Map<string, SqsMessageLike[]>();
-  /** queueUrls this client was ever asked to receive from (assertion hook). */
-  readonly polledQueueUrls = new Set<string>();
-
-  seed(queueUrl: string, bodies: string[]): void {
-    const buf = this.queues.get(queueUrl) ?? [];
-    for (const body of bodies) {
-      buf.push({ Body: body, ReceiptHandle: `rh-${buf.length}-${Math.random()}` });
-    }
-    this.queues.set(queueUrl, buf);
-  }
-
-  async receiveMessage(args: {
-    queueUrl: string;
-    maxMessages: number;
-    waitTimeSeconds: number;
-    signal: AbortSignal;
-  }): Promise<{ messages: SqsMessageLike[] }> {
-    this.polledQueueUrls.add(args.queueUrl);
-    if (args.signal.aborted) return { messages: [] };
-    const buf = this.queues.get(args.queueUrl) ?? [];
-    const taken = buf.splice(0, args.maxMessages);
-    if (taken.length > 0) return { messages: taken };
-    // Real SQS long-poll posture: when the queue is empty, BLOCK until the
-    // abort signal fires (dispose) rather than busy-returning empty arrays.
-    // This keeps the receiver's poll loop from hot-spinning the event loop —
-    // exactly what a real `waitTimeSeconds` long-poll does — so the test
-    // observes "B drained nothing" without starving the runtime.
-    await new Promise<void>((resolve) => {
-      if (args.signal.aborted) return resolve();
-      args.signal.addEventListener("abort", () => resolve(), { once: true });
-    });
-    return { messages: [] };
-  }
-
-  async deleteMessage(args: {
-    queueUrl: string;
-    receiptHandle: string;
-  }): Promise<void> {
-    const buf = this.queues.get(args.queueUrl);
-    if (!buf) return;
-    const idx = buf.findIndex((m) => m.ReceiptHandle === args.receiptHandle);
-    if (idx >= 0) buf.splice(idx, 1);
-  }
-}
-
-/** Build a well-formed PushEvent for a given tenant/device/path. */
-function makeEvent(opts: {
-  tenantId: string;
-  deviceId: string;
-  relativePath: string;
-  sequenceNumber: number;
-}): PushEvent {
-  return {
-    relativePath: opts.relativePath,
-    kind: "upsert",
-    contentHash: ZERO_HASH,
-    mtime: "2026-05-21T12:00:00.000Z",
-    originDeviceId: opts.deviceId,
-    originTenantId: opts.tenantId,
-    sequenceNumber: opts.sequenceNumber,
-    eventTimestamp: "2026-05-21T12:00:00.000Z",
-  };
-}
-
-/** A syncFn that records each relativePath it was asked to pull. */
-function recordingSyncFn(): {
-  fn: (ctx: PushReceiverContext) => Promise<void>;
-  pulledPaths: string[];
-} {
-  const pulledPaths: string[] = [];
-  return {
-    pulledPaths,
-    fn: async (ctx: PushReceiverContext) => {
-      pulledPaths.push(ctx.event.relativePath);
-    },
-  };
-}
-
-// ─── Constants ───────────────────────────────────────────────────────────────
-
-const TENANT_A = "tenant-us010-A";
-const TENANT_B = "tenant-us010-B";
-const TENANT_A_SECRET_PATH = "companies/tenantA/notes/secret.md";
-/** PRD-specified observation window. Elapsed via fake timers, never real. */
-const OBSERVATION_WINDOW_MS = 60_000;
-
-// Track every disposable so a single failed assertion can't leak listeners.
-const disposers: Array<() => Promise<void> | void> = [];
-
-beforeEach(() => {
-  disposers.length = 0;
-  vi.useFakeTimers();
-});
-
-afterEach(async () => {
-  // Run real timers for teardown so dispose() drains aren't stuck behind fakes.
-  vi.useRealTimers();
-  while (disposers.length > 0) {
-    const d = disposers.pop();
-    if (!d) continue;
-    try {
-      await d();
-    } catch {
-      /* dispose is best-effort + idempotent */
-    }
-  }
-});
-
-// ─── Tests ─────────────────────────────────────────────────────────────────
-
-describe("US-010: cross-tenant isolation (BLOCKING — failure is P0)", () => {
-  it(
-    "AC#1+AC#3 — tenant A device saves a file; over a simulated 60s window " +
-      "NO tenant-B device observes a PushEvent via push, while a second " +
-      "tenant-A device DOES (positive control proving the wiring is live)",
-    async () => {
-      // Two tenants, each with its own fanout (its SNS topic → per-client SQS).
-      const fanoutA = new InMemoryFanout();
-      const fanoutB = new InMemoryFanout();
-
-      // Both tenants are flag-enabled so dormancy can't mask a leak: if the
-      // pipeline is fully ON for BOTH tenants and tenant B STILL sees nothing,
-      // the isolation boundary — not an OFF flag — is what's holding.
-      const flagProvider = new StaticFlagProvider([TENANT_A, TENANT_B]);
-
-      // ── Tenant A: device A1 ships through a tenant-A-scoped transport ──
-      const transportA = new TenantScopedTransport(TENANT_A, fanoutA);
-      await transportA.start();
-      const emitterA1 = new PushEventEmitter({
-        originTenantId: TENANT_A,
-        originDeviceId: "device-A1",
-        transport: transportA,
-        flagProvider,
-      });
-
-      // ── Tenant A: device A2 receives from tenant A's fanout (control) ──
-      const a2Sync = recordingSyncFn();
-      const receiverA2 = new InMemoryPushReceiver({
-        tenantId: TENANT_A,
-        fanout: fanoutA,
-        syncFn: a2Sync.fn,
-        flagProvider,
-      });
-      disposers.push(() => receiverA2.dispose());
-      await receiverA2.start();
-
-      // ── Tenant B: BOTH devices subscribe ONLY to tenant B's fanout ──
-      const b1Sync = recordingSyncFn();
-      const receiverB1 = new InMemoryPushReceiver({
-        tenantId: TENANT_B,
-        fanout: fanoutB,
-        syncFn: b1Sync.fn,
-        flagProvider,
-      });
-      disposers.push(() => receiverB1.dispose());
-      await receiverB1.start();
-
-      const b2Sync = recordingSyncFn();
-      const receiverB2 = new InMemoryPushReceiver({
-        tenantId: TENANT_B,
-        fanout: fanoutB,
-        syncFn: b2Sync.fn,
-        flagProvider,
-      });
-      disposers.push(() => receiverB2.dispose());
-      await receiverB2.start();
-
-      // ── Act: tenant A's device A1 "saves" the file → emits a PushEvent ──
-      // emitForBatch with a single changed path. The batch maps absolutePath →
-      // relativePath; PushEventEmitter hashes/stats the file, so we drive the
-      // emit through the transport directly via a hand-built event to keep the
-      // test filesystem-free while still exercising the real transport+receiver
-      // path that carries the originTenantId.
-      const eventA = makeEvent({
-        tenantId: TENANT_A,
-        deviceId: "device-A1",
-        relativePath: TENANT_A_SECRET_PATH,
-        sequenceNumber: 1,
-      });
-      // Sanity: the emitter is enabled for tenant A (not dormant).
-      expect(emitterA1.enabled).toBe(true);
-      await transportA.publish(eventA);
-
-      // ── Advance through the FULL simulated 60s observation window ──
-      await vi.advanceTimersByTimeAsync(OBSERVATION_WINDOW_MS);
-      // Flush any microtask-scheduled receiver dispatch.
-      await Promise.resolve();
-
-      // ── AC#3 positive control: tenant-A device A2 DID receive A1's file ──
-      expect(a2Sync.pulledPaths).toEqual([TENANT_A_SECRET_PATH]);
-      expect(receiverA2.processedCount).toBe(1);
-      expect(transportA.publishedCount).toBe(1);
-      expect(transportA.rejectedCount).toBe(0);
-
-      // ── AC#1: NO tenant-B device observed ANYTHING over the 60s window ──
-      expect(b1Sync.pulledPaths).toEqual([]);
-      expect(b2Sync.pulledPaths).toEqual([]);
-      expect(receiverB1.processedCount).toBe(0);
-      expect(receiverB2.processedCount).toBe(0);
-      expect(receiverB1.dedupedCount).toBe(0);
-      expect(receiverB2.dedupedCount).toBe(0);
-      // No tenant-A bytes ever entered tenant B's fanout: a B receiver that
-      // saw a decode/dispatch would have advanced one of these counters.
-      expect(receiverB1.decodeFailureCount).toBe(0);
-      expect(receiverB2.decodeFailureCount).toBe(0);
-    },
-    20_000,
-  );
-
-  it(
-    "AC#1 (mechanical) — a tenant-A device CANNOT publish onto tenant B: a " +
-      "tenant-B-scoped transport rejects a tenant-A-origin event, and tenant " +
-      "B's fanout stays empty",
-    async () => {
-      const fanoutB = new InMemoryFanout();
-      const transportB = new TenantScopedTransport(TENANT_B, fanoutB);
-      await transportB.start();
-      disposers.push(() => transportB.dispose());
-
-      const bReceived: string[] = [];
-      fanoutB.subscribe((raw) => bReceived.push(raw));
-
-      // A forged tenant-A event handed to tenant B's transport MUST be rejected
-      // — the transport refuses to route a foreign originTenantId onto B's
-      // fanout. This is the client-side analogue of the server's
-      // cross-tenant-push-rejected 403.
-      const forged = makeEvent({
-        tenantId: TENANT_A,
-        deviceId: "device-A1",
-        relativePath: TENANT_A_SECRET_PATH,
-        sequenceNumber: 1,
-      });
-      await expect(transportB.publish(forged)).rejects.toThrow(
-        /cross-tenant/i,
-      );
-
-      expect(transportB.rejectedCount).toBe(1);
-      expect(transportB.publishedCount).toBe(0);
-      // Nothing reached tenant B's fanout.
-      expect(bReceived).toEqual([]);
-    },
-    20_000,
-  );
-
-  it(
-    "AC#2 — tenant B's SQS receiver, polling ITS OWN queue, never PULLS a " +
-      "tenant-A file even when tenant A's queue is full of A's messages " +
-      "(receiver subscribes only to its own-tenant queue)",
-    async () => {
-      // This test exercises the real SqsPushReceiver poll loop, which is an
-      // async loop driven off the (now long-poll-blocking) FakeSqs — not off
-      // host timers. We run it under REAL timers so the loop's promises settle
-      // naturally; the FakeSqs blocks on empty so there is no busy-spin.
-      vi.useRealTimers();
-      // A fast injected sleep keeps any backoff path from waiting real time.
-      const fastSleep = async (): Promise<void> => Promise.resolve();
-
-      const sqs = new FakeSqs();
-      const queueUrlA = "https://sqs.local/queue/tenant-us010-A";
-      const queueUrlB = "https://sqs.local/queue/tenant-us010-B";
-
-      // Tenant A's queue is FULL of tenant-A messages. Tenant B's queue is
-      // EMPTY. If isolation held only by content-filtering (it must not), a
-      // bug that polled the wrong queue would surface here.
-      sqs.seed(queueUrlA, [
-        encodePushEvent(
-          makeEvent({
-            tenantId: TENANT_A,
-            deviceId: "device-A1",
-            relativePath: TENANT_A_SECRET_PATH,
-            sequenceNumber: 1,
-          }),
-        ),
-        encodePushEvent(
-          makeEvent({
-            tenantId: TENANT_A,
-            deviceId: "device-A2",
-            relativePath: "companies/tenantA/notes/other.md",
-            sequenceNumber: 2,
-          }),
-        ),
-      ]);
-
-      const bSync = recordingSyncFn();
-      const receiverB = new SqsPushReceiver({
-        tenantId: TENANT_B,
-        queueUrl: queueUrlB, // ← B subscribes ONLY to its own queue
-        sqs,
-        syncFn: bSync.fn,
-        enabled: true,
-        waitTimeSeconds: 0,
-        sleep: fastSleep,
-      });
-      disposers.push(() => receiverB.dispose());
-
-      await receiverB.start();
-
-      // Let the poll loop run a real iteration against B's (empty) queue. The
-      // first receiveMessage drains B's empty buffer then blocks on abort, so
-      // a short real delay is enough to prove B never pulled anything; the
-      // FakeSqs has no tenant-A queue exposure to B at all.
-      await new Promise((r) => setTimeout(r, 50));
-
-      // Tenant B pulled NOTHING — its queue was empty and it never touched A's.
-      expect(bSync.pulledPaths).toEqual([]);
-      expect(receiverB.processedCount).toBe(0);
-      // The receiver only ever polled tenant B's own queue URL.
-      expect(sqs.polledQueueUrls.has(queueUrlB)).toBe(true);
-      expect(sqs.polledQueueUrls.has(queueUrlA)).toBe(false);
-
-      // Dispose under real timers (afterEach switches back), drains cleanly.
-    },
-    20_000,
-  );
-
-  it(
-    "AC#4 — the BLOCKING `cross-tenant-isolation` CI job references THIS test " +
-      "file; a PR that silently drops the gate fails the test it tried to skip",
-    async () => {
-      const here = fileURLToPath(import.meta.url);
-      // <repo>/test/e2e/sync/cross-tenant-isolation.test.ts → up 4 to <repo>.
-      const repoRoot = path.resolve(path.dirname(here), "..", "..", "..");
-      const workflowText = await fsReadFile(
-        path.join(repoRoot, ".github", "workflows", "ci.yml"),
-        "utf8",
-      );
-
-      // The explicit job id the PRD asks for (job name `cross-tenant-isolation`).
-      expect(workflowText).toContain("cross-tenant-isolation:");
-      // The job must run THIS file by path.
-      expect(workflowText).toContain(
-        "test/e2e/sync/cross-tenant-isolation.test.ts",
-      );
-      // The gate must run on PRs — pin the YAML key form so a comment-only
-      // mention can't satisfy the assertion.
-      expect(workflowText).toContain("pull_request:");
-    },
-    5_000,
-  );
-});
-
-// ---------------------------------------------------------------------------
-// Phase 3 extension (US-018) — receive path with VENDED credentials
-// ---------------------------------------------------------------------------
-//
-// US-016 moved queue access from "client holds no way to read" to "subscribe
-// vends per-device STS creds scoped to exactly one queue ARN". The server-
-// side policy-document tests pin the IAM scoping; THIS extension pins the
-// client half of the same invariant: the startEventSync wiring polls ONLY
-// the queue URL its own subscribe returned — a tenant-B (or peer-device)
-// queue is never touched, and a same-tenant peer's events flow while the
-// device's own echoes are filtered.
-
-import {
-  startEventSync,
-  type SubscribeSyncResponse,
-} from "../../../src/sync/event-sync.js";
-import type {
-  SqsClientLike,
-  PushReceiverContext,
-} from "../../../src/sync/push-receiver.js";
-import type { PushEvent } from "../../../src/sync/push-event.js";
-
-describe("US-018: receive path with vended credentials (isolation extension)", () => {
-  function vendedResponse(tenant: string, device: string): SubscribeSyncResponse {
-    return {
-      queueUrl: `https://sqs.us-east-1.amazonaws.com/000000000000/sync-push-${tenant}-${device}`,
-      region: "us-east-1",
-      credentials: {
-        accessKeyId: `AKIA-${tenant}-${device}`,
-        secretAccessKey: "s",
-        sessionToken: "t",
-        expiration: "2099-01-01T00:00:00.000Z",
-      },
-    };
-  }
-
-  function phase3Event(overrides: Partial<PushEvent>): PushEvent {
-    return {
-      relativePath: "companies/indigo/docs/x.md",
-      kind: "upsert",
-      contentHash: `sha256:${"b".repeat(64)}`,
-      mtime: "2026-06-10T12:00:00.000Z",
-      originDeviceId: "peer",
-      originTenantId: "prs_A",
-      sequenceNumber: 10,
-      eventTimestamp: "2026-06-10T12:00:00.000Z",
-      ...overrides,
-    };
-  }
-
-  it("polls ONLY the queue URL its own subscribe returned, with its own vended creds", async () => {
-    // The suite-level beforeEach arms fake timers for the simulated-60s
-    // tests; this extension drives a REAL async poll loop (vi.waitFor +
-    // receiver microtasks), so switch back. afterEach re-reals anyway.
-    vi.useRealTimers();
-    const polledQueues = new Set<string>();
-    const credsUsed = new Set<string>();
-    let deliver: ((body: string) => void) | undefined;
-
-    const pulled: PushEvent[] = [];
-    const handles = await startEventSync({
-      hqRoot: "/tmp/hq-a1",
-      apiUrl: "https://api.example.com",
-      authToken: "jwt-A1",
-      deviceId: "devA1",
-      resolveTenantId: async () => "prs_A",
-      syncFn: async (ctx: PushReceiverContext) => {
-        pulled.push(ctx.event);
-      },
-      subscribe: async () => vendedResponse("prs_A", "devA1"),
-      buildSqs: (resp): SqsClientLike => {
-        credsUsed.add(resp.credentials.accessKeyId);
-        return {
-          receiveMessage: ({ queueUrl, signal }) =>
-            new Promise((resolve) => {
-              polledQueues.add(queueUrl);
-              signal.addEventListener(
-                "abort",
-                () => resolve({ messages: [] }),
-                { once: true },
-              );
-              deliver = (body: string) => {
-                deliver = undefined;
-                resolve({ messages: [{ Body: body, ReceiptHandle: "rh" }] });
-              };
-            }),
-          deleteMessage: async () => {},
-        };
-      },
-      log: () => {},
-    });
-    expect(handles).not.toBeNull();
-
-    await vi.waitFor(() => {
-      if (!deliver) throw new Error("not polling yet");
-    });
-
-    // The ONLY queue ever polled is this device's own vended queue, with this
-    // device's own vended credentials — the structural mirror of the server
-    // session policy (single queue ARN, nothing else).
-    expect([...polledQueues]).toEqual([
-      "https://sqs.us-east-1.amazonaws.com/000000000000/sync-push-prs_A-devA1",
-    ]);
-    expect([...credsUsed]).toEqual(["AKIA-prs_A-devA1"]);
-
-    // A same-tenant PEER event is bridged into the targeted pull…
-    deliver!(
-      JSON.stringify(phase3Event({ originDeviceId: "devA2", sequenceNumber: 11 })),
-    );
-    await vi.waitFor(() => expect(pulled).toHaveLength(1));
-    expect(pulled[0].originDeviceId).toBe("devA2");
-
-    // …while the device's OWN echo is filtered before the sync engine.
-    await vi.waitFor(() => {
-      if (!deliver) throw new Error("not polling again yet");
-    });
-    deliver!(
-      JSON.stringify(phase3Event({ originDeviceId: "devA1", sequenceNumber: 12 })),
-    );
-    // Give the loop a beat — the echo must NOT add a pull.
-    await new Promise((r) => setTimeout(r, 20));
-    expect(pulled).toHaveLength(1);
-
-    await handles!.dispose();
-  });
-});