@indigoai-us/hq-cloud 6.18.44-alpha.9 → 6.18.44

package/dist/bin/sync-runner-manifest.test.js

@@ -1,921 +0,0 @@
-/**
- * Unit tests for the runner's post-sync manifest upload tail step (US-004).
- *
- * These drive `runPostSyncManifestUploads` directly — the runner's own
- * integration with it (only after a clean pass, never affecting the exit code)
- * is asserted in `sync-runner.test.ts`. The throttle test deliberately uses the
- * REAL `runManifestUploadPass` against a temp HQ root, because "two passes in
- * one day upload once" is a property of the wiring plus the seam, not of a
- * stub.
- */
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-import { createHash } from "node:crypto";
-import * as fs from "fs";
-import * as os from "os";
-import * as path from "path";
-import { readDesktopInstallationId, DESKTOP_CLIENT_HEALTH_STATE_FILE, } from "./sync-runner-installation-id.js";
-import { RUNNER_MANIFEST_PHASE_WALL_MS, RUNNER_MANIFEST_REPAIR_POLL_SPACING_MS, runPostSyncManifestUploads, } from "./sync-runner-manifest.js";
-import { MANIFEST_UPLOAD_DISABLED_ENV } from "../manifest/upload-manifest.js";
-const NOW_MS = Date.parse("2026-09-04T12:00:00.000Z");
-let base;
-let hqRoot;
-let stateDir;
-let previousStateDir;
-let previousHome;
-beforeEach(() => {
-    base = fs.mkdtempSync(path.join(os.tmpdir(), "hq-runner-manifest-"));
-    hqRoot = path.join(base, "hq");
-    stateDir = path.join(base, "state");
-    fs.mkdirSync(path.join(hqRoot, "companies", "acme"), { recursive: true });
-    fs.mkdirSync(stateDir, { recursive: true });
-    fs.writeFileSync(path.join(hqRoot, "companies", "acme", "a.md"), "a", "utf8");
-    fs.writeFileSync(path.join(hqRoot, "notes.md"), "notes", "utf8");
-    // The per-scope upload lock and the journal reader both live under
-    // HQ_STATE_DIR — keep them inside this test's temp dir.
-    previousStateDir = process.env.HQ_STATE_DIR;
-    process.env.HQ_STATE_DIR = stateDir;
-    // `readDesktopInstallationId` falls back to `os.homedir()/.hq`, which on
-    // POSIX is `$HOME`. Without pinning it, any test that exercises the REAL
-    // reader would read the DEVELOPER's own `~/.hq/client-health.json` and pass
-    // or fail depending on whose laptop is running it.
-    previousHome = process.env.HOME;
-    process.env.HOME = path.join(base, "home");
-    fs.mkdirSync(path.join(base, "home", ".hq"), { recursive: true });
-});
-afterEach(() => {
-    if (previousStateDir === undefined)
-        delete process.env.HQ_STATE_DIR;
-    else
-        process.env.HQ_STATE_DIR = previousStateDir;
-    if (previousHome === undefined)
-        delete process.env.HOME;
-    else
-        process.env.HOME = previousHome;
-    fs.rmSync(base, { recursive: true, force: true });
-});
-const PERSONAL_TARGET = {
-    uid: "ent_person_1",
-    slug: "personal",
-    personalMode: true,
-};
-const ACME_TARGET = { uid: "ent_acme", slug: "acme" };
-const REPAIR_COMPANY_UID = "cmp_01KR490G0S8KGE587BZDXTZ9DV";
-const REPAIR_COMPANY_TARGET = { uid: REPAIR_COMPANY_UID, slug: "acme" };
-function makeOptions(overrides = {}) {
-    const events = [];
-    const defaultFetchImpl = async (input, init) => {
-        const url = new URL(String(input));
-        if (url.pathname === "/v1/client-health/commands" &&
-            (init?.method ?? "GET") === "GET") {
-            return new Response(JSON.stringify({ commands: [] }), { status: 200 });
-        }
-        throw new Error("unexpected request in manifest test");
-    };
-    return {
-        hqRoot,
-        stateDir,
-        targets: [ACME_TARGET],
-        completedCompanySlugs: new Set(["acme"]),
-        apiBaseUrl: "https://api.test",
-        getAccessToken: () => Promise.resolve("token"),
-        emitEvent: (payload) => events.push(payload),
-        env: {},
-        now: NOW_MS,
-        resolveMachineId: () => "machine-test",
-        resolveInstallationId: () => "install-test",
-        fetchImpl: defaultFetchImpl,
-        ...overrides,
-        events,
-    };
-}
-function repairPollStatePath(installationId = "install-test") {
-    const installationHash = createHash("sha256")
-        .update(installationId)
-        .digest("hex");
-    return path.join(stateDir, "manifest-repair-polls", `${installationHash}.json`);
-}
-async function expectRepairPollStateReset(options) {
-    const statePath = repairPollStatePath();
-    fs.mkdirSync(path.dirname(statePath), { recursive: true });
-    fs.writeFileSync(statePath, options.initialState, "utf8");
-    const fetchImpl = vi.fn(async (url, init) => {
-        expect(new URL(String(url)).pathname).toBe("/v1/client-health/commands");
-        expect(init?.method ?? "GET").toBe("GET");
-        return new Response(JSON.stringify({ commands: [] }), { status: 200 });
-    });
-    const diagnostics = [];
-    await runPostSyncManifestUploads(makeOptions({
-        now: options.now,
-        runPass: makeUploadedPass(),
-        fetchImpl: fetchImpl,
-        reportDiagnostic: ({ event, context }) => diagnostics.push(`${event}:${String(context?.reason ?? "")}`),
-    }));
-    expect(fetchImpl).toHaveBeenCalledTimes(1);
-    expect(JSON.parse(fs.readFileSync(statePath, "utf8"))).toEqual({
-        version: 1,
-        lastAttemptAtMs: options.now,
-    });
-    expect(diagnostics).toContain(`runner.manifest_upload.repair_poll_state_reset:${options.reason}`);
-    expect(diagnostics).not.toContain("runner.manifest_upload.repair_poll_spacing_failed:");
-}
-/** A stub pass that records its options and reports a clean upload. */
-function makeUploadedPass() {
-    return vi.fn(async (options) => ({
-        status: "uploaded",
-        scopeKey: options.scope.kind,
-        mode: "full",
-        chunkCount: 1,
-        uploadedChunks: 1,
-    }));
-}
-describe("post-sync MANIFEST_FULL repair intents", () => {
-    it("spaces repair-command polls by installation across runner passes", async () => {
-        const runPass = makeUploadedPass();
-        const fetchImpl = vi.fn(async (url, init) => {
-            expect(new URL(String(url)).pathname).toBe("/v1/client-health/commands");
-            expect(init?.method ?? "GET").toBe("GET");
-            return new Response(JSON.stringify({ commands: [] }), { status: 200 });
-        });
-        const options = makeOptions({
-            runPass,
-            fetchImpl: fetchImpl,
-        });
-        await runPostSyncManifestUploads(options);
-        expect(fetchImpl).toHaveBeenCalledTimes(1);
-        options.now = NOW_MS + 30 * 60 * 1000;
-        await runPostSyncManifestUploads(options);
-        expect(fetchImpl).toHaveBeenCalledTimes(1);
-        await runPostSyncManifestUploads({
-            ...options,
-            resolveInstallationId: () => "another-installation",
-        });
-        expect(fetchImpl).toHaveBeenCalledTimes(2);
-        options.now = NOW_MS + RUNNER_MANIFEST_REPAIR_POLL_SPACING_MS;
-        await runPostSyncManifestUploads(options);
-        expect(fetchImpl).toHaveBeenCalledTimes(3);
-        expect(runPass).toHaveBeenCalledTimes(4);
-    });
-    it("replaces corrupt repair poll state and still polls", async () => {
-        await expectRepairPollStateReset({
-            initialState: "{not-json",
-            now: NOW_MS,
-            reason: "corrupt",
-        });
-    });
-    it("replaces repair poll state with an unsupported version and still polls", async () => {
-        await expectRepairPollStateReset({
-            initialState: JSON.stringify({ version: 2, lastAttemptAtMs: NOW_MS }),
-            now: NOW_MS,
-            reason: "invalid",
-        });
-    });
-    it("replaces a negative repair poll timestamp and still polls", async () => {
-        await expectRepairPollStateReset({
-            initialState: JSON.stringify({ version: 1, lastAttemptAtMs: -1 }),
-            now: 0,
-            reason: "invalid",
-        });
-    });
-    it("resets a repair poll timestamp more than one interval in the future", async () => {
-        await expectRepairPollStateReset({
-            initialState: JSON.stringify({
-                version: 1,
-                lastAttemptAtMs: NOW_MS + RUNNER_MANIFEST_REPAIR_POLL_SPACING_MS + 1,
-            }),
-            now: NOW_MS,
-            reason: "clock_rollback",
-        });
-    });
-    it("claims a scoped intent and runs one bounded full upload before acknowledging success", async () => {
-        const runPass = makeUploadedPass();
-        const receipts = [];
-        const fetchImpl = vi.fn(async (url, init) => {
-            const path = String(url);
-            if (path.includes("/v1/client-health/commands?")) {
-                const requestUrl = new URL(path);
-                expect(requestUrl.searchParams.get("installationId")).toBe("install-test");
-                expect(init?.method).toBe("GET");
-                return new Response(JSON.stringify({
-                    commands: [
-                        {
-                            commandId: "manifest-missing-11223344556677889900aabb",
-                            kind: "MANIFEST_FULL",
-                            state: "queued",
-                            revision: 0,
-                            createdAt: "2026-09-24T09:00:00.000Z",
-                            expiresAt: "2026-10-01T09:00:00.000Z",
-                            args: { scopeKey: `company#${REPAIR_COMPANY_UID}` },
-                        },
-                    ],
-                }), { status: 200, headers: { "content-type": "application/json" } });
-            }
-            if (path.endsWith("/v1/client-health/commands/receipt")) {
-                expect(init?.method).toBe("POST");
-                const receipt = JSON.parse(String(init?.body));
-                receipts.push(receipt);
-                return new Response(JSON.stringify({ applied: true, state: receipt.state, revision: receipt.revision }), { status: 200, headers: { "content-type": "application/json" } });
-            }
-            throw new Error("unexpected request");
-        });
-        const options = makeOptions({
-            targets: [REPAIR_COMPANY_TARGET],
-            runPass,
-            fetchImpl: fetchImpl,
-        });
-        await runPostSyncManifestUploads(options);
-        const passed = runPass.mock.calls[0][0];
-        expect(passed.scope).toEqual({
-            kind: "company",
-            companyUid: REPAIR_COMPANY_UID,
-            slug: "acme",
-        });
-        expect(passed.forceFull).toBe(true);
-        expect(passed.ignoreThrottle).toBe(true);
-        expect(receipts.map((receipt) => receipt.state)).toEqual([
-            "acknowledged",
-            "running",
-            "succeeded",
-        ]);
-        expect(receipts.map((receipt) => receipt.revision)).toEqual([1, 2, 3]);
-        expect(receipts[2]?.postcondition).toEqual({ verified: true });
-        expect(receipts[2]?.state).toBe("succeeded");
-    });
-    it("leaves a command for another scope unclaimed and keeps the normal throttled upload path", async () => {
-        const runPass = makeUploadedPass();
-        const receipts = [];
-        const fetchImpl = vi.fn(async (url, init) => {
-            const path = String(url);
-            if (path.includes("/v1/client-health/commands?")) {
-                return new Response(JSON.stringify({
-                    commands: [
-                        {
-                            commandId: "manifest-full-other",
-                            kind: "MANIFEST_FULL",
-                            state: "queued",
-                            revision: 0,
-                            createdAt: "2026-09-24T09:00:00.000Z",
-                            expiresAt: "2026-10-01T09:00:00.000Z",
-                            args: { scopeKey: "personal" },
-                        },
-                    ],
-                }), { status: 200, headers: { "content-type": "application/json" } });
-            }
-            if (path.endsWith("/v1/client-health/commands/receipt"))
-                receipts.push(init?.body);
-            return new Response(JSON.stringify({ applied: true }), { status: 200 });
-        });
-        const options = makeOptions({
-            runPass,
-            fetchImpl: fetchImpl,
-        });
-        await runPostSyncManifestUploads(options);
-        const passed = runPass.mock.calls[0][0];
-        expect(passed.forceFull).toBeUndefined();
-        expect(passed.ignoreThrottle).toBeUndefined();
-        expect(receipts).toEqual([]);
-    });
-    it("does not run an unclaimed full rebuild when the server rejects the running receipt", async () => {
-        const runPass = makeUploadedPass();
-        const receipts = [];
-        const fetchImpl = vi.fn(async (url, init) => {
-            const path = String(url);
-            if (path.includes("/v1/client-health/commands?")) {
-                return new Response(JSON.stringify({
-                    commands: [{
-                            commandId: "manifest-missing-11223344556677889900aabb",
-                            kind: "MANIFEST_FULL",
-                            state: "queued",
-                            revision: 0,
-                            createdAt: "2026-09-24T09:00:00.000Z",
-                            expiresAt: "2026-09-25T09:00:00.000Z",
-                            args: { scopeKey: `company#${REPAIR_COMPANY_UID}` },
-                        }],
-                }), { status: 200 });
-            }
-            const receipt = JSON.parse(String(init?.body));
-            receipts.push(receipt);
-            return new Response(JSON.stringify({
-                applied: receipt.state === "acknowledged",
-                state: receipt.state === "acknowledged" ? "acknowledged" : "queued",
-                revision: receipt.state === "acknowledged" ? 1 : 0,
-            }), { status: receipt.state === "acknowledged" ? 200 : 409 });
-        });
-        await runPostSyncManifestUploads(makeOptions({
-            targets: [REPAIR_COMPANY_TARGET],
-            runPass,
-            fetchImpl: fetchImpl,
-        }));
-        const passed = runPass.mock.calls[0][0];
-        expect(passed.forceFull).toBeUndefined();
-        expect(passed.ignoreThrottle).toBeUndefined();
-        expect(receipts.map((receipt) => receipt.state)).toEqual(["acknowledged", "running"]);
-    });
-    it.each([
-        {
-            state: "acknowledged",
-            revision: 1,
-            expectedStates: ["running", "succeeded"],
-            expectedRevisions: [2, 3],
-        },
-        {
-            state: "running",
-            revision: 2,
-            expectedStates: ["succeeded"],
-            expectedRevisions: [3],
-        },
-    ])("resumes a $state repair after an interrupted runner", async ({ state, revision, expectedStates, expectedRevisions, }) => {
-        const runPass = makeUploadedPass();
-        const receipts = [];
-        const fetchImpl = vi.fn(async (url, init) => {
-            const path = String(url);
-            if (path.includes("/v1/client-health/commands?")) {
-                return new Response(JSON.stringify({
-                    commands: [{
-                            commandId: "manifest-missing-11223344556677889900aabb",
-                            kind: "MANIFEST_FULL",
-                            state,
-                            revision,
-                            createdAt: "2026-09-24T09:00:00.000Z",
-                            expiresAt: "2026-09-25T09:00:00.000Z",
-                            args: { scopeKey: `company#${REPAIR_COMPANY_UID}` },
-                        }],
-                }), { status: 200 });
-            }
-            const receipt = JSON.parse(String(init?.body));
-            receipts.push(receipt);
-            return new Response(JSON.stringify({ applied: true, state: receipt.state, revision: receipt.revision }), { status: 200 });
-        });
-        await runPostSyncManifestUploads(makeOptions({
-            targets: [REPAIR_COMPANY_TARGET],
-            runPass,
-            fetchImpl: fetchImpl,
-        }));
-        const passed = runPass.mock.calls[0][0];
-        expect(passed.forceFull).toBe(true);
-        expect(passed.ignoreThrottle).toBe(true);
-        expect(receipts.map((receipt) => receipt.state)).toEqual(expectedStates);
-        expect(receipts.map((receipt) => receipt.revision)).toEqual(expectedRevisions);
-    });
-    it("falls back to the normal upload when a repair receipt request throws", async () => {
-        const runPass = makeUploadedPass();
-        const diagnostics = [];
-        const fetchImpl = vi.fn(async (url) => {
-            const path = String(url);
-            if (path.includes("/v1/client-health/commands?")) {
-                return new Response(JSON.stringify({
-                    commands: [{
-                            commandId: "manifest-missing-11223344556677889900aabb",
-                            kind: "MANIFEST_FULL",
-                            state: "queued",
-                            revision: 0,
-                            createdAt: "2026-09-24T09:00:00.000Z",
-                            expiresAt: "2026-09-25T09:00:00.000Z",
-                            args: { scopeKey: `company#${REPAIR_COMPANY_UID}` },
-                        }],
-                }), { status: 200 });
-            }
-            throw new Error("receipt transport unavailable");
-        });
-        await runPostSyncManifestUploads(makeOptions({
-            targets: [REPAIR_COMPANY_TARGET],
-            runPass,
-            fetchImpl: fetchImpl,
-            reportDiagnostic: (diagnostic) => diagnostics.push(diagnostic),
-        }));
-        const passed = runPass.mock.calls[0][0];
-        expect(passed.forceFull).toBeUndefined();
-        expect(passed.ignoreThrottle).toBeUndefined();
-        expect(diagnostics).toContainEqual(expect.objectContaining({
-            event: "runner.manifest_upload.repair_claim_failed",
-            context: expect.objectContaining({ errorClass: "Error" }),
-        }));
-    });
-    it("records a failed result with a bounded failure reason", async () => {
-        const runPass = vi.fn(async () => ({
-            status: "failed",
-            scopeKey: `company#${REPAIR_COMPANY_UID}`,
-            error: { kind: "transport_error" },
-        }));
-        const receipts = [];
-        const fetchImpl = vi.fn(async (url, init) => {
-            const path = String(url);
-            if (path.includes("/v1/client-health/commands?")) {
-                return new Response(JSON.stringify({
-                    commands: [{
-                            commandId: "manifest-missing-11223344556677889900aabb",
-                            kind: "MANIFEST_FULL",
-                            state: "queued",
-                            revision: 0,
-                            createdAt: "2026-09-24T09:00:00.000Z",
-                            expiresAt: "2026-09-25T09:00:00.000Z",
-                            args: { scopeKey: `company#${REPAIR_COMPANY_UID}` },
-                        }],
-                }), { status: 200 });
-            }
-            const receipt = JSON.parse(String(init?.body));
-            receipts.push(receipt);
-            return new Response(JSON.stringify({ applied: true, state: receipt.state, revision: receipt.revision }), { status: 200 });
-        });
-        await runPostSyncManifestUploads(makeOptions({
-            targets: [REPAIR_COMPANY_TARGET],
-            runPass,
-            fetchImpl: fetchImpl,
-        }));
-        expect(receipts.at(-1)).toMatchObject({
-            state: "failed",
-            revision: 3,
-            failureReason: "RUNNER_FAILED",
-        });
-        expect(receipts.at(-1)).not.toHaveProperty("postcondition");
-    });
-});
-describe("post-sync manifest uploads", () => {
-    it("runs one pass per cleanly-synced scope and emits one event each", async () => {
-        const runPass = makeUploadedPass();
-        const options = makeOptions({
-            targets: [ACME_TARGET, PERSONAL_TARGET],
-            completedCompanySlugs: new Set(["acme", "personal"]),
-            runPass,
-        });
-        const emitted = await runPostSyncManifestUploads(options);
-        expect(runPass).toHaveBeenCalledTimes(2);
-        expect(options.events).toEqual([
-            {
-                company: "acme",
-                scope: "company",
-                status: "uploaded",
-                mode: "full",
-                chunkCount: 1,
-                uploadedChunks: 1,
-            },
-            {
-                company: "personal",
-                scope: "personal",
-                status: "uploaded",
-                mode: "full",
-                chunkCount: 1,
-                uploadedChunks: 1,
-            },
-        ]);
-        expect(emitted).toEqual(options.events);
-    });
-    it("uses the daemon posture: source desktop, throttle on, no force-full", async () => {
-        const runPass = makeUploadedPass();
-        await runPostSyncManifestUploads(makeOptions({ runPass }));
-        const passed = runPass.mock.calls[0][0];
-        expect(passed.source).toBe("desktop");
-        expect(passed.ignoreThrottle).toBeUndefined();
-        expect(passed.forceFull).toBeUndefined();
-        expect(passed.dryRun).toBeUndefined();
-        // Manifest rows must join client-health rows on the ENROLLED key — the
-        // installation id the desktop heartbeat pinned, NOT the machine id.
-        expect(passed.installationId).toBe("install-test");
-        expect(passed.machineId).toBe("machine-test");
-        expect(passed.scope).toEqual({
-            kind: "company",
-            companyUid: "ent_acme",
-            slug: "acme",
-        });
-    });
-    it("skips a scope whose sync leg aborted or errored", async () => {
-        const runPass = makeUploadedPass();
-        const options = makeOptions({
-            targets: [ACME_TARGET, PERSONAL_TARGET],
-            // Only the personal leg completed cleanly.
-            completedCompanySlugs: new Set(["personal"]),
-            runPass,
-        });
-        await runPostSyncManifestUploads(options);
-        expect(runPass).toHaveBeenCalledTimes(1);
-        expect(options.events).toEqual([
-            expect.objectContaining({ company: "personal", scope: "personal" }),
-        ]);
-    });
-    it("does nothing at all when no scope completed cleanly", async () => {
-        const runPass = makeUploadedPass();
-        const fetchImpl = vi.fn();
-        const options = makeOptions({
-            completedCompanySlugs: new Set(),
-            runPass,
-            fetchImpl: fetchImpl,
-        });
-        await expect(runPostSyncManifestUploads(options)).resolves.toEqual([]);
-        expect(runPass).not.toHaveBeenCalled();
-        expect(fetchImpl).not.toHaveBeenCalled();
-        expect(options.events).toEqual([]);
-    });
-    it("does zero work and zero network when the kill switch is set", async () => {
-        const runPass = makeUploadedPass();
-        const fetchImpl = vi.fn();
-        const resolveMachineId = vi.fn(() => "machine-test");
-        const options = makeOptions({
-            env: { [MANIFEST_UPLOAD_DISABLED_ENV]: "1" },
-            runPass,
-            resolveMachineId,
-            fetchImpl: fetchImpl,
-        });
-        await expect(runPostSyncManifestUploads(options)).resolves.toEqual([]);
-        expect(runPass).not.toHaveBeenCalled();
-        expect(fetchImpl).not.toHaveBeenCalled();
-        // Not even the identity is resolved — the switch must cost nothing.
-        expect(resolveMachineId).not.toHaveBeenCalled();
-        expect(options.events).toEqual([]);
-    });
-    it("survives a pass that throws, and keeps auditing the other scopes", async () => {
-        const runPass = vi.fn(async (passOptions) => {
-            if (passOptions.scope.kind === "company")
-                throw new Error("boom");
-            return {
-                status: "uploaded",
-                scopeKey: "personal",
-                mode: "full",
-                chunkCount: 1,
-                uploadedChunks: 1,
-            };
-        });
-        const diagnostics = [];
-        const options = makeOptions({
-            targets: [ACME_TARGET, PERSONAL_TARGET],
-            completedCompanySlugs: new Set(["acme", "personal"]),
-            runPass,
-            reportDiagnostic: ({ event }) => diagnostics.push(event),
-        });
-        const emitted = await runPostSyncManifestUploads(options);
-        expect(emitted).toEqual([
-            expect.objectContaining({ company: "personal", status: "uploaded" }),
-        ]);
-        expect(diagnostics).toContain("runner.manifest_upload.threw");
-    });
-    it("abandons a pass that never settles instead of hanging the runner", async () => {
-        vi.useFakeTimers();
-        try {
-            const runPass = vi.fn(() => new Promise(() => undefined));
-            const diagnostics = [];
-            const options = makeOptions({
-                runPass,
-                reportDiagnostic: ({ event }) => diagnostics.push(event),
-            });
-            const pending = runPostSyncManifestUploads(options);
-            await vi.waitFor(() => expect(runPass).toHaveBeenCalledTimes(1));
-            await vi.advanceTimersByTimeAsync(5 * 60_000);
-            await expect(pending).resolves.toEqual([]);
-            expect(diagnostics).toContain("runner.manifest_upload.phase_timeout");
-            expect(options.events).toEqual([]);
-        }
-        finally {
-            vi.useRealTimers();
-        }
-    });
-    it("reports the pass status verbatim, including a soft skip", async () => {
-        const runPass = vi.fn(async () => ({
-            status: "soft_skipped",
-            scopeKey: "company",
-        }));
-        const options = makeOptions({ runPass });
-        await runPostSyncManifestUploads(options);
-        expect(options.events).toEqual([
-            { company: "acme", scope: "company", status: "soft_skipped" },
-        ]);
-    });
-    it("POSTs each chunk to /v1/sync-manifest/upload with the caller's bearer", async () => {
-        const fetchImpl = vi.fn(async (url, _init) => {
-            if (new URL(String(url)).pathname === "/v1/client-health/commands") {
-                return new Response(JSON.stringify({ commands: [] }), { status: 200 });
-            }
-            return new Response(JSON.stringify({
-                status: "accepted",
-                snapshotId: "snap-server",
-                completed: true,
-                materialised: true,
-            }), { status: 200, headers: { "content-type": "application/json" } });
-        });
-        const options = makeOptions({
-            targets: [PERSONAL_TARGET],
-            completedCompanySlugs: new Set(["personal"]),
-            fetchImpl: fetchImpl,
-        });
-        const emitted = await runPostSyncManifestUploads(options);
-        expect(emitted).toEqual([
-            expect.objectContaining({ company: "personal", status: "uploaded" }),
-        ]);
-        expect(fetchImpl).toHaveBeenCalled();
-        const uploadCalls = fetchImpl.mock.calls.filter(([, init]) => init?.method === "POST");
-        expect(uploadCalls.length).toBeGreaterThan(0);
-        const [url, init] = uploadCalls[0];
-        expect(url).toBe("https://api.test/v1/sync-manifest/upload");
-        expect(init.method).toBe("POST");
-        expect(init.headers.Authorization).toBe("Bearer token");
-    });
-    it("uploads once across two sync passes inside the 24 h window", async () => {
-        const fetchImpl = vi.fn(async (url, _init) => {
-            if (new URL(String(url)).pathname === "/v1/client-health/commands") {
-                return new Response(JSON.stringify({ commands: [] }), { status: 200 });
-            }
-            return new Response(JSON.stringify({
-                status: "accepted",
-                snapshotId: "snap-server",
-                completed: true,
-                materialised: true,
-            }), { status: 200, headers: { "content-type": "application/json" } });
-        });
-        const first = await runPostSyncManifestUploads(makeOptions({
-            targets: [PERSONAL_TARGET],
-            completedCompanySlugs: new Set(["personal"]),
-            fetchImpl: fetchImpl,
-        }));
-        expect(first).toEqual([
-            expect.objectContaining({ status: "uploaded", mode: "full" }),
-        ]);
-        const requestsAfterFirst = fetchImpl.mock.calls.length;
-        const uploadRequestsAfterFirst = fetchImpl.mock.calls.filter(([, init]) => init?.method === "POST").length;
-        expect(uploadRequestsAfterFirst).toBeGreaterThan(0);
-        // The daemon calls this after EVERY sync cycle; an hour later the throttle
-        // — not the caller — is what keeps a 70k-file walk off the laptop.
-        const second = await runPostSyncManifestUploads(makeOptions({
-            targets: [PERSONAL_TARGET],
-            completedCompanySlugs: new Set(["personal"]),
-            now: NOW_MS + 60 * 60 * 1000,
-            fetchImpl: fetchImpl,
-        }));
-        expect(second).toEqual([
-            expect.objectContaining({ company: "personal", status: "throttled" }),
-        ]);
-        expect(fetchImpl.mock.calls).toHaveLength(requestsAfterFirst + 1);
-        expect(fetchImpl.mock.calls.filter(([, init]) => init?.method === "POST")).toHaveLength(uploadRequestsAfterFirst);
-    });
-});
-describe("enrolled installation identity (US-004)", () => {
-    /** Write a desktop client-health state file into `dir`. */
-    function writeHealthState(dir, body) {
-        fs.mkdirSync(dir, { recursive: true });
-        fs.writeFileSync(path.join(dir, DESKTOP_CLIENT_HEALTH_STATE_FILE), body, "utf8");
-    }
-    it("reads the id the desktop heartbeat pinned in the state dir", () => {
-        writeHealthState(stateDir, JSON.stringify({
-            installationId: "e1bff370-b666-4b97-bfa6-d44c4e81f258",
-            sequence: 7,
-        }));
-        expect(readDesktopInstallationId({ stateDir, homeDir: path.join(base, "home") })).toBe("e1bff370-b666-4b97-bfa6-d44c4e81f258");
-    });
-    it("falls back to the ~/.hq path the Rust heartbeat hard-codes", () => {
-        const homeDir = path.join(base, "home");
-        writeHealthState(path.join(homeDir, ".hq"), JSON.stringify({ installationId: "from-home-dir-1234" }));
-        expect(readDesktopInstallationId({ stateDir, homeDir })).toBe("from-home-dir-1234");
-    });
-    it("returns undefined when no heartbeat has ever enrolled this host", () => {
-        expect(readDesktopInstallationId({ stateDir, homeDir: path.join(base, "home") })).toBeUndefined();
-    });
-    it("returns undefined for a corrupt or malformed state file", () => {
-        const homeDir = path.join(base, "home");
-        for (const body of [
-            "{ not json",
-            "null",
-            "[]",
-            JSON.stringify({ sequence: 3 }),
-            JSON.stringify({ installationId: 42 }),
-            // Fails the manifest contract's identifier shape — never send it.
-            JSON.stringify({ installationId: "has spaces" }),
-            JSON.stringify({ installationId: "" }),
-        ]) {
-            writeHealthState(stateDir, body);
-            expect(readDesktopInstallationId({ stateDir, homeDir })).toBeUndefined();
-        }
-    });
-    it("prefers ~/.hq over a relocated state dir when the two disagree", () => {
-        // `~/.hq` is the ONLY file the menubar app's Rust heartbeat writes, so it
-        // holds the id the server has actually enrolled. A copy under a relocated
-        // HQ_STATE_DIR is either identical (harmless) or stale — and uploading
-        // under a stale id is a permanent 403 for the host, with no way for the
-        // enrolment fence to guess what was meant.
-        const homeDir = path.join(base, "home");
-        writeHealthState(path.join(homeDir, ".hq"), JSON.stringify({ installationId: "enrolled-by-heartbeat" }));
-        writeHealthState(stateDir, JSON.stringify({ installationId: "stale-relocated-copy" }));
-        expect(readDesktopInstallationId({ stateDir, homeDir })).toBe("enrolled-by-heartbeat");
-    });
-    it("still reads a relocated state dir when ~/.hq has no file at all", () => {
-        // The fallback must survive the reordering: on a host where state was
-        // relocated before the heartbeat ever ran, this is the only copy there is,
-        // and finding it beats skipping the audit entirely.
-        const homeDir = path.join(base, "home");
-        writeHealthState(stateDir, JSON.stringify({ installationId: "only-copy-1234" }));
-        expect(readDesktopInstallationId({ stateDir, homeDir })).toBe("only-copy-1234");
-    });
-    it("skips a malformed ~/.hq file and falls through to the state dir", () => {
-        const homeDir = path.join(base, "home");
-        writeHealthState(path.join(homeDir, ".hq"), "{ not json");
-        writeHealthState(stateDir, JSON.stringify({ installationId: "usable-fallback-1" }));
-        expect(readDesktopInstallationId({ stateDir, homeDir })).toBe("usable-fallback-1");
-    });
-    it("never creates, mints, or rewrites the client-health state file", () => {
-        const homeDir = path.join(base, "home");
-        fs.mkdirSync(path.join(homeDir, ".hq"), { recursive: true });
-        expect(readDesktopInstallationId({ stateDir, homeDir })).toBeUndefined();
-        expect(fs.existsSync(path.join(stateDir, DESKTOP_CLIENT_HEALTH_STATE_FILE))).toBe(false);
-        expect(fs.existsSync(path.join(homeDir, ".hq", DESKTOP_CLIENT_HEALTH_STATE_FILE))).toBe(false);
-        const body = JSON.stringify({ installationId: "pinned-id-0001" });
-        writeHealthState(stateDir, body);
-        expect(readDesktopInstallationId({ stateDir, homeDir })).toBe("pinned-id-0001");
-        expect(fs.readFileSync(path.join(stateDir, DESKTOP_CLIENT_HEALTH_STATE_FILE), "utf8")).toBe(body);
-    });
-    it("stamps the enrolled id, keeping machineId as the distinct host id", async () => {
-        writeHealthState(stateDir, JSON.stringify({ installationId: "enrolled-abcdef" }));
-        const runPass = makeUploadedPass();
-        await runPostSyncManifestUploads(makeOptions({
-            runPass,
-            resolveMachineId: () => "hq-root-machine-id",
-            // Exercise the REAL reader, not the seam.
-            resolveInstallationId: undefined,
-        }));
-        const passed = runPass.mock.calls[0][0];
-        expect(passed.installationId).toBe("enrolled-abcdef");
-        expect(passed.machineId).toBe("hq-root-machine-id");
-        expect(passed.installationId).not.toBe(passed.machineId);
-    });
-    it("skips every upload when this host has no enrolled identity", async () => {
-        const runPass = makeUploadedPass();
-        const fetchImpl = vi.fn();
-        const diagnostics = [];
-        const options = makeOptions({
-            runPass,
-            resolveInstallationId: () => undefined,
-            fetchImpl: fetchImpl,
-            reportDiagnostic: (d) => diagnostics.push(d.event),
-        });
-        // A guaranteed 403 is worse than no audit: skip, emit nothing, stay quiet.
-        await expect(runPostSyncManifestUploads(options)).resolves.toEqual([]);
-        expect(runPass).not.toHaveBeenCalled();
-        expect(fetchImpl).not.toHaveBeenCalled();
-        expect(options.events).toEqual([]);
-        expect(diagnostics).toContain("runner.manifest_upload.not_enrolled");
-    });
-    it("skips rather than throwing when the identity lookup blows up", async () => {
-        const runPass = makeUploadedPass();
-        const diagnostics = [];
-        const options = makeOptions({
-            runPass,
-            resolveInstallationId: () => {
-                throw new Error("boom");
-            },
-            reportDiagnostic: (d) => diagnostics.push(d.event),
-        });
-        await expect(runPostSyncManifestUploads(options)).resolves.toEqual([]);
-        expect(runPass).not.toHaveBeenCalled();
-        expect(diagnostics).toContain("runner.manifest_upload.identity_failed");
-    });
-});
-/**
- * The personal leg is identified by `personalMode`, never by the slug string.
- *
- * "personal" is a legal COMPANY slug: an operator can designate a cloud company
- * whose directory is `companies/personal` with its own uid and its own bucket.
- * Keying the scope on the string would build a PERSONAL manifest for it — the
- * personal snapshot scope key, the personal journal shard, the personal walk
- * roots — and upload that tenant's file list under the operator's own vault.
- */
-describe("runPostSyncManifestUploads — a cloud company may be named 'personal'", () => {
-    const COMPANY_NAMED_PERSONAL = { uid: "ent_personal_co", slug: "personal" };
-    it("builds a COMPANY scope for a company slug of 'personal'", async () => {
-        const runPass = makeUploadedPass();
-        await runPostSyncManifestUploads(makeOptions({
-            targets: [COMPANY_NAMED_PERSONAL],
-            completedCompanySlugs: new Set(["personal"]),
-            runPass,
-        }));
-        expect(runPass).toHaveBeenCalledTimes(1);
-        expect(runPass.mock.calls[0]?.[0]?.scope).toEqual({
-            kind: "company",
-            companyUid: "ent_personal_co",
-            slug: "personal",
-        });
-    });
-    it("still builds a PERSONAL scope when personalMode is set", async () => {
-        const runPass = makeUploadedPass();
-        await runPostSyncManifestUploads(makeOptions({
-            targets: [PERSONAL_TARGET],
-            completedCompanySlugs: new Set(["personal"]),
-            runPass,
-        }));
-        expect(runPass.mock.calls[0]?.[0]?.scope).toEqual({ kind: "personal" });
-    });
-    it("keeps the two apart in one fanout, so neither scope is built twice", async () => {
-        // The failure mode this guards: both legs collapsing onto `kind: "personal"`,
-        // which would make the second pass overwrite the first's snapshot — one
-        // scope key, two tenants.
-        const runPass = makeUploadedPass();
-        await runPostSyncManifestUploads(makeOptions({
-            targets: [PERSONAL_TARGET, COMPANY_NAMED_PERSONAL],
-            completedCompanySlugs: new Set(["personal"]),
-            runPass,
-        }));
-        const scopes = runPass.mock.calls.map((call) => call[0]?.scope);
-        expect(scopes).toEqual([
-            { kind: "personal" },
-            { kind: "company", companyUid: "ent_personal_co", slug: "personal" },
-        ]);
-    });
-});
-describe("runPostSyncManifestUploads — the tail step stats, it does not hash", () => {
-    it("pins hashPolicy to 'never' for every scope", async () => {
-        // Content hashing after every sync cycle measured at ~9m40s and 2.9 GB RSS
-        // on a real vault with a cold journal. The daemon path must never opt into
-        // it; `hq sync manifest --full-hash` is where that lives.
-        const runPass = makeUploadedPass();
-        await runPostSyncManifestUploads(makeOptions({ targets: [ACME_TARGET, PERSONAL_TARGET], completedCompanySlugs: new Set(["acme", "personal"]), runPass }));
-        expect(runPass.mock.calls.map((call) => call[0].hashPolicy)).toEqual(["never", "never"]);
-    });
-});
-describe("runPostSyncManifestUploads — phase budget reporting", () => {
-    afterEach(() => {
-        vi.useRealTimers();
-    });
-    it("counts the remaining scopes from the loop position, not from emitted events", async () => {
-        // Two ways a scope leaves the loop WITHOUT emitting an event: it has no uid
-        // (no scope can be attributed to it, so it is skipped), and the phase
-        // budget runs out before it starts. `eligible.length - emitted.length`
-        // counted both as still-pending, so the operator-facing "remaining" was
-        // over-reported by one per skipped target.
-        const noUid = { slug: "no-uid" };
-        const targets = [
-            noUid,
-            ACME_TARGET,
-            { uid: "ent_b", slug: "b" },
-            { uid: "ent_c", slug: "c" },
-        ];
-        const diagnostics = [];
-        // `setSystemTime`, not `advanceTimersByTime`: this must move `Date.now()`
-        // past the phase deadline WITHOUT firing the pending phase-abort and
-        // per-pass race timers, which would take the `phase_timeout` branch
-        // instead of the budget-exhausted one under test.
-        vi.useFakeTimers({ shouldAdvanceTime: true });
-        const startedAt = Date.now();
-        const runPass = vi.fn(async (options) => {
-            vi.setSystemTime(startedAt + RUNNER_MANIFEST_PHASE_WALL_MS + 1);
-            return { status: "uploaded", scopeKey: options.scope.kind };
-        });
-        await runPostSyncManifestUploads(makeOptions({
-            targets,
-            completedCompanySlugs: new Set(["no-uid", "acme", "b", "c"]),
-            runPass,
-            reportDiagnostic: (diagnostic) => diagnostics.push(diagnostic),
-        }));
-        // Index 0 skipped (no uid), index 1 ran and spent the budget, so indices 2
-        // and 3 are what is left.
-        expect(runPass).toHaveBeenCalledTimes(1);
-        const exhausted = diagnostics.find((diagnostic) => diagnostic.event === "runner.manifest_upload.phase_budget_exhausted");
-        expect(exhausted?.context?.remaining).toBe(2);
-    });
-});
-// ─── No silent exits (2026-09-07 personal-scope incident) ────────────────────
-//
-// Two returns on this path used to produce NOTHING — no event, no diagnostic,
-// no log line: the kill switch, and "no scope synced cleanly". Combined with a
-// `manifest-upload` event stream the desktop daemon does not persist, that
-// made three very different situations look identical from the outside:
-// the switch is off, the phase found nothing to do, or the phase never ran.
-describe("runPostSyncManifestUploads — every skip states its reason", () => {
-    it("reports a diagnostic when the kill switch suppresses the phase", async () => {
-        const diagnostics = [];
-        const runPass = makeUploadedPass();
-        const options = makeOptions({
-            env: { [MANIFEST_UPLOAD_DISABLED_ENV]: "1" },
-            runPass,
-            reportDiagnostic: (diagnostic) => diagnostics.push(diagnostic),
-        });
-        const emitted = await runPostSyncManifestUploads(options);
-        // Unchanged behaviour: still costs nothing and still uploads nothing.
-        expect(emitted).toEqual([]);
-        expect(runPass).not.toHaveBeenCalled();
-        // New behaviour: it says so.
-        expect(diagnostics.map((d) => d.event)).toContain("runner.manifest_upload.disabled");
-    });
-    it("reports a diagnostic when no scope synced cleanly", async () => {
-        const diagnostics = [];
-        const runPass = makeUploadedPass();
-        const options = makeOptions({
-            // A target that is NOT in the completed set: the partial-sync shape.
-            targets: [ACME_TARGET],
-            completedCompanySlugs: new Set(),
-            runPass,
-            reportDiagnostic: (diagnostic) => diagnostics.push(diagnostic),
-        });
-        const emitted = await runPostSyncManifestUploads(options);
-        expect(emitted).toEqual([]);
-        expect(runPass).not.toHaveBeenCalled();
-        expect(diagnostics.map((d) => d.event)).toContain("runner.manifest_upload.no_eligible_scopes");
-    });
-    it("still emits the upload event for a scope that DID run", async () => {
-        // Guard against over-correcting: adding the skip diagnostics must not
-        // disturb the healthy path.
-        const diagnostics = [];
-        const options = makeOptions({
-            runPass: makeUploadedPass(),
-            reportDiagnostic: (diagnostic) => diagnostics.push(diagnostic),
-        });
-        const emitted = await runPostSyncManifestUploads(options);
-        expect(emitted).toHaveLength(1);
-        expect(emitted[0]?.status).toBe("uploaded");
-        expect(diagnostics.map((d) => d.event)).not.toContain("runner.manifest_upload.disabled");
-        expect(diagnostics.map((d) => d.event)).not.toContain("runner.manifest_upload.no_eligible_scopes");
-    });
-});
-//# sourceMappingURL=sync-runner-manifest.test.js.map