@indigoai-us/hq-cloud 6.16.64 → 6.16.66

package/dist/bin/sync-runner.test.js

@@ -10,6 +10,9 @@ import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
 import * as fs from "fs";
 import * as os from "os";
 import * as path from "path";
+import * as v8 from "node:v8";
+import * as vm from "node:vm";
+import { monitorEventLoopDelay } from "node:perf_hooks";
 import { runRunner, runRunnerWithLoop, resolveDeletePolicy, resolveSkipPersonal, resolveSkipCompanies, selectObjectIOFactory, routeChangeToTarget, buildTargetedPushArgv, resolvePullScope, readPinnedPrefixes, SESSIONS_SCOPE_PREFIX, defaultCollectTelemetry, AUTH_REQUIRED_PASS_EXIT, } from "./sync-runner.js";
 import { SESSION_LOGS_PUSH_ONLY_PREFIX } from "../sync/pull-scope.js";
 import { AUTH_WAIT_INITIAL_RECHECK_MS, AUTH_WAIT_RESUME_MESSAGE, AUTH_WAIT_START_MESSAGE, AUTH_WAIT_STEADY_RECHECK_MS, } from "./sync-runner-auth-wait.js";
@@ -17,17 +20,20 @@ import { PresignObjectIO, S3SdkObjectIO } from "../object-io.js";
 import { setBandwidthGovernorForTesting } from "../bandwidth.js";
 import { POST_SYNC_FLAG_KEYS, } from "./sync-runner-post-sync-flags.js";
 import { FakeClock, TreeWatcher, } from "../watcher.js";
-import { adaptivePollMs, advanceMonotonicDeadline, DEFAULT_EVENT_BATCH_LIMIT, DEFAULT_FAST_LANE_MAX_BYTES, DEFAULT_FAST_LANE_MAX_FILE_BYTES, DEFAULT_FAST_LANE_MAX_FILES, DEFAULT_FULL_RECONCILE_MS, EVENT_BATCH_LIMIT_ENV, FAST_LANE_MAX_BYTES_ENV, FAST_LANE_MAX_FILES_ENV, FULL_RECONCILE_MS_ENV, isFastLocalBatch, isFastReceiverBatch, partitionLocalBatch, journalEntriesForWatcherDelete, resolveEventBatchLimit, resolveFullReconcileMs, resolveWatchPollMs, normalizeCoordinatorPaths, shouldQuarantineWatcherDeleteIntents, shouldUseAreaStorage, WATCHER_REDISCOVERY_RETRY_MS, WATCHER_REDISCOVERY_RETRY_MAX_MS, } from "./sync-runner-watch-loop.js";
-import { AreaLedgerMigration, JournalStore, openJournalStateStoreForMigration, PERSONAL_VAULT_JOURNAL_SLUG, readJournal, writeJournal, } from "../journal.js";
+import { adaptivePollMs, advanceMonotonicDeadline, DEFAULT_EVENT_BATCH_LIMIT, DEFAULT_FAST_LANE_MAX_BYTES, DEFAULT_FAST_LANE_MAX_FILE_BYTES, DEFAULT_FAST_LANE_MAX_FILES, DEFAULT_FULL_RECONCILE_MS, EVENT_BATCH_LIMIT_ENV, FAST_LANE_MAX_BYTES_ENV, FAST_LANE_MAX_FILES_ENV, FULL_RECONCILE_MS_ENV, isFastLocalBatch, isFastReceiverBatch, partitionLocalBatch, journalEntriesForWatcherDelete, resolveEventBatchLimit, resolveFullReconcileMs, resolveWatchPollMs, CHORE_STARVATION_CAP_MS, CooperativePassScheduler, normalizeCoordinatorPaths, shouldQuarantineWatcherDeleteIntents, shouldUseAreaStorage, WATCHER_REDISCOVERY_RETRY_MS, WATCHER_REDISCOVERY_RETRY_MAX_MS, } from "./sync-runner-watch-loop.js";
+import { AreaLedgerMigration, JournalStore, openJournalStateStoreForMigration, PERSONAL_VAULT_JOURNAL_SLUG, readJournal, readJournalScoped, writeJournal, } from "../journal.js";
+import { AreaLedger } from "../sync/area-ledger.js";
 import { AreaResolver } from "../sync/area-resolver.js";
+import { AREA_LEGACY_MIRROR_LINGER_MS } from "../sync/area-ledger-migration.js";
 import { AreaMaintenanceCursorStore } from "../sync/per-area-maintenance.js";
 import { HQ_CLOUD_VERSION } from "../version.js";
 import { lockPathFor, OPERATION_LOCKED_EXIT } from "../operation-lock.js";
 import { TRANSIENT_NETWORK_EXIT } from "../lib/net-errors.js";
 import { getStateStoreSnapshotRecoveryCountForTest, resetStateStoreSnapshotRecoveryCountForTest, StateStoreLockError, } from "../sync/state-store.js";
-import { PARTIAL_SYNC_EXIT } from "../lib/exit-codes.js";
+import { PARTIAL_SYNC_EXIT, UNRESOLVED_COMPANY_EXIT, } from "../lib/exit-codes.js";
 import { isCoveredByAny } from "../prefix-coalesce.js";
 import { VaultAuthError, VaultNotFoundError } from "../vault-client.js";
+import { buildRoutePullArgv } from "./sync-runner-watch-routes.js";
 import { CognitoAuthError, CognitoRefreshError } from "../cognito-auth.js";
 import { reconcileCompanyManifest, } from "../manifest-reconcile.js";
 import yaml from "js-yaml";
@@ -166,6 +172,7 @@ function makeVaultStub(opts = {}) {
                     bucketName: `bucket-${uid}`,
                     status: "active",
                 })),
+            findInMyNamespace: opts.findInMyNamespace ?? (() => Promise.resolve(null)),
             listByType: opts.listPersons ??
                 (() => Promise.resolve([])),
         },
@@ -958,6 +965,164 @@ describe("target resolution", () => {
         const call = deps.sync.mock.calls[0][0];
         expect(call.company).toBe("cmp_abc");
     });
+    it("returns the unresolved-company exit for an empty single-company plan instead of emitting a clean all-complete", async () => {
+        const deps = makeDeps({
+            createVaultClient: () => makeVaultStub({
+                entityGet: () => Promise.resolve(undefined),
+            }),
+        });
+        expect(await runRunner(["--company", "cmp_missing"], deps)).toBe(UNRESOLVED_COMPANY_EXIT);
+        expect(deps.stderr.events()).toContainEqual({
+            type: "error",
+            company: "cmp_missing",
+            path: "(company-resolution)",
+            message: "company entity lookup returned no entity",
+        });
+        expect(deps.stdout.events().some((event) => event.type === "all-complete")).toBe(false);
+        expect(deps.sync).not.toHaveBeenCalled();
+    });
+    it("returns the unresolved-company exit when a cmp-prefixed route gets a 404", async () => {
+        const client = makeVaultStub({
+            entityGet: () => Promise.reject(new VaultNotFoundError("company deleted")),
+        });
+        const findInMyNamespace = vi.fn().mockResolvedValue(null);
+        client.entity.findInMyNamespace = findInMyNamespace;
+        const deps = makeDeps({
+            createVaultClient: () => client,
+        });
+        expect(await runRunner(["--company", "cmp_ghost"], deps)).toBe(UNRESOLVED_COMPANY_EXIT);
+        expect(findInMyNamespace).toHaveBeenCalledWith("company", "cmp_ghost");
+        expect(deps.stderr.events()).toContainEqual({
+            type: "error",
+            company: "cmp_ghost",
+            path: "(company-resolution)",
+            message: "company entity lookup returned 404",
+        });
+        expect(deps.stdout.events().some((event) => event.type === "all-complete")).toBe(false);
+    });
+    it("reports an intentional skipCompanies skip without treating it as a failed pass", async () => {
+        const previous = process.env.HQ_SYNC_SKIP_COMPANIES;
+        process.env.HQ_SYNC_SKIP_COMPANIES = "paused";
+        try {
+            const deps = makeDeps({
+                createVaultClient: () => makeVaultStub({
+                    entityGet: (uid) => Promise.resolve({
+                        uid,
+                        slug: "paused",
+                        type: "company",
+                        status: "active",
+                    }),
+                }),
+            });
+            expect(await runRunner(["--company", "cmp_paused"], deps)).toBe(0);
+            expect(deps.stdout.events()).toContainEqual({
+                type: "company-skipped",
+                company: "paused",
+                reason: "skip-companies",
+            });
+            expect(deps.stderr.events().some((event) => event.type === "error")).toBe(false);
+            expect(deps.stdout.events().some((event) => event.type === "all-complete")).toBe(false);
+            expect(deps.sync).not.toHaveBeenCalled();
+        }
+        finally {
+            if (previous === undefined)
+                delete process.env.HQ_SYNC_SKIP_COMPANIES;
+            else
+                process.env.HQ_SYNC_SKIP_COMPANIES = previous;
+        }
+    });
+    it("resolves a slug emitted by the company watch route to its namespace UID", async () => {
+        const company = {
+            uid: "cmp_indigo",
+            slug: "indigo",
+            type: "company",
+            status: "active",
+            bucketName: "bucket-cmp_indigo",
+        };
+        const client = makeVaultStub({
+            entityGet: (uid) => Promise.resolve(uid === company.uid ? company : undefined),
+        });
+        const findInMyNamespace = vi.fn().mockResolvedValue(company);
+        client.entity.findInMyNamespace = findInMyNamespace;
+        const deps = makeDeps({ createVaultClient: () => client });
+        const argv = buildRoutePullArgv({ kind: "company", slug: "indigo" }, ["--companies", "--watch", "--hq-root", "/tmp/hq"]);
+        expect(argv).toEqual([
+            "--company",
+            "indigo",
+            "--direction",
+            "pull",
+            "--hq-root",
+            "/tmp/hq",
+        ]);
+        expect(await runRunner(argv, deps)).toBe(0);
+        expect(findInMyNamespace).toHaveBeenCalledWith("company", "indigo");
+        expect(deps.sync).toHaveBeenCalledWith(expect.objectContaining({ company: "cmp_indigo" }));
+        expect(deps.stdout.events()).toContainEqual({
+            type: "fanout-plan",
+            companies: [
+                expect.objectContaining({ uid: "cmp_indigo", slug: "indigo" }),
+            ],
+        });
+    });
+    it("resolves a cmp-prefixed directory slug in the caller namespace before treating it as a UID", async () => {
+        const company = {
+            uid: "cmp_01JTEAM000000000000000000",
+            slug: "cmp_team",
+            type: "company",
+            status: "active",
+            bucketName: "bucket-cmp-team",
+        };
+        const get = vi.fn().mockImplementation((uid) => Promise.resolve(uid === company.uid ? company : undefined));
+        const client = makeVaultStub({ entityGet: get });
+        const findInMyNamespace = vi.fn().mockResolvedValue(company);
+        client.entity.findInMyNamespace = findInMyNamespace;
+        const deps = makeDeps({ createVaultClient: () => client });
+        const argv = buildRoutePullArgv({ kind: "company", slug: "cmp_team" }, ["--companies", "--watch", "--hq-root", "/tmp/hq"]);
+        expect(await runRunner(argv, deps)).toBe(0);
+        expect(findInMyNamespace).toHaveBeenCalledWith("company", "cmp_team");
+        expect(get).toHaveBeenCalledWith(company.uid);
+        expect(deps.sync).toHaveBeenCalledWith(expect.objectContaining({ company: company.uid }));
+        expect(deps.stdout.events()).toContainEqual({
+            type: "fanout-plan",
+            companies: [expect.objectContaining({ uid: company.uid, slug: "cmp_team" })],
+        });
+    });
+    it("falls back to a literal company UID after caller-namespace slug resolution misses", async () => {
+        const uid = "cmp_01JUID0000000000000000000";
+        const company = {
+            uid,
+            slug: "operator-company",
+            type: "company",
+            status: "active",
+            bucketName: "bucket-operator-company",
+        };
+        const get = vi.fn().mockResolvedValue(company);
+        const client = makeVaultStub({ entityGet: get });
+        const findInMyNamespace = vi.fn().mockResolvedValue(null);
+        client.entity.findInMyNamespace = findInMyNamespace;
+        const deps = makeDeps({ createVaultClient: () => client });
+        expect(await runRunner(["--company", uid], deps)).toBe(0);
+        expect(findInMyNamespace).toHaveBeenCalledWith("company", uid);
+        expect(get).toHaveBeenCalledWith(uid);
+        expect(deps.sync).toHaveBeenCalledWith(expect.objectContaining({ company: uid }));
+    });
+    it("reports a foreign company slug when the literal UID fallback finds nothing", async () => {
+        const get = vi.fn().mockRejectedValue(new VaultNotFoundError("company not found"));
+        const client = makeVaultStub({ entityGet: get });
+        const findInMyNamespace = vi.fn().mockResolvedValue(null);
+        client.entity.findInMyNamespace = findInMyNamespace;
+        const deps = makeDeps({ createVaultClient: () => client });
+        expect(await runRunner(["--company", "indigo"], deps)).toBe(UNRESOLVED_COMPANY_EXIT);
+        expect(findInMyNamespace).toHaveBeenCalledWith("company", "indigo");
+        expect(get).toHaveBeenCalledWith("indigo");
+        expect(deps.sync).not.toHaveBeenCalled();
+        expect(deps.stderr.events()).toContainEqual({
+            type: "error",
+            company: "indigo",
+            path: "(company-resolution)",
+            message: "company entity lookup returned 404",
+        });
+    });
 });
 // ---------------------------------------------------------------------------
 // --personal mode (personal-vault-only, skip company fanout)
@@ -1555,6 +1720,43 @@ describe("automatic journal maintenance", () => {
             },
         ]);
     });
+    it("signals watch readiness after journal preparation and before fanout", async () => {
+        const order = [];
+        let releaseFanout = () => { };
+        const fanout = new Promise((resolve) => { releaseFanout = resolve; });
+        const deps = makeDeps({
+            createVaultClient: () => makeVaultStub({
+                memberships: [{ companyUid: "cmp_indigo" }],
+                entityGet: (uid) => Promise.resolve({ uid, slug: "indigo" }),
+            }),
+            repairJournalStateIfNeeded: vi.fn((slug) => {
+                order.push(`repair:${slug}`);
+                return { status: "not-needed", slug };
+            }),
+            migratePersonalVaultJournal: vi.fn(() => {
+                order.push("seed:personal");
+            }),
+            onJournalsReady: () => {
+                order.push("journals-ready");
+            },
+            sync: vi.fn(async () => {
+                order.push("fanout");
+                await fanout;
+                return defaultSyncResult();
+            }),
+        });
+        const running = runRunner(["--companies", "--skip-personal"], deps);
+        await vi.waitFor(() => expect(order).toContain("fanout"));
+        expect(order).toEqual([
+            "repair:indigo",
+            "repair:personal",
+            "seed:personal",
+            "journals-ready",
+            "fanout",
+        ]);
+        releaseFanout();
+        await expect(running).resolves.toBe(0);
+    });
     it("continues the pass when one journal repair is transiently lock-contended", async () => {
         const repaired = [];
         const sync = vi.fn().mockResolvedValue(defaultSyncResult());
@@ -4178,6 +4380,17 @@ describe("routeChangeToTarget", () => {
         });
         expect(routeChangeToTarget("companies/acme/projects/x/prd.json")).toEqual({ kind: "company", slug: "acme" });
     });
+    it("keeps a company-root directory delete attributable without routing company-root files", () => {
+        // A whole-company removal has no child path, but it still owns every
+        // journal row below the slug and must reach the delete-intent guard.
+        expect(routeChangeToTarget("companies/indigo", "unlinkDir")).toEqual({
+            kind: "company",
+            slug: "indigo",
+        });
+        // A file directly under companies/ is shared metadata, never a tenant.
+        expect(routeChangeToTarget("companies/manifest.yaml", "change")).toBeNull();
+        expect(routeChangeToTarget("companies/.DS_Store", "add")).toBeNull();
+    });
     it("routes non-company top-levels to the personal target", () => {
         expect(routeChangeToTarget("personal/notes.md")).toEqual({
             kind: "personal",
@@ -4202,6 +4415,12 @@ describe("routeChangeToTarget", () => {
         // edit always lands at companies/<slug>/..., never at bare "companies".
         expect(routeChangeToTarget("companies")).toBeNull();
         expect(routeChangeToTarget("companies/")).toBeNull();
+        // The companies directory itself contains shared manifest and scaffold
+        // files. They do not belong to a company journal, so a direct child must
+        // never become a bogus `--company <filename>` pass.
+        expect(routeChangeToTarget("companies/manifest.yaml")).toBeNull();
+        expect(routeChangeToTarget("companies/.DS_Store")).toBeNull();
+        expect(routeChangeToTarget("companies/../personal/notes.md")).toBeNull();
     });
     it("does not route the company scaffold to cloud sync", () => {
         expect(routeChangeToTarget("companies/_template/knowledge/README.md")).toBeNull();
@@ -4283,6 +4502,26 @@ async function flushLoopMicrotasks(n = 8) {
     for (let i = 0; i < n; i++)
         await Promise.resolve();
 }
+/** Retained journal rows live in typed-array backing stores as well as heap. */
+function forceGarbageCollectionForTest() {
+    const existing = globalThis.gc;
+    if (typeof existing === "function") {
+        existing();
+        existing();
+        return;
+    }
+    v8.setFlagsFromString("--expose-gc");
+    const collect = vm.runInNewContext("gc");
+    v8.setFlagsFromString("--no-expose-gc");
+    if (typeof collect !== "function")
+        throw new Error("test could not expose GC");
+    collect();
+    collect();
+}
+function retainedProcessBytes() {
+    const usage = process.memoryUsage();
+    return usage.heapUsed + usage.external + usage.arrayBuffers;
+}
 function makeSteppableSleep() {
     const pending = [];
     return {
@@ -4295,8 +4534,19 @@ function makeSteppableSleep() {
                 throw new Error("poll sleep was not pending");
             resolve();
         },
+        pendingCount() {
+            return pending.length;
+        },
     };
 }
+async function waitForPollSleep(sleep) {
+    for (let attempt = 0; attempt < 200; attempt += 1) {
+        if (sleep.pendingCount() > 0)
+            return;
+        await new Promise((resolve) => setImmediate(resolve));
+    }
+    throw new Error("timed out waiting for a poll sleep");
+}
 // ---------------------------------------------------------------------------
 // Adaptive remote-poll backoff — whole-box CPU aware (no --poll-remote-ms)
 // ---------------------------------------------------------------------------
@@ -5285,6 +5535,52 @@ describe("runRunnerWithLoop — event-push wiring", () => {
             vi.useRealTimers();
         }
     });
+    it("wakes a full reconcile when coverage probe finds a vanished HQ root", async () => {
+        vi.useFakeTimers();
+        const watcher = makeWatcherStub();
+        watcher.isWatching = () => true;
+        watcher.watchedPathCount = () => 121;
+        watcher.watchMode = () => "native";
+        watcher.probeCoverage = () => ({
+            ok: false,
+            reason: "root-missing",
+            staleWatches: 121,
+        });
+        const rebuild = vi.fn();
+        watcher.rebuildCoverage = rebuild;
+        const stderrWrite = vi
+            .spyOn(process.stderr, "write")
+            .mockImplementation(() => true);
+        const runPass = vi.fn().mockResolvedValue(completedPassOutcome());
+        let triggerShutdown = () => { };
+        const loop = runRunnerWithLoop(["--companies", "--watch", "--event-push", "--hq-root", "/tmp/hq"], {
+            runPass,
+            createWatcher: () => watcher,
+            sleep: () => new Promise(() => { }),
+            onShutdownSignal: (handler) => {
+                triggerShutdown = handler;
+                return () => { };
+            },
+        });
+        try {
+            await flushLoopMicrotasks();
+            runPass.mockClear();
+            await vi.advanceTimersByTimeAsync(30_000);
+            await flushLoopMicrotasks();
+            const stderr = stderrWrite.mock.calls.map(([chunk]) => String(chunk)).join("");
+            expect(stderr).toContain("event-push watcher coverage stale");
+            expect(stderr).toContain("reason=root-missing");
+            expect(stderr).toContain("not pushing deletes");
+            expect(rebuild).toHaveBeenCalled();
+            expect(runPass).toHaveBeenCalled();
+        }
+        finally {
+            triggerShutdown();
+            await loop;
+            stderrWrite.mockRestore();
+            vi.useRealTimers();
+        }
+    });
     it("does not dispose a populated watcher after liveness reports inactive", async () => {
         vi.useFakeTimers();
         const watcher = makeWatcherStub();
@@ -5388,6 +5684,83 @@ describe("runRunnerWithLoop — event-push wiring", () => {
         triggerShutdown();
         await loop;
     });
+    it.each([
+        ["serialized", "0"],
+        ["parallel coordinator", "1"],
+    ])("starts event ingress once after journals are ready while the first %s full pass is unfinished", async (_mode, coordinator) => {
+        const previousCoordinator = process.env.HQ_SYNC_PARALLEL_COORDINATOR;
+        process.env.HQ_SYNC_PARALLEL_COORDINATOR = coordinator;
+        const watcher = makeWatcherStub();
+        const createWatcher = vi.fn(() => watcher);
+        let releaseFullPass = () => { };
+        const fullPass = new Promise((resolve) => {
+            releaseFullPass = resolve;
+        });
+        let activeDurableWriters = 0;
+        let maxDurableWriters = 0;
+        const runPass = vi.fn(async (...args) => {
+            const journalsReady = args[2];
+            activeDurableWriters += 1;
+            maxDurableWriters = Math.max(maxDurableWriters, activeDurableWriters);
+            journalsReady?.();
+            await fullPass;
+            activeDurableWriters -= 1;
+            return completedPassOutcome();
+        });
+        let shutdown = () => { };
+        const loop = runRunnerWithLoop(["--companies", "--watch", "--event-push", "--hq-root", "/tmp/hq"], {
+            runPass: runPass,
+            runPassSupportsCooperativeCheckpoint: true,
+            createWatcher,
+            sleep: () => new Promise(() => { }),
+            onShutdownSignal: (handler) => {
+                shutdown = handler;
+                return () => { };
+            },
+        });
+        try {
+            await flushLoopMicrotasks(30);
+            expect(runPass).toHaveBeenCalledOnce();
+            expect(createWatcher).toHaveBeenCalledOnce();
+            expect(watcher.started).toBe(true);
+            expect(maxDurableWriters).toBe(1);
+            await flushLoopMicrotasks();
+            expect(runPass).toHaveBeenCalledOnce();
+        }
+        finally {
+            releaseFullPass();
+            shutdown();
+            await loop;
+            if (previousCoordinator === undefined)
+                delete process.env.HQ_SYNC_PARALLEL_COORDINATOR;
+            else
+                process.env.HQ_SYNC_PARALLEL_COORDINATOR = previousCoordinator;
+        }
+    });
+    it.each([
+        ["auth-required", AUTH_REQUIRED_PASS_EXIT],
+        ["journal initialization failure", 1],
+    ])("does not arm event ingress when the first pass exits %s before journal readiness", async (_reason, exitCode) => {
+        const watcher = makeWatcherStub();
+        let shutdown = () => { };
+        const loop = runRunnerWithLoop(["--companies", "--watch", "--event-push", "--hq-root", "/tmp/hq"], {
+            runPass: vi.fn().mockResolvedValue(exitCode),
+            createWatcher: () => watcher,
+            sleep: () => new Promise(() => { }),
+            onShutdownSignal: (handler) => {
+                shutdown = handler;
+                return () => { };
+            },
+        });
+        try {
+            await flushLoopMicrotasks(30);
+            expect(watcher.started).toBe(false);
+        }
+        finally {
+            shutdown();
+            await expect(loop).resolves.toBe(0);
+        }
+    });
     it("pushes a file created before watcher ready through the warm-up catch-up", async () => {
         const watcher = makeBatchWatcherStub();
         let markReady = () => { };
@@ -5706,7 +6079,7 @@ describe("runRunnerWithLoop — event-push wiring", () => {
             });
             await expect(superseded).resolves.toBeUndefined();
             expect(runPass.mock.calls.filter(([argv]) => argv.includes("superseded.md"))).toHaveLength(0);
-            expect(stderr.mock.calls.map(([chunk]) => String(chunk)).join("")).toContain('"event":"sync.realtime.timing","schemaVersion":1,"source":"receiver","direction":"pull","outcome":"refused"');
+            expect(stderr.mock.calls.map(([chunk]) => String(chunk)).join("")).toContain('"event":"sync.realtime.timing","schemaVersion":2,"source":"receiver","direction":"pull","outcome":"refused"');
             releaseHeld();
             await heldReceiverWork;
             await replacement;
@@ -6019,7 +6392,7 @@ describe("runRunnerWithLoop — event-push wiring", () => {
         triggerShutdown();
         await loop;
     });
-    it("fast lane: a small watcher batch dispatches during a slow bulk pass", async () => {
+    it("fast lane: a small watcher batch waits for a full pass that has not reached a hand-off checkpoint", async () => {
         const hqRoot = fs.mkdtempSync(path.join(os.tmpdir(), "hq-fast-lane-watch-"));
         const relativePath = "companies/indigo/realtime.md";
         const absolutePath = path.join(hqRoot, relativePath);
@@ -6059,15 +6432,17 @@ describe("runRunnerWithLoop — event-push wiring", () => {
         expect(order).toEqual(["bulk"]);
         watcher.emit(relativePath, { paths: new Map([[absolutePath, relativePath]]) });
         await flushLoopMicrotasks(30);
-        // Regression: origin/main leaves this as ["bulk"] until releaseBulk().
-        expect(order).toEqual(["bulk", "fast", "fast"]);
+        // A full pass that has not reached its durable checkpoint remains the sole
+        // owner. Realtime is promoted at the checkpoint, never run concurrently.
+        expect(order).toEqual(["bulk"]);
         releaseBulk();
-        await flushLoopMicrotasks();
+        await flushLoopMicrotasks(30);
+        expect(order).toEqual(["bulk", "fast", "fast"]);
         triggerShutdown();
         await loop;
         fs.rmSync(hqRoot, { recursive: true, force: true });
     });
-    it("parallel coordinator: a watcher push starts while a full chore is blocked", async () => {
+    it("parallel coordinator: a watcher push waits for a full chore without a hand-off checkpoint", async () => {
         const previous = process.env.HQ_SYNC_PARALLEL_COORDINATOR;
         process.env.HQ_SYNC_PARALLEL_COORDINATOR = "1";
         const hqRoot = fs.mkdtempSync(path.join(os.tmpdir(), "hq-parallel-watch-"));
@@ -6110,9 +6485,10 @@ describe("runRunnerWithLoop — event-push wiring", () => {
             expect(order).toEqual(["chore"]);
             watcher.emit(relativePath, { paths: new Map([[absolutePath, relativePath]]) });
             await flushLoopMicrotasks(30);
-            expect(order).toEqual(["chore", "realtime"]);
+            expect(order).toEqual(["chore"]);
             releaseBulk();
-            await flushLoopMicrotasks();
+            await flushLoopMicrotasks(30);
+            expect(order).toEqual(["chore", "realtime"]);
             triggerShutdown();
             await loop;
         }
@@ -6197,7 +6573,7 @@ describe("runRunnerWithLoop — event-push wiring", () => {
             fs.rmSync(hqRoot, { recursive: true, force: true });
         }
     });
-    it("parallel coordinator partitions receiver events into fast and slow realtime lanes", async () => {
+    it("parallel coordinator partitions receiver events into fast and slow realtime lanes without overlapping their durable writes", async () => {
         const previous = process.env.HQ_SYNC_PARALLEL_COORDINATOR;
         process.env.HQ_SYNC_PARALLEL_COORDINATOR = "1";
         const hqRoot = fs.mkdtempSync(path.join(os.tmpdir(), "hq-parallel-receiver-lanes-"));
@@ -6268,7 +6644,7 @@ describe("runRunnerWithLoop — event-push wiring", () => {
                 signal: new AbortController().signal,
             });
             await flushLoopMicrotasks(20);
-            expect(order).toEqual(["slow-held", "fast-small"]);
+            expect(order).toEqual(["slow-held"]);
             releaseSlow();
             await held;
             await partitioned;
@@ -6434,64 +6810,562 @@ describe("runRunnerWithLoop — event-push wiring", () => {
             fs.rmSync(hqRoot, { recursive: true, force: true });
         }
     });
-    it("fast lane: prefers declared receiver sizes and falls back to the journal", async () => {
-        const previous = process.env.HQ_SYNC_PARALLEL_COORDINATOR;
+    it("bounds a 32-path realtime personal commit on a 700k-row journal and 50k-path tree", async () => {
+        const previousCoordinator = process.env.HQ_SYNC_PARALLEL_COORDINATOR;
         process.env.HQ_SYNC_PARALLEL_COORDINATOR = "1";
-        const hqRoot = fs.mkdtempSync(path.join(os.tmpdir(), "hq-receiver-declared-size-"));
+        const hqRoot = fs.mkdtempSync(path.join(os.tmpdir(), "hq-production-scale-watch-"));
+        const watchedRoot = path.join(hqRoot, "personal", "watch-load");
+        const targetPaths = Array.from({ length: 32 }, (_, index) => `personal/watch-load/${String(index).padStart(5, "0")}/target.md`);
+        const files = {};
+        for (let index = 0; index < 700_000; index += 1) {
+            files[`personal/history/${String(index % 50_000).padStart(5, "0")}/entry-${index}.md`] = {
+                hash: `sha256:history-${index}`,
+                size: index % 4096,
+                syncedAt: "2026-09-16T21:30:00.000Z",
+                direction: "up",
+            };
+        }
+        for (const target of targetPaths) {
+            files[target] = {
+                hash: `sha256:${target}`,
+                size: 1,
+                syncedAt: "2026-09-16T21:30:00.000Z",
+                direction: "up",
+            };
+        }
+        writeJournal(PERSONAL_VAULT_JOURNAL_SLUG, {
+            version: "2",
+            lastSync: "2026-09-16T21:30:00.000Z",
+            pulls: [],
+            files,
+        });
+        for (let index = 0; index < 50_000; index += 1) {
+            const directory = path.join(watchedRoot, String(index).padStart(5, "0"));
+            fs.mkdirSync(directory, { recursive: true });
+            fs.writeFileSync(path.join(directory, "seed.md"), "seed");
+        }
         const watcher = makeBatchWatcherStub();
-        let receiverSync;
-        let triggerShutdown = () => { };
-        const event = (relativePath, sizeBytes) => ({
-            kind: "upsert",
-            relativePath,
-            contentHash: "sha256:remote",
-            mtime: "2026-08-28T00:00:00.000Z",
-            ...(sizeBytes === undefined ? {} : { sizeBytes }),
-            originDeviceId: "peer-device",
-            originTenantId: "tenant-indigo",
-            sequenceNumber: 1,
-            eventTimestamp: "2026-08-28T00:00:00.000Z",
+        let shutdown = () => { };
+        let committedAt;
+        const runPass = vi.fn(async (argv) => {
+            if (!argv.includes("--scope-path")) {
+                // Production opens the packed journal during the initial full pass,
+                // before the watcher accepts realtime work. That recovered projection
+                // is the one a scoped commit must reuse.
+                readJournal(PERSONAL_VAULT_JOURNAL_SLUG);
+            }
+            if (argv.includes("--scope-path") && argv.includes("push")) {
+                const scoped = readJournalScoped(PERSONAL_VAULT_JOURNAL_SLUG, targetPaths);
+                const target = targetPaths[0];
+                scoped.files[target] = {
+                    ...scoped.files[target],
+                    syncedAt: "2026-09-16T21:38:18.000Z",
+                };
+                writeJournal(PERSONAL_VAULT_JOURNAL_SLUG, scoped);
+                committedAt = performance.now();
+            }
+            return completedPassOutcome();
         });
-        const journal = readJournal("indigo");
-        journal.files["journal-small.md"] = {
-            hash: "sha256:journal-small",
-            size: 16,
-            syncedAt: "2026-08-28T00:00:00.000Z",
-            direction: "down",
-        };
-        writeJournal("indigo", journal);
-        const loop = runRunnerWithLoop(["--companies", "--watch", "--event-push", "--direction", "pull", "--hq-root", hqRoot], {
-            runPass: vi.fn(async () => completedPassOutcome()),
+        const loop = runRunnerWithLoop(["--companies", "--watch", "--event-push", "--direction", "push", "--hq-root", hqRoot], {
+            runPass,
             createWatcher: () => watcher,
-            createReceiver: ({ syncBatchFn }) => {
-                receiverSync = syncBatchFn;
-                return { connected: true, start: async () => { }, dispose: async () => { } };
-            },
             sleep: () => new Promise(() => { }),
             onShutdownSignal: (handler) => {
-                triggerShutdown = handler;
+                shutdown = handler;
                 return () => { };
             },
         });
         try {
             await flushLoopMicrotasks(30);
-            const batches = receiverSync.partition([
-                event("companies/indigo/declared-small.md", 16),
-                event("companies/indigo/declared-large.md", DEFAULT_FAST_LANE_MAX_FILE_BYTES + 1),
-                event("companies/indigo/journal-small.md"),
-                event("companies/indigo/unknown.md"),
-            ]);
-            expect(batches.map((batch) => batch.map((event) => event.relativePath))).toEqual([
-                [
-                    "companies/indigo/declared-small.md",
-                    "companies/indigo/journal-small.md",
-                ],
-                [
-                    "companies/indigo/declared-large.md",
-                    "companies/indigo/unknown.md",
-                ],
-            ]);
-        }
+            runPass.mockClear();
+            resetStateStoreSnapshotRecoveryCountForTest();
+            const eventLoopDelay = monitorEventLoopDelay({ resolution: 10 });
+            eventLoopDelay.enable();
+            await new Promise((resolve) => setTimeout(resolve, 0));
+            const submittedAt = performance.now();
+            let timerDelayMs;
+            const eventLoopTurn = new Promise((resolve) => {
+                setTimeout(() => {
+                    timerDelayMs = performance.now() - submittedAt;
+                    resolve();
+                }, 0);
+            });
+            const batch = {
+                paths: new Map(targetPaths.map((relativePath) => [path.join(hqRoot, relativePath), relativePath])),
+                changes: new Map(targetPaths.map((relativePath) => [
+                    path.join(hqRoot, relativePath),
+                    { kind: "change" },
+                ])),
+            };
+            watcher.emit(targetPaths[0], batch);
+            await vi.waitFor(() => expect(committedAt).toBeDefined(), { timeout: 30_000, interval: 10 });
+            await eventLoopTurn;
+            eventLoopDelay.disable();
+            expect(committedAt - submittedAt).toBeLessThan(1_000);
+            expect(Number(eventLoopDelay.max) / 1_000_000).toBeLessThan(100);
+            expect(timerDelayMs).toBeLessThan(100);
+            expect(getStateStoreSnapshotRecoveryCountForTest()).toBe(0);
+            expect(runPass.mock.calls.filter(([argv]) => argv.includes("--scope-path"))).toHaveLength(1);
+        }
+        finally {
+            shutdown();
+            await loop;
+            if (previousCoordinator === undefined)
+                delete process.env.HQ_SYNC_PARALLEL_COORDINATOR;
+            else
+                process.env.HQ_SYNC_PARALLEL_COORDINATOR = previousCoordinator;
+            fs.rmSync(hqRoot, { recursive: true, force: true });
+        }
+    }, 180_000);
+    it("keeps an area-authoritative 700k-row personal aggregate hot across alternating realtime and company batches", async () => {
+        const previousCoordinator = process.env.HQ_SYNC_PARALLEL_COORDINATOR;
+        process.env.HQ_SYNC_PARALLEL_COORDINATOR = "1";
+        const hqRoot = fs.mkdtempSync(path.join(os.tmpdir(), "hq-multi-journal-watch-"));
+        const watchedRoot = path.join(hqRoot, "personal", "watch-load");
+        const personalPath = "personal/watch-load/00000/target.md";
+        const companyPath = "companies/indigo/watch-load/00000/target.md";
+        const companyKey = "watch-load/00000/target.md";
+        const personalFiles = {};
+        for (let index = 0; index < 700_000; index += 1) {
+            personalFiles[`personal/history-${index % 5}/${String(index % 50_000).padStart(5, "0")}/entry-${index}.md`] = {
+                hash: `sha256:history-${index}`,
+                size: index % 4096,
+                syncedAt: "2026-09-16T21:30:00.000Z",
+                direction: "up",
+            };
+        }
+        personalFiles[personalPath] = {
+            hash: "sha256:personal-target",
+            size: 1,
+            syncedAt: "2026-09-16T21:30:00.000Z",
+            direction: "up",
+        };
+        const resolver = new AreaResolver({
+            format: 1,
+            routerVersion: 1,
+            areas: [
+                ...Array.from({ length: 5 }, (_, index) => ({
+                    id: `root:history-${index}`,
+                    prefixes: [`personal/history-${index}`],
+                    paths: [],
+                })),
+                { id: "root:watch", prefixes: ["personal/watch-load"], paths: [] },
+                { id: "root:@files", prefixes: [], paths: [], rootFiles: true },
+            ],
+        });
+        writeJournal(PERSONAL_VAULT_JOURNAL_SLUG, {
+            version: "2",
+            lastSync: "2026-09-16T21:30:00.000Z",
+            pulls: [],
+            files: {},
+        });
+        writeJournal("indigo", {
+            version: "2",
+            lastSync: "2026-09-16T21:30:00.000Z",
+            pulls: [],
+            files: {
+                [companyKey]: {
+                    hash: "sha256:company-target",
+                    size: 1,
+                    syncedAt: "2026-09-16T21:30:00.000Z",
+                    direction: "up",
+                },
+            },
+        });
+        const migration = new AreaLedgerMigration({
+            rootDir: __runnerTestStateDir,
+            journalSlug: PERSONAL_VAULT_JOURNAL_SLUG,
+            resolver,
+            legacyStore: openJournalStateStoreForMigration(PERSONAL_VAULT_JOURNAL_SLUG),
+        });
+        expect(migration.cutOver(120_000).phase).toBe("area-authoritative");
+        migration.dispose();
+        // The migration state itself is covered by the area-ledger migration
+        // suite. Seed the already-authoritative production shape in one durable
+        // transaction so this watch-loop test measures repeated realtime reads,
+        // rather than spending most of its worker budget replaying a one-time
+        // legacy-to-area copy.
+        openJournalStateStoreForMigration(PERSONAL_VAULT_JOURNAL_SLUG).replaceState({
+            journal: {
+                version: "2",
+                lastSync: "2026-09-16T21:30:00.000Z",
+                pulls: [],
+                files: personalFiles,
+            },
+        });
+        AreaLedger.open({
+            rootDir: __runnerTestStateDir,
+            journalSlug: PERSONAL_VAULT_JOURNAL_SLUG,
+            layoutEpoch: 1,
+            areaIds: resolver.layout.areas.map((area) => area.id),
+            resolveArea: (key) => resolver.resolve(key),
+        }).append({
+            upserts: personalFiles,
+            metadata: { lastSync: "2026-09-16T21:30:00.000Z", pulls: [] },
+        });
+        fs.mkdirSync(watchedRoot, { recursive: true });
+        for (let index = 0; index < 50_000; index += 1) {
+            fs.writeFileSync(path.join(watchedRoot, `seed-${String(index).padStart(5, "0")}.md`), "seed");
+        }
+        fs.mkdirSync(path.dirname(path.join(hqRoot, personalPath)), { recursive: true });
+        fs.writeFileSync(path.join(hqRoot, personalPath), "personal");
+        fs.mkdirSync(path.dirname(path.join(hqRoot, companyPath)), { recursive: true });
+        fs.writeFileSync(path.join(hqRoot, companyPath), "company");
+        const watcher = makeBatchWatcherStub();
+        const sleep = makeSteppableSleep();
+        let shutdown = () => { };
+        let isUntrackedDelete = (_relativePath) => false;
+        const commits = [];
+        let submittedAt = 0;
+        const aggregatePrime = vi.spyOn(AreaLedger.prototype, "primeAggregateCache");
+        const runPass = vi.fn(async (argv) => {
+            if (!argv.includes("--scope-path")) {
+                readJournal(PERSONAL_VAULT_JOURNAL_SLUG);
+                readJournal("indigo");
+            }
+            if (argv.includes("--scope-path") && argv.includes("push")) {
+                const slug = argv.includes("--company") ? "indigo" : PERSONAL_VAULT_JOURNAL_SLUG;
+                const key = slug === "indigo" ? companyKey : personalPath;
+                const scoped = readJournalScoped(slug, [key]);
+                scoped.files[key] = {
+                    ...scoped.files[key],
+                    syncedAt: "2026-09-16T21:38:18.000Z",
+                };
+                writeJournal(slug, scoped);
+                commits.push({ slug, elapsedMs: performance.now() - submittedAt });
+            }
+            return completedPassOutcome();
+        });
+        const loop = runRunnerWithLoop(["--companies", "--watch", "--event-push", "--direction", "push", "--hq-root", hqRoot], {
+            runPass,
+            createWatcher: (options) => {
+                isUntrackedDelete = options.isUntrackedDelete;
+                return watcher;
+            },
+            startEventSync: vi.fn().mockResolvedValue(null),
+            sleep: sleep.sleep,
+            onShutdownSignal: (handler) => {
+                shutdown = handler;
+                return () => { };
+            },
+        });
+        const emitAndWait = async (relativePaths) => {
+            const before = commits.length;
+            if (relativePaths.includes(personalPath)) {
+                // This is the same non-blocking watcher callback which starts an
+                // openJournalStoreSessionAsync before a delete episode is drained.
+                // It is intentionally issued before each realtime batch: a completed
+                // watch pass must not have thrown away the warmed area aggregate.
+                expect(isUntrackedDelete(personalPath)).toBe(false);
+                await new Promise((resolve) => setImmediate(resolve));
+            }
+            submittedAt = performance.now();
+            const batch = {
+                paths: new Map(relativePaths.map((relativePath) => [path.join(hqRoot, relativePath), relativePath])),
+                changes: new Map(relativePaths.map((relativePath) => [
+                    path.join(hqRoot, relativePath),
+                    { kind: "change" },
+                ])),
+            };
+            watcher.emit(relativePaths[0], batch);
+            await vi.waitFor(() => expect(commits.length).toBe(before + relativePaths.length), {
+                timeout: 30_000,
+                interval: 10,
+            });
+            // `commits` is observed inside the injected pass, before the runner has
+            // completed its pass-final cleanup. Let that cleanup run before the next
+            // watcher episode so the assertion observes the cache lifetime at the
+            // same boundary as a real completed watch pass.
+            await flushLoopMicrotasks(30);
+        };
+        try {
+            await flushLoopMicrotasks(30);
+            runPass.mockClear();
+            // The initial runner pass is the one permitted cold open. Every later
+            // scoped batch must reuse that authoritative aggregate. Warm the same
+            // yielding watcher-session path that production uses before its first
+            // delete episode, then measure only post-warmup primes.
+            aggregatePrime.mockClear();
+            expect(isUntrackedDelete(personalPath)).toBe(false);
+            await new Promise((resolve) => setImmediate(resolve));
+            // The initial full pass may already have opened this bridge (zero new
+            // primes), or this watcher callback may perform the one permitted cold
+            // warm-up. The post-poll assertion below is the regression boundary.
+            expect(aggregatePrime.mock.calls.length).toBeLessThanOrEqual(1);
+            aggregatePrime.mockClear();
+            // Reproduce the normal poll boundary observed on the outposts. On the
+            // current implementation it drops every cached area bridge even though
+            // the watcher and runner remain alive.
+            sleep.tick();
+            await flushLoopMicrotasks(30);
+            forceGarbageCollectionForTest();
+            const retainedAfterWarmupBytes = retainedProcessBytes();
+            const postWarmCpuStart = process.cpuUsage();
+            const postWarmStartedAt = performance.now();
+            resetStateStoreSnapshotRecoveryCountForTest();
+            const eventLoopDelay = monitorEventLoopDelay({ resolution: 10 });
+            eventLoopDelay.enable();
+            await emitAndWait([personalPath, companyPath]);
+            for (let round = 0; round < 3; round += 1) {
+                await emitAndWait([personalPath]);
+                await emitAndWait([companyPath]);
+            }
+            eventLoopDelay.disable();
+            const recoveryCount = getStateStoreSnapshotRecoveryCountForTest();
+            const maxDelayMs = Number(eventLoopDelay.max) / 1_000_000;
+            const maxCommitMs = Math.max(...commits.map((commit) => commit.elapsedMs));
+            // A first area delta briefly retains the reverse-shadow mirror to
+            // amortize a burst. Retained memory means after that documented linger
+            // has released its second full-vault projection, not during it.
+            await new Promise((resolve) => setTimeout(resolve, AREA_LEGACY_MIRROR_LINGER_MS + 25));
+            forceGarbageCollectionForTest();
+            const retainedAfterChurnBytes = retainedProcessBytes();
+            const retainedGrowthBytes = retainedAfterChurnBytes - retainedAfterWarmupBytes;
+            const postWarmCpu = process.cpuUsage(postWarmCpuStart);
+            const postWarmCpuPercent = ((postWarmCpu.user + postWarmCpu.system) /
+                ((performance.now() - postWarmStartedAt) * 1_000)) * 100;
+            console.info({
+                aggregatePrimeCount: aggregatePrime.mock.calls.length,
+                recoveryCount,
+                maxDelayMs,
+                maxCommitMs,
+                postWarmCpuPercent,
+                retainedAfterWarmupBytes,
+                retainedAfterChurnBytes,
+                retainedGrowthBytes,
+                commits: commits.length,
+            });
+            expect(aggregatePrime).not.toHaveBeenCalled();
+            // The first area delta opens its reverse-shadow v3 mirror once; its
+            // linger keeps all later scoped commits off snapshot recovery. This is
+            // deliberately exact so a second cold bridge cannot hide as a cache hit.
+            expect.soft(recoveryCount).toBe(1);
+            // The production-shape run remains bounded under the coverage job's
+            // concurrent workers: CI measured 1,090.52 ms of timer delay and
+            // 1,087.79 ms to commit. 1.5 s retains a concrete latency ceiling while
+            // leaving headroom for that instrumentation, rather than making the
+            // assertion depend on a single host's scheduling jitter.
+            expect.soft(maxDelayMs).toBeLessThan(1_500);
+            expect.soft(maxCommitMs).toBeLessThan(1_500);
+            expect.soft(retainedGrowthBytes).toBeLessThan(32 * 1024 * 1024);
+            expect(commits.map((commit) => commit.slug)).toEqual([
+                PERSONAL_VAULT_JOURNAL_SLUG,
+                "indigo",
+                PERSONAL_VAULT_JOURNAL_SLUG,
+                "indigo",
+                PERSONAL_VAULT_JOURNAL_SLUG,
+                "indigo",
+                PERSONAL_VAULT_JOURNAL_SLUG,
+                "indigo",
+            ]);
+        }
+        finally {
+            aggregatePrime.mockRestore();
+            shutdown();
+            await loop;
+            if (previousCoordinator === undefined)
+                delete process.env.HQ_SYNC_PARALLEL_COORDINATOR;
+            else
+                process.env.HQ_SYNC_PARALLEL_COORDINATOR = previousCoordinator;
+            fs.rmSync(hqRoot, { recursive: true, force: true });
+        }
+    }, 180_000);
+    it("keeps warmed personal and company journals hot across alternating realtime batches", async () => {
+        const previousCoordinator = process.env.HQ_SYNC_PARALLEL_COORDINATOR;
+        process.env.HQ_SYNC_PARALLEL_COORDINATOR = "1";
+        const hqRoot = fs.mkdtempSync(path.join(os.tmpdir(), "hq-multi-journal-legacy-watch-"));
+        const watchedRoot = path.join(hqRoot, "personal", "watch-load");
+        const personalPath = "personal/watch-load/00000/target.md";
+        const companyPath = "companies/indigo/watch-load/00000/target.md";
+        const companyKey = "watch-load/00000/target.md";
+        const personalFiles = {};
+        for (let index = 0; index < 700_000; index += 1) {
+            personalFiles[`personal/history/${String(index % 50_000).padStart(5, "0")}/entry-${index}.md`] = {
+                hash: `sha256:history-${index}`,
+                size: index % 4096,
+                syncedAt: "2026-09-16T21:30:00.000Z",
+                direction: "up",
+            };
+        }
+        personalFiles[personalPath] = {
+            hash: "sha256:personal-target",
+            size: 1,
+            syncedAt: "2026-09-16T21:30:00.000Z",
+            direction: "up",
+        };
+        writeJournal(PERSONAL_VAULT_JOURNAL_SLUG, {
+            version: "2",
+            lastSync: "2026-09-16T21:30:00.000Z",
+            pulls: [],
+            files: personalFiles,
+        });
+        writeJournal("indigo", {
+            version: "2",
+            lastSync: "2026-09-16T21:30:00.000Z",
+            pulls: [],
+            files: {
+                [companyKey]: {
+                    hash: "sha256:company-target",
+                    size: 1,
+                    syncedAt: "2026-09-16T21:30:00.000Z",
+                    direction: "up",
+                },
+            },
+        });
+        for (let index = 0; index < 50_000; index += 1) {
+            const directory = path.join(watchedRoot, String(index).padStart(5, "0"));
+            fs.mkdirSync(directory, { recursive: true });
+            fs.writeFileSync(path.join(directory, "seed.md"), "seed");
+        }
+        fs.mkdirSync(path.dirname(path.join(hqRoot, personalPath)), { recursive: true });
+        fs.writeFileSync(path.join(hqRoot, personalPath), "personal");
+        fs.mkdirSync(path.dirname(path.join(hqRoot, companyPath)), { recursive: true });
+        fs.writeFileSync(path.join(hqRoot, companyPath), "company");
+        const watcher = makeBatchWatcherStub();
+        let shutdown = () => { };
+        const commits = [];
+        let submittedAt = 0;
+        const runPass = vi.fn(async (argv) => {
+            if (!argv.includes("--scope-path")) {
+                readJournal(PERSONAL_VAULT_JOURNAL_SLUG);
+                readJournal("indigo");
+            }
+            if (argv.includes("--scope-path") && argv.includes("push")) {
+                const slug = argv.includes("--company") ? "indigo" : PERSONAL_VAULT_JOURNAL_SLUG;
+                const key = slug === "indigo" ? companyKey : personalPath;
+                const scoped = readJournalScoped(slug, [key]);
+                scoped.files[key] = {
+                    ...scoped.files[key],
+                    syncedAt: "2026-09-16T21:38:18.000Z",
+                };
+                writeJournal(slug, scoped);
+                commits.push({ slug, elapsedMs: performance.now() - submittedAt });
+            }
+            return completedPassOutcome();
+        });
+        const loop = runRunnerWithLoop(["--companies", "--watch", "--event-push", "--direction", "push", "--hq-root", hqRoot], {
+            runPass,
+            createWatcher: () => watcher,
+            sleep: () => new Promise(() => { }),
+            onShutdownSignal: (handler) => {
+                shutdown = handler;
+                return () => { };
+            },
+        });
+        const emitAndWait = async (relativePaths) => {
+            const before = commits.length;
+            submittedAt = performance.now();
+            const batch = {
+                paths: new Map(relativePaths.map((relativePath) => [path.join(hqRoot, relativePath), relativePath])),
+                changes: new Map(relativePaths.map((relativePath) => [
+                    path.join(hqRoot, relativePath),
+                    { kind: "change" },
+                ])),
+            };
+            watcher.emit(relativePaths[0], batch);
+            await vi.waitFor(() => expect(commits.length).toBe(before + relativePaths.length), {
+                timeout: 30_000,
+                interval: 10,
+            });
+        };
+        try {
+            await flushLoopMicrotasks(30);
+            runPass.mockClear();
+            resetStateStoreSnapshotRecoveryCountForTest();
+            const eventLoopDelay = monitorEventLoopDelay({ resolution: 10 });
+            eventLoopDelay.enable();
+            await emitAndWait([personalPath, companyPath]);
+            for (let round = 0; round < 3; round += 1) {
+                await emitAndWait([personalPath]);
+                await emitAndWait([companyPath]);
+            }
+            eventLoopDelay.disable();
+            const recoveryCount = getStateStoreSnapshotRecoveryCountForTest();
+            const maxDelayMs = Number(eventLoopDelay.max) / 1_000_000;
+            const maxCommitMs = Math.max(...commits.map((commit) => commit.elapsedMs));
+            console.info({ recoveryCount, maxDelayMs, maxCommitMs, commits: commits.length });
+            expect.soft(recoveryCount).toBe(0);
+            expect.soft(maxDelayMs).toBeLessThan(100);
+            expect.soft(maxCommitMs).toBeLessThan(1_000);
+            expect(commits.map((commit) => commit.slug)).toEqual([
+                PERSONAL_VAULT_JOURNAL_SLUG,
+                "indigo",
+                PERSONAL_VAULT_JOURNAL_SLUG,
+                "indigo",
+                PERSONAL_VAULT_JOURNAL_SLUG,
+                "indigo",
+                PERSONAL_VAULT_JOURNAL_SLUG,
+                "indigo",
+            ]);
+        }
+        finally {
+            shutdown();
+            await loop;
+            if (previousCoordinator === undefined)
+                delete process.env.HQ_SYNC_PARALLEL_COORDINATOR;
+            else
+                process.env.HQ_SYNC_PARALLEL_COORDINATOR = previousCoordinator;
+            fs.rmSync(hqRoot, { recursive: true, force: true });
+        }
+    }, 180_000);
+    it("fast lane: prefers declared receiver sizes and falls back to the journal", async () => {
+        const previous = process.env.HQ_SYNC_PARALLEL_COORDINATOR;
+        process.env.HQ_SYNC_PARALLEL_COORDINATOR = "1";
+        const hqRoot = fs.mkdtempSync(path.join(os.tmpdir(), "hq-receiver-declared-size-"));
+        const watcher = makeBatchWatcherStub();
+        let receiverSync;
+        let triggerShutdown = () => { };
+        const event = (relativePath, sizeBytes) => ({
+            kind: "upsert",
+            relativePath,
+            contentHash: "sha256:remote",
+            mtime: "2026-08-28T00:00:00.000Z",
+            ...(sizeBytes === undefined ? {} : { sizeBytes }),
+            originDeviceId: "peer-device",
+            originTenantId: "tenant-indigo",
+            sequenceNumber: 1,
+            eventTimestamp: "2026-08-28T00:00:00.000Z",
+        });
+        const journal = readJournal("indigo");
+        journal.files["journal-small.md"] = {
+            hash: "sha256:journal-small",
+            size: 16,
+            syncedAt: "2026-08-28T00:00:00.000Z",
+            direction: "down",
+        };
+        writeJournal("indigo", journal);
+        const loop = runRunnerWithLoop(["--companies", "--watch", "--event-push", "--direction", "pull", "--hq-root", hqRoot], {
+            runPass: vi.fn(async () => completedPassOutcome()),
+            createWatcher: () => watcher,
+            createReceiver: ({ syncBatchFn }) => {
+                receiverSync = syncBatchFn;
+                return { connected: true, start: async () => { }, dispose: async () => { } };
+            },
+            sleep: () => new Promise(() => { }),
+            onShutdownSignal: (handler) => {
+                triggerShutdown = handler;
+                return () => { };
+            },
+        });
+        try {
+            await flushLoopMicrotasks(30);
+            const batches = receiverSync.partition([
+                event("companies/indigo/declared-small.md", 16),
+                event("companies/indigo/declared-large.md", DEFAULT_FAST_LANE_MAX_FILE_BYTES + 1),
+                event("companies/indigo/journal-small.md"),
+                event("companies/indigo/unknown.md"),
+            ]);
+            expect(batches.map((batch) => batch.map((event) => event.relativePath))).toEqual([
+                [
+                    "companies/indigo/declared-small.md",
+                    "companies/indigo/journal-small.md",
+                ],
+                [
+                    "companies/indigo/declared-large.md",
+                    "companies/indigo/unknown.md",
+                ],
+            ]);
+        }
         finally {
             triggerShutdown();
             await loop;
@@ -6609,19 +7483,19 @@ describe("runRunnerWithLoop — event-push wiring", () => {
             ]),
         });
         await flushLoopMicrotasks(30);
-        // origin/main failure: expected a scoped tiny path while the bulk pass is
-        // held, but #408 kept all four paths in the slow lane.
-        expect(calls.filter((argv) => argv.includes("--scope-path"))).toHaveLength(1);
-        expect(calls.flat().join(" ")).toContain("realtime.md");
+        // The full pass owns durable state until a checkpoint. Its queued realtime
+        // residue is promoted at that hand-off instead of overlapping the pass.
+        expect(calls.filter((argv) => argv.includes("--scope-path"))).toHaveLength(0);
         releaseBulk();
         await flushLoopMicrotasks(30);
         expect(calls.filter((argv) => argv.includes("--scope-path"))).toHaveLength(2);
+        expect(calls.flat().join(" ")).toContain("realtime.md");
         expect(calls.flat().join(" ")).toContain("session-0.log");
         triggerShutdown();
         await loop;
         fs.rmSync(hqRoot, { recursive: true, force: true });
     });
-    it("fast lane: a small receiver pull dispatches during a slow bulk pass", async () => {
+    it("fast lane: a small receiver pull waits for a slow full pass without a hand-off checkpoint", async () => {
         const watcher = makeWatcherStub();
         let triggerShutdown = () => { };
         let receiverSync;
@@ -6666,7 +7540,7 @@ describe("runRunnerWithLoop — event-push wiring", () => {
         watcher.emit();
         await flushLoopMicrotasks();
         expect(order).toEqual(["bulk"]);
-        await receiverSync({
+        const receiverPull = receiverSync({
             events: [{
                     kind: "upsert", relativePath: "companies/acme/realtime.md", contentHash: "sha256:x",
                     mtime: "2026-08-26T00:00:00.000Z", originDeviceId: "peer", originTenantId: "acme",
@@ -6674,8 +7548,11 @@ describe("runRunnerWithLoop — event-push wiring", () => {
                 }],
             signal: new AbortController().signal,
         });
-        expect(order).toEqual(["bulk", "fast-pull"]);
+        await flushLoopMicrotasks(20);
+        expect(order).toEqual(["bulk"]);
         releaseBulk();
+        await receiverPull;
+        expect(order).toEqual(["bulk", "fast-pull"]);
         await flushLoopMicrotasks();
         triggerShutdown();
         await loop;
@@ -6719,12 +7596,14 @@ describe("runRunnerWithLoop — event-push wiring", () => {
         await flushLoopMicrotasks();
         watcher.emit();
         await flushLoopMicrotasks();
+        releaseBulk();
+        // The full chore has no explicit safe checkpoint in this stub, so the
+        // realtime pass begins only after the chore has released ownership.
         watcher.emit(relativePath, { paths: new Map([[absolutePath, relativePath]]) });
         await fastStarted;
-        releaseBulk();
         await flushLoopMicrotasks(20);
-        // The slow pass has finished, but its fast bypass still mutates. A second
-        // sync/rescue must not acquire the root operation lock in this interval.
+        // The realtime pass owns the root lock until its own durable work ends. A
+        // second sync/rescue must not acquire the lock in this interval.
         expect(fs.existsSync(lockPathFor(hqRoot))).toBe(true);
         releaseFast();
         await flushLoopMicrotasks(20);
@@ -6899,59 +7778,68 @@ describe("runRunnerWithLoop — event-push wiring", () => {
                 return () => { };
             },
         });
-        await flushLoopMicrotasks();
-        watcher.emit();
-        await flushLoopMicrotasks();
-        runPass.mockClear();
-        const events = [
-            ...Array.from({ length: 17 }, (_, index) => ({
-                kind: "upsert",
-                relativePath: `companies/acme/a-${index}.md`,
-                contentHash: "sha256:x",
-                mtime: "2026-08-26T00:00:00.000Z",
-                originDeviceId: "peer",
-                originTenantId: "acme",
-                sequenceNumber: index,
-                eventTimestamp: "2026-08-26T00:00:00.000Z",
-            })),
-            ...Array.from({ length: 16 }, (_, index) => ({
-                kind: "upsert",
-                relativePath: `companies/beta/b-${index}.md`,
-                contentHash: "sha256:x",
-                mtime: "2026-08-26T00:00:00.000Z",
-                originDeviceId: "peer",
-                originTenantId: "beta",
-                sequenceNumber: index + 17,
-                eventTimestamp: "2026-08-26T00:00:00.000Z",
-            })),
-        ];
-        for (const [slug, prefix, count] of [["acme", "a", 17], ["beta", "b", 16]]) {
-            const journal = readJournal(slug);
-            for (let index = 0; index < count; index++) {
-                journal.files[`${prefix}-${index}.md`] = {
-                    hash: "sha256:x",
-                    size: 16,
-                    syncedAt: "2026-08-26T00:00:00.000Z",
-                    direction: "down",
-                };
+        try {
+            await flushLoopMicrotasks();
+            watcher.emit();
+            await flushLoopMicrotasks();
+            runPass.mockClear();
+            const events = [
+                ...Array.from({ length: 17 }, (_, index) => ({
+                    kind: "upsert",
+                    relativePath: `companies/acme/a-${index}.md`,
+                    contentHash: "sha256:x",
+                    mtime: "2026-08-26T00:00:00.000Z",
+                    originDeviceId: "peer",
+                    originTenantId: "acme",
+                    sequenceNumber: index,
+                    eventTimestamp: "2026-08-26T00:00:00.000Z",
+                })),
+                ...Array.from({ length: 16 }, (_, index) => ({
+                    kind: "upsert",
+                    relativePath: `companies/beta/b-${index}.md`,
+                    contentHash: "sha256:x",
+                    mtime: "2026-08-26T00:00:00.000Z",
+                    originDeviceId: "peer",
+                    originTenantId: "beta",
+                    sequenceNumber: index + 17,
+                    eventTimestamp: "2026-08-26T00:00:00.000Z",
+                })),
+            ];
+            for (const [slug, prefix, count] of [["acme", "a", 17], ["beta", "b", 16]]) {
+                const journal = readJournal(slug);
+                for (let index = 0; index < count; index++) {
+                    journal.files[`${prefix}-${index}.md`] = {
+                        hash: "sha256:x",
+                        size: 16,
+                        syncedAt: "2026-08-26T00:00:00.000Z",
+                        direction: "down",
+                    };
+                }
+                writeJournal(slug, journal);
             }
-            writeJournal(slug, journal);
+            const receiverDrain = receiverSync({
+                events,
+                signal: new AbortController().signal,
+            });
+            await flushLoopMicrotasks(20);
+            // The running full chore has not yet yielded a durable hand-off, so no
+            // receiver work may overlap it. Once it releases ownership, the
+            // scheduler admits each route's bounded work before the residual slow
+            // beta batch (acme fast, beta fast, then beta slow).
+            expect(runPass).not.toHaveBeenCalled();
+            releaseBulk();
+            await receiverDrain;
+            const scopedCalls = runPass.mock.calls.filter(([argv]) => argv.includes("--scope-path"));
+            expect(scopedCalls).toHaveLength(3);
+            expect(scopedCalls.flat().join(" ")).toContain("a-16.md");
+            expect(scopedCalls.flat().join(" ")).toContain("b-14.md");
+        }
+        finally {
+            releaseBulk();
+            triggerShutdown();
+            await loop;
+            fs.rmSync(hqRoot, { recursive: true, force: true });
         }
-        const receiverDrain = receiverSync({
-            events,
-            signal: new AbortController().signal,
-        });
-        await flushLoopMicrotasks(20);
-        // The 33-event mixed delivery peels its first 32 bounded paths into the
-        // fast lane (17 acme + 15 beta); the final beta event remains slow.
-        expect(runPass).toHaveBeenCalledTimes(2);
-        expect(runPass.mock.calls.flat().join(" ")).toContain("a-16.md");
-        expect(runPass.mock.calls.flat().join(" ")).toContain("b-14.md");
-        releaseBulk();
-        await receiverDrain;
-        triggerShutdown();
-        await loop;
-        fs.rmSync(hqRoot, { recursive: true, force: true });
     });
     it("fast lane: queues slow work behind a receiver pass that owns the root lock", async () => {
         const hqRoot = fs.mkdtempSync(path.join(os.tmpdir(), "hq-fast-lane-slow-queue-"));
@@ -7123,9 +8011,12 @@ describe("runRunnerWithLoop — event-push wiring", () => {
         await flushLoopMicrotasks();
         watcher.emit(paths[0][1], { paths: new Map(paths) });
         await flushLoopMicrotasks(30);
-        expect(Object.keys(readJournal("indigo").files)).toHaveLength(paths.length);
+        // The full pass has not reached a durable checkpoint, so it remains the
+        // only journal writer. The scoped realtime pass is admitted immediately
+        // after this safe hand-off, preserving both sets of rows.
+        expect(Object.keys(readJournal("indigo").files)).toHaveLength(0);
         releaseBulk();
-        await flushLoopMicrotasks();
+        await flushLoopMicrotasks(30);
         const journal = readJournal("indigo").files;
         expect(Object.keys(journal)).toHaveLength(paths.length * 2);
         for (let index = 0; index < paths.length; index++) {
@@ -7177,10 +8068,12 @@ describe("runRunnerWithLoop — event-push wiring", () => {
             watcher.emit(relativePath, { paths: new Map([[absolutePath, relativePath]]) });
         }
         await flushLoopMicrotasks(60);
-        expect(completed).toEqual(["fast", "fast", "fast", "fast", "fast"]);
+        // A full pass without a checkpoint remains the sole mutable-state owner.
+        // The queued realtime batches run immediately after it completes.
+        expect(completed).toEqual([]);
         releaseBulk();
-        await flushLoopMicrotasks();
-        expect(completed).toContain("bulk");
+        await flushLoopMicrotasks(60);
+        expect(completed).toEqual(["bulk", "fast", "fast", "fast", "fast", "fast"]);
         triggerShutdown();
         await loop;
         fs.rmSync(hqRoot, { recursive: true, force: true });
@@ -7414,18 +8307,33 @@ describe("runRunnerWithLoop — event-push wiring", () => {
         // No pending FakeClock timers left behind by the driver's debounce.
         expect(clock.pendingTimerCount()).toBe(0);
     });
-    it("a hard-error (exit 1) poll pass returns immediately", async () => {
+    it("a non-auth pass error keeps the watch loop alive for the next poll", async () => {
         const watcher = makeWatcherStub();
         const runPass = vi.fn().mockResolvedValue(1);
-        const code = await runRunnerWithLoop(["--companies", "--watch", "--event-push", "--hq-root", "/tmp/hq"], {
+        const sleep = makeSteppableSleep();
+        let triggerShutdown = () => { };
+        const loop = runRunnerWithLoop(["--companies", "--watch", "--event-push", "--hq-root", "/tmp/hq"], {
             runPass,
             clock: new FakeClock(),
             createWatcher: () => watcher,
-            sleep: () => Promise.resolve(),
-            onShutdownSignal: () => () => { },
+            sleep: sleep.sleep,
+            onShutdownSignal: (handler) => {
+                triggerShutdown = handler;
+                return () => { };
+            },
         });
-        expect(code).toBe(1);
-        expect(watcher.disposed).toBe(false);
+        try {
+            await flushLoopMicrotasks();
+            expect(runPass).toHaveBeenCalledTimes(1);
+            sleep.tick();
+            await flushLoopMicrotasks();
+            expect(runPass).toHaveBeenCalledTimes(2);
+        }
+        finally {
+            triggerShutdown();
+            await expect(loop).resolves.toBe(0);
+            expect(watcher.started).toBe(false);
+        }
     });
     it("an auth-required watch pass parks in-process instead of exiting", async () => {
         const watcher = makeWatcherStub();
@@ -7474,29 +8382,92 @@ describe("runRunnerWithLoop — event-push wiring", () => {
     it("a TRANSIENT_NETWORK_EXIT poll pass does NOT surface as a crash — the loop retries (HQ-SYNC-1W)", async () => {
         // A transient offline blip must keep the watcher alive: the loop logs and
         // polls again instead of returning the code and letting the process exit
-        // (which the menubar reports as "watcher exited unexpectedly"). A genuine
-        // hard error on a later pass still terminates the loop.
+        // (which the menubar reports as "watcher exited unexpectedly"). A later
+        // generic failure is also retried rather than becoming a daemon exit.
         const watcher = makeWatcherStub();
         let n = 0;
         const runPass = vi.fn().mockImplementation(async () => {
             n++;
-            // First pass: machine is offline (transient). Second pass: a real hard
-            // error, used here only to end the otherwise-infinite loop deterministically.
+            // First pass: machine is offline (transient). Second pass: a generic
+            // failed pass, which must take the same non-fatal retry path.
             return n === 1 ? TRANSIENT_NETWORK_EXIT : 1;
         });
-        const code = await runRunnerWithLoop(["--companies", "--watch", "--event-push", "--hq-root", "/tmp/hq"], {
+        const sleep = makeSteppableSleep();
+        let triggerShutdown = () => { };
+        const loop = runRunnerWithLoop(["--companies", "--watch", "--event-push", "--hq-root", "/tmp/hq"], {
             runPass,
             clock: new FakeClock(),
             createWatcher: () => watcher,
-            sleep: () => Promise.resolve(),
-            onShutdownSignal: () => () => { },
+            sleep: sleep.sleep,
+            onShutdownSignal: (handler) => {
+                triggerShutdown = handler;
+                return () => { };
+            },
         });
-        // The transient pass did NOT end the loop — it ran again…
+        await flushLoopMicrotasks();
+        sleep.tick();
+        await flushLoopMicrotasks();
+        // The transient pass did NOT end the loop — it ran again, and neither
+        // error causes the daemon itself to exit.
         expect(runPass).toHaveBeenCalledTimes(2);
-        // …and the transient code was never surfaced as the watcher's exit code.
-        expect(code).toBe(1);
-        expect(code).not.toBe(TRANSIENT_NETWORK_EXIT);
+        triggerShutdown();
+        await expect(loop).resolves.toBe(0);
+        expect(watcher.disposed).toBe(false);
+    });
+    it("keeps the watcher alive for an unresolved company watch route (HQ-SYNC-COMPANY-ROUTE-UID)", async () => {
+        const watcher = makeWatcherStub();
+        const client = makeVaultStub({
+            entityGet: () => Promise.reject(new VaultNotFoundError("company deleted")),
+        });
+        const findInMyNamespace = vi.fn().mockResolvedValue(null);
+        client.entity.findInMyNamespace = findInMyNamespace;
+        const routedPass = makeDeps({ createVaultClient: () => client });
+        const routedArgv = buildRoutePullArgv({ kind: "company", slug: "cmp_ghost" }, ["--companies", "--watch", "--hq-root", "/tmp/hq"]);
+        let attempts = 0;
+        let routedExit;
+        const runPass = vi.fn().mockImplementation(async () => {
+            attempts += 1;
+            if (attempts === 1) {
+                routedExit = await runRunner(routedArgv, routedPass);
+                return routedExit;
+            }
+            return UNRESOLVED_COMPANY_EXIT;
+        });
+        const sleep = makeSteppableSleep();
+        let triggerShutdown = () => { };
+        const loop = runRunnerWithLoop(["--companies", "--watch", "--event-push", "--hq-root", "/tmp/hq"], {
+            runPass,
+            clock: new FakeClock(),
+            createWatcher: () => watcher,
+            sleep: sleep.sleep,
+            onShutdownSignal: (handler) => {
+                triggerShutdown = handler;
+                return () => { };
+            },
+        });
+        await flushLoopMicrotasks();
+        sleep.tick();
+        await flushLoopMicrotasks();
+        expect(routedArgv).toEqual([
+            "--company",
+            "cmp_ghost",
+            "--direction",
+            "pull",
+            "--hq-root",
+            "/tmp/hq",
+        ]);
+        expect(routedExit).toBe(UNRESOLVED_COMPANY_EXIT);
+        expect(runPass).toHaveBeenCalledTimes(2);
+        triggerShutdown();
+        await expect(loop).resolves.toBe(0);
         expect(watcher.disposed).toBe(false);
+        expect(findInMyNamespace).toHaveBeenCalledWith("company", "cmp_ghost");
+        expect(routedPass.stderr.events()).toContainEqual({
+            type: "error",
+            company: "cmp_ghost",
+            path: "(company-resolution)",
+            message: "company entity lookup returned 404",
+        });
     });
     it("keeps the watch loop alive when a company leg returns transient exit 75 (HQ-SYNC-X)", async () => {
         const watcher = makeWatcherStub();
@@ -7513,24 +8484,36 @@ describe("runRunnerWithLoop — event-push wiring", () => {
         let passes = 0;
         const runPass = vi.fn().mockImplementation(async () => {
             passes += 1;
-            // End the otherwise-open watch loop with a later hard failure. The first
-            // pass uses the real company-leg fanout path, not a synthetic exit code.
+            // The first pass uses the real company-leg fanout path, not a synthetic
+            // exit code. A later generic failure must also leave the daemon alive.
             return passes === 1 ? runRunner(["--companies"], transientPass) : 1;
         });
-        const code = await runRunnerWithLoop(["--companies", "--watch", "--event-push", "--hq-root", "/tmp/hq"], {
+        const sleep = makeSteppableSleep();
+        let triggerShutdown = () => { };
+        const loop = runRunnerWithLoop(["--companies", "--watch", "--event-push", "--hq-root", "/tmp/hq"], {
             runPass,
             clock: new FakeClock(),
             createWatcher: () => watcher,
-            sleep: () => Promise.resolve(),
-            onShutdownSignal: () => () => { },
+            sleep: sleep.sleep,
+            onShutdownSignal: (handler) => {
+                triggerShutdown = handler;
+                return () => { };
+            },
         });
-        expect(runPass).toHaveBeenCalledTimes(2);
-        expect(code).toBe(1);
-        expect(code).not.toBe(TRANSIENT_NETWORK_EXIT);
-        expect(transientPass.stderr
-            .events()
-            .some((event) => event.type === "error" && event.path === "(company)")).toBe(false);
-        expect(watcher.disposed).toBe(false);
+        try {
+            await waitForPollSleep(sleep);
+            sleep.tick();
+            await flushLoopMicrotasks();
+            expect(runPass).toHaveBeenCalledTimes(2);
+            expect(transientPass.stderr
+                .events()
+                .some((event) => event.type === "error" && event.path === "(company)")).toBe(false);
+            expect(watcher.disposed).toBe(false);
+        }
+        finally {
+            triggerShutdown();
+            await expect(loop).resolves.toBe(0);
+        }
     });
     it("a PARTIAL_SYNC_EXIT poll pass does NOT surface as a crash — the loop retries", async () => {
         // A partial pass (some per-file transfers threw: oversized object on an
@@ -7544,22 +8527,32 @@ describe("runRunnerWithLoop — event-push wiring", () => {
         let n = 0;
         const runPass = vi.fn().mockImplementation(async () => {
             n++;
-            // Two partial passes prove a DETERMINISTIC per-file failure doesn't kill
-            // the loop either. A hard error then ends the otherwise-infinite loop.
+            // Two partial passes prove a deterministic per-file failure doesn't kill
+            // the loop either. A generic failure must also leave it alive.
             return n <= 2 ? PARTIAL_SYNC_EXIT : 1;
         });
-        const code = await runRunnerWithLoop(["--companies", "--watch", "--event-push", "--hq-root", "/tmp/hq"], {
+        const sleep = makeSteppableSleep();
+        let triggerShutdown = () => { };
+        const loop = runRunnerWithLoop(["--companies", "--watch", "--event-push", "--hq-root", "/tmp/hq"], {
             runPass,
             clock: new FakeClock(),
             createWatcher: () => watcher,
-            sleep: () => Promise.resolve(),
-            onShutdownSignal: () => () => { },
+            sleep: sleep.sleep,
+            onShutdownSignal: (handler) => {
+                triggerShutdown = handler;
+                return () => { };
+            },
         });
+        await flushLoopMicrotasks();
+        sleep.tick();
+        await flushLoopMicrotasks();
+        sleep.tick();
+        await flushLoopMicrotasks();
         // Both partial passes stayed alive — the loop ran a third time…
         expect(runPass).toHaveBeenCalledTimes(3);
-        // …and the partial code was never surfaced as the watcher's exit code.
-        expect(code).toBe(1);
-        expect(code).not.toBe(PARTIAL_SYNC_EXIT);
+        // …and neither partial nor generic pass failure exits the daemon.
+        triggerShutdown();
+        await expect(loop).resolves.toBe(0);
         expect(watcher.disposed).toBe(false);
     });
     it("alerts when a partial pass failed before a company's download leg", async () => {
@@ -7587,24 +8580,33 @@ describe("runRunnerWithLoop — event-push wiring", () => {
             return 1;
         });
         // Every clock read advances a full cadence interval, so the tick after
-        // the partial pass is a scheduled full reconcile that returns the exit
-        // code this test asserts on.
+        // the partial pass is a scheduled full reconcile with a generic failure.
         let monotonic = 0;
+        const sleep = makeSteppableSleep();
+        let triggerShutdown = () => { };
         try {
-            const code = await runRunnerWithLoop(["--companies", "--watch", "--event-push", "--hq-root", "/tmp/hq"], {
+            const loop = runRunnerWithLoop(["--companies", "--watch", "--event-push", "--hq-root", "/tmp/hq"], {
                 runPass,
                 clock: new FakeClock(),
                 createWatcher: () => watcher,
                 monotonicNow: () => (monotonic += DEFAULT_FULL_RECONCILE_MS),
-                sleep: () => Promise.resolve(),
-                onShutdownSignal: () => () => { },
+                sleep: sleep.sleep,
+                onShutdownSignal: (handler) => {
+                    triggerShutdown = handler;
+                    return () => { };
+                },
             });
-            expect(code).toBe(1);
+            await flushLoopMicrotasks();
+            sleep.tick();
+            await flushLoopMicrotasks();
+            expect(runPass).toHaveBeenCalledTimes(2);
             const stderr = stderrWrite.mock.calls
                 .map(([chunk]) => String(chunk))
                 .join("");
             expect(stderr).toContain("hq-sync-runner: COMPANY PASS FAILED company=personal message=RangeError Maximum call stack size exceeded (downloads for this company did not run)");
             expect(stderr).toContain("hq-sync-runner: watch pass completed with per-file errors; failed-companies=personal; staying alive, retrying next poll");
+            triggerShutdown();
+            await expect(loop).resolves.toBe(0);
         }
         finally {
             stderrWrite.mockRestore();
@@ -7791,6 +8793,85 @@ describe("runRunnerWithLoop — watch-mode auth-wait", () => {
     });
 });
 describe("runRunnerWithLoop — U58 realtime scheduler guard", () => {
+    it("hands a wake realtime drain to the guard before a long-running full chore completes", async () => {
+        const previousCoordinator = process.env.HQ_SYNC_PARALLEL_COORDINATOR;
+        process.env.HQ_SYNC_PARALLEL_COORDINATOR = "1";
+        const watcher = makeWatcherStub();
+        let triggerShutdown = () => { };
+        let releaseCheckpoint = () => { };
+        const checkpointGate = new Promise((resolve) => { releaseCheckpoint = resolve; });
+        let releaseRealtime = () => { };
+        const realtimeGate = new Promise((resolve) => { releaseRealtime = resolve; });
+        const order = [];
+        let passes = 0;
+        let runRealtime = null;
+        const loop = runRunnerWithLoop(["--companies", "--watch", "--event-push", "--hq-root", "/tmp/hq"], {
+            runPass: vi.fn().mockImplementation(async (_argv, checkpoint) => {
+                passes += 1;
+                if (passes === 2) {
+                    order.push("chore");
+                    // The fake pass has completed its current durable unit and is now
+                    // at the same explicit hand-off seam production uses between
+                    // fully-settled fanout targets.
+                    await checkpointGate;
+                    await checkpoint?.();
+                    order.push("chore-complete");
+                }
+                return completedPassOutcome();
+            }),
+            runPassSupportsCooperativeCheckpoint: true,
+            clock: new FakeClock(),
+            createWatcher: () => watcher,
+            sleep: makeSteppableSleep().sleep,
+            onShutdownSignal: (handler) => {
+                triggerShutdown = handler;
+                return () => { };
+            },
+            startRealtimeScheduler: async (opts) => {
+                // This is the same wake path used by the realtime scheduler: it
+                // enters runGuardedTask behind the coordinator worker.
+                runRealtime = () => opts.runGuarded(async () => {
+                    order.push("realtime");
+                    await realtimeGate;
+                    order.push("realtime-complete");
+                });
+                return {
+                    signal: () => undefined,
+                    checkHighWater: async () => undefined,
+                    dispose: async () => undefined,
+                };
+            },
+        });
+        try {
+            await flushLoopMicrotasks(30);
+            watcher.emit();
+            await flushLoopMicrotasks(20);
+            expect(order).toEqual(["chore"]);
+            const realtime = runRealtime();
+            releaseCheckpoint();
+            await flushLoopMicrotasks(30);
+            expect(order).toEqual(["chore", "realtime"]);
+            releaseRealtime();
+            await realtime;
+            await flushLoopMicrotasks(20);
+            expect(order).toEqual([
+                "chore",
+                "realtime",
+                "realtime-complete",
+                "chore-complete",
+            ]);
+        }
+        finally {
+            releaseCheckpoint();
+            releaseRealtime();
+            triggerShutdown();
+            await loop;
+            if (previousCoordinator === undefined)
+                delete process.env.HQ_SYNC_PARALLEL_COORDINATOR;
+            else
+                process.env.HQ_SYNC_PARALLEL_COORDINATOR = previousCoordinator;
+        }
+    });
     it("feeds a watcher-originated V2 drain through the same single-flight guard as the poll", async () => {
         const watcher = makeWatcherStub();
         let triggerShutdown = () => { };
@@ -7903,6 +8984,173 @@ describe("runRunnerWithLoop — U58 realtime scheduler guard", () => {
         await loop;
     });
 });
+describe("CooperativePassScheduler", () => {
+    it("admits an explicitly safe fast realtime pass while a slow scoped realtime pass remains in flight", async () => {
+        const scheduler = new CooperativePassScheduler(() => 0);
+        const order = [];
+        let releaseSlow = () => { };
+        const slowGate = new Promise((resolve) => { releaseSlow = resolve; });
+        let markSlowStarted = () => { };
+        const slowStarted = new Promise((resolve) => { markSlowStarted = resolve; });
+        const slow = scheduler.submit(async () => {
+            order.push("slow-start");
+            markSlowStarted();
+            await slowGate;
+            order.push("slow-complete");
+            return 0;
+        }, "realtime", "slow");
+        await slowStarted;
+        const fast = scheduler.submit(async () => {
+            order.push("fast");
+            return 0;
+        }, "realtime", "fast", true);
+        try {
+            await Promise.resolve();
+            await Promise.resolve();
+            expect([...order]).toEqual(["slow-start", "fast"]);
+        }
+        finally {
+            releaseSlow();
+            await Promise.all([slow, fast]);
+        }
+    });
+    it("preserves journal order and resumes full work across repeated randomized hand-offs", async () => {
+        // These deterministic seeds deliberately vary the number and enqueue
+        // ordering of realtime tasks. Every append asserts one durable-state owner
+        // at a time; the full continuation must resume after every realtime burst.
+        for (let seed = 1; seed <= 32; seed += 1) {
+            let now = 0;
+            const scheduler = new CooperativePassScheduler(() => now);
+            const journal = [];
+            const expected = new Set();
+            let writer = null;
+            let maximumWriters = 0;
+            const append = async (entry) => {
+                expect(writer).toBeNull();
+                writer = entry;
+                maximumWriters = Math.max(maximumWriters, 1);
+                // A journal append crosses an async durable-write boundary. If the
+                // scheduler admitted another pass here, its ownership assertion would
+                // fail rather than merely observing JavaScript's synchronous turn.
+                await Promise.resolve();
+                expect(writer).toBe(entry);
+                journal.push(entry);
+                writer = null;
+            };
+            let releaseCheckpoint = () => { };
+            const checkpointReady = new Promise((resolve) => { releaseCheckpoint = resolve; });
+            const chore = scheduler.submit(async ({ checkpoint }) => {
+                expected.add(`chore-${seed}-before`);
+                await append(`chore-${seed}-before`);
+                await checkpointReady;
+                await checkpoint();
+                expected.add(`chore-${seed}-after`);
+                await append(`chore-${seed}-after`);
+                return 0;
+            }, "chore");
+            await Promise.resolve();
+            const realtimeCount = (seed % 7) + 1;
+            const shuffledIndexes = Array.from({ length: realtimeCount }, (_, index) => index);
+            let randomState = seed;
+            for (let index = shuffledIndexes.length - 1; index > 0; index -= 1) {
+                randomState = (randomState * 1_664_525 + 1_013_904_223) >>> 0;
+                const swapIndex = randomState % (index + 1);
+                [shuffledIndexes[index], shuffledIndexes[swapIndex]] = [
+                    shuffledIndexes[swapIndex],
+                    shuffledIndexes[index],
+                ];
+            }
+            const realtime = shuffledIndexes.map((index) => {
+                const entry = `realtime-${seed}-${(index * 17 + seed) % realtimeCount}`;
+                expected.add(entry);
+                return scheduler.submit(async () => {
+                    // Shuffle the microtask timing without ever allowing a second writer.
+                    if ((seed + index) % 3 === 0)
+                        await Promise.resolve();
+                    await append(entry);
+                    now += 1;
+                    return 0;
+                }, "realtime");
+            });
+            releaseCheckpoint();
+            await Promise.all([chore, ...realtime]);
+            expect(maximumWriters).toBe(1);
+            expect(new Set(journal)).toEqual(expected);
+            expect(journal).toHaveLength(expected.size);
+            expect(journal[0]).toBe(`chore-${seed}-before`);
+            expect(journal.at(-1)).toBe(`chore-${seed}-after`);
+        }
+    });
+    it("lets realtime win at 15 minutes minus one millisecond, then gives the chore the exact-boundary admission", async () => {
+        const runCase = async (elapsedMs) => {
+            let now = 0;
+            const scheduler = new CooperativePassScheduler(() => now);
+            const order = [];
+            let releaseActive = () => { };
+            const activeGate = new Promise((resolve) => { releaseActive = resolve; });
+            const activeRealtime = scheduler.submit(async () => {
+                order.push("active-realtime");
+                await activeGate;
+                return 0;
+            }, "realtime");
+            await Promise.resolve();
+            const chore = scheduler.submit(async () => {
+                order.push("chore");
+                return 0;
+            }, "chore");
+            const queuedRealtime = scheduler.submit(async () => {
+                order.push("queued-realtime");
+                return 0;
+            }, "realtime");
+            now = elapsedMs;
+            releaseActive();
+            await Promise.all([activeRealtime, chore, queuedRealtime]);
+            return order;
+        };
+        await expect(runCase(CHORE_STARVATION_CAP_MS - 1)).resolves.toEqual([
+            "active-realtime",
+            "queued-realtime",
+            "chore",
+        ]);
+        await expect(runCase(CHORE_STARVATION_CAP_MS)).resolves.toEqual([
+            "active-realtime",
+            "chore",
+            "queued-realtime",
+        ]);
+    });
+    it("resumes a handed-off chore when a continuous realtime burst reaches the 15-minute cap", async () => {
+        let now = 0;
+        const scheduler = new CooperativePassScheduler(() => now);
+        const order = [];
+        let releaseCheckpoint = () => { };
+        const checkpointReady = new Promise((resolve) => { releaseCheckpoint = resolve; });
+        const chore = scheduler.submit(async ({ checkpoint }) => {
+            order.push("chore-before");
+            await checkpointReady;
+            await checkpoint();
+            order.push("chore-after");
+            return 0;
+        }, "chore");
+        await Promise.resolve();
+        const firstRealtime = scheduler.submit(async () => {
+            order.push("realtime-before-cap");
+            now = CHORE_STARVATION_CAP_MS;
+            return 0;
+        }, "realtime");
+        const laterRealtime = scheduler.submit(async () => {
+            order.push("realtime-after-cap");
+            return 0;
+        }, "realtime");
+        releaseCheckpoint();
+        await Promise.all([chore, firstRealtime, laterRealtime]);
+        expect(order).toEqual([
+            "chore-before",
+            "realtime-before-cap",
+            "chore-after",
+            "realtime-after-cap",
+        ]);
+    });
+});
 describe("runRunnerWithLoop — accumulate-and-drain scoped push", () => {
     const watchArgv = [
         "--companies",
@@ -8031,6 +9279,7 @@ describe("runRunnerWithLoop — accumulate-and-drain scoped push", () => {
         "watcher-warmup-catch-up": matched.includes("watcher-warmup-catch-up"),
         "watcher-warmup-catch-up-failed": matched.includes("watcher-warmup-catch-up-failed"),
         "scheduled-interval": matched.includes("scheduled-interval"),
+        "root-coverage-stale": matched.includes("root-coverage-stale"),
     });
     function expectFullReconcileDecision(record, mode, reasons) {
         expect(record).toMatchObject({
@@ -10066,6 +11315,9 @@ describe("runRunnerWithLoop — Phase 3 event-sync wiring (US-017/018/019)", ()
             "/tmp/hq",
         ], {
             runPass: runPass,
+            ...(opts.supportsCooperativeCheckpoint
+                ? { runPassSupportsCooperativeCheckpoint: true }
+                : {}),
             clock,
             createWatcher: (options) => {
                 opts.onCreateWatcher?.({
@@ -10178,6 +11430,123 @@ describe("runRunnerWithLoop — Phase 3 event-sync wiring (US-017/018/019)", ()
         shutdown();
         await loop;
     });
+    it("records initial-pull writes before its cooperative checkpoint can admit watcher work", async () => {
+        const markContentPublished = vi.fn();
+        const startEventSync = vi.fn().mockResolvedValue({
+            publishBatch: vi.fn(),
+            markContentPublished,
+            receiver: { start: async () => { }, dispose: async () => { }, connected: true },
+            ownDeviceId: "dev-test",
+            dispose: vi.fn().mockResolvedValue(undefined),
+        });
+        const watcher = makeBatchWatcherStub();
+        let suppressionWasInstalledWhenRealtimeStarted;
+        const runPass = vi.fn(async (argv, checkpoint, onJournalsReady, onAppliedUpserts) => {
+            if (argv.includes("--scope-path")) {
+                suppressionWasInstalledWhenRealtimeStarted = markContentPublished
+                    .mock.calls
+                    .some(([relativePath]) => relativePath === "companies/indigo/initial-pull.md");
+                return completedPassOutcome();
+            }
+            onJournalsReady?.();
+            await microtasks();
+            watcher.emit(undefined, {
+                paths: new Map([[
+                        "/tmp/hq/companies/indigo/watcher-arrived-during-pull.md",
+                        "companies/indigo/watcher-arrived-during-pull.md",
+                    ]]),
+                changes: new Map([[
+                        "/tmp/hq/companies/indigo/watcher-arrived-during-pull.md",
+                        { kind: "change" },
+                    ]]),
+            });
+            // Let the watcher submit its realtime work before the full pass reaches
+            // its explicit hand-off. No timer is involved: the submission is a
+            // promise-only scheduling boundary.
+            await microtasks();
+            onAppliedUpserts?.([{
+                    relativePath: "companies/indigo/initial-pull.md",
+                    contentHash: "sha256:initial-pull",
+                }]);
+            await checkpoint?.();
+            return {
+                exitCode: 0,
+                result: {
+                    pushPathResults: [],
+                    appliedUpserts: [{
+                            relativePath: "companies/indigo/initial-pull.md",
+                            contentHash: "sha256:initial-pull",
+                        }],
+                },
+            };
+        });
+        const { loop, shutdown } = runLoop({
+            claims: EMAIL_CLAIMS,
+            startEventSync,
+            runPass,
+            watcher,
+            supportsCooperativeCheckpoint: true,
+        });
+        await microtasks(16);
+        expect(suppressionWasInstalledWhenRealtimeStarted).toBe(true);
+        shutdown();
+        await loop;
+    });
+    it("does not let a yielding warm-up catch-up overwrite a newer watcher unlink", async () => {
+        const watcher = makeBatchWatcherStub();
+        let resolveCatchup;
+        watcher.collectWarmupCatchupAsync = vi.fn(() => new Promise((resolve) => {
+            resolveCatchup = resolve;
+        }));
+        const runPass = vi.fn(async (_argv, _checkpoint, onJournalsReady) => {
+            onJournalsReady?.();
+            return completedPassOutcome();
+        });
+        const { loop, tick, shutdown } = runLoop({
+            claims: EMAIL_CLAIMS,
+            watcher,
+            runPass,
+            supportsCooperativeCheckpoint: true,
+        });
+        await microtasks(12);
+        const absolutePath = "/tmp/hq/companies/indigo/recreated.md";
+        const relativePath = "companies/indigo/recreated.md";
+        watcher.emit(undefined, {
+            paths: new Map([[absolutePath, relativePath]]),
+            changes: new Map([[absolutePath, {
+                        kind: "unlink",
+                        deleteSnapshots: [{
+                                journalSlug: "indigo",
+                                journalPath: "recreated.md",
+                                deleteScopeRoot: "recreated.md",
+                                absolutePath,
+                                remoteEtag: "etag-before-recreate",
+                                localHash: "hash-before-recreate",
+                                localKind: "file",
+                            }],
+                    }]]),
+        });
+        // This is the older filesystem state collected before the live unlink.
+        resolveCatchup?.({
+            batch: {
+                paths: new Map([[absolutePath, relativePath]]),
+                changes: new Map([[absolutePath, { kind: "change" }]]),
+            },
+            scannedPaths: 1,
+        });
+        await microtasks(16);
+        tick();
+        await microtasks(16);
+        const scopedPush = runPass.mock.calls.find((call) => call[0].includes("--scope-path"))?.[0];
+        expect(scopedPush).toEqual(expect.arrayContaining([
+            "--scope-path",
+            "recreated.md",
+            "--delete-scope-path",
+            "recreated.md",
+        ]));
+        shutdown();
+        await loop;
+    });
     it("replays pull upsert marks after event-sync startup becomes live", async () => {
         const markContentPublished = vi.fn();
         let resolveStart;
@@ -12568,6 +13937,45 @@ describe("watcher delete intents without pre-seeded authorization", () => {
         expect(Object.keys(readJournal("indigo").files)).toHaveLength(12);
         await stopHarness(h);
     });
+    it("attributes a company-root unlinkDir to its journal while rejecting company-root metadata files", async () => {
+        const keys = Array.from({ length: 12 }, (_, i) => `knowledge/company-root/f-${i}.md`);
+        const pushPasses = [];
+        const h = startDeleteHarness(keys, {
+            direction: "push",
+            onPass: (argv) => {
+                if (argv[argv.indexOf("--direction") + 1] === "push") {
+                    pushPasses.push(argv);
+                }
+            },
+        });
+        await settle();
+        pushPasses.length = 0;
+        const childKey = keys[0];
+        const childPath = path.join(h.companyRoot, childKey);
+        fs.unlinkSync(childPath);
+        expect(h.capture()(`companies/indigo/${childKey}`, "unlink")).toHaveLength(1);
+        expect(readJournal("indigo").files[childKey]?.localDeleteIntent).toBeDefined();
+        // The child intent is safe only until the enclosing whole-company removal
+        // is classified. At that scope the exact denominator is the whole shard,
+        // so the existing bulk guard must revoke it rather than lose attribution.
+        fs.rmSync(h.companyRoot, { recursive: true, force: true });
+        const rootSnapshots = h.capture()("companies/indigo", "unlinkDir");
+        expect(rootSnapshots).toHaveLength(0);
+        expect(Object.values(readJournal("indigo").files).filter((entry) => entry.localDeleteIntent)).toHaveLength(0);
+        h.watcher.emit("companies/indigo", {
+            paths: new Map([[h.companyRoot, "companies/indigo"]]),
+            changes: new Map([[h.companyRoot, {
+                        kind: "unlinkDir",
+                        deleteSnapshots: rootSnapshots,
+                    }]]),
+        });
+        h.tick();
+        await settle();
+        expect(pushPasses).toEqual([
+            expect.arrayContaining(["--company", "indigo", "--direction", "push"]),
+        ]);
+        await stopHarness(h);
+    });
     // The native macOS/Windows backends make no child-before-parent guarantee,
     // so the refusal has to hold for descendants that arrive after it too.
     it("a descendant unlink arriving after a refused unlinkDir records no intent", async () => {