@indigoai-us/hq-cloud 6.15.24 → 6.15.26

package/dist/cli/sync.test.js

@@ -5,6 +5,7 @@ import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
 import * as fs from "fs";
 import * as path from "path";
 import * as os from "os";
+import * as crypto from "crypto";
 import { clearContextCache } from "../context.js";
 import { lockPathFor } from "../operation-lock.js";
 // Re-export node:fs as a mutable module so unreadable-link regressions can
@@ -13,6 +14,13 @@ vi.mock("fs", async (importOriginal) => {
     const actual = await importOriginal();
     return { ...actual };
 });
+// Same mutable-namespace trick as `fs` above: `skip` is an interactive-only
+// resolution, so the only way to exercise its arm is to stand in for the
+// prompt. Re-exporting the real module keeps every other call site genuine.
+vi.mock("./conflict.js", async (importOriginal) => {
+    const actual = await importOriginal();
+    return { ...actual };
+});
 describe("sync mutation stdin boundary", () => {
     it("accepts only the exact sidecar command and emits one discriminated upsert result", async () => {
         expect(SYNC_MUTATION_STDIN_COMMAND).toEqual(["sync", "mutation", "--stdin-json"]);
@@ -115,6 +123,7 @@ vi.mock("./reindex.js", () => ({
 import { sync, reportNewFilesToNotify, applyRealtimeDeltaPage, isSyncMutationStdinCommand, runSyncMutationStdinJson, SYNC_MUTATION_STDIN_COMMAND, win32SymlinkFlavorBroken, } from "./sync.js";
 import { share } from "./share.js";
 import * as s3Module from "../s3.js";
+import * as conflictModule from "./conflict.js";
 import { reindex } from "./reindex.js";
 import { readSyncProgress } from "../sync-progress.js";
 import { VaultAuthError } from "../vault-client.js";
@@ -135,6 +144,16 @@ function journalAt(journalPath) {
         .replace(/\.json$/, "");
     return readJournal(slug);
 }
+/**
+ * The single `.conflict-` sidecar in a directory. Asserting through this rather
+ * than re-globbing inline keeps "exactly one was minted" enforced everywhere a
+ * test reaches for the preserved side.
+ */
+function sidecarIn(dir) {
+    const found = fs.readdirSync(dir).filter((f) => f.includes(".conflict-"));
+    expect(found).toHaveLength(1);
+    return path.join(dir, found[0]);
+}
 const mockConfig = {
     apiUrl: "https://vault-api.test",
     authToken: "test-jwt-token",
@@ -482,7 +501,7 @@ describe("sync", () => {
         const result = await sync({ vaultConfig: mockConfig, hqRoot: tmpDir });
         expect(result.filesDownloaded).toBe(2);
     });
-    it("detects conflicts with local changes and keeps local on --on-conflict keep", async () => {
+    it("detects conflicts with local changes and adopts the cloud copy on --on-conflict keep", async () => {
         const companyDocs = path.join(tmpDir, "companies", "acme", "docs");
         fs.mkdirSync(companyDocs, { recursive: true });
         fs.writeFileSync(path.join(companyDocs, "handoff.md"), "local version");
@@ -506,10 +525,12 @@ describe("sync", () => {
         });
         expect(result.conflicts).toBe(1);
         expect(result.conflictPaths).toEqual(["docs/handoff.md"]);
-        expect(result.filesSkipped).toBeGreaterThanOrEqual(1);
-        expect(fs.readFileSync(path.join(companyDocs, "handoff.md"), "utf-8")).toBe("local version");
+        // `keep` adopts the cloud body at the original name…
+        expect(fs.readFileSync(path.join(companyDocs, "handoff.md"), "utf-8")).toBe("mock file content");
+        // …and the local one survives beside it.
+        expect(fs.readFileSync(sidecarIn(companyDocs), "utf-8")).toBe("local version");
     });
-    it("conflict keep marks the entry localDiverges (journal-honesty: kept copy never matched the recorded remote etag)", async () => {
+    it("conflict skip marks the entry localDiverges (journal-honesty: the held copy never matched the recorded remote etag)", async () => {
         const companyDocs = path.join(tmpDir, "companies", "acme", "docs");
         fs.mkdirSync(companyDocs, { recursive: true });
         fs.writeFileSync(path.join(companyDocs, "handoff.md"), "local version");
@@ -525,17 +546,28 @@ describe("sync", () => {
                 },
             },
         }));
-        const result = await sync({
-            company: "acme",
-            onConflict: "keep",
-            vaultConfig: mockConfig,
-            hqRoot: tmpDir,
-        });
+        // `keep` no longer holds, so the honesty flag now belongs to the arms that
+        // still do. `skip` is the interactive one and is exercised through the
+        // prompt stand-in.
+        const resolveSpy = vi
+            .spyOn(conflictModule, "resolveConflict")
+            .mockResolvedValue("skip");
+        let result;
+        try {
+            result = await sync({
+                company: "acme",
+                vaultConfig: mockConfig,
+                hqRoot: tmpDir,
+            });
+        }
+        finally {
+            resolveSpy.mockRestore();
+        }
         expect(result.conflicts).toBe(1);
         const journal = journalAt(journalPath);
         // remoteEtag still recorded so the conflict can't re-fire (#137 invariant)…
         expect(journal.files["docs/handoff.md"].remoteEtag).toBeTruthy();
-        // …but the kept-local copy is flagged divergent so a later currency-gated
+        // …but the held local copy is flagged divergent so a later currency-gated
         // delete cannot fire on a journal that lies about local==remote.
         expect(journal.files["docs/handoff.md"].localDiverges).toBe(true);
     });
@@ -576,6 +608,249 @@ describe("sync", () => {
         expect(journal.files["docs/handoff.md"].remoteEtag).toBeTruthy();
         expect(journal.files["docs/handoff.md"].localDiverges).toBe(true);
     });
+    // --- `keep` semantics, revised 2026-08-21 -------------------------------
+    //
+    // `keep` now means "the CLOUD copy becomes the working copy; my local body is
+    // preserved beside it as a `.conflict-` sidecar." It used to mean the
+    // opposite — hold local, stamp the remote etag, arm `localDiverges` — and
+    // that combination was terminal: push refused the divergent local, pull saw
+    // the remote unchanged so it never replaced the entry, and every subsequent
+    // `keep` re-armed the flag. The file could converge in neither direction, and
+    // because the desktop app hardcodes `--on-conflict keep`, that was the
+    // default outcome for every real conflict.
+    //
+    // Electing the cloud body clears the divergence BY CONSTRUCTION — the entry
+    // then genuinely records what sits on disk — while the local bytes survive
+    // under the sidecar for the operator to re-apply. Nothing is destroyed; the
+    // working copy changes and the old one is renamed.
+    it("conflict keep takes the cloud body at the original path and preserves local in a `.conflict-` sidecar", async () => {
+        const companyDocs = path.join(tmpDir, "companies", "acme", "docs");
+        fs.mkdirSync(companyDocs, { recursive: true });
+        fs.writeFileSync(path.join(companyDocs, "handoff.md"), "local version");
+        vi.mocked(s3Module.listRemoteFiles).mockResolvedValueOnce([
+            { key: "docs/handoff.md", size: 42, lastModified: new Date(), etag: '"divergent"' },
+        ]);
+        fs.writeFileSync(journalPath, JSON.stringify({
+            version: "1",
+            lastSync: new Date().toISOString(),
+            files: {
+                "docs/handoff.md": {
+                    hash: "old-hash-from-last-sync",
+                    size: 20,
+                    syncedAt: new Date(Date.now() - 3600000).toISOString(),
+                    direction: "down",
+                },
+            },
+        }));
+        const result = await sync({
+            company: "acme",
+            onConflict: "keep",
+            vaultConfig: mockConfig,
+            hqRoot: tmpDir,
+        });
+        expect(result.conflicts).toBe(1);
+        expect(result.conflictPaths).toEqual(["docs/handoff.md"]);
+        // The cloud body is the working copy now.
+        expect(fs.readFileSync(path.join(companyDocs, "handoff.md"), "utf-8")).toBe("mock file content");
+        // …and the local body is not lost — it is sitting beside it.
+        const sidecars = fs
+            .readdirSync(companyDocs)
+            .filter((f) => f.includes(".conflict-"));
+        expect(sidecars).toHaveLength(1);
+        expect(fs.readFileSync(path.join(companyDocs, sidecars[0]), "utf-8")).toBe("local version");
+    });
+    it("conflict keep clears the fetched sidecar before rename for Windows compatibility", async () => {
+        const companyDocs = path.join(tmpDir, "companies", "acme", "docs");
+        fs.mkdirSync(companyDocs, { recursive: true });
+        const originalPath = path.join(companyDocs, "handoff.md");
+        fs.writeFileSync(originalPath, "local version");
+        vi.mocked(s3Module.listRemoteFiles).mockResolvedValueOnce([
+            { key: "docs/handoff.md", size: 42, lastModified: new Date(), etag: '"divergent"' },
+        ]);
+        fs.writeFileSync(journalPath, JSON.stringify({
+            version: "1",
+            lastSync: new Date().toISOString(),
+            files: {
+                "docs/handoff.md": {
+                    hash: "old-hash-from-last-sync",
+                    size: 20,
+                    syncedAt: new Date(Date.now() - 3600000).toISOString(),
+                    direction: "down",
+                },
+            },
+        }));
+        // Node's Windows rename does not replace an occupied destination. Model
+        // that rule only for the local→sidecar move; unrelated atomic index and
+        // journal renames keep using the host filesystem's normal behaviour.
+        const realRenameSync = fs.renameSync;
+        const renameSpy = vi.spyOn(fs, "renameSync").mockImplementation((from, to) => {
+            if (String(from) === originalPath &&
+                String(to).includes(".conflict-") &&
+                fs.existsSync(to)) {
+                throw errnoError("EEXIST");
+            }
+            return realRenameSync(from, to);
+        });
+        try {
+            await sync({
+                company: "acme",
+                onConflict: "keep",
+                vaultConfig: mockConfig,
+                hqRoot: tmpDir,
+            });
+        }
+        finally {
+            renameSpy.mockRestore();
+        }
+        expect(fs.readFileSync(originalPath, "utf-8")).toBe("mock file content");
+        expect(fs.readFileSync(sidecarIn(companyDocs), "utf-8")).toBe("local version");
+    });
+    it("conflict keep converges the journal on the REMOTE body and leaves localDiverges unset", async () => {
+        const companyDocs = path.join(tmpDir, "companies", "acme", "docs");
+        fs.mkdirSync(companyDocs, { recursive: true });
+        fs.writeFileSync(path.join(companyDocs, "handoff.md"), "local version");
+        vi.mocked(s3Module.listRemoteFiles).mockResolvedValueOnce([
+            { key: "docs/handoff.md", size: 42, lastModified: new Date(), etag: '"divergent"' },
+        ]);
+        fs.writeFileSync(journalPath, JSON.stringify({
+            version: "1",
+            lastSync: new Date().toISOString(),
+            files: {
+                "docs/handoff.md": {
+                    hash: "old-hash-from-last-sync",
+                    size: 20,
+                    syncedAt: new Date(Date.now() - 3600000).toISOString(),
+                    direction: "down",
+                },
+            },
+        }));
+        await sync({
+            company: "acme",
+            onConflict: "keep",
+            vaultConfig: mockConfig,
+            hqRoot: tmpDir,
+        });
+        const entry = journalAt(journalPath).files["docs/handoff.md"];
+        expect(entry.remoteEtag).toBeTruthy();
+        // The whole point of the change: the entry describes the body that is
+        // actually on disk, so the honesty flag has nothing to report. A set flag
+        // here would re-create the deadlock this test exists to prevent.
+        expect(entry.localDiverges).toBeFalsy();
+    });
+    it("conflict keep records the REMOTE body's hash, so the entry is pushable instead of permanently divergent", async () => {
+        // This is the deadlock in one assertion. The old `keep` wrote the LOCAL
+        // hash next to the REMOTE etag, which is a self-contradictory entry: the
+        // push leg refuses to send a body the journal calls divergent, and the pull
+        // leg sees a remote whose etag already matches and leaves it alone. Writing
+        // the remote hash is what makes the entry describable — and therefore
+        // sendable — again.
+        const companyDocs = path.join(tmpDir, "companies", "acme", "docs");
+        fs.mkdirSync(companyDocs, { recursive: true });
+        fs.writeFileSync(path.join(companyDocs, "handoff.md"), "local version");
+        vi.mocked(s3Module.listRemoteFiles).mockResolvedValueOnce([
+            { key: "docs/handoff.md", size: 42, lastModified: new Date(), etag: '"divergent"' },
+        ]);
+        fs.writeFileSync(journalPath, JSON.stringify({
+            version: "1",
+            lastSync: new Date().toISOString(),
+            files: {
+                "docs/handoff.md": {
+                    hash: "old-hash-from-last-sync",
+                    size: 20,
+                    syncedAt: new Date(Date.now() - 3600000).toISOString(),
+                    direction: "down",
+                },
+            },
+        }));
+        await sync({
+            company: "acme",
+            onConflict: "keep",
+            vaultConfig: mockConfig,
+            hqRoot: tmpDir,
+        });
+        // Pinned to the REMOTE body specifically, not to "whatever is on disk" —
+        // the old behaviour also left those two agreeing (it recorded the local
+        // hash and left the local file in place), so a disk-relative assertion
+        // would pass against the very bug this guards.
+        const remoteHash = crypto
+            .createHash("sha256")
+            .update("mock file content")
+            .digest("hex");
+        const entry = journalAt(journalPath).files["docs/handoff.md"];
+        expect(entry.hash).toBe(remoteHash);
+    });
+    it("conflict keep indexes the sidecar as the LOCAL body so /resolve-conflicts offers the right side", async () => {
+        const companyDocs = path.join(tmpDir, "companies", "acme", "docs");
+        fs.mkdirSync(companyDocs, { recursive: true });
+        fs.writeFileSync(path.join(companyDocs, "handoff.md"), "local version");
+        vi.mocked(s3Module.listRemoteFiles).mockResolvedValueOnce([
+            { key: "docs/handoff.md", size: 42, lastModified: new Date(), etag: '"divergent"' },
+        ]);
+        fs.writeFileSync(journalPath, JSON.stringify({
+            version: "1",
+            lastSync: new Date().toISOString(),
+            files: {
+                "docs/handoff.md": {
+                    hash: "old-hash-from-last-sync",
+                    size: 20,
+                    syncedAt: new Date(Date.now() - 3600000).toISOString(),
+                    direction: "down",
+                },
+            },
+        }));
+        await sync({
+            company: "acme",
+            onConflict: "keep",
+            vaultConfig: mockConfig,
+            hqRoot: tmpDir,
+        });
+        const index = JSON.parse(fs.readFileSync(path.join(tmpDir, ".hq-conflicts", "index.json"), "utf-8"));
+        expect(index.conflicts).toHaveLength(1);
+        const entry = index.conflicts[0];
+        expect(entry.originalPath).toBe("companies/acme/docs/handoff.md");
+        expect(entry.preserved).toBe("local");
+        // The sidecar it points at holds the LOCAL body — the side the operator
+        // may want back. Reading the recorded path is the contract /resolve-conflicts
+        // relies on, so assert through it rather than re-globbing the directory.
+        expect(fs.readFileSync(path.join(tmpDir, entry.conflictPath), "utf-8")).toBe("local version");
+    });
+    it("interactive `skip` still leaves local in place — skip is not keep", async () => {
+        // `skip` means "do not touch this one, I will deal with it later". It is a
+        // separate arm from `keep` and must NOT adopt the cloud body; a strategy
+        // that says "leave it alone" may not rename the operator's file.
+        const companyDocs = path.join(tmpDir, "companies", "acme", "docs");
+        fs.mkdirSync(companyDocs, { recursive: true });
+        fs.writeFileSync(path.join(companyDocs, "handoff.md"), "local version");
+        vi.mocked(s3Module.listRemoteFiles).mockResolvedValueOnce([
+            { key: "docs/handoff.md", size: 42, lastModified: new Date(), etag: '"divergent"' },
+        ]);
+        fs.writeFileSync(journalPath, JSON.stringify({
+            version: "1",
+            lastSync: new Date().toISOString(),
+            files: {
+                "docs/handoff.md": {
+                    hash: "old-hash-from-last-sync",
+                    size: 20,
+                    syncedAt: new Date(Date.now() - 3600000).toISOString(),
+                    direction: "down",
+                },
+            },
+        }));
+        const resolveSpy = vi
+            .spyOn(conflictModule, "resolveConflict")
+            .mockResolvedValue("skip");
+        try {
+            await sync({
+                company: "acme",
+                vaultConfig: mockConfig,
+                hqRoot: tmpDir,
+            });
+        }
+        finally {
+            resolveSpy.mockRestore();
+        }
+        expect(fs.readFileSync(path.join(companyDocs, "handoff.md"), "utf-8")).toBe("local version");
+    });
     it("a genuine download clears a stale localDiverges flag (entry is now truly local==remote)", async () => {
         const companyDocs = path.join(tmpDir, "companies", "acme", "docs");
         fs.mkdirSync(companyDocs, { recursive: true });
@@ -835,13 +1110,10 @@ describe("sync", () => {
         });
         expect(result.conflicts).toBe(1);
         expect(result.conflictPaths).toEqual(["docs/handoff.md"]);
-        // Local preserved on keep.
-        expect(fs.readFileSync(path.join(companyDocs, "handoff.md"), "utf-8")).toBe("local version");
-        // Mirror retained for inspection.
-        const litter = fs
-            .readdirSync(companyDocs)
-            .filter((f) => f.includes(".conflict-"));
-        expect(litter).toHaveLength(1);
+        // Cloud body adopted at the original name on keep…
+        expect(fs.readFileSync(path.join(companyDocs, "handoff.md"), "utf-8")).toBe("mock file content");
+        // …and exactly one sidecar retained, holding the displaced local body.
+        expect(fs.readFileSync(sidecarIn(companyDocs), "utf-8")).toBe("local version");
     });
     it("cloud-authoritative file is PULL-WINS on conflict: overwrites local, no mirror, no false-stamp", async () => {
         // company-brief.md is server-regenerated (gardener), so a divergence is not
@@ -954,10 +1226,12 @@ describe("sync", () => {
         // Surfaced as a conflict, NOT a silent download.
         expect(result.conflicts).toBe(1);
         expect(result.conflictPaths).toEqual(["docs/handoff.md"]);
-        expect(result.filesDownloaded).toBe(0);
-        // The newer local bytes are intact — nothing was rolled back.
-        expect(fs.readFileSync(localPath, "utf-8")).toBe(localContent);
-        // Remote preserved as an inspection mirror rather than overwriting local.
+        expect(result.filesDownloaded).toBe(1);
+        // The newer local bytes are not lost — the rollback is survivable because
+        // `keep` renames them aside rather than discarding them. The guard's job is
+        // to route this through conflict resolution instead of a silent download;
+        // which side ends up at the original name is the strategy's call.
+        expect(fs.readFileSync(sidecarIn(path.dirname(localPath)), "utf-8")).toBe(localContent);
         const litter = fs
             .readdirSync(companyDocs)
             .filter((f) => f.includes(".conflict-"));
@@ -1017,8 +1291,8 @@ describe("sync", () => {
         });
         expect(result.conflicts).toBe(1);
         expect(result.conflictPaths).toEqual(["docs/handoff.md"]);
-        expect(result.filesDownloaded).toBe(0);
-        expect(fs.readFileSync(localPath, "utf-8")).toBe(localEdit);
+        expect(result.filesDownloaded).toBe(1);
+        expect(fs.readFileSync(sidecarIn(path.dirname(localPath)), "utf-8")).toBe(localEdit);
     });
     it("anti-rollback guard is direction-gated: a SMALLER remote on a clean CONSUMER copy (direction=down) downloads, not conflict", async () => {
         // The device only ever PULLED this file (direction: "down") — a consumer
@@ -1142,18 +1416,16 @@ describe("sync", () => {
         // Surfaced as a conflict, NOT a silent download.
         expect(result.conflicts).toBe(1);
         expect(result.conflictPaths).toEqual(["docs/handoff.md"]);
-        expect(result.filesDownloaded).toBe(0);
-        // The local edit is intact.
-        expect(fs.readFileSync(localPath, "utf-8")).toBe(localContent);
-        // Cloud copy preserved alongside it for inspection / `/resolve-conflicts`.
-        const litter = fs
-            .readdirSync(companyDocs)
-            .filter((f) => f.includes(".conflict-"));
-        expect(litter).toHaveLength(1);
-        expect(fs.readFileSync(path.join(companyDocs, litter[0]), "utf-8")).toBe("mock file content");
+        expect(result.filesDownloaded).toBe(1);
+        // The unjournaled local body is not lost — it is renamed aside, which is
+        // what makes adopting the cloud copy survivable for a file that had no
+        // sync history at all.
+        expect(fs.readFileSync(sidecarIn(path.dirname(localPath)), "utf-8")).toBe(localContent);
+        // The cloud body took the original name.
+        expect(fs.readFileSync(localPath, "utf-8")).toBe("mock file content");
         // And a durable record exists so the overwrite can never be silent.
         const index = JSON.parse(fs.readFileSync(path.join(tmpDir, ".hq-conflicts", "index.json"), "utf-8"));
-        expect(index.conflicts.some((c) => c.originalPath === "companies/acme/docs/handoff.md")).toBe(true);
+        expect(index.conflicts.some((c) => c.originalPath === "companies/acme/docs/handoff.md" && c.preserved === "local")).toBe(true);
     });
     it("untracked-local guard is free on first pull: an unjournaled local file that already MATCHES the cloud reconciles silently", async () => {
         // The guard must not manufacture conflicts for the common case — a fresh
@@ -1803,9 +2075,10 @@ describe("sync", () => {
         });
         expect(result.conflicts).toBe(1);
         expect(result.conflictPaths).toEqual(["workspace/threads/handoff.json"]);
-        expect(result.filesSkipped).toBeGreaterThanOrEqual(1);
-        // B's newer local pointer is preserved verbatim — not clobbered by A's.
-        const kept = JSON.parse(fs.readFileSync(path.join(threadsLocal, "handoff.json"), "utf-8"));
+        // B's newer local pointer is preserved verbatim — renamed aside rather than
+        // destroyed. DEV-1778 was about the pointer being LOST; a recoverable
+        // sidecar satisfies that, and the machine can still resume from it.
+        const kept = JSON.parse(fs.readFileSync(sidecarIn(threadsLocal), "utf-8"));
         expect(kept.message).toBe("newer local from B");
         expect(kept.thread_path).toBe("workspace/threads/T-machineB.json");
     });
@@ -2307,10 +2580,16 @@ describe("sync", () => {
             },
             pulls: [],
         }));
-        vi.mocked(s3Module.headRemoteFile).mockResolvedValueOnce({
+        vi.mocked(s3Module.headRemoteFile)
+            .mockResolvedValueOnce({
             etag: "old-etag",
             size: baseline.length,
             lastModified: new Date(),
+        })
+            .mockResolvedValueOnce({
+            etag: "peer-etag",
+            size: "mock file content".length,
+            lastModified: new Date(),
         });
         const preconditionError = Object.assign(new Error("remote changed"), {
             name: "PreconditionFailed",
@@ -2326,7 +2605,15 @@ describe("sync", () => {
             onConflict: "keep",
         });
         expect(result.conflictPaths).toContain("board.json");
-        expect(fs.readFileSync(boardPath, "utf-8")).toBe(localAppend);
+        // The conditional PUT still fails closed, but keep is cloud-wins: the
+        // peer body takes the working name and the local append remains in the
+        // sidecar for explicit resolution.
+        expect(fs.readFileSync(boardPath, "utf-8")).toBe("mock file content");
+        expect(fs.readFileSync(sidecarIn(companyRoot), "utf-8")).toBe(localAppend);
+        expect(journalAt(journalPath).files["board.json"]).toMatchObject({
+            remoteEtag: "peer-etag",
+            direction: "down",
+        });
         expect(s3Module.uploadFile).toHaveBeenCalledWith(expect.anything(), boardPath, "board.json", undefined, { ifMatch: "old-etag" });
     });
     it("does NOT tombstone symlinks whose readlink target has diverged from the journal (Codex P1 round 4)", async () => {
@@ -2604,7 +2891,7 @@ describe("sync", () => {
         expect(result.conflicts).toBeGreaterThanOrEqual(1);
         expect(result.conflictPaths).toContain("docs/edited.md");
         expect(fs.existsSync(editedPath)).toBe(true);
-        expect(fs.readFileSync(editedPath, "utf-8")).toBe("my local edits");
+        expect(fs.readFileSync(sidecarIn(path.dirname(editedPath)), "utf-8")).toBe("my local edits");
         expect(result.filesTombstoned).toBe(0);
     });
     it("delete-resync: suppression is per-key and the fetch is company-scoped (no cross-tenant bleed)", async () => {