@indigoai-us/hq-cloud 6.18.44-alpha.9 → 6.18.44

package/dist/bin/sync-runner-company.test.js

@@ -1,2439 +0,0 @@
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-import * as fs from "fs";
-import * as os from "os";
-import * as path from "path";
-// Re-export node:fs as a mutable module so the scoped-walk regression can
-// measure the real walker without replacing any filesystem behavior.
-vi.mock("fs", async (importOriginal) => {
-    const actual = await importOriginal();
-    return { ...actual };
-});
-// Mock the S3 transport so the real share() can run through executeCompanyFanout
-// in the HQ-DESKTOP-64 regression below without touching the network. Inert for
-// every other test here, which injects its own shareFn/syncFn.
-vi.mock("../s3.js", async (importOriginal) => {
-    const actual = await importOriginal();
-    return {
-        ...actual,
-        uploadFile: vi.fn().mockResolvedValue({ etag: '"upload-etag"' }),
-        uploadSymlink: vi.fn().mockResolvedValue({ etag: '"upload-symlink-etag"' }),
-        downloadFile: vi.fn().mockResolvedValue(undefined),
-        listRemoteFiles: vi.fn().mockResolvedValue([]),
-        deleteRemoteFile: vi.fn().mockResolvedValue(undefined),
-        headRemoteFile: vi.fn().mockResolvedValue(null),
-        readVerifiedRemoteSymlinkTarget: vi.fn().mockResolvedValue(null),
-        primeObjectTransport: vi.fn().mockResolvedValue(undefined),
-        primeUploads: vi.fn().mockResolvedValue(undefined),
-    };
-});
-import { executeCompanyFanout } from "./sync-runner-company.js";
-import { clearContextCache, resolveEntityContext, setEntityFetchSleepForTest, } from "../context.js";
-import { CognitoAuthError, CognitoRefreshError } from "../cognito-auth.js";
-import { SESSION_LOGS_SYNC_REL } from "../personal-vault.js";
-import { _testing as shareTesting, share, parseRegisteredCompanySkillUid, } from "../cli/share.js";
-import { PERSONAL_VAULT_JOURNAL_SLUG, readJournal } from "../journal.js";
-import { VaultConflictError, vaultErrorFromResponse } from "../vault-client.js";
-import { deleteRemoteFile, headRemoteFile, uploadFile } from "../s3.js";
-import { hashFile } from "../journal.js";
-import { PLAN_LIMIT_UPGRADE_URL, canonicalPlanLimitBody, } from "../plan-limit.fixtures.js";
-import { setPlanLimitPauseClockForTesting } from "../plan-limit-pause.js";
-import { setBandwidthGovernorForTesting } from "../bandwidth.js";
-import { FakeClock, TreeWatcher } from "../watcher.js";
-import { buildScopedPushArgv } from "./sync-runner-watch-routes.js";
-describe("executeCompanyFanout realtime inventory gate", () => {
-    it("stops before any legacy push or pull when fresh inventory requires reset", async () => {
-        const syncFn = vi.fn();
-        const shareFn = vi.fn();
-        const client = {
-            listMyMemberships: vi.fn(() => {
-                throw new Error("membership lookup must not run after reset admission stops network");
-            }),
-        };
-        const emit = vi.fn();
-        const result = await executeCompanyFanout({
-            plan: [{ uid: "prs_1", slug: "personal", personalMode: true }],
-            direction: "both",
-            hqRoot: "/tmp/realtime-inventory-runner",
-            onConflict: "abort",
-            client: client,
-            vaultConfig: { apiUrl: "https://api.example", authToken: "access-token" },
-            syncFn,
-            shareFn,
-            resolveDeletePolicy: () => "all",
-            emit,
-            ensureCompanyDir: vi.fn(),
-            scopeInventoryGate: {
-                refresh: vi.fn(async () => ({ network: "stop", state: "reset-required", reason: "reset-required" })),
-            },
-        });
-        expect(syncFn).not.toHaveBeenCalled();
-        expect(shareFn).not.toHaveBeenCalled();
-        expect(client.listMyMemberships).not.toHaveBeenCalled();
-        expect(result.errors).toEqual([{ company: "personal", message: "scope inventory reset-required: reset-required; stopped before legacy network I/O" }]);
-        expect(emit).toHaveBeenCalledWith(expect.objectContaining({ type: "error", company: "personal", path: "(scope)" }));
-    });
-});
-describe("executeCompanyFanout cooperative checkpoints", () => {
-    it("hands off only after each target leg has settled and retains the remaining plan", async () => {
-        const hqRoot = fs.mkdtempSync(path.join(os.tmpdir(), "hq-fanout-checkpoint-"));
-        const order = [];
-        const shareResult = {
-            filesUploaded: 0,
-            bytesUploaded: 0,
-            filesSkipped: 0,
-            filesDeleted: 0,
-            filesTombstoned: 0,
-            filesRefusedStale: 0,
-            filesRefusedStalePaths: [],
-            filesSuppressedByTombstone: 0,
-            filesExcludedByPolicy: 0,
-            filesExcludedByScope: 0,
-            filesExcludedByIgnore: 0,
-            unreachablePaths: [],
-            linkedSubtreesNotShipped: [],
-            conflictPaths: [],
-            aborted: false,
-        };
-        try {
-            await executeCompanyFanout({
-                plan: [
-                    { uid: "prs_1", slug: "personal", personalMode: true },
-                    { uid: "prs_2", slug: "personal-next", personalMode: true },
-                ],
-                direction: "push",
-                hqRoot,
-                onConflict: "abort",
-                client: {},
-                vaultConfig: { apiUrl: "https://api.example", authToken: "access-token" },
-                syncFn: vi.fn(),
-                shareFn: vi.fn(async (options) => {
-                    order.push(`target:${options.company}`);
-                    return shareResult;
-                }),
-                resolveDeletePolicy: () => "all",
-                emit: vi.fn(),
-                ensureCompanyDir: vi.fn(),
-                cooperativeCheckpoint: async () => { order.push("checkpoint"); },
-                telemetryClient: null,
-            });
-            expect(order).toEqual([
-                "target:prs_1",
-                "checkpoint",
-                "target:prs_2",
-                "checkpoint",
-            ]);
-        }
-        finally {
-            fs.rmSync(hqRoot, { recursive: true, force: true });
-        }
-    });
-});
-describe("executeCompanyFanout — plan-limit event forwarding", () => {
-    it("preserves the server upgrade URL and company label without recording a failure", async () => {
-        const hqRoot = fs.mkdtempSync(path.join(os.tmpdir(), "hq-fanout-plan-limit-"));
-        const events = [];
-        const shareResult = {
-            filesUploaded: 0,
-            bytesUploaded: 0,
-            filesSkipped: 2,
-            filesDeleted: 0,
-            filesTombstoned: 0,
-            filesRefusedStale: 0,
-            filesRefusedStalePaths: [],
-            filesSuppressedByTombstone: 0,
-            filesExcludedByPolicy: 0,
-            filesExcludedByScope: 0,
-            filesExcludedByIgnore: 0,
-            unreachablePaths: [],
-            linkedSubtreesNotShipped: [],
-            conflictPaths: [],
-            aborted: false,
-        };
-        fs.mkdirSync(path.join(hqRoot, "companies", "acme"), { recursive: true });
-        try {
-            const result = await executeCompanyFanout({
-                plan: [{ uid: "cmp_1", slug: "acme", name: "Acme" }],
-                direction: "push",
-                hqRoot,
-                onConflict: "abort",
-                client: {},
-                vaultConfig: { apiUrl: "https://api.example", authToken: "access-token" },
-                syncFn: vi.fn(),
-                shareFn: vi.fn(async (options) => {
-                    // The runner opts every push leg into plan-limit pauses.
-                    expect(options.planLimitPause).toBe(true);
-                    options.onEvent?.({
-                        type: "plan-limit",
-                        upgradeUrl: "https://billing.example.test/company/acme",
-                        message: "New files are paused while Acme is over its Starter limits.",
-                        code: "PLAN_LIMIT_EXCEEDED",
-                        error: "plan_limit_reached",
-                        count: 2,
-                        paths: ["a.md", "b.md"],
-                        pausedUntil: "2026-09-28T13:00:00.000Z",
-                        fromPause: true,
-                    });
-                    return { ...shareResult, filesPlanLimited: 2, planLimitedPaths: ["a.md", "b.md"] };
-                }),
-                resolveDeletePolicy: () => "all",
-                emit: (event) => events.push(event),
-                ensureCompanyDir: vi.fn(),
-                telemetryClient: null,
-            });
-            expect(events).toContainEqual({
-                type: "plan-limit",
-                company: "acme",
-                upgradeUrl: "https://billing.example.test/company/acme",
-                message: "New files are paused while Acme is over its Starter limits.",
-                code: "PLAN_LIMIT_EXCEEDED",
-                error: "plan_limit_reached",
-                count: 2,
-                paths: ["a.md", "b.md"],
-                pausedUntil: "2026-09-28T13:00:00.000Z",
-                fromPause: true,
-            });
-            expect(events).toContainEqual(expect.objectContaining({ type: "complete", company: "acme", filesPlanLimited: 2, aborted: false }));
-            expect(result.errors).toEqual([]);
-            expect(result.stateByCompany.get("acme")?.status).toBe("complete");
-        }
-        finally {
-            fs.rmSync(hqRoot, { recursive: true, force: true });
-        }
-    });
-});
-describe("executeCompanyFanout — plan-limit-only pass over the real share() (US-012)", () => {
-    const T0 = Date.parse("2026-09-28T12:00:00.000Z");
-    let hqRoot;
-    let stateDir;
-    let previousStateDir;
-    const COMPANIES = {
-        cmp_01ACME: "acme",
-        cmp_02BETA: "beta",
-    };
-    function entityContextFor(uid) {
-        return {
-            uid,
-            slug: COMPANIES[uid],
-            bucketName: `hq-vault-${COMPANIES[uid]}`,
-            region: "us-east-1",
-            credentials: {
-                accessKeyId: "ASIA_PRE_VENDED",
-                secretAccessKey: "pre-vended-secret",
-                sessionToken: "pre-vended-session",
-            },
-            expiresAt: new Date(Date.now() + 15 * 60 * 1000).toISOString(),
-        };
-    }
-    beforeEach(() => {
-        setPlanLimitPauseClockForTesting(() => T0);
-        hqRoot = fs.mkdtempSync(path.join(os.tmpdir(), "hq-fanout-plan-limit-real-"));
-        stateDir = fs.mkdtempSync(path.join(os.tmpdir(), "hq-fanout-plan-limit-state-"));
-        previousStateDir = process.env.HQ_STATE_DIR;
-        process.env.HQ_STATE_DIR = stateDir;
-        vi.mocked(headRemoteFile).mockReset();
-        vi.mocked(headRemoteFile).mockResolvedValue(null);
-        vi.mocked(deleteRemoteFile).mockClear();
-        // Acme is over storage: every PUT is refused with the server's canonical
-        // 402 body, mapped exactly as the vault client maps it. Beta is healthy.
-        vi.mocked(uploadFile).mockReset();
-        vi.mocked(uploadFile).mockImplementation(async (ctx) => {
-            if (ctx.uid === "cmp_01ACME") {
-                throw vaultErrorFromResponse(402, JSON.stringify(canonicalPlanLimitBody()));
-            }
-            return { etag: '"upload-etag"' };
-        });
-    });
-    afterEach(() => {
-        setPlanLimitPauseClockForTesting(null);
-        vi.mocked(uploadFile).mockReset();
-        vi.mocked(uploadFile).mockResolvedValue({ etag: '"upload-etag"' });
-        fs.rmSync(hqRoot, { recursive: true, force: true });
-        fs.rmSync(stateDir, { recursive: true, force: true });
-        if (previousStateDir === undefined)
-            delete process.env.HQ_STATE_DIR;
-        else
-            process.env.HQ_STATE_DIR = previousStateDir;
-    });
-    it("settles the company complete, still runs its delete and pull, and still syncs other companies", async () => {
-        for (const [name, body] of [
-            ["acme/docs/new-1.md", "one"],
-            ["acme/docs/new-2.md", "two"],
-            ["beta/docs/ok.md", "ok"],
-        ]) {
-            const abs = path.join(hqRoot, "companies", name);
-            fs.mkdirSync(path.dirname(abs), { recursive: true });
-            fs.writeFileSync(abs, body);
-        }
-        // A file acme synced earlier and has since deleted locally: its remote
-        // delete must still run even though every upload is refused.
-        const gone = path.join(hqRoot, "companies", "acme", "docs", "gone.md");
-        fs.writeFileSync(gone, "gone");
-        const goneStat = fs.statSync(gone);
-        const journal = readJournal("acme");
-        journal.files["docs/gone.md"] = {
-            hash: hashFile(gone),
-            size: goneStat.size,
-            syncedAt: "2026-09-27T12:00:00.000Z",
-            direction: "up",
-            remoteEtag: "gone-etag",
-            mtimeMs: goneStat.mtimeMs,
-            ctimeMs: goneStat.ctimeMs,
-        };
-        const { writeJournal } = await import("../journal.js");
-        writeJournal("acme", journal);
-        fs.rmSync(gone);
-        // The remote still holds the journaled version, so the delete is current.
-        vi.mocked(headRemoteFile).mockImplementation(async (_ctx, key) => key === "docs/gone.md"
-            ? { lastModified: new Date("2026-09-27T12:00:00.000Z"), etag: '"gone-etag"', size: goneStat.size }
-            : null);
-        const pullResult = {
-            filesDownloaded: 0,
-            bytesDownloaded: 0,
-            filesSkipped: 0,
-            conflicts: 0,
-            conflictPaths: [],
-            aborted: false,
-            newFiles: [],
-            newFilesCount: 0,
-            filesExcludedByPolicy: 0,
-            filesTombstoned: 0,
-            filesOutOfScope: 0,
-            scopeOrphansRemoved: 0,
-            scopeOrphansBlocked: 0,
-            changedPaths: [],
-        };
-        const syncFn = vi.fn(async (_options) => pullResult);
-        const events = [];
-        const result = await executeCompanyFanout({
-            plan: [
-                { uid: "cmp_01ACME", slug: "acme" },
-                { uid: "cmp_02BETA", slug: "beta" },
-            ],
-            direction: "both",
-            hqRoot,
-            onConflict: "abort",
-            client: {},
-            vaultConfig: { apiUrl: "https://api.example", authToken: "access-token" },
-            fetchFileTombstones: vi.fn().mockResolvedValue(new Map()),
-            syncFn,
-            shareFn: ({ vaultConfig: _vaultConfig, company, ...rest }) => share({
-                ...rest,
-                entityContext: entityContextFor(company),
-            }),
-            // The runner's default delete policy.
-            resolveDeletePolicy: () => "currency-gated",
-            emit: (event) => events.push(event),
-            ensureCompanyDir: vi.fn(),
-            telemetryClient: null,
-        });
-        // Not a failure: no errors, no company failures, both companies complete.
-        expect(result.errors).toEqual([]);
-        expect(result.companyFailures).toEqual([]);
-        expect(result.transientCompanies).toEqual([]);
-        expect(result.stateByCompany.get("acme")?.status).toBe("complete");
-        expect(result.stateByCompany.get("beta")?.status).toBe("complete");
-        expect(events.filter((e) => e.type === "error" && !("diagnostic" in e && e.diagnostic))).toEqual([]);
-        // One plan-limit event for acme, with the refused files and the link.
-        const notices = events.filter((e) => e.type === "plan-limit");
-        expect(notices).toEqual([
-            expect.objectContaining({
-                type: "plan-limit",
-                company: "acme",
-                upgradeUrl: PLAN_LIMIT_UPGRADE_URL,
-                count: 2,
-                paths: expect.arrayContaining(["docs/new-1.md", "docs/new-2.md"]),
-                message: "New files are paused while Acme is over its Starter limits.",
-                error: "plan_limit_reached",
-                code: "PLAN_LIMIT_EXCEEDED",
-                fromPause: false,
-            }),
-        ]);
-        expect(events).toContainEqual(expect.objectContaining({
-            type: "complete",
-            company: "acme",
-            filesPlanLimited: 2,
-            filesUploaded: 0,
-            filesRefusedStale: 0,
-            aborted: false,
-        }));
-        expect(events).toContainEqual(expect.objectContaining({ type: "complete", company: "beta", filesPlanLimited: 0, filesUploaded: 1 }));
-        // Deletes and pulls still ran for the plan-limited company.
-        expect(vi.mocked(deleteRemoteFile)).toHaveBeenCalledWith(expect.objectContaining({ uid: "cmp_01ACME" }), "docs/gone.md");
-        expect(syncFn.mock.calls.map(([o]) => o.company).sort()).toEqual(["cmp_01ACME", "cmp_02BETA"]);
-    });
-});
-describe("executeCompanyFanout — not-shipped event forwarding", () => {
-    it("preserves a company skill validation message", async () => {
-        const hqRoot = fs.mkdtempSync(path.join(os.tmpdir(), "hq-fanout-skill-validation-"));
-        const events = [];
-        const shareResult = {
-            filesUploaded: 0,
-            bytesUploaded: 0,
-            filesSkipped: 1,
-            filesDeleted: 0,
-            filesTombstoned: 0,
-            filesRefusedStale: 0,
-            filesRefusedStalePaths: [],
-            filesSuppressedByTombstone: 0,
-            filesExcludedByPolicy: 0,
-            filesExcludedByScope: 0,
-            filesExcludedByIgnore: 0,
-            unreachablePaths: [],
-            linkedSubtreesNotShipped: [],
-            conflictPaths: [],
-            aborted: false,
-        };
-        fs.mkdirSync(path.join(hqRoot, "personal"), { recursive: true });
-        try {
-            await executeCompanyFanout({
-                plan: [{ uid: "prs_1", slug: "personal", personalMode: true }],
-                direction: "push",
-                hqRoot,
-                onConflict: "abort",
-                client: {},
-                vaultConfig: { apiUrl: "https://api.example", authToken: "access-token" },
-                syncFn: vi.fn(),
-                shareFn: vi.fn(async (options) => {
-                    options.onEvent?.({
-                        type: "not-shipped",
-                        reason: "skill-registration-invalid",
-                        count: 1,
-                        samplePaths: ["skills/invalid-frontmatter/SKILL.md"],
-                        message: "frontmatter.name is required",
-                    });
-                    return shareResult;
-                }),
-                resolveDeletePolicy: () => "all",
-                emit: (event) => events.push(event),
-                ensureCompanyDir: vi.fn(),
-                telemetryClient: null,
-            });
-            expect(events).toContainEqual({
-                type: "not-shipped",
-                company: "personal",
-                reason: "skill-registration-invalid",
-                count: 1,
-                samplePaths: ["skills/invalid-frontmatter/SKILL.md"],
-                message: "frontmatter.name is required",
-            });
-        }
-        finally {
-            fs.rmSync(hqRoot, { recursive: true, force: true });
-        }
-    });
-});
-describe("executeCompanyFanout — personal-vault journal purge forwarding", () => {
-    const shareResult = {
-        filesUploaded: 0,
-        bytesUploaded: 0,
-        filesSkipped: 0,
-        filesDeleted: 0,
-        filesTombstoned: 0,
-        filesRefusedStale: 0,
-        filesRefusedStalePaths: [],
-        filesSuppressedByTombstone: 0,
-        filesExcludedByPolicy: 0,
-        filesExcludedByScope: 0,
-        filesExcludedByIgnore: 0,
-        unreachablePaths: [],
-        linkedSubtreesNotShipped: [],
-        conflictPaths: [],
-        aborted: false,
-    };
-    async function runPersonalPush(emitFromShare) {
-        const hqRoot = fs.mkdtempSync(path.join(os.tmpdir(), "hq-fanout-journal-purge-"));
-        fs.mkdirSync(path.join(hqRoot, "personal"), { recursive: true });
-        const events = [];
-        try {
-            const result = await executeCompanyFanout({
-                plan: [{ uid: "prs_1", slug: "personal", personalMode: true }],
-                direction: "push",
-                hqRoot,
-                onConflict: "abort",
-                client: {},
-                vaultConfig: { apiUrl: "https://api.example", authToken: "access-token" },
-                syncFn: vi.fn(),
-                shareFn: vi.fn(async (options) => {
-                    emitFromShare(options);
-                    return shareResult;
-                }),
-                resolveDeletePolicy: () => "all",
-                emit: (event) => events.push(event),
-                ensureCompanyDir: vi.fn(),
-                telemetryClient: null,
-            });
-            return { result, events };
-        }
-        finally {
-            fs.rmSync(hqRoot, { recursive: true, force: true });
-        }
-    }
-    it("forwards a pruned event with the company label, counts by reason and a few sample paths", async () => {
-        // The purge's success path was invisible in watch mode: only the vetoed
-        // (`purge-skipped`) branch was forwarded, so a 25k-row drain per full pass
-        // (hq-cloud 6.16.12, reason `ignore-filtered-present`) left no trace in
-        // ~/.hq/logs/hq-sync.log. Forward the pruned event too — count, byReason and
-        // a bounded sample — so an operator can see the journal shrinking.
-        const samplePaths = Array.from({ length: 10 }, (_, i) => `workspace/.session-logs/claude/s-${i}.jsonl`);
-        const { result, events } = await runPersonalPush((options) => {
-            options.onEvent?.({
-                type: "personal-vault-journal-pruned",
-                count: 25_000,
-                samplePaths,
-                byReason: { "ignore-filtered": 0, "ignore-filtered-present": 25_000, "excluded-top-level": 0 },
-            });
-        });
-        expect(events).toContainEqual({
-            type: "personal-vault-journal-pruned",
-            company: "personal",
-            count: 25_000,
-            samplePaths: samplePaths.slice(0, 5),
-            byReason: { "ignore-filtered": 0, "ignore-filtered-present": 25_000, "excluded-top-level": 0 },
-        });
-        expect(result.errors).toEqual([]);
-        expect(events.some((e) => e.type === "error")).toBe(false);
-        expect(result.stateByCompany.get("personal")?.status).toBe("complete");
-    });
-    it("still forwards the vetoed purge with the company label", async () => {
-        const { result, events } = await runPersonalPush((options) => {
-            options.onEvent?.({
-                type: "personal-vault-journal-purge-skipped",
-                attempted: 400_000,
-                totalRows: 512_560,
-            });
-        });
-        expect(events).toContainEqual({
-            type: "personal-vault-journal-purge-skipped",
-            company: "personal",
-            attempted: 400_000,
-            totalRows: 512_560,
-        });
-        expect(result.errors).toEqual([]);
-    });
-});
-describe("executeCompanyFanout scope fairness", () => {
-    it("starts a personal-vault push while a company-vault push is still in flight", async () => {
-        const hqRoot = fs.mkdtempSync(path.join(os.tmpdir(), "hq-fanout-fairness-"));
-        fs.mkdirSync(path.join(hqRoot, "personal"), { recursive: true });
-        fs.mkdirSync(path.join(hqRoot, "companies", "indigo"), { recursive: true });
-        fs.writeFileSync(path.join(hqRoot, "personal", "changed.md"), "personal");
-        fs.writeFileSync(path.join(hqRoot, "companies", "indigo", "changed.md"), "company");
-        let releaseCompanyPush;
-        const companyPush = new Promise((resolve) => {
-            releaseCompanyPush = resolve;
-        });
-        let personalPushStarted = false;
-        const shareResult = {
-            filesUploaded: 0,
-            bytesUploaded: 0,
-            filesSkipped: 0,
-            filesDeleted: 0,
-            filesTombstoned: 0,
-            filesRefusedStale: 0,
-            filesRefusedStalePaths: [],
-            filesSuppressedByTombstone: 0,
-            filesExcludedByPolicy: 0,
-            filesExcludedByScope: 0,
-            filesExcludedByIgnore: 0,
-            unreachablePaths: [],
-            linkedSubtreesNotShipped: [],
-            conflictPaths: [],
-            aborted: false,
-        };
-        const shareFn = vi.fn(async (opts) => {
-            if (opts.personalMode === true) {
-                personalPushStarted = true;
-                return shareResult;
-            }
-            await companyPush;
-            return shareResult;
-        });
-        try {
-            const running = executeCompanyFanout({
-                plan: [
-                    { uid: "cmp_indigo", slug: "indigo" },
-                    {
-                        uid: "prs_me",
-                        slug: "personal",
-                        personalMode: true,
-                        journalSlug: "__hq_personal_vault__",
-                    },
-                ],
-                direction: "push",
-                hqRoot,
-                onConflict: "abort",
-                client: {},
-                vaultConfig: { apiUrl: "https://api.example", authToken: "access-token" },
-                syncFn: vi.fn(),
-                shareFn,
-                resolveDeletePolicy: () => "all",
-                emit: vi.fn(),
-                ensureCompanyDir: vi.fn(),
-                telemetryClient: null,
-            });
-            await Promise.resolve();
-            await Promise.resolve();
-            expect(personalPushStarted).toBe(true);
-            releaseCompanyPush?.();
-            await running;
-        }
-        finally {
-            releaseCompanyPush?.();
-            fs.rmSync(hqRoot, { recursive: true, force: true });
-        }
-    });
-});
-describe("executeCompanyFanout transfer ceiling", () => {
-    it("keeps concurrent targets at HQ_SYNC_MAX_CONCURRENCY transfers in total", async () => {
-        const oldCap = process.env.HQ_SYNC_MAX_CONCURRENCY;
-        process.env.HQ_SYNC_MAX_CONCURRENCY = "2";
-        setBandwidthGovernorForTesting(null);
-        let inFlight = 0;
-        let observedMaximum = 0;
-        let releaseTransfers;
-        const transfersMayFinish = new Promise((resolve) => {
-            releaseTransfers = resolve;
-        });
-        const shareResult = {
-            filesUploaded: 0, bytesUploaded: 0, filesSkipped: 0, filesDeleted: 0,
-            filesTombstoned: 0, filesRefusedStale: 0, filesRefusedStalePaths: [],
-            filesSuppressedByTombstone: 0, filesExcludedByPolicy: 0,
-            filesExcludedByScope: 0, filesExcludedByIgnore: 0, unreachablePaths: [],
-            linkedSubtreesNotShipped: [], conflictPaths: [], aborted: false,
-        };
-        const shareFn = vi.fn(async (options) => {
-            expect(options.transferSemaphore).toBeDefined();
-            await Promise.all(Array.from({ length: 3 }, () => options.transferSemaphore.withPermit(async () => {
-                inFlight += 1;
-                observedMaximum = Math.max(observedMaximum, inFlight);
-                await transfersMayFinish;
-                inFlight -= 1;
-            })));
-            return shareResult;
-        });
-        try {
-            const running = executeCompanyFanout({
-                plan: [
-                    { uid: "cmp_acme", slug: "acme" },
-                    { uid: "cmp_beta", slug: "beta" },
-                ],
-                direction: "push",
-                hqRoot: "/tmp/global-transfer-cap",
-                onConflict: "abort",
-                client: {},
-                vaultConfig: { apiUrl: "https://api.example", authToken: "access-token" },
-                syncFn: vi.fn(),
-                shareFn,
-                resolveDeletePolicy: () => "all",
-                emit: vi.fn(),
-                ensureCompanyDir: vi.fn(),
-            });
-            await Promise.resolve();
-            await Promise.resolve();
-            expect(observedMaximum).toBe(2);
-            releaseTransfers?.();
-            await running;
-            expect(observedMaximum).toBeLessThanOrEqual(2);
-        }
-        finally {
-            releaseTransfers?.();
-            if (oldCap === undefined)
-                delete process.env.HQ_SYNC_MAX_CONCURRENCY;
-            else
-                process.env.HQ_SYNC_MAX_CONCURRENCY = oldCap;
-            setBandwidthGovernorForTesting(null);
-        }
-    });
-});
-describe("executeCompanyFanout tombstone snapshot", () => {
-    it("shares one personal deletion set between push and pull in a combined pass", async () => {
-        const hqRoot = fs.mkdtempSync(path.join(os.tmpdir(), "hq-fanout-tombstones-"));
-        const deletedAt = "2026-08-22T12:00:00.000Z";
-        const fetchMock = vi.fn(async (_url) => ({
-            ok: true,
-            status: 200,
-            json: async () => ({
-                tombstones: [{ key: "knowledge/deleted.md", deletedAt }],
-            }),
-        }));
-        vi.stubGlobal("fetch", fetchMock);
-        const pushResult = {
-            filesUploaded: 0,
-            bytesUploaded: 0,
-            filesSkipped: 0,
-            filesDeleted: 0,
-            filesTombstoned: 0,
-            filesRefusedStale: 0,
-            filesRefusedStalePaths: [],
-            filesSuppressedByTombstone: 0,
-            filesExcludedByPolicy: 0,
-            filesExcludedByScope: 0,
-            filesExcludedByIgnore: 0,
-            unreachablePaths: [],
-            linkedSubtreesNotShipped: [],
-            conflictPaths: [],
-            aborted: false,
-        };
-        const pullResult = {
-            filesDownloaded: 0,
-            bytesDownloaded: 0,
-            filesSkipped: 0,
-            conflicts: 0,
-            conflictPaths: [],
-            aborted: false,
-            newFiles: [],
-            newFilesCount: 0,
-            filesExcludedByPolicy: 0,
-            filesTombstoned: 0,
-            filesOutOfScope: 0,
-            scopeOrphansRemoved: 0,
-            scopeOrphansBlocked: 0,
-            changedPaths: [],
-        };
-        const shareFn = vi.fn(async (_options) => pushResult);
-        const syncFn = vi.fn(async (_options) => pullResult);
-        try {
-            await executeCompanyFanout({
-                plan: [{ uid: "prs_1", slug: "personal", personalMode: true }],
-                direction: "both",
-                hqRoot,
-                onConflict: "abort",
-                client: {},
-                vaultConfig: { apiUrl: "https://api.example", authToken: "access-token" },
-                syncFn,
-                shareFn,
-                resolveDeletePolicy: () => "all",
-                emit: vi.fn(),
-                ensureCompanyDir: vi.fn(),
-                telemetryClient: null,
-            });
-            const pushTombstones = shareFn.mock.calls[0][0].fileTombstones;
-            const pullTombstones = syncFn.mock.calls[0][0].fileTombstones;
-            expect(pushTombstones).toBe(pullTombstones);
-            expect(pushTombstones?.get("knowledge/deleted.md")).toEqual({ deletedAt });
-            expect(fetchMock).toHaveBeenCalledTimes(1);
-            expect(String(fetchMock.mock.calls[0][0])).toBe("https://api.example/v1/files/tombstones?personal=1");
-        }
-        finally {
-            vi.unstubAllGlobals();
-            fs.rmSync(hqRoot, { recursive: true, force: true });
-        }
-    });
-});
-describe("executeCompanyFanout — Windows symlink-privilege skip (HQ-DESKTOP-54)", () => {
-    it("re-emits the skip with the company label, never errors the company, and keeps it complete", async () => {
-        // A privilege-refused symlink surfaces from the pull leg as the dedicated
-        // skip event. The fanout must re-tag it with the company and pass it
-        // through WITHOUT recording an error — so `errors[]` stays empty (runner
-        // exit 0) and the company settles `complete`. personalMode avoids the
-        // network scope resolution so the leg reaches the injected syncFn directly.
-        const hqRoot = fs.mkdtempSync(path.join(os.tmpdir(), "hq-fanout-symlink-"));
-        try {
-            const events = [];
-            const skipResult = {
-                filesDownloaded: 0,
-                bytesDownloaded: 0,
-                filesSkipped: 1,
-                conflicts: 0,
-                conflictPaths: [],
-                aborted: false,
-                newFiles: [],
-                newFilesCount: 0,
-                filesExcludedByPolicy: 0,
-                filesTombstoned: 0,
-                filesOutOfScope: 0,
-                scopeOrphansRemoved: 0,
-                scopeOrphansBlocked: 0,
-            };
-            const syncFn = vi.fn(async (opts) => {
-                opts.onEvent?.({
-                    type: "skip-symlink-privilege",
-                    path: "docs/skill-link.md",
-                    target: "../target.md",
-                    remedy: "enable Developer Mode",
-                });
-                return skipResult;
-            });
-            const result = await executeCompanyFanout({
-                plan: [{ uid: "prs_1", slug: "personal", personalMode: true }],
-                direction: "pull",
-                hqRoot,
-                onConflict: "abort",
-                client: {},
-                vaultConfig: { apiUrl: "https://api.example", authToken: "access-token" },
-                syncFn,
-                shareFn: vi.fn(),
-                resolveDeletePolicy: () => "all",
-                emit: (e) => events.push(e),
-                ensureCompanyDir: vi.fn(),
-                telemetryClient: null,
-            });
-            // Re-emitted with the company label, verbatim payload preserved.
-            expect(events).toContainEqual({
-                type: "skip-symlink-privilege",
-                company: "personal",
-                path: "docs/skill-link.md",
-                target: "../target.md",
-                remedy: "enable Developer Mode",
-            });
-            // The load-bearing guarantee: no error recorded anywhere.
-            expect(result.errors).toEqual([]);
-            expect(result.companyFailures).toEqual([]);
-            expect(events.some((e) => e.type === "error")).toBe(false);
-            // The company settled `complete`, not `errored`.
-            expect(result.stateByCompany.get("personal")?.status).toBe("complete");
-        }
-        finally {
-            fs.rmSync(hqRoot, { recursive: true, force: true });
-        }
-    });
-});
-describe("executeCompanyFanout — archived session-log skip", () => {
-    it("re-emits the skip with the company label and never errors the company", async () => {
-        // The push leg refuses to adopt a DEEP_ARCHIVE session transcript (its body
-        // cannot be fetched) and reports the deliberate skip. The fanout must pass
-        // it through re-tagged with the company, off errors[], so the company still
-        // settles `complete` and the runner keeps exit 0.
-        const hqRoot = fs.mkdtempSync(path.join(os.tmpdir(), "hq-fanout-archived-"));
-        try {
-            const events = [];
-            const skipResult = {
-                filesDownloaded: 0,
-                bytesDownloaded: 0,
-                filesSkipped: 1,
-                conflicts: 0,
-                conflictPaths: [],
-                aborted: false,
-                newFiles: [],
-                newFilesCount: 0,
-                filesExcludedByPolicy: 0,
-                filesTombstoned: 0,
-                filesOutOfScope: 0,
-                scopeOrphansRemoved: 0,
-                scopeOrphansBlocked: 0,
-            };
-            const syncFn = vi.fn(async (opts) => {
-                opts.onEvent?.({
-                    type: "skip-archived-session-log",
-                    path: "workspace/.session-logs/codex/2026/08/20/rollout-r1.jsonl",
-                });
-                return skipResult;
-            });
-            const result = await executeCompanyFanout({
-                plan: [{ uid: "prs_1", slug: "personal", personalMode: true }],
-                direction: "pull",
-                hqRoot,
-                onConflict: "keep",
-                client: {},
-                vaultConfig: { apiUrl: "https://api.example", authToken: "access-token" },
-                syncFn,
-                shareFn: vi.fn(),
-                resolveDeletePolicy: () => "all",
-                emit: (e) => events.push(e),
-                ensureCompanyDir: vi.fn(),
-                telemetryClient: null,
-            });
-            expect(events).toContainEqual({
-                type: "skip-archived-session-log",
-                company: "personal",
-                path: "workspace/.session-logs/codex/2026/08/20/rollout-r1.jsonl",
-            });
-            expect(result.errors).toEqual([]);
-            expect(result.companyFailures).toEqual([]);
-            expect(events.some((e) => e.type === "error")).toBe(false);
-            expect(result.stateByCompany.get("personal")?.status).toBe("complete");
-        }
-        finally {
-            fs.rmSync(hqRoot, { recursive: true, force: true });
-        }
-    });
-});
-describe("executeCompanyFanout — diagnostic tombstone HEAD deferral", () => {
-    it("does not error the company when the only events are diagnostic tombstone deferrals", async () => {
-        // A vault 100/hr throttle during planned-deletion HEAD verify is
-        // emitted as `{ type: "error", diagnostic: true }`. The fanout must
-        // forward that marker and leave errors[] empty so the company
-        // settles `complete` and the runner keeps exit 0 (never 2).
-        const hqRoot = fs.mkdtempSync(path.join(os.tmpdir(), "hq-fanout-tombstone-"));
-        try {
-            const events = [];
-            const pullResult = {
-                filesDownloaded: 0,
-                bytesDownloaded: 0,
-                filesSkipped: 0,
-                conflicts: 0,
-                conflictPaths: [],
-                aborted: false,
-                newFiles: [],
-                newFilesCount: 0,
-                filesExcludedByPolicy: 0,
-                filesTombstoned: 0,
-                filesOutOfScope: 0,
-                scopeOrphansRemoved: 0,
-                scopeOrphansBlocked: 0,
-            };
-            const syncFn = vi.fn(async (opts) => {
-                opts.onEvent?.({
-                    type: "error",
-                    diagnostic: true,
-                    path: "skills/wbr-finalize/SKILL.md",
-                    message: "tombstone HEAD verify failed (deferring): RateLimited rate limited (100/hr) — get skills/wbr-finalize/SKILL.md deferred to next sync",
-                });
-                return pullResult;
-            });
-            const result = await executeCompanyFanout({
-                plan: [{ uid: "prs_1", slug: "personal", personalMode: true }],
-                direction: "pull",
-                hqRoot,
-                onConflict: "keep",
-                client: {},
-                vaultConfig: { apiUrl: "https://api.example", authToken: "access-token" },
-                syncFn,
-                shareFn: vi.fn(),
-                resolveDeletePolicy: () => "all",
-                emit: (e) => events.push(e),
-                ensureCompanyDir: vi.fn(),
-                telemetryClient: null,
-            });
-            expect(events).toContainEqual({
-                type: "error",
-                diagnostic: true,
-                company: "personal",
-                path: "skills/wbr-finalize/SKILL.md",
-                message: "tombstone HEAD verify failed (deferring): RateLimited rate limited (100/hr) — get skills/wbr-finalize/SKILL.md deferred to next sync",
-            });
-            expect(result.errors).toEqual([]);
-            expect(result.companyFailures).toEqual([]);
-            expect(result.transientCompanies).toEqual([]);
-            expect(events.some((e) => e.type === "error" && e.diagnostic !== true)).toBe(false);
-            expect(result.stateByCompany.get("personal")?.status).toBe("complete");
-        }
-        finally {
-            fs.rmSync(hqRoot, { recursive: true, force: true });
-        }
-    });
-});
-describe("executeCompanyFanout — diagnostic rate-limited transfer deferral", () => {
-    it("does not error the company when the only events are diagnostic upload deferrals", async () => {
-        // A vault 100/hr throttle during a per-file PUT is emitted as
-        // `{ type: "error", diagnostic: true }`. The fanout must forward that
-        // marker and leave errors[] empty so the company settles `complete`
-        // and the runner keeps exit 0 (never 2).
-        const hqRoot = fs.mkdtempSync(path.join(os.tmpdir(), "hq-fanout-put-defer-"));
-        try {
-            const events = [];
-            const shareResult = {
-                filesUploaded: 0,
-                bytesUploaded: 0,
-                filesSkipped: 1,
-                filesDeleted: 0,
-                filesTombstoned: 0,
-                filesRefusedStale: 0,
-                filesRefusedStalePaths: [],
-                filesSuppressedByTombstone: 0,
-                filesExcludedByPolicy: 0,
-                filesExcludedByScope: 0,
-                filesExcludedByIgnore: 0,
-                unreachablePaths: [],
-                linkedSubtreesNotShipped: [],
-                conflictPaths: [],
-                aborted: false,
-            };
-            const shareFn = vi.fn(async (opts) => {
-                opts.onEvent?.({
-                    type: "error",
-                    diagnostic: true,
-                    path: "workers/concierge/output/mention-sweep-batches/1789110806_212549.json",
-                    message: "RateLimited rate limited (100/hr) — put workers/concierge/output/mention-sweep-batches/1789110806_212549.json deferred to next sync",
-                });
-                return shareResult;
-            });
-            const result = await executeCompanyFanout({
-                plan: [{ uid: "prs_1", slug: "mhi-media", personalMode: true }],
-                direction: "push",
-                hqRoot,
-                onConflict: "keep",
-                client: {},
-                vaultConfig: { apiUrl: "https://api.example", authToken: "access-token" },
-                syncFn: vi.fn(),
-                shareFn,
-                resolveDeletePolicy: () => "all",
-                emit: (e) => events.push(e),
-                ensureCompanyDir: vi.fn(),
-                telemetryClient: null,
-            });
-            expect(events).toContainEqual({
-                type: "error",
-                diagnostic: true,
-                company: "mhi-media",
-                path: "workers/concierge/output/mention-sweep-batches/1789110806_212549.json",
-                message: "RateLimited rate limited (100/hr) — put workers/concierge/output/mention-sweep-batches/1789110806_212549.json deferred to next sync",
-            });
-            expect(result.errors).toEqual([]);
-            expect(result.companyFailures).toEqual([]);
-            expect(result.transientCompanies).toEqual([]);
-            expect(events.some((e) => e.type === "error" && e.diagnostic !== true)).toBe(false);
-            expect(result.stateByCompany.get("mhi-media")?.status).toBe("complete");
-        }
-        finally {
-            fs.rmSync(hqRoot, { recursive: true, force: true });
-        }
-    });
-    it("does not error the company when the only events are a breaker-tripped upload-batch deferral", async () => {
-        // throwUploadWorkerErrors collapses an all-RateLimited worker batch into
-        // one `{ type: "error", diagnostic: true, path: "(company)" }`. Same
-        // contract as the per-file PUT deferral: errors[] stays empty, the
-        // company settles `complete`, the runner keeps exit 0 (never 2).
-        const hqRoot = fs.mkdtempSync(path.join(os.tmpdir(), "hq-fanout-put-batch-defer-"));
-        try {
-            const events = [];
-            const shareResult = {
-                filesUploaded: 0,
-                bytesUploaded: 0,
-                filesSkipped: 0,
-                filesDeleted: 0,
-                filesTombstoned: 0,
-                filesRefusedStale: 0,
-                filesRefusedStalePaths: [],
-                filesSuppressedByTombstone: 0,
-                filesExcludedByPolicy: 0,
-                filesExcludedByScope: 0,
-                filesExcludedByIgnore: 0,
-                unreachablePaths: [],
-                linkedSubtreesNotShipped: [],
-                conflictPaths: [],
-                aborted: false,
-            };
-            const shareFn = vi.fn(async (opts) => {
-                opts.onEvent?.({
-                    type: "error",
-                    diagnostic: true,
-                    path: "(company)",
-                    message: "RateLimited rate limited (100/hr) — get workers/concierge/output/mention-sweep-batches/1789110806_212549.json deferred to next sync (and 4915 more upload-worker errors)",
-                });
-                return shareResult;
-            });
-            const result = await executeCompanyFanout({
-                plan: [{ uid: "prs_1", slug: "brickcraft", personalMode: true }],
-                direction: "push",
-                hqRoot,
-                onConflict: "keep",
-                client: {},
-                vaultConfig: { apiUrl: "https://api.example", authToken: "access-token" },
-                syncFn: vi.fn(),
-                shareFn,
-                resolveDeletePolicy: () => "all",
-                emit: (e) => events.push(e),
-                ensureCompanyDir: vi.fn(),
-                telemetryClient: null,
-            });
-            expect(events).toContainEqual({
-                type: "error",
-                diagnostic: true,
-                company: "brickcraft",
-                path: "(company)",
-                message: "RateLimited rate limited (100/hr) — get workers/concierge/output/mention-sweep-batches/1789110806_212549.json deferred to next sync (and 4915 more upload-worker errors)",
-            });
-            expect(result.errors).toEqual([]);
-            expect(result.companyFailures).toEqual([]);
-            expect(result.transientCompanies).toEqual([]);
-            expect(events.some((e) => e.type === "error" && e.diagnostic !== true)).toBe(false);
-            expect(result.stateByCompany.get("brickcraft")?.status).toBe("complete");
-        }
-        finally {
-            fs.rmSync(hqRoot, { recursive: true, force: true });
-        }
-    });
-});
-describe("executeCompanyFanout — Windows rename-blocked skip (HQ-DESKTOP-54, second path)", () => {
-    it("re-emits the skip with the company label, never errors the company, and keeps it complete", async () => {
-        // A transient Windows rename refusal surfaces from the pull leg as the
-        // dedicated skip event. Same contract as the symlink skip: the fanout must
-        // re-tag it with the company and pass it through WITHOUT recording an error,
-        // so `errors[]` stays empty (runner exit 0) and the company settles
-        // `complete`.
-        const hqRoot = fs.mkdtempSync(path.join(os.tmpdir(), "hq-fanout-rename-"));
-        try {
-            const events = [];
-            const skipResult = {
-                filesDownloaded: 0,
-                bytesDownloaded: 0,
-                filesSkipped: 1,
-                conflicts: 0,
-                conflictPaths: [],
-                aborted: false,
-                newFiles: [],
-                newFilesCount: 0,
-                filesExcludedByPolicy: 0,
-                filesTombstoned: 0,
-                filesOutOfScope: 0,
-                scopeOrphansRemoved: 0,
-                scopeOrphansBlocked: 0,
-            };
-            const syncFn = vi.fn(async (opts) => {
-                opts.onEvent?.({
-                    type: "skip-rename-blocked",
-                    path: "projects/demo/note.md",
-                    remedy: "a program is holding this file open",
-                });
-                return skipResult;
-            });
-            const result = await executeCompanyFanout({
-                plan: [{ uid: "prs_1", slug: "personal", personalMode: true }],
-                direction: "pull",
-                hqRoot,
-                onConflict: "keep",
-                client: {},
-                vaultConfig: { apiUrl: "https://api.example", authToken: "access-token" },
-                syncFn,
-                shareFn: vi.fn(),
-                resolveDeletePolicy: () => "all",
-                emit: (e) => events.push(e),
-                ensureCompanyDir: vi.fn(),
-                telemetryClient: null,
-            });
-            // Re-emitted with the company label, verbatim payload preserved.
-            expect(events).toContainEqual({
-                type: "skip-rename-blocked",
-                company: "personal",
-                path: "projects/demo/note.md",
-                remedy: "a program is holding this file open",
-            });
-            // The load-bearing guarantee: no error recorded anywhere.
-            expect(result.errors).toEqual([]);
-            expect(result.companyFailures).toEqual([]);
-            expect(events.some((e) => e.type === "error")).toBe(false);
-            expect(result.stateByCompany.get("personal")?.status).toBe("complete");
-        }
-        finally {
-            fs.rmSync(hqRoot, { recursive: true, force: true });
-        }
-    });
-});
-describe("executeCompanyFanout — vanished-remote skip (LIST→GET race)", () => {
-    it("re-emits the skip with the company label, never errors the company, and keeps it complete", async () => {
-        // A short-lived inbox file that vanished between LIST and GET surfaces
-        // from the pull leg as skip-vanished-remote. The fanout must re-tag it
-        // with the company and pass it through WITHOUT recording an error — so
-        // `errors[]` stays empty (runner exit 0) and the company settles
-        // `complete`.
-        const hqRoot = fs.mkdtempSync(path.join(os.tmpdir(), "hq-fanout-vanished-"));
-        try {
-            const events = [];
-            const skipResult = {
-                filesDownloaded: 0,
-                bytesDownloaded: 0,
-                filesSkipped: 1,
-                conflicts: 0,
-                conflictPaths: [],
-                aborted: false,
-                newFiles: [],
-                newFilesCount: 0,
-                filesExcludedByPolicy: 0,
-                filesTombstoned: 0,
-                filesOutOfScope: 0,
-                scopeOrphansRemoved: 0,
-                scopeOrphansBlocked: 0,
-            };
-            const vanishedPath = "inbox/pending/jobrun-job-01M0ZP0F8P8BHW4F81X3DR2JKN-1789901775993.json";
-            const syncFn = vi.fn(async (opts) => {
-                opts.onEvent?.({
-                    type: "skip-vanished-remote",
-                    path: vanishedPath,
-                    message: "NoSuchKey http=404 The specified key does not exist.",
-                });
-                return skipResult;
-            });
-            const result = await executeCompanyFanout({
-                plan: [{ uid: "prs_1", slug: "personal", personalMode: true }],
-                direction: "pull",
-                hqRoot,
-                onConflict: "keep",
-                client: {},
-                vaultConfig: { apiUrl: "https://api.example", authToken: "access-token" },
-                syncFn,
-                shareFn: vi.fn(),
-                resolveDeletePolicy: () => "all",
-                emit: (e) => events.push(e),
-                ensureCompanyDir: vi.fn(),
-                telemetryClient: null,
-            });
-            expect(events).toContainEqual({
-                type: "skip-vanished-remote",
-                company: "personal",
-                path: vanishedPath,
-                message: "NoSuchKey http=404 The specified key does not exist.",
-            });
-            expect(result.errors).toEqual([]);
-            expect(result.companyFailures).toEqual([]);
-            expect(events.some((e) => e.type === "error")).toBe(false);
-            expect(result.stateByCompany.get("personal")?.status).toBe("complete");
-        }
-        finally {
-            fs.rmSync(hqRoot, { recursive: true, force: true });
-        }
-    });
-});
-describe("executeCompanyFanout — targeted pull narrowing (--scope-path)", () => {
-    const emptyResult = {
-        filesDownloaded: 0,
-        bytesDownloaded: 0,
-        filesSkipped: 0,
-        conflicts: 0,
-        conflictPaths: [],
-        aborted: false,
-        newFiles: [],
-        newFilesCount: 0,
-        filesExcludedByPolicy: 0,
-        filesTombstoned: 0,
-        filesOutOfScope: 0,
-        scopeOrphansRemoved: 0,
-        scopeOrphansBlocked: 0,
-    };
-    it("threads scopePaths into the pull leg as pullPrefixes", async () => {
-        const hqRoot = fs.mkdtempSync(path.join(os.tmpdir(), "hq-fanout-scoped-"));
-        try {
-            const syncFn = vi.fn(async (_opts) => emptyResult);
-            await executeCompanyFanout({
-                plan: [{ uid: "prs_1", slug: "personal", personalMode: true }],
-                direction: "pull",
-                hqRoot,
-                onConflict: "abort",
-                client: {},
-                vaultConfig: { apiUrl: "https://api.example", authToken: "access-token" },
-                syncFn,
-                shareFn: vi.fn(),
-                resolveDeletePolicy: () => "all",
-                emit: vi.fn(),
-                ensureCompanyDir: vi.fn(),
-                telemetryClient: null,
-                scopePaths: ["knowledge/a.md", "projects/x/"],
-            });
-            expect(syncFn).toHaveBeenCalledTimes(1);
-            expect(syncFn.mock.calls[0][0].pullPrefixes).toEqual([
-                "knowledge/a.md",
-                "projects/x/",
-            ]);
-        }
-        finally {
-            fs.rmSync(hqRoot, { recursive: true, force: true });
-        }
-    });
-    it("threads event content hashes into the same scoped pull leg", async () => {
-        const hqRoot = fs.mkdtempSync(path.join(os.tmpdir(), "hq-fanout-scoped-hash-"));
-        const contentHash = `sha256:${"a".repeat(64)}`;
-        try {
-            const syncFn = vi.fn(async (_opts) => emptyResult);
-            await executeCompanyFanout({
-                plan: [{ uid: "prs_1", slug: "personal", personalMode: true }],
-                direction: "pull",
-                hqRoot,
-                onConflict: "abort",
-                client: {},
-                vaultConfig: { apiUrl: "https://api.example", authToken: "access-token" },
-                syncFn,
-                shareFn: vi.fn(),
-                resolveDeletePolicy: () => "all",
-                emit: vi.fn(),
-                ensureCompanyDir: vi.fn(),
-                telemetryClient: null,
-                scopePaths: ["knowledge/a.md"],
-                scopeContentHashes: { "knowledge/a.md": contentHash },
-            });
-            expect(syncFn).toHaveBeenCalledTimes(1);
-            expect(syncFn.mock.calls[0][0].pullPrefixes).toEqual(["knowledge/a.md"]);
-            expect(syncFn.mock.calls[0][0].pullContentHashes).toEqual({
-                "knowledge/a.md": contentHash,
-            });
-        }
-        finally {
-            fs.rmSync(hqRoot, { recursive: true, force: true });
-        }
-    });
-    it("omits pullPrefixes entirely when no scopePaths were passed (full pull preserved)", async () => {
-        const hqRoot = fs.mkdtempSync(path.join(os.tmpdir(), "hq-fanout-unscoped-"));
-        try {
-            const syncFn = vi.fn(async (_opts) => emptyResult);
-            await executeCompanyFanout({
-                plan: [{ uid: "prs_1", slug: "personal", personalMode: true }],
-                direction: "pull",
-                hqRoot,
-                onConflict: "abort",
-                client: {},
-                vaultConfig: { apiUrl: "https://api.example", authToken: "access-token" },
-                syncFn,
-                shareFn: vi.fn(),
-                resolveDeletePolicy: () => "all",
-                emit: vi.fn(),
-                ensureCompanyDir: vi.fn(),
-                telemetryClient: null,
-            });
-            expect(syncFn).toHaveBeenCalledTimes(1);
-            expect("pullPrefixes" in syncFn.mock.calls[0][0]).toBe(false);
-        }
-        finally {
-            fs.rmSync(hqRoot, { recursive: true, force: true });
-        }
-    });
-});
-describe("executeCompanyFanout — scoped push walk roots", () => {
-    const shareResult = {
-        filesUploaded: 0,
-        bytesUploaded: 0,
-        filesSkipped: 0,
-        filesDeleted: 0,
-        filesTombstoned: 0,
-        filesRefusedStale: 0,
-        filesRefusedStalePaths: [],
-        filesSuppressedByTombstone: 0,
-        filesExcludedByPolicy: 0,
-        filesExcludedByScope: 0,
-        filesExcludedByIgnore: 0,
-        unreachablePaths: [],
-        linkedSubtreesNotShipped: [],
-        conflictPaths: [],
-        aborted: false,
-    };
-    it("walks only three scoped files in a 10k-file personal fixture", async () => {
-        const hqRoot = fs.mkdtempSync(path.join(os.tmpdir(), "hq-scoped-push-walk-"));
-        const personalRoot = path.join(hqRoot, "personal");
-        fs.mkdirSync(personalRoot, { recursive: true });
-        const scopePaths = [
-            "personal/selected-a.md",
-            "personal/selected-b.md",
-            "personal/selected-c.md",
-        ];
-        for (const scopePath of scopePaths) {
-            fs.writeFileSync(path.join(hqRoot, scopePath), scopePath);
-        }
-        for (let index = 0; index < 10_000; index++) {
-            fs.writeFileSync(path.join(personalRoot, `unscoped-${index}.md`), "x");
-        }
-        let visitedEntries = 0;
-        const realReaddirSync = fs.readdirSync;
-        const readdirSpy = vi.spyOn(fs, "readdirSync").mockImplementation(((...args) => {
-            const entries = Reflect.apply(realReaddirSync, fs, args);
-            if (Array.isArray(entries))
-                visitedEntries += entries.length;
-            return entries;
-        }));
-        const shareFn = vi.fn(async (options) => {
-            await shareTesting.collectFiles(options.paths, hqRoot, hqRoot, () => true);
-            return shareResult;
-        });
-        try {
-            await executeCompanyFanout({
-                plan: [{ uid: "prs_1", slug: "personal", personalMode: true }],
-                direction: "push",
-                hqRoot,
-                onConflict: "abort",
-                client: {},
-                vaultConfig: { apiUrl: "https://api.example", authToken: "access-token" },
-                syncFn: vi.fn(),
-                shareFn,
-                resolveDeletePolicy: () => "all",
-                emit: vi.fn(),
-                ensureCompanyDir: vi.fn(),
-                telemetryClient: null,
-                scopePaths,
-            });
-            expect(shareFn).toHaveBeenCalledTimes(1);
-            expect(shareFn.mock.calls[0]?.[0].deleteScopeRoots).toEqual(scopePaths);
-            expect(shareFn.mock.calls[0]?.[0].scopedJournal).toBe(true);
-            expect(visitedEntries).toBeLessThanOrEqual(3);
-        }
-        finally {
-            readdirSpy.mockRestore();
-            fs.rmSync(hqRoot, { recursive: true, force: true });
-        }
-    });
-    it("walks a scoped directory but never a sibling subtree", async () => {
-        const hqRoot = fs.mkdtempSync(path.join(os.tmpdir(), "hq-scoped-push-dir-"));
-        const selectedDir = path.join(hqRoot, "personal", "selected");
-        const outsideDir = path.join(hqRoot, "personal", "outside");
-        fs.mkdirSync(selectedDir, { recursive: true });
-        fs.mkdirSync(outsideDir, { recursive: true });
-        fs.writeFileSync(path.join(selectedDir, "inside.md"), "inside");
-        fs.writeFileSync(path.join(outsideDir, "outside.md"), "outside");
-        const readDirs = [];
-        const realReaddirSync = fs.readdirSync;
-        const readdirSpy = vi.spyOn(fs, "readdirSync").mockImplementation(((...args) => {
-            readDirs.push(String(args[0]));
-            return Reflect.apply(realReaddirSync, fs, args);
-        }));
-        try {
-            await executeCompanyFanout({
-                plan: [{ uid: "prs_1", slug: "personal", personalMode: true }],
-                direction: "push",
-                hqRoot,
-                onConflict: "abort",
-                client: {},
-                vaultConfig: { apiUrl: "https://api.example", authToken: "access-token" },
-                syncFn: vi.fn(),
-                shareFn: async (options) => {
-                    await shareTesting.collectFiles(options.paths, hqRoot, hqRoot, () => true);
-                    return shareResult;
-                },
-                resolveDeletePolicy: () => "all",
-                emit: vi.fn(),
-                ensureCompanyDir: vi.fn(),
-                telemetryClient: null,
-                scopePaths: ["personal/selected/"],
-            });
-            expect(readDirs).toContain(selectedDir);
-            expect(readDirs).not.toContain(outsideDir);
-            expect(readDirs).not.toContain(path.join(hqRoot, "personal"));
-        }
-        finally {
-            readdirSpy.mockRestore();
-            fs.rmSync(hqRoot, { recursive: true, force: true });
-        }
-    });
-    it("walks a containing thread carve-out scope alongside a vault-root file", async () => {
-        const hqRoot = fs.mkdtempSync(path.join(os.tmpdir(), "hq-scoped-push-carveout-"));
-        const rootFile = path.join(hqRoot, "personal", "rtprobe.md");
-        const handoffFile = path.join(hqRoot, "workspace", "threads", "handoff.json");
-        const threadFile = path.join(hqRoot, "workspace", "threads", "x.json");
-        fs.mkdirSync(path.dirname(rootFile), { recursive: true });
-        fs.mkdirSync(path.dirname(threadFile), { recursive: true });
-        fs.writeFileSync(rootFile, "root");
-        fs.writeFileSync(threadFile, "thread");
-        fs.writeFileSync(handoffFile, JSON.stringify({ thread_path: "workspace/threads/x.json" }));
-        try {
-            const uploadedPaths = [];
-            await executeCompanyFanout({
-                plan: [{ uid: "prs_1", slug: "personal", personalMode: true }],
-                direction: "push",
-                hqRoot,
-                onConflict: "abort",
-                client: {},
-                vaultConfig: { apiUrl: "https://api.example", authToken: "access-token" },
-                syncFn: vi.fn(),
-                shareFn: async (options) => {
-                    uploadedPaths.push(...(await shareTesting.collectFiles(options.paths, hqRoot, hqRoot, () => true))
-                        .map((entry) => entry.relativePath));
-                    return shareResult;
-                },
-                resolveDeletePolicy: () => "all",
-                emit: vi.fn(),
-                ensureCompanyDir: vi.fn(),
-                telemetryClient: null,
-                scopePaths: ["personal/rtprobe.md", "workspace/threads/"],
-            });
-            expect(uploadedPaths).toContain("personal/rtprobe.md");
-            expect(uploadedPaths).toContain("workspace/threads/x.json");
-        }
-        finally {
-            fs.rmSync(hqRoot, { recursive: true, force: true });
-        }
-    });
-    it("routes an active continuity-thread event through the scoped personal push", async () => {
-        const hqRoot = fs.mkdtempSync(path.join(os.tmpdir(), "hq-scoped-thread-event-"));
-        const threadFile = path.join(hqRoot, "workspace", "threads", "x.json");
-        fs.mkdirSync(path.dirname(threadFile), { recursive: true });
-        fs.writeFileSync(threadFile, "thread");
-        fs.writeFileSync(path.join(hqRoot, "workspace", "threads", "handoff.json"), JSON.stringify({ thread_path: "workspace/threads/x.json" }));
-        try {
-            const clock = new FakeClock();
-            const batches = [];
-            const watcher = new TreeWatcher({
-                hqRoot,
-                personalMode: true,
-                debounceMs: 1,
-                clock,
-            });
-            watcher.onChange((_unused, batch) => {
-                if (batch)
-                    batches.push(batch);
-            });
-            watcher.handleEvent(threadFile, "change");
-            clock.advance(1);
-            expect(batches).toHaveLength(1);
-            const scopedArgv = buildScopedPushArgv({ kind: "personal" }, [...batches[0].paths.values()], []);
-            expect(scopedArgv).toContain("workspace/threads/x.json");
-            const uploadedPaths = [];
-            await executeCompanyFanout({
-                plan: [{ uid: "prs_1", slug: "personal", personalMode: true }],
-                direction: "push",
-                hqRoot,
-                onConflict: "abort",
-                client: {},
-                vaultConfig: { apiUrl: "https://api.example", authToken: "access-token" },
-                syncFn: vi.fn(),
-                shareFn: async (options) => {
-                    uploadedPaths.push(...(await shareTesting.collectFiles(options.paths, hqRoot, hqRoot, () => true))
-                        .map((entry) => entry.relativePath));
-                    return shareResult;
-                },
-                resolveDeletePolicy: () => "all",
-                emit: vi.fn(),
-                ensureCompanyDir: vi.fn(),
-                telemetryClient: null,
-                scopePaths: ["workspace/threads/x.json"],
-            });
-            expect(uploadedPaths).toContain("workspace/threads/x.json");
-        }
-        finally {
-            fs.rmSync(hqRoot, { recursive: true, force: true });
-        }
-    });
-    it("walks a nested session-log carve-out path without walking its sibling", async () => {
-        const hqRoot = fs.mkdtempSync(path.join(os.tmpdir(), "hq-scoped-push-session-logs-"));
-        const selected = path.join(hqRoot, "workspace", ".session-logs", "a", "b", "c.txt");
-        const sibling = path.join(hqRoot, "workspace", ".session-logs", "sibling.txt");
-        fs.mkdirSync(path.dirname(selected), { recursive: true });
-        fs.writeFileSync(selected, "selected");
-        fs.writeFileSync(sibling, "sibling");
-        try {
-            const uploadedPaths = [];
-            await executeCompanyFanout({
-                plan: [{ uid: "prs_1", slug: "personal", personalMode: true }],
-                direction: "push",
-                hqRoot,
-                onConflict: "abort",
-                client: {},
-                vaultConfig: { apiUrl: "https://api.example", authToken: "access-token" },
-                syncFn: vi.fn(),
-                shareFn: async (options) => {
-                    uploadedPaths.push(...(await shareTesting.collectFiles(options.paths, hqRoot, hqRoot, () => true))
-                        .map((entry) => entry.relativePath));
-                    return shareResult;
-                },
-                resolveDeletePolicy: () => "all",
-                emit: vi.fn(),
-                ensureCompanyDir: vi.fn(),
-                telemetryClient: null,
-                scopePaths: ["workspace/.session-logs/a/b/c.txt"],
-            });
-            expect(uploadedPaths).toEqual(["workspace/.session-logs/a/b/c.txt"]);
-        }
-        finally {
-            fs.rmSync(hqRoot, { recursive: true, force: true });
-        }
-    });
-    it("walks a scoped local-company path in the personal vault", async () => {
-        const hqRoot = fs.mkdtempSync(path.join(os.tmpdir(), "hq-scoped-push-company-"));
-        const companyFile = path.join(hqRoot, "companies", "acme", "knowledge", "x.md");
-        fs.mkdirSync(path.dirname(companyFile), { recursive: true });
-        fs.writeFileSync(companyFile, "company");
-        try {
-            const uploadedPaths = [];
-            await executeCompanyFanout({
-                plan: [{ uid: "prs_1", slug: "personal", personalMode: true }],
-                direction: "push",
-                hqRoot,
-                onConflict: "abort",
-                client: {},
-                vaultConfig: { apiUrl: "https://api.example", authToken: "access-token" },
-                syncFn: vi.fn(),
-                shareFn: async (options) => {
-                    uploadedPaths.push(...(await shareTesting.collectFiles(options.paths, hqRoot, hqRoot, () => true))
-                        .map((entry) => entry.relativePath));
-                    return shareResult;
-                },
-                resolveDeletePolicy: () => "all",
-                emit: vi.fn(),
-                ensureCompanyDir: vi.fn(),
-                telemetryClient: null,
-                scopePaths: ["companies/acme/knowledge/x.md"],
-            });
-            expect(uploadedPaths).toEqual(["companies/acme/knowledge/x.md"]);
-        }
-        finally {
-            fs.rmSync(hqRoot, { recursive: true, force: true });
-        }
-    });
-    it("reports an out-of-vault scope instead of silently omitting it", async () => {
-        const hqRoot = fs.mkdtempSync(path.join(os.tmpdir(), "hq-scoped-push-outside-"));
-        const emit = vi.fn();
-        try {
-            await executeCompanyFanout({
-                plan: [{ uid: "prs_1", slug: "personal", personalMode: true }],
-                direction: "push",
-                hqRoot,
-                onConflict: "abort",
-                client: {},
-                vaultConfig: { apiUrl: "https://api.example", authToken: "access-token" },
-                syncFn: vi.fn(),
-                shareFn: vi.fn(async () => shareResult),
-                resolveDeletePolicy: () => "all",
-                emit,
-                ensureCompanyDir: vi.fn(),
-                telemetryClient: null,
-                scopePaths: ["workspace/not-a-carve-out/x.json"],
-            });
-            expect(emit).toHaveBeenCalledWith({
-                type: "not-shipped",
-                company: "personal",
-                reason: "outside-vault-scope",
-                count: 1,
-                samplePaths: ["workspace/not-a-carve-out/x.json"],
-            });
-        }
-        finally {
-            fs.rmSync(hqRoot, { recursive: true, force: true });
-        }
-    });
-    it("retains a deleted thread carve-out path as a tombstone scope", async () => {
-        const hqRoot = fs.mkdtempSync(path.join(os.tmpdir(), "hq-scoped-push-thread-delete-"));
-        const handoffFile = path.join(hqRoot, "workspace", "threads", "handoff.json");
-        const threadFile = path.join(hqRoot, "workspace", "threads", "x.json");
-        fs.mkdirSync(path.dirname(threadFile), { recursive: true });
-        fs.writeFileSync(handoffFile, JSON.stringify({ thread_path: "workspace/threads/x.json" }));
-        try {
-            const shareFn = vi.fn(async (_options) => shareResult);
-            await executeCompanyFanout({
-                plan: [{ uid: "prs_1", slug: "personal", personalMode: true }],
-                direction: "push",
-                hqRoot,
-                onConflict: "abort",
-                client: {},
-                vaultConfig: { apiUrl: "https://api.example", authToken: "access-token" },
-                syncFn: vi.fn(),
-                shareFn,
-                resolveDeletePolicy: () => "all",
-                emit: vi.fn(),
-                ensureCompanyDir: vi.fn(),
-                telemetryClient: null,
-                scopePaths: ["workspace/threads/x.json"],
-                deleteScopePaths: ["workspace/threads/x.json"],
-            });
-            expect(shareFn.mock.calls[0]?.[0].deleteScopeRoots).toContain("workspace/threads/x.json");
-        }
-        finally {
-            fs.rmSync(hqRoot, { recursive: true, force: true });
-        }
-    });
-    it("keeps the full personal walk for an unscoped pass", async () => {
-        const hqRoot = fs.mkdtempSync(path.join(os.tmpdir(), "hq-full-push-walk-"));
-        const personalRoot = path.join(hqRoot, "personal");
-        fs.mkdirSync(personalRoot, { recursive: true });
-        for (let index = 0; index < 10_000; index++) {
-            fs.writeFileSync(path.join(personalRoot, `full-${index}.md`), "x");
-        }
-        let visitedEntries = 0;
-        const realReaddirSync = fs.readdirSync;
-        const readdirSpy = vi.spyOn(fs, "readdirSync").mockImplementation(((...args) => {
-            const entries = Reflect.apply(realReaddirSync, fs, args);
-            if (Array.isArray(entries))
-                visitedEntries += entries.length;
-            return entries;
-        }));
-        const shareFn = vi.fn(async (options) => {
-            await shareTesting.collectFiles(options.paths, hqRoot, hqRoot, () => true);
-            return shareResult;
-        });
-        try {
-            await executeCompanyFanout({
-                plan: [{ uid: "prs_1", slug: "personal", personalMode: true }],
-                direction: "push",
-                hqRoot,
-                onConflict: "abort",
-                client: {},
-                vaultConfig: { apiUrl: "https://api.example", authToken: "access-token" },
-                syncFn: vi.fn(),
-                shareFn,
-                resolveDeletePolicy: () => "all",
-                emit: vi.fn(),
-                ensureCompanyDir: vi.fn(),
-                telemetryClient: null,
-            });
-            expect(visitedEntries).toBeGreaterThanOrEqual(10_000);
-            expect(shareFn.mock.calls[0]?.[0].scopedJournal).toBeUndefined();
-        }
-        finally {
-            readdirSpy.mockRestore();
-            fs.rmSync(hqRoot, { recursive: true, force: true });
-        }
-    });
-    it("passes a combined reconcile checkpoint to the pull leg after the push succeeds", async () => {
-        const hqRoot = fs.mkdtempSync(path.join(os.tmpdir(), "hq-combined-reconcile-"));
-        const reconcileApply = { store: {}, cursor: {
-                routerVersion: 1,
-                epoch: "epoch-1",
-                areaId: "root:personal",
-                phase: "apply",
-            } };
-        let pullOptions;
-        const shareResult = {
-            filesUploaded: 0, bytesUploaded: 0, filesSkipped: 0, filesDeleted: 0,
-            filesTombstoned: 0, filesRefusedStale: 0, filesRefusedStalePaths: [],
-            filesSuppressedByTombstone: 0, filesExcludedByPolicy: 0,
-            filesExcludedByScope: 0, filesExcludedByIgnore: 0, unreachablePaths: [],
-            linkedSubtreesNotShipped: [], conflictPaths: [], aborted: false,
-        };
-        const syncResult = {
-            filesDownloaded: 0, bytesDownloaded: 0, filesSkipped: 0, conflicts: 0,
-            conflictPaths: [], aborted: false, newFiles: [], newFilesCount: 0,
-            filesExcludedByPolicy: 0, filesTombstoned: 0, filesOutOfScope: 0,
-            scopeOrphansRemoved: 0, scopeOrphansBlocked: 0, changedPaths: [],
-        };
-        try {
-            await executeCompanyFanout({
-                plan: [{ uid: "prs_1", slug: "personal", personalMode: true }],
-                direction: "both",
-                hqRoot,
-                onConflict: "abort",
-                client: {},
-                vaultConfig: { apiUrl: "https://api.example", authToken: "access-token" },
-                fetchFileTombstones: vi.fn(async () => new Map()),
-                shareFn: vi.fn(async () => shareResult),
-                syncFn: vi.fn(async (options) => {
-                    pullOptions = options;
-                    return syncResult;
-                }),
-                resolveDeletePolicy: () => "all",
-                emit: vi.fn(),
-                ensureCompanyDir: vi.fn(),
-                reconcileApplyForTarget: () => reconcileApply,
-            });
-            expect(pullOptions?.reconcileApply).toBe(reconcileApply);
-        }
-        finally {
-            fs.rmSync(hqRoot, { recursive: true, force: true });
-        }
-    });
-});
-describe("executeCompanyFanout — entity-fetch 429 (2026-09-18 Odin)", () => {
-    const vaultConfig = {
-        apiUrl: "https://vault-api.test",
-        authToken: "access-token",
-    };
-    const entity = {
-        uid: "cmp_01KQ2RYAHXHDPCTY9GPQPTH3DG",
-        slug: "indigo",
-        bucketName: "hq-vault-indigo",
-        status: "active",
-    };
-    const vend = {
-        credentials: {
-            accessKeyId: "ASIA_TEST",
-            secretAccessKey: "secret",
-            sessionToken: "session",
-            expiration: new Date(Date.now() + 15 * 60 * 1000).toISOString(),
-        },
-        expiresAt: new Date(Date.now() + 15 * 60 * 1000).toISOString(),
-    };
-    const runIndigoPull = async (syncFn) => {
-        const hqRoot = fs.mkdtempSync(path.join(os.tmpdir(), "hq-fanout-429-"));
-        const events = [];
-        try {
-            const result = await executeCompanyFanout({
-                plan: [{ uid: entity.uid, slug: "indigo" }],
-                direction: "pull",
-                hqRoot,
-                onConflict: "keep",
-                client: {},
-                vaultConfig,
-                syncFn,
-                shareFn: vi.fn(),
-                resolveDeletePolicy: () => "all",
-                emit: (e) => events.push(e),
-                ensureCompanyDir: vi.fn(),
-                telemetryClient: null,
-            });
-            return { result, events };
-        }
-        finally {
-            fs.rmSync(hqRoot, { recursive: true, force: true });
-        }
-    };
-    beforeEach(() => {
-        clearContextCache();
-        setEntityFetchSleepForTest(async () => undefined);
-    });
-    afterEach(() => {
-        setEntityFetchSleepForTest(undefined);
-        vi.unstubAllGlobals();
-    });
-    it("a 429 then success on retry yields a complete company sync", async () => {
-        let entityCalls = 0;
-        vi.stubGlobal("fetch", vi.fn(async (url) => {
-            const u = String(url);
-            if (u.includes(`/entity/${entity.uid}`)) {
-                entityCalls += 1;
-                if (entityCalls === 1) {
-                    return new Response(JSON.stringify({ message: "Too Many Requests" }), {
-                        status: 429,
-                    });
-                }
-                return new Response(JSON.stringify({ entity }), { status: 200 });
-            }
-            if (u.includes("/sts/vend")) {
-                return new Response(JSON.stringify(vend), { status: 200 });
-            }
-            return new Response("Not found", { status: 404 });
-        }));
-        const emptyPull = {
-            filesDownloaded: 0,
-            bytesDownloaded: 0,
-            filesSkipped: 0,
-            conflicts: 0,
-            conflictPaths: [],
-            aborted: false,
-            newFiles: [],
-            newFilesCount: 0,
-            filesExcludedByPolicy: 0,
-            filesTombstoned: 0,
-            filesOutOfScope: 0,
-            scopeOrphansRemoved: 0,
-            scopeOrphansBlocked: 0,
-            changedPaths: [],
-        };
-        const { result, events } = await runIndigoPull(async (opts) => {
-            await resolveEntityContext(opts.company ?? entity.uid, opts.vaultConfig);
-            return emptyPull;
-        });
-        expect(entityCalls).toBe(2);
-        expect(result.errors).toEqual([]);
-        expect(result.transientCompanies).toEqual([]);
-        expect(result.stateByCompany.get("indigo")?.status).toBe("complete");
-        expect(events.some((e) => e.type === "error")).toBe(false);
-        expect(events.some((e) => e.type === "transient-network")).toBe(false);
-    });
-});
-describe("executeCompanyFanout — mid-pass identity refusal (HQ-DESKTOP-5S)", () => {
-    // A mid-pass Cognito refusal surfaces from the leg (share.ts/sync.ts now
-    // rethrow it instead of recording a per-file error). personalMode avoids the
-    // network scope resolution so the leg reaches the injected syncFn directly.
-    const runWithRejectingPull = async (refusal) => {
-        const hqRoot = fs.mkdtempSync(path.join(os.tmpdir(), "hq-fanout-refusal-"));
-        const events = [];
-        try {
-            const result = await executeCompanyFanout({
-                plan: [{ uid: "prs_1", slug: "personal", personalMode: true }],
-                direction: "pull",
-                hqRoot,
-                onConflict: "abort",
-                client: {},
-                vaultConfig: { apiUrl: "https://api.example", authToken: "access-token" },
-                syncFn: vi.fn(async () => {
-                    throw refusal;
-                }),
-                shareFn: vi.fn(),
-                resolveDeletePolicy: () => "all",
-                emit: (e) => events.push(e),
-                ensureCompanyDir: vi.fn(),
-                telemetryClient: null,
-            });
-            return { result, events };
-        }
-        catch (thrown) {
-            return { thrown, events };
-        }
-        finally {
-            fs.rmSync(hqRoot, { recursive: true, force: true });
-        }
-    };
-    it("propagates a terminal identity refusal out of the fanout, never as an error", async () => {
-        const refusal = new CognitoRefreshError("Your HQ session needs a quick refresh. Sign in again to keep sync moving.", true, 401, "fp-terminal");
-        const { result, thrown, events } = await runWithRejectingPull(refusal);
-        // Rethrown like VaultAuthError — the caller (sync-runner) clears the session
-        // and emits one auth-error. It must NEVER be recorded as a company error.
-        expect(result).toBeUndefined();
-        expect(thrown).toBe(refusal);
-        expect(events.some((e) => e.type === "error")).toBe(false);
-        expect(events.some((e) => e.type === "complete")).toBe(false);
-    });
-    it("terminal also covers a bare CognitoAuthError (not a refresh failure)", async () => {
-        const refusal = new CognitoAuthError("interactive login required");
-        const { result, thrown, events } = await runWithRejectingPull(refusal);
-        expect(result).toBeUndefined();
-        expect(thrown).toBe(refusal);
-        expect(events.some((e) => e.type === "error")).toBe(false);
-    });
-    it("routes a retryable identity refusal to transientCompanies, leaving errors empty", async () => {
-        const refusal = new CognitoRefreshError("Cognito refresh failed (503): service unavailable", false, 503, "fp-retryable");
-        const { result, thrown, events } = await runWithRejectingPull(refusal);
-        expect(thrown).toBeUndefined();
-        expect(result?.errors).toEqual([]);
-        expect(result?.companyFailures).toEqual([]);
-        expect(result?.transientCompanies).toHaveLength(1);
-        expect(result?.transientCompanies[0].company).toBe("personal");
-        expect(result?.stateByCompany.get("personal")?.status).toBe("transient-network");
-        // Emitted as a transient-network signal, never as an error record.
-        expect(events.some((e) => e.type === "error")).toBe(false);
-        expect(events.some((e) => e.type === "transient-network" && e.company === "personal")).toBe(true);
-    });
-    it("still records a non-identity leg failure as a deterministic company error", async () => {
-        const boom = new Error("disk exploded");
-        const { result, thrown, events } = await runWithRejectingPull(boom);
-        expect(thrown).toBeUndefined();
-        expect(result?.errors).toHaveLength(1);
-        expect(result?.companyFailures).toHaveLength(1);
-        expect(result?.transientCompanies).toEqual([]);
-        expect(events.some((e) => e.type === "error" && e.company === "personal")).toBe(true);
-    });
-    it("names the vault file on a company-leg abort instead of path (company)", async () => {
-        // The undrdog 2026-09-11 event was
-        // {type:"error", path:"(company)", message:"VaultConflictError The landed skill…"}.
-        // A vault refusal that already named the file must keep that path on the
-        // runner event. A Node filesystem error's `.path` must NOT leak here.
-        const refusal = new VaultConflictError("The landed skill does not carry the registered identity for this path", {
-            code: "SKILL_REGISTER_LANDED_IDENTITY_MISMATCH",
-            path: "skills/workflow-preflight/SKILL.md",
-        });
-        const { result, thrown, events } = await runWithRejectingPull(refusal);
-        expect(thrown).toBeUndefined();
-        expect(events.some((e) => e.type === "error" &&
-            e.company === "personal" &&
-            e.path === "skills/workflow-preflight/SKILL.md")).toBe(true);
-        expect(result?.errors).toHaveLength(1);
-        const fsBoom = Object.assign(new Error("ENOENT"), {
-            path: "/Users/don/hq/companies/undrdog/skills/secret.md",
-        });
-        const fsRun = await runWithRejectingPull(fsBoom);
-        const fsError = fsRun.events.find((e) => e.type === "error");
-        expect(fsError).toMatchObject({ path: "(company)" });
-    });
-});
-describe("executeCompanyFanout — a company-skill 409 never aborts the leg (HQ-DESKTOP-64)", () => {
-    let hqRoot;
-    let stateDir;
-    function makeEntityContext() {
-        return {
-            uid: "cmp_01ABCDEF",
-            slug: "acme",
-            bucketName: "hq-vault-acme-123",
-            region: "us-east-1",
-            credentials: {
-                accessKeyId: "ASIA_PRE_VENDED",
-                secretAccessKey: "pre-vended-secret",
-                sessionToken: "pre-vended-session",
-            },
-            expiresAt: new Date(Date.now() + 15 * 60 * 1000).toISOString(),
-        };
-    }
-    beforeEach(() => {
-        hqRoot = fs.mkdtempSync(path.join(os.tmpdir(), "hq-fanout-skill-conflict-"));
-        stateDir = fs.mkdtempSync(path.join(os.tmpdir(), "hq-fanout-skill-state-"));
-        process.env.HQ_STATE_DIR = stateDir;
-        vi.mocked(uploadFile).mockClear();
-        vi.mocked(uploadFile).mockResolvedValue({ etag: '"upload-etag"' });
-        vi.mocked(headRemoteFile).mockReset();
-        vi.mocked(headRemoteFile).mockResolvedValue(null);
-        fs.mkdirSync(path.join(hqRoot, "companies", "acme"), { recursive: true });
-    });
-    afterEach(() => {
-        fs.rmSync(hqRoot, { recursive: true, force: true });
-        fs.rmSync(stateDir, { recursive: true, force: true });
-        delete process.env.HQ_STATE_DIR;
-    });
-    it("runs the real share() with a 409-ing registrar and keeps the company complete unaborted", async () => {
-        const skillFile = path.join(hqRoot, "companies", "acme", "skills", "copied", "SKILL.md");
-        fs.mkdirSync(path.dirname(skillFile), { recursive: true });
-        fs.writeFileSync(skillFile, "---\nname: Copied\ndescription: Copied skill\nskill_uid: skl_SOURCE1\n---\n");
-        // Seed a stuck pending marker via one direct push whose metadata reconcile
-        // fails transiently — the unchanged base behaviour that stranded the marker.
-        await share({
-            paths: [skillFile],
-            hqRoot,
-            entityContext: makeEntityContext(),
-            registerCompanySkill: vi.fn(async () => {
-                throw new Error("registry temporarily unavailable");
-            }),
-        });
-        expect(readJournal("acme").files["skills/copied/SKILL.md"]).toMatchObject({ skillMetadataPending: true });
-        // Pass 2 runs the real share() THROUGH the fanout. The remote now exists and
-        // the registrar 409s on every call (landed reconcile and non-landed
-        // fallback): the field signature of a copied skill the server will not
-        // re-identify from this machine. On the base runner this rejected out of the
-        // pending loop, and the company-leg catch turned it into a (company) error +
-        // PARTIAL_SYNC_EXIT.
-        vi.mocked(uploadFile).mockClear();
-        vi.mocked(headRemoteFile).mockResolvedValue({
-            lastModified: new Date(),
-            etag: '"upload-etag"',
-            size: fs.statSync(skillFile).size,
-        });
-        const conflictRegistrar = vi.fn(async () => {
-            throw new VaultConflictError("landed identity mismatch");
-        });
-        const events = [];
-        const result = await executeCompanyFanout({
-            plan: [{ uid: "cmp_01ABCDEF", slug: "acme" }],
-            direction: "push",
-            hqRoot,
-            onConflict: "abort",
-            client: {},
-            vaultConfig: { apiUrl: "https://api.example", authToken: "access-token" },
-            syncFn: vi.fn(),
-            shareFn: ({ vaultConfig: _vaultConfig, company: _company, ...rest }) => share({
-                ...rest,
-                entityContext: makeEntityContext(),
-                registerCompanySkill: conflictRegistrar,
-            }),
-            resolveDeletePolicy: () => "all",
-            emit: (event) => events.push(event),
-            ensureCompanyDir: vi.fn(),
-            telemetryClient: null,
-        });
-        // A skill 409 is no longer a deterministic company failure.
-        expect(result.errors).toEqual([]);
-        expect(result.companyFailures).toEqual([]);
-        expect(events.some((e) => e.type === "error" &&
-            e.path === "(company)")).toBe(false);
-        const complete = events.find((e) => e.type === "complete");
-        expect(complete).toBeDefined();
-        expect(complete).toMatchObject({ aborted: false });
-        // The deliberate skip is surfaced once, tagged with the company.
-        expect(events).toContainEqual(expect.objectContaining({
-            type: "not-shipped",
-            company: "acme",
-            reason: "skill-registration-conflict",
-            samplePaths: ["skills/copied/SKILL.md"],
-        }));
-        // The marker is cleared so a later pass cannot loop.
-        expect(readJournal("acme").files["skills/copied/SKILL.md"]?.skillMetadataPending).toBeUndefined();
-        // A copied skill's stamped identity is unchanged: the fallback was refused,
-        // so no local re-stamp happened this pass.
-        expect(parseRegisteredCompanySkillUid(fs.readFileSync(skillFile, "utf8"))).toBe("skl_SOURCE1");
-    });
-});
-describe("executeCompanyFanout — personal vault skips journaled company dirs", () => {
-    const shareResult = {
-        filesUploaded: 0,
-        bytesUploaded: 0,
-        filesSkipped: 0,
-        filesDeleted: 0,
-        filesTombstoned: 0,
-        filesRefusedStale: 0,
-        filesRefusedStalePaths: [],
-        filesSuppressedByTombstone: 0,
-        filesExcludedByPolicy: 0,
-        filesExcludedByScope: 0,
-        filesExcludedByIgnore: 0,
-        unreachablePaths: [],
-        linkedSubtreesNotShipped: [],
-        conflictPaths: [],
-        aborted: false,
-    };
-    const syncResult = {
-        filesDownloaded: 0,
-        bytesDownloaded: 0,
-        filesSkipped: 0,
-        conflicts: 0,
-        conflictPaths: [],
-        aborted: false,
-        newFiles: [],
-        newFilesCount: 0,
-        filesExcludedByPolicy: 0,
-        filesTombstoned: 0,
-        filesOutOfScope: 0,
-        scopeOrphansRemoved: 0,
-        scopeOrphansBlocked: 0,
-        changedPaths: [],
-    };
-    let hqRoot;
-    let stateDir;
-    let previousStateDir;
-    beforeEach(() => {
-        hqRoot = fs.mkdtempSync(path.join(os.tmpdir(), "hq-fanout-journal-slugs-"));
-        stateDir = fs.mkdtempSync(path.join(os.tmpdir(), "hq-fanout-journal-state-"));
-        previousStateDir = process.env.HQ_STATE_DIR;
-        process.env.HQ_STATE_DIR = stateDir;
-        fs.mkdirSync(path.join(hqRoot, "personal"), { recursive: true });
-    });
-    afterEach(() => {
-        fs.rmSync(hqRoot, { recursive: true, force: true });
-        fs.rmSync(stateDir, { recursive: true, force: true });
-        if (previousStateDir === undefined)
-            delete process.env.HQ_STATE_DIR;
-        else
-            process.env.HQ_STATE_DIR = previousStateDir;
-    });
-    function writeCompanyDir(slug) {
-        fs.mkdirSync(path.join(hqRoot, "companies", slug), { recursive: true });
-    }
-    function writeJournalLocator(slug) {
-        fs.writeFileSync(path.join(stateDir, `sync-journal.${slug}.json`), JSON.stringify({ schema: "hq-sync-journal-locator@1" }));
-    }
-    function relSharePaths(shareFn) {
-        const call = shareFn.mock.calls[0];
-        expect(call).toBeDefined();
-        return call[0].paths.map((p) => path.relative(hqRoot, p)).sort();
-    }
-    async function runPersonalBoth(shareFn = vi.fn(async (_options) => shareResult), syncFn = vi.fn(async (_options) => syncResult)) {
-        const events = [];
-        await executeCompanyFanout({
-            plan: [{ uid: "prs_1", slug: "personal", personalMode: true }],
-            direction: "both",
-            hqRoot,
-            onConflict: "abort",
-            client: {},
-            vaultConfig: { apiUrl: "https://api.example", authToken: "access-token" },
-            fetchFileTombstones: async () => new Map(),
-            syncFn,
-            shareFn,
-            resolveDeletePolicy: () => "all",
-            emit: (event) => events.push(event),
-            ensureCompanyDir: vi.fn(),
-            telemetryClient: null,
-        });
-        return { events, shareFn, syncFn };
-    }
-    it("excludes companies/dandy from the personal push when its sync journal exists and there is no manifest", async () => {
-        writeCompanyDir("dandy");
-        writeJournalLocator("dandy");
-        const { events, shareFn, syncFn } = await runPersonalBoth();
-        const rel = relSharePaths(shareFn);
-        expect(rel).not.toContain(path.join("companies", "dandy"));
-        expect(rel).toContain("personal");
-        const shareArgs = shareFn.mock.calls[0][0];
-        expect(shareArgs.decommissionPrefixes).toEqual(["companies/dandy"]);
-        const pullArgs = syncFn.mock.calls[0][0];
-        expect(Array.from(pullArgs.teamSyncedSlugs ?? [])).toEqual(["dandy"]);
-        expect(events).toContainEqual({
-            type: "error",
-            diagnostic: true,
-            company: "personal",
-            path: "(personal-vault)",
-            message: "excluding journaled companies from personal vault: dandy",
-        });
-        expect(events.some((e) => e.type === "error" && e.diagnostic !== true)).toBe(false);
-    });
-    it("still includes a local-only company that has no journal when there is no manifest", async () => {
-        writeCompanyDir("local-only");
-        const { events, shareFn, syncFn } = await runPersonalBoth();
-        const rel = relSharePaths(shareFn);
-        expect(rel).toContain(path.join("companies", "local-only"));
-        expect(shareFn.mock.calls[0][0]).not.toHaveProperty("decommissionPrefixes");
-        expect(Array.from(syncFn.mock.calls[0][0].teamSyncedSlugs ?? [])).toEqual([]);
-        expect(events.some((e) => e.type === "error")).toBe(false);
-    });
-    it("does not treat the personal-vault sentinel journal as a company slug", async () => {
-        writeCompanyDir("local-only");
-        writeJournalLocator(PERSONAL_VAULT_JOURNAL_SLUG);
-        const { events, shareFn, syncFn } = await runPersonalBoth();
-        const rel = relSharePaths(shareFn);
-        expect(rel).toContain(path.join("companies", "local-only"));
-        expect(shareFn.mock.calls[0][0]).not.toHaveProperty("decommissionPrefixes");
-        expect(Array.from(syncFn.mock.calls[0][0].teamSyncedSlugs ?? [])).toEqual([]);
-        expect(events.some((e) => e.type === "error")).toBe(false);
-    });
-    it("does not pass journal-derived teamSyncedSlugs to a company target", async () => {
-        writeCompanyDir("dandy");
-        writeJournalLocator("dandy");
-        const shareFn = vi.fn(async (_options) => shareResult);
-        const syncFn = vi.fn(async (_options) => syncResult);
-        await executeCompanyFanout({
-            plan: [{ uid: "cmp_dandy", slug: "dandy" }],
-            direction: "both",
-            hqRoot,
-            onConflict: "abort",
-            client: {},
-            vaultConfig: { apiUrl: "https://api.example", authToken: "access-token" },
-            fetchFileTombstones: async () => new Map(),
-            syncFn,
-            shareFn,
-            resolveDeletePolicy: () => "all",
-            emit: vi.fn(),
-            ensureCompanyDir: vi.fn(),
-            telemetryClient: null,
-        });
-        expect(shareFn.mock.calls[0][0].paths).toEqual([
-            path.join(hqRoot, "companies", "dandy"),
-        ]);
-        expect(shareFn.mock.calls[0][0]).not.toHaveProperty("decommissionPrefixes");
-        expect(Object.keys(syncFn.mock.calls[0][0])).not.toContain("teamSyncedSlugs");
-    });
-});
-describe("executeCompanyFanout work-bearing sync count telemetry", () => {
-    function emptyShare(overrides = {}) {
-        return {
-            filesUploaded: 0,
-            bytesUploaded: 0,
-            filesSkipped: 0,
-            filesDeleted: 0,
-            filesTombstoned: 0,
-            filesRefusedStale: 0,
-            filesRefusedStalePaths: [],
-            filesSuppressedByTombstone: 0,
-            filesExcludedByPolicy: 0,
-            filesExcludedByScope: 0,
-            filesExcludedByIgnore: 0,
-            unreachablePaths: [],
-            linkedSubtreesNotShipped: [],
-            conflictPaths: [],
-            aborted: false,
-            ...overrides,
-        };
-    }
-    function emptySync(overrides = {}) {
-        return {
-            filesDownloaded: 0,
-            bytesDownloaded: 0,
-            filesSkipped: 0,
-            conflicts: 0,
-            conflictPaths: [],
-            aborted: false,
-            newFiles: [],
-            newFilesCount: 0,
-            filesExcludedByPolicy: 0,
-            filesTombstoned: 0,
-            filesOutOfScope: 0,
-            scopeOrphansRemoved: 0,
-            scopeOrphansBlocked: 0,
-            changedPaths: [],
-            ...overrides,
-        };
-    }
-    async function runPersonalFanout(args) {
-        const posts = [];
-        const hqRoot = fs.mkdtempSync(path.join(os.tmpdir(), "hq-fanout-sync-counts-"));
-        fs.mkdirSync(path.join(hqRoot, "personal"), { recursive: true });
-        try {
-            await executeCompanyFanout({
-                plan: [{ uid: "prs_1", slug: "personal", personalMode: true }],
-                direction: args.direction ?? "both",
-                hqRoot,
-                onConflict: "abort",
-                client: {},
-                vaultConfig: { apiUrl: "https://api.example", authToken: "access-token" },
-                fetchFileTombstones: async () => new Map(),
-                syncFn: args.syncFn ?? (async () => emptySync()),
-                shareFn: args.shareFn,
-                resolveDeletePolicy: () => "all",
-                emit: vi.fn(),
-                ensureCompanyDir: vi.fn(),
-                telemetryClient: {
-                    postTelemetryEvents: async (batch) => {
-                        posts.push(batch);
-                        return { ok: true, written: batch.events.length, skipped: [] };
-                    },
-                },
-            });
-            await new Promise((resolve) => setTimeout(resolve, 0));
-            return posts.flatMap((post) => post.events);
-        }
-        finally {
-            fs.rmSync(hqRoot, { recursive: true, force: true });
-        }
-    }
-    it("emits uploadedCount, downloadedCount, and sessionLogUploadedCount on a work-bearing leg", async () => {
-        const events = await runPersonalFanout({
-            shareFn: async () => emptyShare({
-                filesUploaded: 4,
-                bytesUploaded: 400,
-                skillRegistrationFallbacks: 3,
-            }),
-            syncFn: async () => emptySync({ filesDownloaded: 2, bytesDownloaded: 200 }),
-        });
-        const leg = events.find((event) => event.eventName === "company_sync_leg_completed");
-        expect(leg).toMatchObject({
-            app: "hq-cloud",
-            source: "sync-runner",
-            properties: {
-                status: "complete",
-                filesUploaded: 4,
-                filesDownloaded: 2,
-                uploadedCount: 4,
-                downloadedCount: 2,
-                skillRegistrationFallbacks: 3,
-                sessionLogUploadedCount: 0,
-            },
-        });
-    });
-    it("puts the skill fallback count on the existing end-of-pass event", async () => {
-        const events = [];
-        const hqRoot = fs.mkdtempSync(path.join(os.tmpdir(), "hq-fanout-skill-fallback-count-"));
-        try {
-            await executeCompanyFanout({
-                plan: [{ uid: "prs_1", slug: "personal", personalMode: true }],
-                direction: "push",
-                hqRoot,
-                onConflict: "abort",
-                client: {},
-                vaultConfig: { apiUrl: "https://api.example", authToken: "access-token" },
-                fetchFileTombstones: async () => new Map(),
-                syncFn: async () => emptySync(),
-                shareFn: async () => emptyShare({ skillRegistrationFallbacks: 2 }),
-                resolveDeletePolicy: () => "all",
-                emit: (event) => events.push(event),
-                ensureCompanyDir: vi.fn(),
-                telemetryClient: null,
-            });
-            expect(events.find((event) => event.type === "complete")).toMatchObject({
-                type: "complete",
-                skillRegistrationFallbacks: 2,
-            });
-        }
-        finally {
-            fs.rmSync(hqRoot, { recursive: true, force: true });
-        }
-    });
-    it("preserves ignore counts in completion when the push leg throws after reporting them", async () => {
-        const events = [];
-        const hqRoot = fs.mkdtempSync(path.join(os.tmpdir(), "hq-fanout-ignore-count-error-"));
-        try {
-            await executeCompanyFanout({
-                plan: [{ uid: "prs_1", slug: "personal", personalMode: true }],
-                direction: "push",
-                hqRoot,
-                onConflict: "abort",
-                client: {},
-                vaultConfig: { apiUrl: "https://api.example", authToken: "access-token" },
-                fetchFileTombstones: async () => new Map(),
-                syncFn: async () => emptySync(),
-                shareFn: async (options) => {
-                    options.onEvent?.({
-                        type: "ignore-excluded",
-                        count: 2,
-                        totalExcluded: 2,
-                        samplePaths: ["docs/generated"],
-                    });
-                    options.onEvent?.({ type: "secret-excluded", count: 3 });
-                    throw new Error("push failed after finalizing its ignore report");
-                },
-                resolveDeletePolicy: () => "all",
-                emit: (event) => events.push(event),
-                ensureCompanyDir: vi.fn(),
-                telemetryClient: null,
-            });
-            expect(events.find((event) => event.type === "complete")).toMatchObject({
-                type: "complete",
-                aborted: true,
-                filesExcludedByIgnore: 5,
-            });
-        }
-        finally {
-            fs.rmSync(hqRoot, { recursive: true, force: true });
-        }
-    });
-    it("forwards noteworthy and by-design ignore counts in events and completion", async () => {
-        const events = [];
-        const hqRoot = fs.mkdtempSync(path.join(os.tmpdir(), "hq-fanout-ignore-count-"));
-        try {
-            await executeCompanyFanout({
-                plan: [{ uid: "prs_1", slug: "personal", personalMode: true }],
-                direction: "push",
-                hqRoot,
-                onConflict: "abort",
-                client: {},
-                vaultConfig: { apiUrl: "https://api.example", authToken: "access-token" },
-                fetchFileTombstones: async () => new Map(),
-                syncFn: async () => emptySync(),
-                shareFn: async (options) => {
-                    options.onEvent?.({
-                        type: "ignore-excluded",
-                        count: 1,
-                        totalExcluded: 3,
-                        samplePaths: ["companies/acme/knowledge/repos"],
-                    });
-                    options.onEvent?.({ type: "secret-excluded", count: 1 });
-                    return emptyShare({ filesExcludedByIgnore: 2 });
-                },
-                resolveDeletePolicy: () => "all",
-                emit: (event) => events.push(event),
-                ensureCompanyDir: vi.fn(),
-                telemetryClient: null,
-            });
-            expect(events.find((event) => event.type === "ignore-excluded")).toMatchObject({
-                type: "ignore-excluded",
-                count: 1,
-                samplePaths: ["companies/acme/knowledge/repos"],
-            });
-            expect(events.find((event) => event.type === "secret-excluded")).toMatchObject({
-                type: "secret-excluded",
-                count: 1,
-                company: "personal",
-            });
-            expect(events.find((event) => event.type === "secret-excluded")).not.toHaveProperty("samplePaths");
-            expect(events.find((event) => event.type === "complete")).toMatchObject({
-                type: "complete",
-                filesExcludedByIgnore: 2,
-            });
-        }
-        finally {
-            fs.rmSync(hqRoot, { recursive: true, force: true });
-        }
-    });
-    it("emits the fallback count when it is the only work on a pass", async () => {
-        const events = await runPersonalFanout({
-            direction: "push",
-            shareFn: async () => emptyShare({ skillRegistrationFallbacks: 2 }),
-        });
-        const leg = events.find((event) => event.eventName === "company_sync_leg_completed");
-        expect(leg?.properties).toMatchObject({
-            status: "complete",
-            skillRegistrationFallbacks: 2,
-        });
-    });
-    it("counts only SESSION_LOGS_SYNC_REL uploads and never emits a path", async () => {
-        const events = await runPersonalFanout({
-            direction: "push",
-            shareFn: async (options) => {
-                options.onEvent?.({
-                    type: "progress",
-                    path: `${SESSION_LOGS_SYNC_REL}/claude/a.jsonl`,
-                    bytes: 11,
-                });
-                options.onEvent?.({
-                    type: "progress",
-                    path: `${SESSION_LOGS_SYNC_REL}/codex/b.jsonl`,
-                    bytes: 22,
-                });
-                options.onEvent?.({
-                    type: "progress",
-                    path: "personal/notes.md",
-                    bytes: 33,
-                });
-                options.onEvent?.({
-                    type: "progress",
-                    path: "workspace/.session-logs-old/x.jsonl",
-                    bytes: 44,
-                });
-                options.onEvent?.({
-                    type: "progress",
-                    path: `${SESSION_LOGS_SYNC_REL}/claude/deleted.jsonl`,
-                    bytes: 0,
-                    deleted: true,
-                });
-                return emptyShare({ filesUploaded: 4, bytesUploaded: 110 });
-            },
-        });
-        const leg = events.find((event) => event.eventName === "company_sync_leg_completed");
-        expect(leg?.properties).toMatchObject({
-            uploadedCount: 4,
-            downloadedCount: 0,
-            sessionLogUploadedCount: 2,
-            filesUploaded: 4,
-        });
-        const serialized = JSON.stringify(leg);
-        expect(serialized).not.toContain(`${SESSION_LOGS_SYNC_REL}/`);
-        expect(serialized).not.toContain("personal/notes.md");
-        expect(serialized).not.toContain("session-logs-old");
-        expect(serialized.toLowerCase()).not.toContain("filename");
-    });
-    it("emits no company_sync_leg_completed on an empty cycle", async () => {
-        const events = await runPersonalFanout({
-            shareFn: async () => emptyShare(),
-            syncFn: async () => emptySync(),
-        });
-        expect(events.map((event) => event.eventName)).not.toContain("company_sync_leg_completed");
-    });
-    it("keeps the three count keys after emitCloudTelemetry redaction", async () => {
-        const events = await runPersonalFanout({
-            direction: "push",
-            shareFn: async (options) => {
-                options.onEvent?.({
-                    type: "progress",
-                    path: `${SESSION_LOGS_SYNC_REL}/grok/c.jsonl`,
-                    bytes: 9,
-                });
-                return emptyShare({ filesUploaded: 1, bytesUploaded: 9 });
-            },
-        });
-        const leg = events.find((event) => event.eventName === "company_sync_leg_completed");
-        expect(leg?.properties).toEqual(expect.objectContaining({
-            uploadedCount: 1,
-            downloadedCount: 0,
-            sessionLogUploadedCount: 1,
-            filesUploaded: 1,
-        }));
-        expect(leg?.properties).not.toHaveProperty("path");
-        expect(leg?.properties).not.toHaveProperty("canonicalPath");
-        expect(JSON.stringify(leg?.properties)).not.toContain(SESSION_LOGS_SYNC_REL);
-    });
-});
-//# sourceMappingURL=sync-runner-company.test.js.map