@kaelio/ktx 0.5.0 → 0.7.0

package/dist/context/ingest/ingest-bundle.runner.isolated-diff.test.js

@@ -1,1928 +0,0 @@
-import { mkdir, mkdtemp, readFile, readdir, rm, writeFile } from 'node:fs/promises';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { describe, expect, it, vi } from 'vitest';
-import { GitService } from '../../context/core/git.service.js';
-import { SessionWorktreeService } from '../../context/core/session-worktree.service.js';
-import { LocalGitFileStore } from '../project/local-git-file-store.js';
-import { addTouchedSlSource } from '../../context/tools/touched-sl-sources.js';
-import { IngestBundleRunner } from './ingest-bundle.runner.js';
-async function makeRealGitRuntime() {
-    const homeDir = await mkdtemp(join(tmpdir(), 'ktx-isolated-runner-'));
-    const configDir = join(homeDir, 'config');
-    const git = new GitService({
-        storage: { configDir, homeDir },
-        git: {
-            userName: 'System User',
-            userEmail: 'system@example.com',
-            bootstrapMessage: 'init',
-            bootstrapAuthor: 'system',
-            bootstrapAuthorEmail: 'system@example.com',
-        },
-    });
-    await git.onModuleInit();
-    const configService = new LocalGitFileStore({ rootDir: configDir, git });
-    const sessionWorktreeService = new SessionWorktreeService({
-        coreConfig: {
-            storage: { configDir, homeDir },
-            git: {
-                userName: 'System User',
-                userEmail: 'system@example.com',
-                bootstrapMessage: 'init',
-                bootstrapAuthor: 'system',
-                bootstrapAuthorEmail: 'system@example.com',
-            },
-        },
-        gitService: git,
-        configService,
-    });
-    return { homeDir, configDir, git, configService, sessionWorktreeService };
-}
-function rootOfConfig(configService, fallback) {
-    const rootDir = configService.rootDir;
-    return typeof rootDir === 'string' ? rootDir : fallback;
-}
-async function loadSourcesFromRoot(root) {
-    const raw = await readFile(join(root, 'semantic-layer/warehouse/mart_account_segments.yaml'), 'utf-8').catch(() => '');
-    const hasCents = raw.includes('total_contract_arr_cents');
-    const hasDollars = raw.includes('total_contract_arr');
-    return {
-        sources: hasCents || hasDollars
-            ? [
-                {
-                    name: 'mart_account_segments',
-                    grain: ['account_id'],
-                    columns: [{ name: 'account_id', type: 'string' }],
-                    joins: [],
-                    measures: [{ name: hasCents ? 'total_contract_arr_cents' : 'total_contract_arr', expr: 'sum(contract_arr)' }],
-                    table: 'analytics.mart_account_segments',
-                },
-            ]
-            : [],
-        loadErrors: [],
-    };
-}
-async function listGlobalWikiPageKeys(root) {
-    const dir = join(root, 'wiki/global');
-    const entries = await readdir(dir).catch(() => []);
-    return entries
-        .filter((entry) => entry.endsWith('.md'))
-        .map((entry) => entry.slice(0, -'.md'.length))
-        .sort();
-}
-function frontmatterList(yaml, key) {
-    const pattern = new RegExp(`(?:^|\\n)${key}:\\n((?:  - .+\\n?)*)`);
-    return (pattern
-        .exec(yaml)?.[1]
-        ?.split('\n')
-        .map((line) => line.trim().replace(/^- /, ''))
-        .filter(Boolean) ?? []);
-}
-function legacyFallbackSettingKey() {
-    return ['sharedWorktree', 'SourceKeys'].join('');
-}
-function legacySharedTraceEvent() {
-    return ['shared', 'worktree', 'path', 'enabled'].join('_');
-}
-function makeWikiService(root) {
-    return {
-        listPageKeys: vi.fn(async (scope) => (scope === 'GLOBAL' ? listGlobalWikiPageKeys(root) : [])),
-        readPage: vi.fn(async (_scope, _scopeId, key) => {
-            const path = join(root, 'wiki/global', `${key}.md`);
-            const raw = await readFile(path, 'utf-8').catch(() => null);
-            if (!raw) {
-                return null;
-            }
-            const [, yaml = '', content = ''] = /^---\n([\s\S]*?)\n---\n?([\s\S]*)$/.exec(raw) ?? [];
-            return {
-                pageKey: key,
-                frontmatter: {
-                    summary: key,
-                    usage_mode: 'auto',
-                    refs: frontmatterList(yaml, 'refs'),
-                    sl_refs: frontmatterList(yaml, 'sl_refs'),
-                },
-                content: content.trim(),
-            };
-        }),
-        writePage: vi.fn(async (_scope, _scopeId, key, frontmatter, content) => {
-            await mkdir(join(root, 'wiki/global'), { recursive: true });
-            const refs = (frontmatter.refs ?? []).map((ref) => `  - ${ref}`).join('\n');
-            const slRefs = (frontmatter.sl_refs ?? []).map((ref) => `  - ${ref}`).join('\n');
-            await writeFile(join(root, 'wiki/global', `${key}.md`), [
-                '---',
-                `summary: ${frontmatter.summary ?? key}`,
-                `usage_mode: ${frontmatter.usage_mode ?? 'auto'}`,
-                'refs:',
-                refs,
-                'sl_refs:',
-                slRefs,
-                '---',
-                '',
-                content,
-                '',
-            ].join('\n'));
-        }),
-        syncFromCommit: vi.fn(),
-    };
-}
-function makeDeps(runtime, sourceKey = 'metabase', settings = {}) {
-    const adapter = {
-        source: sourceKey,
-        skillNames: [],
-        detect: vi.fn().mockResolvedValue(true),
-        chunk: vi.fn().mockResolvedValue({
-            workUnits: [
-                { unitKey: 'card-wiki', rawFiles: ['cards/wiki.json'], peerFileIndex: [], dependencyPaths: [] },
-                { unitKey: 'card-source', rawFiles: ['cards/source.json'], peerFileIndex: [], dependencyPaths: [] },
-            ],
-        }),
-    };
-    const wikiService = makeWikiService(runtime.configDir);
-    const semanticLayerService = {
-        loadAllSources: vi.fn(async () => loadSourcesFromRoot(runtime.configDir)),
-        listFilesForConnection: vi.fn().mockResolvedValue(['mart_account_segments.yaml']),
-    };
-    semanticLayerService.forWorktree = vi.fn((workdir) => ({
-        ...semanticLayerService,
-        loadAllSources: vi.fn(async () => loadSourcesFromRoot(workdir)),
-        listFilesForConnection: vi.fn().mockResolvedValue(['mart_account_segments.yaml']),
-    }));
-    const deps = {
-        runs: { create: vi.fn().mockResolvedValue({ id: 'run-1' }), markCompleted: vi.fn(), markFailed: vi.fn() },
-        provenance: {
-            insertMany: vi.fn(),
-            findLatestHashesForCompletedSyncs: vi.fn().mockResolvedValue(new Map()),
-            findLatestArtifactsForRawPaths: vi.fn().mockResolvedValue(new Map()),
-        },
-        reports: { create: vi.fn().mockResolvedValue({ id: 'report-1' }), findByJobId: vi.fn().mockResolvedValue(null), markSuperseded: vi.fn() },
-        canonicalPins: { listPins: vi.fn().mockResolvedValue([]) },
-        registry: { get: vi.fn().mockReturnValue(adapter), register: vi.fn(), has: vi.fn(), list: vi.fn() },
-        diffSetService: {
-            compute: vi.fn().mockResolvedValue({ added: ['cards/wiki.json', 'cards/source.json'], modified: [], deleted: [], unchanged: [] }),
-        },
-        sessionWorktreeService: runtime.sessionWorktreeService,
-        agentRunner: { runLoop: vi.fn() },
-        gitService: runtime.git,
-        lockingService: { withLock: vi.fn(async (_key, fn) => fn()) },
-        storage: {
-            homeDir: join(runtime.configDir, '.ktx'),
-            systemGitAuthor: { name: 'KTX Test', email: 'system@ktx.local' },
-            resolveUploadDir: (id) => join(runtime.homeDir, 'upload', id),
-            resolvePullDir: (id) => join(runtime.homeDir, 'pull', id),
-            resolveTranscriptDir: (id) => join(runtime.configDir, '.ktx/ingest-transcripts', id),
-            resolveTracePath: (id) => join(runtime.configDir, '.ktx/ingest-traces', id, 'trace.jsonl'),
-        },
-        settings: {
-            memoryIngestionModel: 'test',
-            probeRowCount: 1,
-            ingestTraceLevel: 'trace',
-            ...settings,
-        },
-        skillsRegistry: {
-            listSkills: vi.fn().mockResolvedValue([]),
-            getSkill: vi.fn().mockResolvedValue(null),
-            buildSkillsPrompt: vi.fn().mockReturnValue(''),
-            stripFrontmatter: vi.fn((body) => body),
-        },
-        promptService: { loadPrompt: vi.fn().mockResolvedValue('base') },
-        wikiService: { ...wikiService, forWorktree: vi.fn((workdir) => makeWikiService(workdir)) },
-        knowledgeIndex: { listPagesForUser: vi.fn().mockResolvedValue([]) },
-        knowledgeSlRefs: { syncFromWiki: vi.fn() },
-        semanticLayerService,
-        slSearchService: { indexSources: vi.fn() },
-        slSourcesRepository: {},
-        slValidator: { validateSingleSource: vi.fn().mockResolvedValue({ errors: [], warnings: [] }) },
-        connections: { listEnabledConnections: vi.fn().mockResolvedValue([]), getConnectionById: vi.fn() },
-        toolsetFactory: { createIngestWuToolset: vi.fn(() => ({ toRuntimeTools: vi.fn(() => ({})) })) },
-        commitMessages: { enqueueForExternalCommit: vi.fn() },
-        embedding: { maxBatchSize: 64, computeEmbedding: vi.fn(), computeEmbeddingsBulk: vi.fn() },
-    };
-    return { deps, adapter };
-}
-async function mockStageRawFiles(runner, runtime, hashes, sourceKey = 'metabase') {
-    runner.resolveStagedDir = vi.fn().mockResolvedValue(join(runtime.homeDir, 'stage'));
-    runner.stageRawFilesStage1 = vi.fn(async ({ worktreeRoot }) => {
-        const rawDir = join(worktreeRoot, 'raw-sources/warehouse', sourceKey, 's');
-        await mkdir(rawDir, { recursive: true });
-        for (const [rawPath] of hashes) {
-            await mkdir(join(rawDir, rawPath.split('/').slice(0, -1).join('/')), { recursive: true });
-            await writeFile(join(rawDir, rawPath), '{}');
-        }
-        return { currentHashes: new Map(hashes), rawDirInWorktree: `raw-sources/warehouse/${sourceKey}/s` };
-    });
-}
-describe('IngestBundleRunner isolated diff path', () => {
-    it('routes an unlisted direct-writing source through isolated diffs by default', async () => {
-        const runtime = await makeRealGitRuntime();
-        try {
-            const sourceKey = 'custom-direct-source';
-            const { deps, adapter } = makeDeps(runtime, sourceKey);
-            adapter.chunk.mockResolvedValue({
-                workUnits: [
-                    {
-                        unitKey: 'custom-wiki',
-                        rawFiles: ['custom/page.json'],
-                        peerFileIndex: [],
-                        dependencyPaths: [],
-                    },
-                ],
-            });
-            let currentSession = null;
-            deps.toolsetFactory.createIngestWuToolset = vi.fn((toolSession) => {
-                currentSession = toolSession;
-                return { toRuntimeTools: vi.fn(() => ({})) };
-            });
-            deps.agentRunner.runLoop = vi.fn(async (params) => {
-                if (params.telemetryTags.operationName !== 'ingest-bundle-wu') {
-                    return { stopReason: 'natural' };
-                }
-                const root = rootOfConfig(currentSession.configService, runtime.configDir);
-                await mkdir(join(root, 'wiki/global'), { recursive: true });
-                await writeFile(join(root, 'wiki/global/custom-isolated.md'), '---\nsummary: Custom isolated write\nusage_mode: auto\n---\n\nCustom isolated write.\n', 'utf-8');
-                currentSession.actions.push({
-                    target: 'wiki',
-                    type: 'created',
-                    key: 'custom-isolated',
-                    detail: 'Custom isolated write',
-                    rawPaths: ['custom/page.json'],
-                });
-                await currentSession.gitService.commitFiles(['wiki/global/custom-isolated.md'], 'custom wiki', 'KTX Test', 'system@ktx.local');
-                return { stopReason: 'natural' };
-            });
-            const runner = new IngestBundleRunner(deps);
-            await mockStageRawFiles(runner, runtime, [['custom/page.json', 'h1']], sourceKey);
-            await expect(runner.run({
-                jobId: 'job-custom-default',
-                connectionId: 'warehouse',
-                sourceKey,
-                trigger: 'upload',
-                bundleRef: { kind: 'upload', uploadId: 'upload' },
-            })).resolves.toMatchObject({
-                jobId: 'job-custom-default',
-                failedWorkUnits: [],
-                workUnitCount: 1,
-            });
-            const trace = await readFile(join(runtime.configDir, '.ktx/ingest-traces/job-custom-default/trace.jsonl'), 'utf-8');
-            expect(trace).toContain('isolated_diff_enabled');
-            expect(trace).toContain('work_unit_child_created');
-            expect(trace).not.toContain(legacySharedTraceEvent());
-            const reportCreate = vi.mocked(deps.reports.create).mock.calls.at(-1)?.[0];
-            const reportBody = reportCreate?.body;
-            expect(reportBody?.isolatedDiff).toMatchObject({
-                enabled: true,
-                acceptedPatches: 1,
-            });
-        }
-        finally {
-            await rm(runtime.homeDir, { recursive: true, force: true });
-        }
-    });
-    it('does not support shared-worktree fallback settings', async () => {
-        const runtime = await makeRealGitRuntime();
-        try {
-            const sourceKey = 'legacy-source';
-            const staleSettings = {
-                [legacyFallbackSettingKey()]: ['legacy-source'],
-            };
-            const { deps, adapter } = makeDeps(runtime, sourceKey, staleSettings);
-            adapter.chunk.mockResolvedValue({
-                workUnits: [
-                    {
-                        unitKey: 'legacy-wiki',
-                        rawFiles: ['legacy/page.json'],
-                        peerFileIndex: [],
-                        dependencyPaths: [],
-                    },
-                ],
-            });
-            let currentSession = null;
-            deps.toolsetFactory.createIngestWuToolset = vi.fn((toolSession) => {
-                currentSession = toolSession;
-                return { toRuntimeTools: vi.fn(() => ({})) };
-            });
-            deps.agentRunner.runLoop = vi.fn(async (params) => {
-                if (params.telemetryTags.operationName !== 'ingest-bundle-wu') {
-                    return { stopReason: 'natural' };
-                }
-                const root = rootOfConfig(currentSession.configService, runtime.configDir);
-                await mkdir(join(root, 'wiki/global'), { recursive: true });
-                await writeFile(join(root, 'wiki/global/legacy-isolated.md'), '---\nsummary: Legacy isolated write\nusage_mode: auto\n---\n\nLegacy isolated write.\n', 'utf-8');
-                currentSession.actions.push({
-                    target: 'wiki',
-                    type: 'created',
-                    key: 'legacy-isolated',
-                    detail: 'Legacy isolated write',
-                    rawPaths: ['legacy/page.json'],
-                });
-                await currentSession.gitService.commitFiles(['wiki/global/legacy-isolated.md'], 'legacy isolated wiki', 'KTX Test', 'system@ktx.local');
-                return { stopReason: 'natural' };
-            });
-            const runner = new IngestBundleRunner(deps);
-            await mockStageRawFiles(runner, runtime, [['legacy/page.json', 'h1']], sourceKey);
-            await expect(runner.run({
-                jobId: 'job-legacy-isolated',
-                connectionId: 'warehouse',
-                sourceKey,
-                trigger: 'upload',
-                bundleRef: { kind: 'upload', uploadId: 'upload' },
-            })).resolves.toMatchObject({
-                jobId: 'job-legacy-isolated',
-                failedWorkUnits: [],
-                workUnitCount: 1,
-            });
-            const trace = await readFile(join(runtime.configDir, '.ktx/ingest-traces/job-legacy-isolated/trace.jsonl'), 'utf-8');
-            expect(trace).toContain('isolated_diff_enabled');
-            expect(trace).toContain('work_unit_child_created');
-            expect(trace).not.toContain(legacySharedTraceEvent());
-            const reportCreate = vi.mocked(deps.reports.create).mock.calls.at(-1)?.[0];
-            const reportBody = reportCreate?.body;
-            expect(reportBody?.isolatedDiff).toMatchObject({
-                enabled: true,
-                acceptedPatches: 1,
-            });
-        }
-        finally {
-            await rm(runtime.homeDir, { recursive: true, force: true });
-        }
-    });
-    it('does not integrate failed isolated WorkUnit patches', async () => {
-        const runtime = await makeRealGitRuntime();
-        try {
-            const { deps, adapter } = makeDeps(runtime, 'fake');
-            adapter.chunk.mockResolvedValue({
-                workUnits: [
-                    { unitKey: 'wu-good', rawFiles: ['good.raw'], peerFileIndex: [], dependencyPaths: [] },
-                    { unitKey: 'wu-bad', rawFiles: ['bad.raw'], peerFileIndex: [], dependencyPaths: [] },
-                ],
-            });
-            deps.diffSetService.compute = vi.fn().mockResolvedValue({
-                added: ['good.raw', 'bad.raw'],
-                modified: [],
-                deleted: [],
-                unchanged: [],
-            });
-            deps.slValidator.validateSingleSource = vi.fn(async (_validationDeps, _connectionId, sourceName) => ({
-                errors: sourceName === 'bad' ? [{ message: 'bad source rejected' }] : [],
-                warnings: [],
-            }));
-            let currentSession = null;
-            deps.toolsetFactory.createIngestWuToolset = vi.fn((toolSession) => {
-                currentSession = toolSession;
-                return { toRuntimeTools: vi.fn(() => ({})) };
-            });
-            deps.agentRunner.runLoop = vi.fn(async (params) => {
-                if (params.telemetryTags.operationName !== 'ingest-bundle-wu') {
-                    return { stopReason: 'natural' };
-                }
-                const unitKey = params.telemetryTags.unitKey;
-                const root = rootOfConfig(currentSession.configService, runtime.configDir);
-                await mkdir(join(root, 'semantic-layer/warehouse'), { recursive: true });
-                if (unitKey === 'wu-good') {
-                    await writeFile(join(root, 'semantic-layer/warehouse/good.yaml'), 'name: good\n', 'utf-8');
-                    addTouchedSlSource(currentSession.touchedSlSources, 'warehouse', 'good');
-                    currentSession.actions.push({
-                        target: 'sl',
-                        type: 'created',
-                        key: 'good',
-                        detail: 'good source',
-                        targetConnectionId: 'warehouse',
-                        rawPaths: ['good.raw'],
-                    });
-                    await currentSession.gitService.commitFiles(['semantic-layer/warehouse/good.yaml'], 'test: add good source', 'KTX Test', 'system@ktx.local');
-                }
-                if (unitKey === 'wu-bad') {
-                    await writeFile(join(root, 'semantic-layer/warehouse/bad.yaml'), 'name: bad\n', 'utf-8');
-                    addTouchedSlSource(currentSession.touchedSlSources, 'warehouse', 'bad');
-                    currentSession.actions.push({
-                        target: 'sl',
-                        type: 'created',
-                        key: 'bad',
-                        detail: 'bad source',
-                        targetConnectionId: 'warehouse',
-                        rawPaths: ['bad.raw'],
-                    });
-                    await currentSession.gitService.commitFiles(['semantic-layer/warehouse/bad.yaml'], 'test: add bad source', 'KTX Test', 'system@ktx.local');
-                }
-                return { stopReason: 'natural' };
-            });
-            const runner = new IngestBundleRunner(deps);
-            await mockStageRawFiles(runner, runtime, [
-                ['good.raw', 'good-hash'],
-                ['bad.raw', 'bad-hash'],
-            ], 'fake');
-            const result = await runner.run({
-                jobId: 'job-failed-wu-isolated',
-                connectionId: 'warehouse',
-                sourceKey: 'fake',
-                trigger: 'upload',
-                bundleRef: { kind: 'upload', uploadId: 'upload' },
-            });
-            expect(result.failedWorkUnits).toEqual(['wu-bad']);
-            await expect(readFile(join(runtime.configDir, 'semantic-layer/warehouse/good.yaml'), 'utf-8')).resolves.toContain('good');
-            await expect(readFile(join(runtime.configDir, 'semantic-layer/warehouse/bad.yaml'), 'utf-8')).rejects.toThrow();
-            const reportCreate = vi.mocked(deps.reports.create).mock.calls.at(-1)?.[0];
-            const reportBody = reportCreate?.body;
-            expect(reportBody.failedWorkUnits).toEqual(['wu-bad']);
-            expect(reportBody.isolatedDiff).toMatchObject({ enabled: true, acceptedPatches: 1 });
-            const trace = await readFile(join(runtime.configDir, '.ktx/ingest-traces/job-failed-wu-isolated/trace.jsonl'), 'utf-8');
-            expect(trace).toContain('work_unit_failed_before_patch');
-            expect(trace).toContain('patch_accepted');
-            expect(trace).not.toContain(legacySharedTraceEvent());
-        }
-        finally {
-            await rm(runtime.homeDir, { recursive: true, force: true });
-        }
-    });
-    it.each(['notion', 'lookml', 'looker', 'dbt', 'metricflow'])('routes %s direct writes through isolated child worktrees', async (sourceKey) => {
-        const runtime = await makeRealGitRuntime();
-        try {
-            const { deps, adapter } = makeDeps(runtime, sourceKey);
-            adapter.chunk.mockResolvedValue({
-                workUnits: [
-                    {
-                        unitKey: `${sourceKey}-wiki`,
-                        rawFiles: [`${sourceKey}/page.json`],
-                        peerFileIndex: [],
-                        dependencyPaths: [],
-                    },
-                ],
-            });
-            let currentSession = null;
-            deps.toolsetFactory.createIngestWuToolset = vi.fn((toolSession) => {
-                currentSession = toolSession;
-                return { toRuntimeTools: vi.fn(() => ({})) };
-            });
-            deps.agentRunner.runLoop = vi.fn(async (params) => {
-                if (params.telemetryTags.operationName !== 'ingest-bundle-wu') {
-                    return { stopReason: 'natural' };
-                }
-                expect(params.telemetryTags).toMatchObject({
-                    operationName: 'ingest-bundle-wu',
-                    source: sourceKey,
-                    unitKey: `${sourceKey}-wiki`,
-                });
-                const root = rootOfConfig(currentSession.configService, runtime.configDir);
-                await mkdir(join(root, 'wiki/global'), { recursive: true });
-                await writeFile(join(root, 'wiki/global', `${sourceKey}-isolated.md`), `---\nsummary: ${sourceKey} isolated write\nusage_mode: auto\n---\n\nIsolated ${sourceKey} write.\n`, 'utf-8');
-                currentSession.actions.push({
-                    target: 'wiki',
-                    type: 'created',
-                    key: `${sourceKey}-isolated`,
-                    detail: `${sourceKey} isolated write`,
-                    rawPaths: [`${sourceKey}/page.json`],
-                });
-                await currentSession.gitService.commitFiles([`wiki/global/${sourceKey}-isolated.md`], `${sourceKey} wiki`, 'KTX Test', 'system@ktx.local');
-                return { stopReason: 'natural' };
-            });
-            const runner = new IngestBundleRunner(deps);
-            await mockStageRawFiles(runner, runtime, [[`${sourceKey}/page.json`, 'h1']], sourceKey);
-            await expect(runner.run({
-                jobId: `job-${sourceKey}`,
-                connectionId: 'warehouse',
-                sourceKey,
-                trigger: 'upload',
-                bundleRef: { kind: 'upload', uploadId: 'upload' },
-            })).resolves.toMatchObject({
-                jobId: `job-${sourceKey}`,
-                failedWorkUnits: [],
-                workUnitCount: 1,
-            });
-            const trace = await readFile(join(runtime.configDir, '.ktx/ingest-traces', `job-${sourceKey}`, 'trace.jsonl'), 'utf-8');
-            expect(trace).toContain('isolated_diff_enabled');
-            expect(trace).toContain('work_unit_child_created');
-            expect(trace).toContain('work_unit_patch_collected');
-            expect(trace).toContain('patch_apply_started');
-            expect(trace).not.toContain(legacySharedTraceEvent());
-            const reportCreate = vi.mocked(deps.reports.create).mock.calls.at(-1)?.[0];
-            const reportBody = reportCreate?.body;
-            expect(reportBody?.isolatedDiff).toMatchObject({
-                enabled: true,
-                acceptedPatches: 1,
-            });
-        }
-        finally {
-            await rm(runtime.homeDir, { recursive: true, force: true });
-        }
-    });
-    it('rejects the Metabase stale-measure wiki body regression before squash', async () => {
-        const runtime = await makeRealGitRuntime();
-        try {
-            const { deps, adapter } = makeDeps(runtime);
-            adapter.project = vi.fn(async ({ workdir }) => {
-                await mkdir(join(workdir, 'semantic-layer/warehouse'), { recursive: true });
-                await writeFile(join(workdir, 'semantic-layer/warehouse/mart_account_segments.yaml'), 'name: mart_account_segments\ngrain: [account_id]\ncolumns: [{name: account_id, type: string}]\njoins: []\nmeasures:\n  - name: total_contract_arr_cents\n    expr: sum(contract_arr)\n');
-                return {
-                    warnings: [],
-                    errors: [],
-                    touchedSources: [{ connectionId: 'warehouse', sourceName: 'mart_account_segments' }],
-                    changedWikiPageKeys: [],
-                };
-            });
-            let currentSession = null;
-            deps.toolsetFactory.createIngestWuToolset = vi.fn((toolSession) => {
-                currentSession = toolSession;
-                return { toRuntimeTools: vi.fn(() => ({})) };
-            });
-            deps.agentRunner.runLoop = vi.fn(async (params) => {
-                const root = rootOfConfig(currentSession.configService, runtime.configDir);
-                if (params.telemetryTags.unitKey === 'card-wiki') {
-                    await mkdir(join(root, 'wiki/global'), { recursive: true });
-                    await writeFile(join(root, 'wiki/global/account-segments.md'), '---\nsummary: Account segments\nusage_mode: auto\nsl_refs:\n  - mart_account_segments\n---\n\nARR is `mart_account_segments.total_contract_arr_cents`.\n');
-                    currentSession.actions.push({ target: 'wiki', type: 'created', key: 'account-segments', detail: 'Account segments' });
-                    await currentSession.gitService.commitFiles(['wiki/global/account-segments.md'], 'wu wiki', 'KTX Test', 'system@ktx.local');
-                }
-                if (params.telemetryTags.unitKey === 'card-source') {
-                    await writeFile(join(root, 'semantic-layer/warehouse/mart_account_segments.yaml'), 'name: mart_account_segments\ngrain: [account_id]\ncolumns: [{name: account_id, type: string}]\njoins: []\nmeasures:\n  - name: total_contract_arr\n    expr: sum(contract_arr)\n');
-                    addTouchedSlSource(currentSession.touchedSlSources, 'warehouse', 'mart_account_segments');
-                    currentSession.actions.push({
-                        target: 'sl',
-                        type: 'updated',
-                        key: 'mart_account_segments',
-                        detail: 'Dollar measure',
-                        targetConnectionId: 'warehouse',
-                    });
-                    await currentSession.gitService.commitFiles(['semantic-layer/warehouse/mart_account_segments.yaml'], 'wu source', 'KTX Test', 'system@ktx.local');
-                }
-                return { stopReason: 'natural' };
-            });
-            const runner = new IngestBundleRunner(deps);
-            await mockStageRawFiles(runner, runtime, [
-                ['cards/wiki.json', 'h1'],
-                ['cards/source.json', 'h2'],
-            ]);
-            await expect(runner.run({ jobId: 'job-1', connectionId: 'warehouse', sourceKey: 'metabase', trigger: 'upload', bundleRef: { kind: 'upload', uploadId: 'upload' } })).rejects.toThrow(/total_contract_arr_cents/);
-            const trace = await readFile(join(runtime.configDir, '.ktx/ingest-traces/job-1/trace.jsonl'), 'utf-8');
-            expect(trace).toContain('input_snapshot');
-            expect(trace).toContain('isolated_diff_enabled');
-            expect(trace).toContain('work_unit_child_created');
-            expect(trace).toContain('work_unit_patch_collected');
-            expect(trace).toContain('patch_apply_started');
-            expect(trace).toContain('final_artifact_gates_failed');
-            expect(trace).toContain('ingest_failed');
-        }
-        finally {
-            await rm(runtime.homeDir, { recursive: true, force: true });
-        }
-    });
-    it('rejects unchanged wiki body refs made stale by isolated semantic-layer changes', async () => {
-        const runtime = await makeRealGitRuntime();
-        try {
-            await mkdir(join(runtime.configDir, 'semantic-layer/warehouse'), { recursive: true });
-            await mkdir(join(runtime.configDir, 'wiki/global'), { recursive: true });
-            await writeFile(join(runtime.configDir, 'semantic-layer/warehouse/mart_account_segments.yaml'), 'name: mart_account_segments\ngrain: [account_id]\ncolumns: [{name: account_id, type: string}]\njoins: []\nmeasures:\n  - name: total_contract_arr_cents\n    expr: sum(contract_arr)\n');
-            await writeFile(join(runtime.configDir, 'wiki/global/account-segments.md'), '---\nsummary: Account segments\nusage_mode: auto\n---\n\nExisting ARR uses `mart_account_segments.total_contract_arr_cents`.\n');
-            await runtime.git.commitFiles(['semantic-layer/warehouse/mart_account_segments.yaml', 'wiki/global/account-segments.md'], 'seed existing wiki body ref', 'KTX Test', 'system@ktx.local');
-            const preRunHead = await runtime.git.revParseHead();
-            const { deps, adapter } = makeDeps(runtime);
-            adapter.chunk.mockResolvedValue({
-                workUnits: [{ unitKey: 'source-only', rawFiles: ['cards/source.json'], peerFileIndex: [], dependencyPaths: [] }],
-            });
-            let currentSession = null;
-            deps.toolsetFactory.createIngestWuToolset = vi.fn((toolSession) => {
-                currentSession = toolSession;
-                return { toRuntimeTools: vi.fn(() => ({})) };
-            });
-            deps.agentRunner.runLoop = vi.fn(async () => {
-                const root = rootOfConfig(currentSession.configService, runtime.configDir);
-                await writeFile(join(root, 'semantic-layer/warehouse/mart_account_segments.yaml'), 'name: mart_account_segments\ngrain: [account_id]\ncolumns: [{name: account_id, type: string}]\njoins: []\nmeasures:\n  - name: total_contract_arr\n    expr: sum(contract_arr)\n');
-                addTouchedSlSource(currentSession.touchedSlSources, 'warehouse', 'mart_account_segments');
-                currentSession.actions.push({
-                    target: 'sl',
-                    type: 'updated',
-                    key: 'mart_account_segments',
-                    detail: 'Rename ARR measure',
-                    targetConnectionId: 'warehouse',
-                    rawPaths: ['cards/source.json'],
-                });
-                await currentSession.gitService.commitFiles(['semantic-layer/warehouse/mart_account_segments.yaml'], 'wu source rename', 'KTX Test', 'system@ktx.local');
-                return { stopReason: 'natural' };
-            });
-            const runner = new IngestBundleRunner(deps);
-            await mockStageRawFiles(runner, runtime, [['cards/source.json', 'h1']]);
-            await expect(runner.run({
-                jobId: 'job-existing-body-stale',
-                connectionId: 'warehouse',
-                sourceKey: 'metabase',
-                trigger: 'upload',
-                bundleRef: { kind: 'upload', uploadId: 'upload' },
-            })).rejects.toThrow(/total_contract_arr_cents/);
-            expect(await runtime.git.revParseHead()).toBe(preRunHead);
-            const events = (await readFile(join(runtime.configDir, '.ktx/ingest-traces/job-existing-body-stale/trace.jsonl'), 'utf-8'))
-                .trim()
-                .split('\n')
-                .map((line) => JSON.parse(line));
-            expect(events.map((event) => event.event)).toEqual(expect.arrayContaining([
-                'final_artifact_gates_started',
-                'final_artifact_gates_failed',
-                'ingest_failed',
-                'failure_report_created',
-            ]));
-            expect(events.map((event) => event.event)).not.toContain('squash_finished');
-            const gateFailure = events.find((event) => event.event === 'final_artifact_gates_failed');
-            expect(gateFailure).toMatchObject({
-                data: {
-                    wikiReferenceGateScope: {
-                        global: true,
-                        reasons: expect.arrayContaining(['semantic_layer_changed']),
-                        pageKeysValidated: expect.arrayContaining(['account-segments']),
-                    },
-                    actionOrigins: expect.arrayContaining([
-                        expect.objectContaining({
-                            source: 'work_unit_action',
-                            unitKey: 'source-only',
-                            unitRawFiles: ['cards/source.json'],
-                            action: expect.objectContaining({
-                                target: 'sl',
-                                type: 'updated',
-                                key: 'mart_account_segments',
-                                rawPaths: ['cards/source.json'],
-                                targetConnectionId: 'warehouse',
-                            }),
-                        }),
-                    ]),
-                },
-                error: { message: expect.stringContaining('total_contract_arr_cents') },
-            });
-            const failureReport = deps.reports.create.mock.calls
-                .map((call) => call[0])
-                .find((report) => report.body.status === 'failed');
-            expect(failureReport.body.failure).toMatchObject({
-                phase: 'final_gates',
-                message: expect.stringContaining('total_contract_arr_cents'),
-                details: expect.objectContaining({
-                    wikiReferenceGateScope: expect.objectContaining({
-                        global: true,
-                        reasons: expect.arrayContaining(['semantic_layer_changed']),
-                        pageKeysValidated: expect.arrayContaining(['account-segments']),
-                    }),
-                    touchedSlSources: expect.arrayContaining([
-                        expect.objectContaining({ connectionId: 'warehouse', sourceName: 'mart_account_segments' }),
-                    ]),
-                    actionOrigins: expect.arrayContaining([
-                        expect.objectContaining({
-                            source: 'work_unit_action',
-                            unitKey: 'source-only',
-                            action: expect.objectContaining({
-                                target: 'sl',
-                                type: 'updated',
-                                key: 'mart_account_segments',
-                                rawPaths: ['cards/source.json'],
-                                targetConnectionId: 'warehouse',
-                            }),
-                        }),
-                    ]),
-                }),
-            });
-            expect(failureReport.body.workUnits).toEqual(expect.arrayContaining([
-                expect.objectContaining({
-                    unitKey: 'source-only',
-                    actions: expect.arrayContaining([
-                        expect.objectContaining({
-                            target: 'sl',
-                            type: 'updated',
-                            key: 'mart_account_segments',
-                            rawPaths: ['cards/source.json'],
-                        }),
-                    ]),
-                }),
-            ]));
-        }
-        finally {
-            await rm(runtime.homeDir, { recursive: true, force: true });
-        }
-    });
-    it('accepts two isolated work units that edit different wiki pages', async () => {
-        const runtime = await makeRealGitRuntime();
-        try {
-            const { deps, adapter } = makeDeps(runtime);
-            adapter.chunk.mockResolvedValue({
-                workUnits: [
-                    { unitKey: 'page-a', rawFiles: ['pages/a.json'], peerFileIndex: [], dependencyPaths: [] },
-                    { unitKey: 'page-b', rawFiles: ['pages/b.json'], peerFileIndex: [], dependencyPaths: [] },
-                ],
-            });
-            let currentSession = null;
-            deps.toolsetFactory.createIngestWuToolset = vi.fn((toolSession) => {
-                currentSession = toolSession;
-                return { toRuntimeTools: vi.fn(() => ({})) };
-            });
-            deps.agentRunner.runLoop = vi.fn(async (params) => {
-                const unitKey = params.telemetryTags.unitKey;
-                const root = rootOfConfig(currentSession.configService, runtime.configDir);
-                await mkdir(join(root, 'wiki/global'), { recursive: true });
-                await writeFile(join(root, `wiki/global/${unitKey}.md`), `---\nsummary: ${unitKey}\nusage_mode: auto\n---\n\n${unitKey}\n`);
-                currentSession.actions.push({ target: 'wiki', type: 'created', key: unitKey, detail: unitKey });
-                await currentSession.gitService.commitFiles([`wiki/global/${unitKey}.md`], `wu ${unitKey}`, 'KTX Test', 'system@ktx.local');
-                return { stopReason: 'natural' };
-            });
-            const runner = new IngestBundleRunner(deps);
-            await mockStageRawFiles(runner, runtime, [
-                ['pages/a.json', 'h1'],
-                ['pages/b.json', 'h2'],
-            ]);
-            const result = await runner.run({ jobId: 'job-clean', connectionId: 'warehouse', sourceKey: 'metabase', trigger: 'upload', bundleRef: { kind: 'upload', uploadId: 'upload' } });
-            expect(result.failedWorkUnits).toEqual([]);
-            const trace = await readFile(join(runtime.configDir, '.ktx/ingest-traces/job-clean/trace.jsonl'), 'utf-8');
-            expect(trace.match(/patch_accepted/g)).toHaveLength(2);
-            expect(trace).toContain('ingest_finished');
-        }
-        finally {
-            await rm(runtime.homeDir, { recursive: true, force: true });
-        }
-    });
-    it('classifies same-source patch application failure as a textual conflict', async () => {
-        const runtime = await makeRealGitRuntime();
-        try {
-            const { deps, adapter } = makeDeps(runtime);
-            adapter.chunk.mockResolvedValue({
-                workUnits: [
-                    { unitKey: 'orders-a', rawFiles: ['orders/a.json'], peerFileIndex: [], dependencyPaths: [] },
-                    { unitKey: 'orders-b', rawFiles: ['orders/b.json'], peerFileIndex: [], dependencyPaths: [] },
-                ],
-            });
-            let currentSession = null;
-            deps.toolsetFactory.createIngestWuToolset = vi.fn((toolSession) => {
-                currentSession = toolSession;
-                return { toRuntimeTools: vi.fn(() => ({})) };
-            });
-            deps.agentRunner.runLoop = vi.fn(async (params) => {
-                if (params.telemetryTags.operationName === 'ingest-isolated-diff-textual-resolver') {
-                    return { stopReason: 'natural' };
-                }
-                const suffix = params.telemetryTags.unitKey === 'orders-a' ? 'a' : 'b';
-                const root = rootOfConfig(currentSession.configService, runtime.configDir);
-                await mkdir(join(root, 'semantic-layer/warehouse'), { recursive: true });
-                await writeFile(join(root, 'semantic-layer/warehouse/orders.yaml'), `name: orders\ngrain: [id]\ncolumns: [{name: id, type: string}]\njoins: []\nmeasures:\n  - name: order_count_${suffix}\n    expr: count(*)\n`);
-                addTouchedSlSource(currentSession.touchedSlSources, 'warehouse', 'orders');
-                currentSession.actions.push({ target: 'sl', type: 'updated', key: 'orders', detail: suffix, targetConnectionId: 'warehouse' });
-                await currentSession.gitService.commitFiles(['semantic-layer/warehouse/orders.yaml'], `wu ${suffix}`, 'KTX Test', 'system@ktx.local');
-                return { stopReason: 'natural' };
-            });
-            const runner = new IngestBundleRunner(deps);
-            await mockStageRawFiles(runner, runtime, [
-                ['orders/a.json', 'h1'],
-                ['orders/b.json', 'h2'],
-            ]);
-            await expect(runner.run({ jobId: 'job-text-conflict', connectionId: 'warehouse', sourceKey: 'metabase', trigger: 'upload', bundleRef: { kind: 'upload', uploadId: 'upload' } })).rejects.toThrow(/isolated diff textual conflict/);
-            const trace = await readFile(join(runtime.configDir, '.ktx/ingest-traces/job-text-conflict/trace.jsonl'), 'utf-8');
-            expect(trace).toContain('patch_textual_conflict');
-            expect(trace).toContain('textual_conflict_resolver_failed');
-        }
-        finally {
-            await rm(runtime.homeDir, { recursive: true, force: true });
-        }
-    });
-    it('makes deterministic projection visible to child worktrees before WorkUnit synthesis', async () => {
-        const runtime = await makeRealGitRuntime();
-        try {
-            const { deps, adapter } = makeDeps(runtime);
-            adapter.chunk.mockResolvedValue({
-                workUnits: [{ unitKey: 'wiki-projected', rawFiles: ['projected/wiki.json'], peerFileIndex: [], dependencyPaths: [] }],
-            });
-            adapter.project = vi.fn(async ({ workdir }) => {
-                await mkdir(join(workdir, 'semantic-layer/warehouse'), { recursive: true });
-                await writeFile(join(workdir, 'semantic-layer/warehouse/mart_account_segments.yaml'), 'name: mart_account_segments\ngrain: [account_id]\ncolumns: [{name: account_id, type: string}]\njoins: []\nmeasures:\n  - name: total_contract_arr\n    expr: sum(contract_arr)\n');
-                return {
-                    warnings: [],
-                    errors: [],
-                    touchedSources: [{ connectionId: 'warehouse', sourceName: 'mart_account_segments' }],
-                    changedWikiPageKeys: [],
-                };
-            });
-            let currentSession = null;
-            deps.toolsetFactory.createIngestWuToolset = vi.fn((toolSession) => {
-                currentSession = toolSession;
-                return { toRuntimeTools: vi.fn(() => ({})) };
-            });
-            deps.agentRunner.runLoop = vi.fn(async () => {
-                const root = rootOfConfig(currentSession.configService, runtime.configDir);
-                await expect(readFile(join(root, 'semantic-layer/warehouse/mart_account_segments.yaml'), 'utf-8')).resolves.toContain('total_contract_arr');
-                await mkdir(join(root, 'wiki/global'), { recursive: true });
-                await writeFile(join(root, 'wiki/global/projected-orders.md'), '---\nsummary: Projected orders\nusage_mode: auto\nsl_refs:\n  - mart_account_segments\n---\n\nARR `mart_account_segments.total_contract_arr`.\n');
-                currentSession.actions.push({ target: 'wiki', type: 'created', key: 'projected-orders', detail: 'Projected orders' });
-                await currentSession.gitService.commitFiles(['wiki/global/projected-orders.md'], 'wu projected wiki', 'KTX Test', 'system@ktx.local');
-                return { stopReason: 'natural' };
-            });
-            const runner = new IngestBundleRunner(deps);
-            await mockStageRawFiles(runner, runtime, [['projected/wiki.json', 'h1']]);
-            const result = await runner.run({ jobId: 'job-projection', connectionId: 'warehouse', sourceKey: 'metabase', trigger: 'upload', bundleRef: { kind: 'upload', uploadId: 'upload' } });
-            expect(result.failedWorkUnits).toEqual([]);
-            const trace = await readFile(join(runtime.configDir, '.ktx/ingest-traces/job-projection/trace.jsonl'), 'utf-8');
-            expect(trace).toContain('deterministic_projection_finished');
-            expect(trace).toContain('deterministic_projection_committed');
-        }
-        finally {
-            await rm(runtime.homeDir, { recursive: true, force: true });
-        }
-    });
-    it('rejects Notion-style changed wiki pages with invalid sl_refs', async () => {
-        const runtime = await makeRealGitRuntime();
-        try {
-            const { deps, adapter } = makeDeps(runtime);
-            adapter.chunk.mockResolvedValue({
-                workUnits: [{ unitKey: 'notion-page', rawFiles: ['pages/notion.json'], peerFileIndex: [], dependencyPaths: [] }],
-            });
-            let currentSession = null;
-            deps.toolsetFactory.createIngestWuToolset = vi.fn((toolSession) => {
-                currentSession = toolSession;
-                return { toRuntimeTools: vi.fn(() => ({})) };
-            });
-            deps.agentRunner.runLoop = vi.fn(async (params) => {
-                if (params.telemetryTags.operationName === 'ingest-isolated-diff-gate-repair') {
-                    return { stopReason: 'natural' };
-                }
-                const root = rootOfConfig(currentSession.configService, runtime.configDir);
-                await mkdir(join(root, 'wiki/global'), { recursive: true });
-                await writeFile(join(root, 'wiki/global/notion-page.md'), '---\nsummary: Notion page\nusage_mode: auto\nsl_refs:\n  - missing_source\n---\n\nBody\n');
-                currentSession.actions.push({ target: 'wiki', type: 'created', key: 'notion-page', detail: 'Notion page' });
-                await currentSession.gitService.commitFiles(['wiki/global/notion-page.md'], 'wu notion', 'KTX Test', 'system@ktx.local');
-                return { stopReason: 'natural' };
-            });
-            const runner = new IngestBundleRunner(deps);
-            await mockStageRawFiles(runner, runtime, [['pages/notion.json', 'h1']]);
-            await expect(runner.run({ jobId: 'job-invalid-slrefs', connectionId: 'warehouse', sourceKey: 'metabase', trigger: 'upload', bundleRef: { kind: 'upload', uploadId: 'upload' } })).rejects.toThrow(/gate repair completed without editing an allowed path/);
-        }
-        finally {
-            await rm(runtime.homeDir, { recursive: true, force: true });
-        }
-    });
-    it('runs final artifact gates after reconciliation mutates the integration tree', async () => {
-        const runtime = await makeRealGitRuntime();
-        try {
-            const { deps, adapter } = makeDeps(runtime);
-            adapter.chunk.mockResolvedValue({
-                workUnits: [{ unitKey: 'card-source', rawFiles: ['cards/source.json'], peerFileIndex: [], dependencyPaths: [] }],
-            });
-            let currentSession = null;
-            deps.toolsetFactory.createIngestWuToolset = vi.fn((toolSession) => {
-                currentSession = toolSession;
-                return { toRuntimeTools: vi.fn(() => ({})) };
-            });
-            deps.agentRunner.runLoop = vi.fn(async (params) => {
-                const root = rootOfConfig(currentSession.configService, runtime.configDir);
-                if (params.telemetryTags.operationName === 'ingest-bundle-wu') {
-                    await mkdir(join(root, 'semantic-layer/warehouse'), { recursive: true });
-                    await writeFile(join(root, 'semantic-layer/warehouse/mart_account_segments.yaml'), 'name: mart_account_segments\ngrain: [account_id]\ncolumns: [{name: account_id, type: string}]\njoins: []\nmeasures:\n  - name: total_contract_arr\n    expr: sum(contract_arr)\n');
-                    addTouchedSlSource(currentSession.touchedSlSources, 'warehouse', 'mart_account_segments');
-                    currentSession.actions.push({
-                        target: 'sl',
-                        type: 'created',
-                        key: 'mart_account_segments',
-                        detail: 'Source with renamed ARR measure',
-                        targetConnectionId: 'warehouse',
-                        rawPaths: ['cards/source.json'],
-                    });
-                    await currentSession.gitService.commitFiles(['semantic-layer/warehouse/mart_account_segments.yaml'], 'wu source', 'KTX Test', 'system@ktx.local');
-                }
-                else {
-                    await mkdir(join(root, 'wiki/global'), { recursive: true });
-                    await writeFile(join(root, 'wiki/global/account-segments.md'), '---\nsummary: Account segments\nusage_mode: auto\nsl_refs:\n  - mart_account_segments\n---\n\nReconcile wrote stale ARR `mart_account_segments.total_contract_arr_cents`.\n');
-                    currentSession.actions.push({
-                        target: 'wiki',
-                        type: 'created',
-                        key: 'account-segments',
-                        detail: 'Stale reconcile wiki page',
-                        rawPaths: ['cards/source.json'],
-                    });
-                    await currentSession.gitService.commitFiles(['wiki/global/account-segments.md'], 'reconcile wiki', 'KTX Test', 'system@ktx.local');
-                }
-                return { stopReason: 'natural' };
-            });
-            const runner = new IngestBundleRunner(deps);
-            await mockStageRawFiles(runner, runtime, [['cards/source.json', 'h1']]);
-            await expect(runner.run({
-                jobId: 'job-reconcile-stale',
-                connectionId: 'warehouse',
-                sourceKey: 'metabase',
-                trigger: 'upload',
-                bundleRef: { kind: 'upload', uploadId: 'upload' },
-            })).rejects.toThrow(/total_contract_arr_cents/);
-            const trace = await readFile(join(runtime.configDir, '.ktx/ingest-traces/job-reconcile-stale/trace.jsonl'), 'utf-8');
-            expect(trace).toContain('reconciliation_finished');
-            expect(trace).toContain('final_artifact_gates_failed');
-            expect(trace).toContain('ingest_failed');
-            expect(await runtime.git.revParseHead()).not.toContain('reconcile wiki');
-        }
-        finally {
-            await rm(runtime.homeDir, { recursive: true, force: true });
-        }
-    });
-    it('stores a failure report and postmortem trace for final gate failures', async () => {
-        const runtime = await makeRealGitRuntime();
-        try {
-            const { deps, adapter } = makeDeps(runtime);
-            const createdReports = [];
-            deps.reports.create = vi.fn(async (args) => {
-                createdReports.push(args);
-                return { id: `report-${createdReports.length}` };
-            });
-            adapter.chunk.mockResolvedValue({
-                workUnits: [
-                    { unitKey: 'card-wiki', rawFiles: ['cards/wiki.json'], peerFileIndex: [], dependencyPaths: [] },
-                    { unitKey: 'card-source', rawFiles: ['cards/source.json'], peerFileIndex: [], dependencyPaths: [] },
-                ],
-            });
-            let currentSession = null;
-            deps.toolsetFactory.createIngestWuToolset = vi.fn((toolSession) => {
-                currentSession = toolSession;
-                return { toRuntimeTools: vi.fn(() => ({})) };
-            });
-            deps.agentRunner.runLoop = vi.fn(async (params) => {
-                const root = rootOfConfig(currentSession.configService, runtime.configDir);
-                if (params.telemetryTags.unitKey === 'card-wiki') {
-                    await mkdir(join(root, 'wiki/global'), { recursive: true });
-                    await writeFile(join(root, 'wiki/global/account-segments.md'), '---\nsummary: Account segments\nusage_mode: auto\n---\n\nARR is `mart_account_segments.total_contract_arr_cents`.\n');
-                    currentSession.actions.push({
-                        target: 'wiki',
-                        type: 'created',
-                        key: 'account-segments',
-                        detail: 'Account segments',
-                        rawPaths: ['cards/wiki.json'],
-                    });
-                    await currentSession.gitService.commitFiles(['wiki/global/account-segments.md'], 'wu wiki', 'KTX Test', 'system@ktx.local');
-                }
-                if (params.telemetryTags.unitKey === 'card-source') {
-                    await mkdir(join(root, 'semantic-layer/warehouse'), { recursive: true });
-                    await writeFile(join(root, 'semantic-layer/warehouse/mart_account_segments.yaml'), 'name: mart_account_segments\ngrain: [account_id]\ncolumns: [{name: account_id, type: string}]\njoins: []\nmeasures:\n  - name: total_contract_arr\n    expr: sum(contract_arr)\n');
-                    addTouchedSlSource(currentSession.touchedSlSources, 'warehouse', 'mart_account_segments');
-                    currentSession.actions.push({
-                        target: 'sl',
-                        type: 'created',
-                        key: 'mart_account_segments',
-                        detail: 'Dollar measure',
-                        targetConnectionId: 'warehouse',
-                        rawPaths: ['cards/source.json'],
-                    });
-                    await currentSession.gitService.commitFiles(['semantic-layer/warehouse/mart_account_segments.yaml'], 'wu source', 'KTX Test', 'system@ktx.local');
-                }
-                return { stopReason: 'natural' };
-            });
-            const runner = new IngestBundleRunner(deps);
-            await mockStageRawFiles(runner, runtime, [
-                ['cards/wiki.json', 'h1'],
-                ['cards/source.json', 'h2'],
-            ]);
-            await expect(runner.run({
-                jobId: 'job-trace-failure',
-                connectionId: 'warehouse',
-                sourceKey: 'metabase',
-                trigger: 'upload',
-                bundleRef: { kind: 'upload', uploadId: 'upload' },
-            })).rejects.toThrow(/total_contract_arr_cents/);
-            const failureReport = createdReports.find((report) => report.body.status === 'failed');
-            expect(failureReport.body.tracePath).toContain('job-trace-failure/trace.jsonl');
-            expect(failureReport.body.failure).toMatchObject({ phase: 'final_gates' });
-            const events = (await readFile(join(runtime.configDir, '.ktx/ingest-traces/job-trace-failure/trace.jsonl'), 'utf-8'))
-                .trim()
-                .split('\n')
-                .map((line) => JSON.parse(line));
-            expect(events.map((event) => event.event)).toEqual(expect.arrayContaining([
-                'ingest_started',
-                'input_snapshot',
-                'work_units_planned',
-                'isolated_diff_enabled',
-                'work_unit_child_created',
-                'work_unit_patch_collected',
-                'patch_apply_started',
-                'patch_accepted',
-                'reconciliation_finished',
-                'final_artifact_gates_failed',
-                'ingest_failed',
-                'failure_report_created',
-            ]));
-            const failed = events.find((event) => event.event === 'ingest_failed');
-            expect(failed).toMatchObject({
-                runId: 'run-1',
-                syncId: expect.any(String),
-                data: { phase: 'final_gates', tracePath: expect.stringContaining('trace.jsonl') },
-                error: { message: expect.stringContaining('total_contract_arr_cents') },
-            });
-        }
-        finally {
-            await rm(runtime.homeDir, { recursive: true, force: true });
-        }
-    });
-    it('rejects invalid provenance raw paths before squash reaches main', async () => {
-        const runtime = await makeRealGitRuntime();
-        try {
-            const { deps, adapter } = makeDeps(runtime);
-            const createdReports = [];
-            deps.reports.create = vi.fn(async (args) => {
-                createdReports.push(args);
-                return { id: `report-${createdReports.length}` };
-            });
-            adapter.chunk.mockResolvedValue({
-                workUnits: [
-                    {
-                        unitKey: 'card-valid-artifacts',
-                        rawFiles: ['cards/source.json'],
-                        peerFileIndex: [],
-                        dependencyPaths: [],
-                    },
-                ],
-            });
-            let currentSession = null;
-            deps.toolsetFactory.createIngestWuToolset = vi.fn((toolSession) => {
-                currentSession = toolSession;
-                return { toRuntimeTools: vi.fn(() => ({})) };
-            });
-            deps.agentRunner.runLoop = vi.fn(async () => {
-                const root = rootOfConfig(currentSession.configService, runtime.configDir);
-                await mkdir(join(root, 'semantic-layer/warehouse'), { recursive: true });
-                await mkdir(join(root, 'wiki/global'), { recursive: true });
-                await writeFile(join(root, 'semantic-layer/warehouse/mart_account_segments.yaml'), 'name: mart_account_segments\ngrain: [account_id]\ncolumns: [{name: account_id, type: string}]\njoins: []\nmeasures:\n  - name: total_contract_arr\n    expr: sum(contract_arr)\n');
-                await writeFile(join(root, 'wiki/global/account-segments.md'), '---\nsummary: Account segments\nusage_mode: auto\nsl_refs:\n  - mart_account_segments\n---\n\nARR is `mart_account_segments.total_contract_arr`.\n');
-                addTouchedSlSource(currentSession.touchedSlSources, 'warehouse', 'mart_account_segments');
-                currentSession.actions.push({
-                    target: 'sl',
-                    type: 'created',
-                    key: 'mart_account_segments',
-                    detail: 'Valid source',
-                    targetConnectionId: 'warehouse',
-                    rawPaths: ['cards/source.json'],
-                });
-                currentSession.actions.push({
-                    target: 'wiki',
-                    type: 'created',
-                    key: 'account-segments',
-                    detail: 'Valid wiki with invalid provenance raw path',
-                    rawPaths: ['cards/missing.json'],
-                });
-                await currentSession.gitService.commitFiles(['semantic-layer/warehouse/mart_account_segments.yaml', 'wiki/global/account-segments.md'], 'valid artifacts with invalid provenance', 'KTX Test', 'system@ktx.local');
-                return { stopReason: 'natural' };
-            });
-            const runner = new IngestBundleRunner(deps);
-            await mockStageRawFiles(runner, runtime, [['cards/source.json', 'h1']]);
-            const preRunHead = await runtime.git.revParseHead();
-            await expect(runner.run({
-                jobId: 'job-invalid-provenance',
-                connectionId: 'warehouse',
-                sourceKey: 'metabase',
-                trigger: 'upload',
-                bundleRef: { kind: 'upload', uploadId: 'upload' },
-            })).rejects.toThrow(/provenance row references raw path outside this snapshot: cards\/missing\.json/);
-            expect(await runtime.git.revParseHead()).toBe(preRunHead);
-            expect(deps.provenance.insertMany).not.toHaveBeenCalled();
-            const failureReport = createdReports.find((report) => report.body.status === 'failed');
-            expect(failureReport.body.tracePath).toContain('job-invalid-provenance/trace.jsonl');
-            expect(failureReport.body.failure).toMatchObject({
-                phase: 'provenance_validation',
-                message: expect.stringContaining('cards/missing.json'),
-            });
-            expect(failureReport.body.failure.details).toMatchObject({
-                invalidRawPaths: ['cards/missing.json'],
-                currentRawPaths: ['cards/source.json'],
-                invalidRows: expect.arrayContaining([
-                    expect.objectContaining({
-                        row: expect.objectContaining({
-                            rawPath: 'cards/missing.json',
-                            artifactKind: 'wiki',
-                            artifactKey: 'account-segments',
-                            actionType: 'wiki_written',
-                        }),
-                        origin: expect.objectContaining({
-                            source: 'work_unit_action',
-                            unitKey: 'card-valid-artifacts',
-                            actionIndex: 1,
-                            unitRawFiles: ['cards/source.json'],
-                            action: expect.objectContaining({
-                                target: 'wiki',
-                                type: 'created',
-                                key: 'account-segments',
-                                rawPaths: ['cards/missing.json'],
-                            }),
-                        }),
-                    }),
-                ]),
-            });
-            expect(failureReport.body.provenanceRows).toEqual(expect.arrayContaining([
-                expect.objectContaining({ rawPath: 'cards/source.json', artifactKind: 'sl', artifactKey: 'mart_account_segments' }),
-                expect.objectContaining({ rawPath: 'cards/missing.json', artifactKind: 'wiki', artifactKey: 'account-segments' }),
-            ]));
-            expect(failureReport.body.workUnits).toEqual(expect.arrayContaining([
-                expect.objectContaining({
-                    unitKey: 'card-valid-artifacts',
-                    rawFiles: ['cards/source.json'],
-                    actions: expect.arrayContaining([
-                        expect.objectContaining({
-                            target: 'wiki',
-                            key: 'account-segments',
-                            rawPaths: ['cards/missing.json'],
-                        }),
-                    ]),
-                }),
-            ]));
-            const events = (await readFile(join(runtime.configDir, '.ktx/ingest-traces/job-invalid-provenance/trace.jsonl'), 'utf-8'))
-                .trim()
-                .split('\n')
-                .map((line) => JSON.parse(line));
-            expect(events.map((event) => event.event)).toEqual(expect.arrayContaining([
-                'final_artifact_gates_finished',
-                'provenance_rows_validation_failed',
-                'ingest_failed',
-                'failure_report_created',
-            ]));
-            expect(events.map((event) => event.event)).not.toContain('squash_finished');
-            const validationFailure = events.find((event) => event.event === 'provenance_rows_validation_failed');
-            expect(validationFailure).toMatchObject({
-                phase: 'provenance',
-                data: {
-                    invalidRawPaths: ['cards/missing.json'],
-                    currentRawPaths: ['cards/source.json'],
-                    invalidRows: expect.arrayContaining([
-                        expect.objectContaining({
-                            row: expect.objectContaining({ rawPath: 'cards/missing.json' }),
-                            origin: expect.objectContaining({
-                                source: 'work_unit_action',
-                                unitKey: 'card-valid-artifacts',
-                                actionIndex: 1,
-                            }),
-                        }),
-                    ]),
-                },
-            });
-        }
-        finally {
-            await rm(runtime.homeDir, { recursive: true, force: true });
-        }
-    });
-    it('rejects slDisallowed patches that touch semantic-layer files', async () => {
-        const runtime = await makeRealGitRuntime();
-        try {
-            const { deps, adapter } = makeDeps(runtime);
-            adapter.chunk.mockResolvedValue({
-                workUnits: [
-                    {
-                        unitKey: 'lookml-mismatch',
-                        rawFiles: ['views/orders.lkml'],
-                        peerFileIndex: [],
-                        dependencyPaths: [],
-                        slDisallowed: true,
-                        slDisallowedReason: 'lookml_connection_mismatch',
-                    },
-                ],
-            });
-            let currentSession = null;
-            deps.toolsetFactory.createIngestWuToolset = vi.fn((toolSession) => {
-                currentSession = toolSession;
-                return { toRuntimeTools: vi.fn(() => ({})) };
-            });
-            deps.agentRunner.runLoop = vi.fn(async () => {
-                const root = rootOfConfig(currentSession.configService, runtime.configDir);
-                await mkdir(join(root, 'semantic-layer/warehouse'), { recursive: true });
-                await writeFile(join(root, 'semantic-layer/warehouse/orders.yaml'), 'name: orders\ngrain: [id]\ncolumns: [{name: id, type: string}]\njoins: []\nmeasures: []\n');
-                currentSession.actions.push({ target: 'sl', type: 'created', key: 'orders', detail: 'forbidden', targetConnectionId: 'warehouse' });
-                await currentSession.gitService.commitFiles(['semantic-layer/warehouse/orders.yaml'], 'forbidden sl', 'KTX Test', 'system@ktx.local');
-                return { stopReason: 'natural' };
-            });
-            const runner = new IngestBundleRunner(deps);
-            await mockStageRawFiles(runner, runtime, [['views/orders.lkml', 'h1']]);
-            await expect(runner.run({ jobId: 'job-sl-disallowed', connectionId: 'warehouse', sourceKey: 'metabase', trigger: 'upload', bundleRef: { kind: 'upload', uploadId: 'upload' } })).rejects.toThrow(/isolated diff textual conflict/);
-            const trace = await readFile(join(runtime.configDir, '.ktx/ingest-traces/job-sl-disallowed/trace.jsonl'), 'utf-8');
-            expect(trace).toContain('patch_policy_rejected');
-            expect(trace).toContain('slDisallowed WorkUnit lookml-mismatch touched semantic-layer/warehouse/orders.yaml');
-        }
-        finally {
-            await rm(runtime.homeDir, { recursive: true, force: true });
-        }
-    });
-    it('rejects final wiki refs broken by another accepted WorkUnit before squash', async () => {
-        const runtime = await makeRealGitRuntime();
-        try {
-            await mkdir(join(runtime.configDir, 'wiki/global'), { recursive: true });
-            await writeFile(join(runtime.configDir, 'wiki/global/source-page.md'), '---\nsummary: Source page\nusage_mode: auto\n---\n\nSource page\n');
-            await runtime.git.commitFiles(['wiki/global/source-page.md'], 'seed source page', 'KTX Test', 'system@ktx.local');
-            const preRunHead = await runtime.git.revParseHead();
-            const { deps, adapter } = makeDeps(runtime);
-            adapter.chunk.mockResolvedValue({
-                workUnits: [
-                    { unitKey: 'page-ref', rawFiles: ['pages/ref.json'], peerFileIndex: [], dependencyPaths: [] },
-                    { unitKey: 'page-delete', rawFiles: ['pages/delete.json'], peerFileIndex: [], dependencyPaths: [] },
-                ],
-            });
-            let currentSession = null;
-            deps.toolsetFactory.createIngestWuToolset = vi.fn((toolSession) => {
-                currentSession = toolSession;
-                return { toRuntimeTools: vi.fn(() => ({})) };
-            });
-            deps.agentRunner.runLoop = vi.fn(async (params) => {
-                const root = rootOfConfig(currentSession.configService, runtime.configDir);
-                if (params.telemetryTags.unitKey === 'page-ref') {
-                    await mkdir(join(root, 'wiki/global'), { recursive: true });
-                    await writeFile(join(root, 'wiki/global/account-segments.md'), '---\nsummary: Account segments\nusage_mode: auto\nrefs:\n  - source-page\n---\n\nSee [[source-page]].\n');
-                    currentSession.actions.push({
-                        target: 'wiki',
-                        type: 'created',
-                        key: 'account-segments',
-                        detail: 'Page with wiki ref',
-                        rawPaths: ['pages/ref.json'],
-                    });
-                    await currentSession.gitService.commitFiles(['wiki/global/account-segments.md'], 'wu page ref', 'KTX Test', 'system@ktx.local');
-                }
-                if (params.telemetryTags.unitKey === 'page-delete') {
-                    await rm(join(root, 'wiki/global/source-page.md'), { force: true });
-                    currentSession.actions.push({
-                        target: 'wiki',
-                        type: 'removed',
-                        key: 'source-page',
-                        detail: 'Delete referenced page',
-                        rawPaths: ['pages/delete.json'],
-                    });
-                    await currentSession.gitService.commitFiles(['wiki/global/source-page.md'], 'wu delete source page', 'KTX Test', 'system@ktx.local');
-                }
-                return { stopReason: 'natural' };
-            });
-            const runner = new IngestBundleRunner(deps);
-            await mockStageRawFiles(runner, runtime, [
-                ['pages/ref.json', 'h1'],
-                ['pages/delete.json', 'h2'],
-            ]);
-            await expect(runner.run({
-                jobId: 'job-wiki-ref-conflict',
-                connectionId: 'warehouse',
-                sourceKey: 'metabase',
-                trigger: 'upload',
-                bundleRef: { kind: 'upload', uploadId: 'upload' },
-            })).rejects.toThrow(/wiki references target missing page\(s\): account-segments -> source-page/);
-            expect(await runtime.git.revParseHead()).toBe(preRunHead);
-            const trace = await readFile(join(runtime.configDir, '.ktx/ingest-traces/job-wiki-ref-conflict/trace.jsonl'), 'utf-8');
-            expect(trace).toContain('final_artifact_gates_failed');
-            expect(trace).toContain('account-segments -> source-page');
-            expect(trace).toContain('ingest_failed');
-            expect(trace).toContain('failure_report_created');
-            expect(trace).not.toContain('squash_finished');
-            const failureReport = deps.reports.create.mock.calls
-                .map((call) => call[0])
-                .find((report) => report.body.status === 'failed');
-            expect(failureReport.body.failure).toMatchObject({
-                phase: 'final_gates',
-                message: expect.stringContaining('account-segments -> source-page'),
-                details: expect.objectContaining({
-                    changedWikiPageKeys: expect.arrayContaining(['account-segments']),
-                    workUnitPatchTouchedPaths: expect.arrayContaining([
-                        'wiki/global/account-segments.md',
-                        'wiki/global/source-page.md',
-                    ]),
-                }),
-            });
-        }
-        finally {
-            await rm(runtime.homeDir, { recursive: true, force: true });
-        }
-    });
-    it('rejects unchanged inbound wiki refs broken by an isolated wiki deletion', async () => {
-        const runtime = await makeRealGitRuntime();
-        try {
-            await mkdir(join(runtime.configDir, 'wiki/global'), { recursive: true });
-            await writeFile(join(runtime.configDir, 'wiki/global/source-page.md'), '---\nsummary: Source page\nusage_mode: auto\n---\n\nSource page\n');
-            await writeFile(join(runtime.configDir, 'wiki/global/account-segments.md'), '---\nsummary: Account segments\nusage_mode: auto\nrefs:\n  - source-page\n---\n\nSee [[source-page]].\n');
-            await runtime.git.commitFiles(['wiki/global/source-page.md', 'wiki/global/account-segments.md'], 'seed inbound wiki refs', 'KTX Test', 'system@ktx.local');
-            const preRunHead = await runtime.git.revParseHead();
-            const { deps, adapter } = makeDeps(runtime);
-            adapter.chunk.mockResolvedValue({
-                workUnits: [{ unitKey: 'delete-target-page', rawFiles: ['pages/delete.json'], peerFileIndex: [], dependencyPaths: [] }],
-            });
-            let currentSession = null;
-            deps.toolsetFactory.createIngestWuToolset = vi.fn((toolSession) => {
-                currentSession = toolSession;
-                return { toRuntimeTools: vi.fn(() => ({})) };
-            });
-            deps.agentRunner.runLoop = vi.fn(async (params) => {
-                if (params.telemetryTags.unitKey !== 'delete-target-page') {
-                    return { stopReason: 'natural' };
-                }
-                const root = rootOfConfig(currentSession.configService, runtime.configDir);
-                await rm(join(root, 'wiki/global/source-page.md'), { force: true });
-                currentSession.actions.push({
-                    target: 'wiki',
-                    type: 'removed',
-                    key: 'source-page',
-                    detail: 'Delete referenced page',
-                    rawPaths: ['pages/delete.json'],
-                });
-                await currentSession.gitService.commitFiles(['wiki/global/source-page.md'], 'wu delete target page', 'KTX Test', 'system@ktx.local');
-                return { stopReason: 'natural' };
-            });
-            const runner = new IngestBundleRunner(deps);
-            await mockStageRawFiles(runner, runtime, [['pages/delete.json', 'h1']]);
-            await expect(runner.run({
-                jobId: 'job-existing-wiki-ref-stale',
-                connectionId: 'warehouse',
-                sourceKey: 'metabase',
-                trigger: 'upload',
-                bundleRef: { kind: 'upload', uploadId: 'upload' },
-            })).rejects.toThrow(/wiki references target missing page\(s\): account-segments -> source-page/);
-            expect(await runtime.git.revParseHead()).toBe(preRunHead);
-            const events = (await readFile(join(runtime.configDir, '.ktx/ingest-traces/job-existing-wiki-ref-stale/trace.jsonl'), 'utf-8'))
-                .trim()
-                .split('\n')
-                .map((line) => JSON.parse(line));
-            expect(events.map((event) => event.event)).toEqual(expect.arrayContaining([
-                'final_artifact_gates_started',
-                'final_artifact_gates_failed',
-                'ingest_failed',
-                'failure_report_created',
-            ]));
-            expect(events.map((event) => event.event)).not.toContain('squash_finished');
-            const gateFailure = events.find((event) => event.event === 'final_artifact_gates_failed');
-            expect(gateFailure).toMatchObject({
-                data: {
-                    wikiReferenceGateScope: {
-                        global: true,
-                        reasons: expect.arrayContaining(['wiki_page_removed']),
-                        removedWikiPageKeys: expect.arrayContaining(['source-page']),
-                        pageKeysValidated: expect.arrayContaining(['account-segments']),
-                    },
-                    actionOrigins: expect.arrayContaining([
-                        expect.objectContaining({
-                            source: 'work_unit_action',
-                            unitKey: 'delete-target-page',
-                            unitRawFiles: ['pages/delete.json'],
-                            action: expect.objectContaining({
-                                target: 'wiki',
-                                type: 'removed',
-                                key: 'source-page',
-                                rawPaths: ['pages/delete.json'],
-                            }),
-                        }),
-                    ]),
-                },
-                error: { message: expect.stringContaining('account-segments -> source-page') },
-            });
-            const failureReport = deps.reports.create.mock.calls
-                .map((call) => call[0])
-                .find((report) => report.body.status === 'failed');
-            expect(failureReport.body.failure).toMatchObject({
-                phase: 'final_gates',
-                message: expect.stringContaining('account-segments -> source-page'),
-                details: expect.objectContaining({
-                    wikiReferenceGateScope: expect.objectContaining({
-                        global: true,
-                        reasons: expect.arrayContaining(['wiki_page_removed']),
-                        removedWikiPageKeys: expect.arrayContaining(['source-page']),
-                        pageKeysValidated: expect.arrayContaining(['account-segments']),
-                    }),
-                    changedWikiPageKeys: expect.arrayContaining(['source-page']),
-                    actionOrigins: expect.arrayContaining([
-                        expect.objectContaining({
-                            source: 'work_unit_action',
-                            unitKey: 'delete-target-page',
-                            action: expect.objectContaining({
-                                target: 'wiki',
-                                type: 'removed',
-                                key: 'source-page',
-                                rawPaths: ['pages/delete.json'],
-                            }),
-                        }),
-                    ]),
-                }),
-            });
-            expect(failureReport.body.workUnits).toEqual(expect.arrayContaining([
-                expect.objectContaining({
-                    unitKey: 'delete-target-page',
-                    actions: expect.arrayContaining([
-                        expect.objectContaining({
-                            target: 'wiki',
-                            type: 'removed',
-                            key: 'source-page',
-                            rawPaths: ['pages/delete.json'],
-                        }),
-                    ]),
-                }),
-            ]));
-        }
-        finally {
-            await rm(runtime.homeDir, { recursive: true, force: true });
-        }
-    });
-    it('rejects WorkUnit patches that touch unauthorized semantic-layer target connections', async () => {
-        const runtime = await makeRealGitRuntime();
-        try {
-            const { deps, adapter } = makeDeps(runtime);
-            adapter.chunk.mockResolvedValue({
-                workUnits: [{ unitKey: 'finance-source', rawFiles: ['cards/finance.json'], peerFileIndex: [], dependencyPaths: [] }],
-            });
-            let currentSession = null;
-            deps.toolsetFactory.createIngestWuToolset = vi.fn((toolSession) => {
-                currentSession = toolSession;
-                return { toRuntimeTools: vi.fn(() => ({})) };
-            });
-            deps.agentRunner.runLoop = vi.fn(async () => {
-                const root = rootOfConfig(currentSession.configService, runtime.configDir);
-                await mkdir(join(root, 'semantic-layer/finance'), { recursive: true });
-                await writeFile(join(root, 'semantic-layer/finance/orders.yaml'), 'name: orders\ngrain: [id]\ncolumns: [{name: id, type: string}]\njoins: []\nmeasures: []\n');
-                addTouchedSlSource(currentSession.touchedSlSources, 'finance', 'orders');
-                currentSession.actions.push({
-                    target: 'sl',
-                    type: 'created',
-                    key: 'orders',
-                    detail: 'Unauthorized target',
-                    targetConnectionId: 'finance',
-                    rawPaths: ['cards/finance.json'],
-                });
-                await currentSession.gitService.commitFiles(['semantic-layer/finance/orders.yaml'], 'wu unauthorized target', 'KTX Test', 'system@ktx.local');
-                return { stopReason: 'natural' };
-            });
-            const runner = new IngestBundleRunner(deps);
-            await mockStageRawFiles(runner, runtime, [['cards/finance.json', 'h1']]);
-            const preRunHead = await runtime.git.revParseHead();
-            await expect(runner.run({
-                jobId: 'job-unauthorized-wu-target',
-                connectionId: 'warehouse',
-                sourceKey: 'metabase',
-                trigger: 'upload',
-                bundleRef: { kind: 'upload', uploadId: 'upload' },
-            })).rejects.toThrow(/isolated diff textual conflict.*semantic-layer target connection not allowed/);
-            expect(await runtime.git.revParseHead()).toBe(preRunHead);
-            const trace = await readFile(join(runtime.configDir, '.ktx/ingest-traces/job-unauthorized-wu-target/trace.jsonl'), 'utf-8');
-            expect(trace).toContain('patch_policy_rejected');
-            expect(trace).toContain('semantic-layer/finance/orders.yaml');
-            expect(trace).toContain('allowedTargetConnectionIds');
-            expect(trace).toContain('ingest_failed');
-            expect(trace).toContain('failure_report_created');
-            expect(trace).not.toContain('squash_finished');
-            const failureReport = deps.reports.create.mock.calls
-                .map((call) => call[0])
-                .find((report) => report.body.status === 'failed');
-            expect(failureReport.body.failure).toMatchObject({
-                phase: 'integration',
-                message: expect.stringContaining('semantic-layer target connection not allowed'),
-            });
-            expect(failureReport.body.failure.details).toMatchObject({
-                unitKey: 'finance-source',
-                allowedTargetConnectionIds: ['warehouse'],
-                touchedPaths: ['semantic-layer/finance/orders.yaml'],
-                reason: expect.stringContaining('semantic-layer/finance/orders.yaml (finance)'),
-            });
-        }
-        finally {
-            await rm(runtime.homeDir, { recursive: true, force: true });
-        }
-    });
-    it('rejects reconciliation mutations that touch unauthorized semantic-layer target connections before squash', async () => {
-        const runtime = await makeRealGitRuntime();
-        try {
-            const { deps, adapter } = makeDeps(runtime);
-            adapter.chunk.mockResolvedValue({
-                workUnits: [{ unitKey: 'valid-page', rawFiles: ['pages/source.json'], peerFileIndex: [], dependencyPaths: [] }],
-            });
-            let currentSession = null;
-            deps.toolsetFactory.createIngestWuToolset = vi.fn((toolSession) => {
-                currentSession = toolSession;
-                return { toRuntimeTools: vi.fn(() => ({})) };
-            });
-            deps.agentRunner.runLoop = vi.fn(async (params) => {
-                const root = rootOfConfig(currentSession.configService, runtime.configDir);
-                if (params.telemetryTags.operationName === 'ingest-bundle-wu') {
-                    await mkdir(join(root, 'wiki/global'), { recursive: true });
-                    await writeFile(join(root, 'wiki/global/valid-page.md'), '---\nsummary: Valid page\nusage_mode: auto\n---\n\nValid\n');
-                    currentSession.actions.push({
-                        target: 'wiki',
-                        type: 'created',
-                        key: 'valid-page',
-                        detail: 'Valid page',
-                        rawPaths: ['pages/source.json'],
-                    });
-                    await currentSession.gitService.commitFiles(['wiki/global/valid-page.md'], 'wu valid page', 'KTX Test', 'system@ktx.local');
-                }
-                else {
-                    await mkdir(join(root, 'semantic-layer/finance'), { recursive: true });
-                    await writeFile(join(root, 'semantic-layer/finance/reconcile_orders.yaml'), 'name: reconcile_orders\ngrain: [id]\ncolumns: [{name: id, type: string}]\njoins: []\nmeasures: []\n');
-                    addTouchedSlSource(currentSession.touchedSlSources, 'finance', 'reconcile_orders');
-                    currentSession.actions.push({
-                        target: 'sl',
-                        type: 'created',
-                        key: 'reconcile_orders',
-                        detail: 'Unauthorized reconcile target',
-                        targetConnectionId: 'finance',
-                        rawPaths: ['pages/source.json'],
-                    });
-                    await currentSession.gitService.commitFiles(['semantic-layer/finance/reconcile_orders.yaml'], 'reconcile unauthorized target', 'KTX Test', 'system@ktx.local');
-                }
-                return { stopReason: 'natural' };
-            });
-            const runner = new IngestBundleRunner(deps);
-            await mockStageRawFiles(runner, runtime, [['pages/source.json', 'h1']]);
-            const preRunHead = await runtime.git.revParseHead();
-            await expect(runner.run({
-                jobId: 'job-unauthorized-reconcile-target',
-                connectionId: 'warehouse',
-                sourceKey: 'metabase',
-                trigger: 'upload',
-                bundleRef: { kind: 'upload', uploadId: 'upload' },
-            })).rejects.toThrow(/semantic-layer target connection not allowed/);
-            expect(await runtime.git.revParseHead()).toBe(preRunHead);
-            const trace = await readFile(join(runtime.configDir, '.ktx/ingest-traces/job-unauthorized-reconcile-target/trace.jsonl'), 'utf-8');
-            expect(trace).toContain('semantic_layer_target_policy_started');
-            expect(trace).toContain('semantic_layer_target_policy_failed');
-            expect(trace).toContain('allowedTargetConnectionIds');
-            expect(trace).toContain('semantic-layer/finance/reconcile_orders.yaml');
-            expect(trace).toContain('ingest_failed');
-            expect(trace).toContain('failure_report_created');
-            expect(trace).not.toContain('squash_finished');
-            const failureReport = deps.reports.create.mock.calls
-                .map((call) => call[0])
-                .find((report) => report.body.status === 'failed');
-            expect(failureReport.body.failure).toMatchObject({
-                phase: 'target_policy',
-                message: expect.stringContaining('semantic-layer target connection not allowed'),
-            });
-            expect(failureReport.body.failure.details).toMatchObject({
-                allowedTargetConnectionIds: ['warehouse'],
-                touchedPaths: expect.arrayContaining(['semantic-layer/finance/reconcile_orders.yaml']),
-            });
-        }
-        finally {
-            await rm(runtime.homeDir, { recursive: true, force: true });
-        }
-    });
-    it('repairs additive same-source textual conflicts before final gates and squash', async () => {
-        const runtime = await makeRealGitRuntime();
-        try {
-            const { deps } = makeDeps(runtime);
-            let currentSession = null;
-            deps.toolsetFactory.createIngestWuToolset = vi.fn((toolSession) => {
-                currentSession = toolSession;
-                return { toRuntimeTools: vi.fn(() => ({})) };
-            });
-            deps.agentRunner.runLoop = vi.fn(async (params) => {
-                if (params.telemetryTags.operationName === 'ingest-isolated-diff-textual-resolver') {
-                    const current = await params.toolSet.read_integration_file.execute({
-                        path: 'semantic-layer/warehouse/mart_account_segments.yaml',
-                    });
-                    expect(current.markdown).toContain('total_contract_arr_cents');
-                    const patch = await params.toolSet.read_failed_patch.execute({});
-                    expect(patch.markdown).toContain('account_count');
-                    await params.toolSet.write_integration_file.execute({
-                        path: 'semantic-layer/warehouse/mart_account_segments.yaml',
-                        content: 'name: mart_account_segments\n' +
-                            'grain: [account_id]\n' +
-                            'columns: [{name: account_id, type: string}]\n' +
-                            'joins: []\n' +
-                            'measures:\n' +
-                            '  - name: total_contract_arr_cents\n' +
-                            '    expr: sum(contract_arr)\n' +
-                            '  - name: account_count\n' +
-                            '    expr: count_distinct(account_id)\n',
-                    });
-                    return { stopReason: 'natural' };
-                }
-                const root = rootOfConfig(currentSession.configService, runtime.configDir);
-                await mkdir(join(root, 'semantic-layer/warehouse'), { recursive: true });
-                if (params.telemetryTags.unitKey === 'card-wiki') {
-                    await writeFile(join(root, 'semantic-layer/warehouse/mart_account_segments.yaml'), 'name: mart_account_segments\n' +
-                        'grain: [account_id]\n' +
-                        'columns: [{name: account_id, type: string}]\n' +
-                        'joins: []\n' +
-                        'measures:\n' +
-                        '  - name: total_contract_arr_cents\n' +
-                        '    expr: sum(contract_arr)\n');
-                }
-                else if (params.telemetryTags.unitKey === 'card-source') {
-                    await writeFile(join(root, 'semantic-layer/warehouse/mart_account_segments.yaml'), 'name: mart_account_segments\n' +
-                        'grain: [account_id]\n' +
-                        'columns: [{name: account_id, type: string}]\n' +
-                        'joins: []\n' +
-                        'measures:\n' +
-                        '  - name: account_count\n' +
-                        '    expr: count_distinct(account_id)\n');
-                }
-                addTouchedSlSource(currentSession.touchedSlSources, 'warehouse', 'mart_account_segments');
-                currentSession.actions.push({
-                    target: 'sl',
-                    type: 'updated',
-                    key: 'mart_account_segments',
-                    detail: 'Updated account segments source',
-                    targetConnectionId: 'warehouse',
-                });
-                await currentSession.gitService.commitFiles(['semantic-layer/warehouse/mart_account_segments.yaml'], `wu ${params.telemetryTags.unitKey}`, 'KTX Test', 'system@ktx.local');
-                return { stopReason: 'natural' };
-            });
-            const runner = new IngestBundleRunner(deps);
-            await mockStageRawFiles(runner, runtime, [
-                ['cards/wiki.json', 'hash-a'],
-                ['cards/source.json', 'hash-b'],
-            ]);
-            const result = await runner.run({
-                jobId: 'job-resolver-e2e',
-                connectionId: 'warehouse',
-                sourceKey: 'metabase',
-                trigger: 'manual_resync',
-                bundleRef: { kind: 'upload', uploadId: 'upload-1' },
-            });
-            expect(result.commitSha).toBeTruthy();
-            const source = await readFile(join(runtime.configDir, 'semantic-layer/warehouse/mart_account_segments.yaml'), 'utf-8');
-            expect(source).toContain('total_contract_arr_cents');
-            expect(source).toContain('account_count');
-            expect(deps.agentRunner.runLoop).toHaveBeenCalledWith(expect.objectContaining({
-                modelRole: 'repair',
-                telemetryTags: expect.objectContaining({
-                    operationName: 'ingest-isolated-diff-textual-resolver',
-                    unitKey: 'card-source',
-                }),
-            }));
-            const successReport = deps.reports.create.mock.calls.at(-1)?.[0]?.body;
-            expect(successReport.isolatedDiff).toMatchObject({
-                acceptedPatches: 2,
-                textualConflicts: 1,
-                semanticConflicts: 0,
-                resolverAttempts: 1,
-                resolverRepairs: 1,
-                resolverFailures: 0,
-            });
-            const trace = await readFile(join(runtime.configDir, '.ktx/ingest-traces/job-resolver-e2e/trace.jsonl'), 'utf-8');
-            expect(trace).toContain('textual_conflict_resolver_repaired');
-            expect(trace).toContain('patch_accepted_after_textual_resolution');
-        }
-        finally {
-            await rm(runtime.homeDir, { recursive: true, force: true });
-        }
-    });
-    it('repairs final wiki body refs before squash when the repair agent edits the scoped page', async () => {
-        const runtime = await makeRealGitRuntime();
-        try {
-            await mkdir(join(runtime.configDir, 'semantic-layer/warehouse'), { recursive: true });
-            await mkdir(join(runtime.configDir, 'wiki/global'), { recursive: true });
-            await writeFile(join(runtime.configDir, 'semantic-layer/warehouse/mart_account_segments.yaml'), 'name: mart_account_segments\ngrain: [account_id]\ncolumns: [{name: account_id, type: string}]\njoins: []\nmeasures:\n  - name: total_contract_arr_cents\n    expr: sum(contract_arr)\n');
-            await writeFile(join(runtime.configDir, 'wiki/global/account-segments.md'), '---\nsummary: Account segments\nusage_mode: auto\n---\n\nExisting ARR uses `mart_account_segments.total_contract_arr_cents`.\n');
-            await runtime.git.commitFiles(['semantic-layer/warehouse/mart_account_segments.yaml', 'wiki/global/account-segments.md'], 'seed stale wiki body ref', 'KTX Test', 'system@ktx.local');
-            const { deps, adapter } = makeDeps(runtime);
-            adapter.chunk.mockResolvedValue({
-                workUnits: [{ unitKey: 'source-only', rawFiles: ['cards/source.json'], peerFileIndex: [], dependencyPaths: [] }],
-            });
-            let currentSession = null;
-            deps.toolsetFactory.createIngestWuToolset = vi.fn((toolSession) => {
-                currentSession = toolSession;
-                return { toRuntimeTools: vi.fn(() => ({})) };
-            });
-            deps.agentRunner.runLoop = vi.fn(async (params) => {
-                if (params.telemetryTags.operationName === 'ingest-isolated-diff-gate-repair') {
-                    const gateError = await params.toolSet.read_gate_error.execute({});
-                    expect(gateError.markdown).toContain('total_contract_arr_cents');
-                    const page = await params.toolSet.read_repair_file.execute({
-                        path: 'wiki/global/account-segments.md',
-                    });
-                    await params.toolSet.write_repair_file.execute({
-                        path: 'wiki/global/account-segments.md',
-                        content: page.markdown.replace('total_contract_arr_cents', 'total_contract_arr'),
-                    });
-                    return { stopReason: 'natural' };
-                }
-                if (params.modelRole === 'reconcile') {
-                    return { stopReason: 'natural' };
-                }
-                const root = rootOfConfig(currentSession.configService, runtime.configDir);
-                await writeFile(join(root, 'semantic-layer/warehouse/mart_account_segments.yaml'), 'name: mart_account_segments\ngrain: [account_id]\ncolumns: [{name: account_id, type: string}]\njoins: []\nmeasures:\n  - name: total_contract_arr\n    expr: sum(contract_arr)\n');
-                addTouchedSlSource(currentSession.touchedSlSources, 'warehouse', 'mart_account_segments');
-                currentSession.actions.push({
-                    target: 'sl',
-                    type: 'updated',
-                    key: 'mart_account_segments',
-                    detail: 'Rename ARR measure',
-                    targetConnectionId: 'warehouse',
-                    rawPaths: ['cards/source.json'],
-                });
-                await currentSession.gitService.commitFiles(['semantic-layer/warehouse/mart_account_segments.yaml'], 'wu source rename', 'KTX Test', 'system@ktx.local');
-                return { stopReason: 'natural' };
-            });
-            const runner = new IngestBundleRunner(deps);
-            await mockStageRawFiles(runner, runtime, [['cards/source.json', 'h1']]);
-            const result = await runner.run({
-                jobId: 'job-final-gate-repair',
-                connectionId: 'warehouse',
-                sourceKey: 'metabase',
-                trigger: 'upload',
-                bundleRef: { kind: 'upload', uploadId: 'upload' },
-            });
-            expect(result.commitSha).toBeTruthy();
-            await expect(readFile(join(runtime.configDir, 'wiki/global/account-segments.md'), 'utf-8')).resolves.toContain('mart_account_segments.total_contract_arr');
-            await expect(readFile(join(runtime.configDir, 'wiki/global/account-segments.md'), 'utf-8')).resolves.not.toContain('total_contract_arr_cents');
-            const reportCreate = vi.mocked(deps.reports.create).mock.calls.at(-1)?.[0];
-            expect(reportCreate.body.isolatedDiff).toMatchObject({
-                gateRepairAttempts: 1,
-                gateRepairs: 1,
-                gateRepairFailures: 0,
-            });
-            const trace = await readFile(join(runtime.configDir, '.ktx/ingest-traces/job-final-gate-repair/trace.jsonl'), 'utf-8');
-            expect(trace).toContain('gate_repair_repaired');
-            expect(trace).toContain('final_artifact_gates_after_gate_repair_finished');
-            expect(trace).toContain('final_gate_repair_committed');
-        }
-        finally {
-            await rm(runtime.homeDir, { recursive: true, force: true });
-        }
-    });
-    it('fails before squash when final gate repair makes no edit', async () => {
-        const runtime = await makeRealGitRuntime();
-        try {
-            await mkdir(join(runtime.configDir, 'semantic-layer/warehouse'), { recursive: true });
-            await mkdir(join(runtime.configDir, 'wiki/global'), { recursive: true });
-            await writeFile(join(runtime.configDir, 'semantic-layer/warehouse/mart_account_segments.yaml'), 'name: mart_account_segments\ngrain: [account_id]\ncolumns: [{name: account_id, type: string}]\njoins: []\nmeasures:\n  - name: total_contract_arr_cents\n    expr: sum(contract_arr)\n');
-            await writeFile(join(runtime.configDir, 'wiki/global/account-segments.md'), '---\nsummary: Account segments\nusage_mode: auto\n---\n\nExisting ARR uses `mart_account_segments.total_contract_arr_cents`.\n');
-            await runtime.git.commitFiles(['semantic-layer/warehouse/mart_account_segments.yaml', 'wiki/global/account-segments.md'], 'seed stale wiki body ref', 'KTX Test', 'system@ktx.local');
-            const preRunHead = await runtime.git.revParseHead();
-            const { deps, adapter } = makeDeps(runtime);
-            adapter.chunk.mockResolvedValue({
-                workUnits: [{ unitKey: 'source-only', rawFiles: ['cards/source.json'], peerFileIndex: [], dependencyPaths: [] }],
-            });
-            let currentSession = null;
-            deps.toolsetFactory.createIngestWuToolset = vi.fn((toolSession) => {
-                currentSession = toolSession;
-                return { toRuntimeTools: vi.fn(() => ({})) };
-            });
-            deps.agentRunner.runLoop = vi.fn(async (params) => {
-                if (params.telemetryTags.operationName === 'ingest-isolated-diff-gate-repair') {
-                    return { stopReason: 'natural' };
-                }
-                if (params.modelRole === 'reconcile') {
-                    return { stopReason: 'natural' };
-                }
-                const root = rootOfConfig(currentSession.configService, runtime.configDir);
-                await writeFile(join(root, 'semantic-layer/warehouse/mart_account_segments.yaml'), 'name: mart_account_segments\ngrain: [account_id]\ncolumns: [{name: account_id, type: string}]\njoins: []\nmeasures:\n  - name: total_contract_arr\n    expr: sum(contract_arr)\n');
-                addTouchedSlSource(currentSession.touchedSlSources, 'warehouse', 'mart_account_segments');
-                currentSession.actions.push({
-                    target: 'sl',
-                    type: 'updated',
-                    key: 'mart_account_segments',
-                    detail: 'Rename ARR measure',
-                    targetConnectionId: 'warehouse',
-                    rawPaths: ['cards/source.json'],
-                });
-                await currentSession.gitService.commitFiles(['semantic-layer/warehouse/mart_account_segments.yaml'], 'wu source rename', 'KTX Test', 'system@ktx.local');
-                return { stopReason: 'natural' };
-            });
-            const runner = new IngestBundleRunner(deps);
-            await mockStageRawFiles(runner, runtime, [['cards/source.json', 'h1']]);
-            await expect(runner.run({
-                jobId: 'job-final-gate-repair-fails',
-                connectionId: 'warehouse',
-                sourceKey: 'metabase',
-                trigger: 'upload',
-                bundleRef: { kind: 'upload', uploadId: 'upload' },
-            })).rejects.toThrow(/gate repair completed without editing an allowed path/);
-            expect(await runtime.git.revParseHead()).toBe(preRunHead);
-            const reportCreate = vi.mocked(deps.reports.create).mock.calls.at(-1)?.[0];
-            expect(reportCreate.body.status).toBe('failed');
-            expect(reportCreate.body.isolatedDiff).toMatchObject({
-                gateRepairAttempts: 1,
-                gateRepairs: 0,
-                gateRepairFailures: 1,
-            });
-            const trace = await readFile(join(runtime.configDir, '.ktx/ingest-traces/job-final-gate-repair-fails/trace.jsonl'), 'utf-8');
-            expect(trace).toContain('gate_repair_failed');
-            expect(trace).not.toContain('squash_finished');
-        }
-        finally {
-            await rm(runtime.homeDir, { recursive: true, force: true });
-        }
-    });
-    it('runs finalization before wiki sl-ref repair and final gates', async () => {
-        const runtime = await makeRealGitRuntime();
-        try {
-            const { deps, adapter } = makeDeps(runtime);
-            adapter.chunk.mockResolvedValue({
-                workUnits: [{ unitKey: 'wiki-page', rawFiles: ['cards/source.json'], peerFileIndex: [], dependencyPaths: [] }],
-            });
-            adapter.finalize = vi.fn(async ({ workdir }) => {
-                await mkdir(join(workdir, 'semantic-layer/warehouse'), { recursive: true });
-                await mkdir(join(workdir, 'wiki/global'), { recursive: true });
-                await writeFile(join(workdir, 'semantic-layer/warehouse/mart_account_segments.yaml'), 'name: mart_account_segments\ngrain: [account_id]\ncolumns: [{name: account_id, type: string}]\njoins: []\nmeasures:\n  - name: total_contract_arr\n    expr: sum(contract_arr)\n');
-                await writeFile(join(workdir, 'wiki/global/finalized-accounts.md'), '---\nsummary: Finalized accounts\nusage_mode: auto\nsl_refs:\n  - mart_account_segments\n  - missing_source\n---\n\nAccounts use `mart_account_segments.total_contract_arr`.\n');
-                return {
-                    warnings: [],
-                    errors: [],
-                    touchedSources: [{ connectionId: 'warehouse', sourceName: 'mart_account_segments' }],
-                    changedWikiPageKeys: ['finalized-accounts'],
-                    actions: [
-                        {
-                            target: 'sl',
-                            type: 'created',
-                            key: 'mart_account_segments',
-                            detail: 'Finalized accounts',
-                            targetConnectionId: 'warehouse',
-                            rawPaths: ['cards/source.json'],
-                        },
-                        {
-                            target: 'wiki',
-                            type: 'created',
-                            key: 'finalized-accounts',
-                            detail: 'Finalized wiki',
-                            rawPaths: ['cards/source.json'],
-                        },
-                    ],
-                };
-            });
-            deps.agentRunner.runLoop = vi.fn(async () => ({ stopReason: 'natural' }));
-            const runner = new IngestBundleRunner(deps);
-            await mockStageRawFiles(runner, runtime, [['cards/source.json', 'h1']]);
-            await runner.run({
-                jobId: 'job-finalization',
-                connectionId: 'warehouse',
-                sourceKey: 'metabase',
-                trigger: 'upload',
-                bundleRef: { kind: 'upload', uploadId: 'upload' },
-            });
-            const trace = await readFile(join(runtime.configDir, '.ktx/ingest-traces/job-finalization/trace.jsonl'), 'utf-8');
-            expect(trace.indexOf('finalization_committed')).toBeLessThan(trace.indexOf('wiki_sl_refs_repaired'));
-            expect(trace.indexOf('wiki_sl_refs_repaired')).toBeLessThan(trace.indexOf('final_artifact_gates'));
-            await expect(readFile(join(runtime.configDir, 'wiki/global/finalized-accounts.md'), 'utf-8')).resolves.toContain('sl_refs:\n  - mart_account_segments');
-        }
-        finally {
-            await rm(runtime.homeDir, { recursive: true, force: true });
-        }
-    });
-    it('fails when finalization edits a path already changed earlier in the run', async () => {
-        const runtime = await makeRealGitRuntime();
-        try {
-            const { deps, adapter } = makeDeps(runtime);
-            adapter.chunk.mockResolvedValue({
-                workUnits: [{ unitKey: 'wiki-page', rawFiles: ['cards/source.json'], peerFileIndex: [], dependencyPaths: [] }],
-            });
-            let currentSession = null;
-            deps.toolsetFactory.createIngestWuToolset = vi.fn((toolSession) => {
-                currentSession = toolSession;
-                return { toRuntimeTools: vi.fn(() => ({})) };
-            });
-            deps.agentRunner.runLoop = vi.fn(async () => {
-                const root = rootOfConfig(currentSession.configService, runtime.configDir);
-                await mkdir(join(root, 'wiki/global'), { recursive: true });
-                await writeFile(join(root, 'wiki/global/orders.md'), '---\nsummary: Orders\nusage_mode: auto\n---\n\nWU body\n');
-                currentSession.actions.push({
-                    target: 'wiki',
-                    type: 'created',
-                    key: 'orders',
-                    detail: 'WU orders',
-                    rawPaths: ['cards/source.json'],
-                });
-                await currentSession.gitService.commitFiles(['wiki/global/orders.md'], 'wu orders', 'KTX Test', 'system@ktx.local');
-                return { stopReason: 'natural' };
-            });
-            adapter.finalize = vi.fn(async ({ workdir }) => {
-                await writeFile(join(workdir, 'wiki/global/orders.md'), '---\nsummary: Orders\nusage_mode: auto\n---\n\nFinalized body\n');
-                return {
-                    warnings: [],
-                    errors: [],
-                    touchedSources: [],
-                    changedWikiPageKeys: ['orders'],
-                    actions: [{ target: 'wiki', type: 'updated', key: 'orders', detail: 'Conflicting finalization' }],
-                };
-            });
-            const runner = new IngestBundleRunner(deps);
-            await mockStageRawFiles(runner, runtime, [['cards/source.json', 'h1']]);
-            await expect(runner.run({
-                jobId: 'job-finalization-overlap',
-                connectionId: 'warehouse',
-                sourceKey: 'metabase',
-                trigger: 'upload',
-                bundleRef: { kind: 'upload', uploadId: 'upload' },
-            })).rejects.toThrow(/finalization modified path\(s\) already changed earlier in this run: wiki\/global\/orders\.md/);
-        }
-        finally {
-            await rm(runtime.homeDir, { recursive: true, force: true });
-        }
-    });
-    it('rejects finalization writes to unauthorized semantic-layer targets', async () => {
-        const runtime = await makeRealGitRuntime();
-        try {
-            const { deps, adapter } = makeDeps(runtime);
-            adapter.chunk.mockResolvedValue({ workUnits: [] });
-            adapter.finalize = vi.fn(async ({ workdir }) => {
-                await mkdir(join(workdir, 'semantic-layer/other-warehouse'), { recursive: true });
-                await writeFile(join(workdir, 'semantic-layer/other-warehouse/orders.yaml'), 'name: orders\ngrain: [order_id]\ncolumns: [{name: order_id, type: string}]\njoins: []\nmeasures: []\n');
-                return {
-                    warnings: [],
-                    errors: [],
-                    touchedSources: [{ connectionId: 'other-warehouse', sourceName: 'orders' }],
-                    changedWikiPageKeys: [],
-                    actions: [
-                        {
-                            target: 'sl',
-                            type: 'created',
-                            key: 'orders',
-                            targetConnectionId: 'other-warehouse',
-                            detail: 'Forbidden target',
-                            rawPaths: ['cards/source.json'],
-                        },
-                    ],
-                };
-            });
-            const runner = new IngestBundleRunner(deps);
-            await mockStageRawFiles(runner, runtime, [['cards/source.json', 'h1']]);
-            await expect(runner.run({
-                jobId: 'job-finalization-target-policy',
-                connectionId: 'warehouse',
-                sourceKey: 'metabase',
-                trigger: 'upload',
-                bundleRef: { kind: 'upload', uploadId: 'upload' },
-            })).rejects.toThrow(/semantic-layer target connection not allowed/);
-            const trace = await readFile(join(runtime.configDir, '.ktx/ingest-traces/job-finalization-target-policy/trace.jsonl'), 'utf-8');
-            expect(trace).toContain('finalization_committed');
-            expect(trace).toContain('semantic_layer_target_policy');
-            expect(trace).toContain('ingest_failed');
-        }
-        finally {
-            await rm(runtime.homeDir, { recursive: true, force: true });
-        }
-    });
-});