@m2-ai/lattice-cli 0.0.0-stage → 0.8.7

package/dist/security/commands.test.js

@@ -0,0 +1,1051 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const strict_1 = __importDefault(require("node:assert/strict"));
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const node_test_1 = __importDefault(require("node:test"));
+const commands_js_1 = require("./commands.js");
+const api_js_1 = require("./api.js");
+const journal_js_1 = require("./journal.js");
+const APP_ID = '11111111-1111-4111-8111-111111111111';
+const TOKEN = 'synthetic_security_token_123456789012345';
+const ENTITLEMENT_ID = '22222222-2222-4222-8222-222222222222';
+const RUN_ID = '33333333-3333-4333-8333-333333333333';
+const JOURNAL_ID = '44444444-4444-4444-8444-444444444444';
+const CHILD_RUN_ID = '55555555-5555-4555-8555-555555555555';
+const BASELINE_RUN_ID = '66666666-6666-4666-8666-666666666666';
+const connection = {
+    apiUrl: 'https://latticeai.app', appId: APP_ID, token: TOKEN, connectedAt: '2026-10-20T00:00:00.000Z',
+};
+function status() {
+    return {
+        app: {
+            id: APP_ID, name: 'Fixture', repositoryIdentity: 'github.com/example/fixture', origin: null,
+            repositoryLockedAt: null, createdAt: '2026-10-20T00:00:00.000Z',
+        },
+        entitledModes: ['scan'],
+        entitlements: [],
+        checkoutEnabled: false,
+        publicationEnabled: false,
+        releaseBlockers: ['commercial_artifact_unavailable'],
+    };
+}
+function blockedManifest() {
+    return {
+        format: 'lattice-security-artifact-v1', sourceCommit: 'a'.repeat(40),
+        identity: {
+            vsgVersion: '1.0.2', profileId: 'commercial-default', profileVersion: '1.0.0',
+            rulesDigest: '1'.repeat(64), registryDigest: '2'.repeat(64), commercialManifestDigest: '3'.repeat(64),
+            evaluatorDigest: '4'.repeat(64), catalogDigest: '5'.repeat(64),
+        },
+        entryPoint: 'bin/vsg.mjs', exporterPath: 'src/lattice/export.mjs',
+        transportPath: 'src/lattice/transport.mjs', evaluatorPath: 'lattice-runtime.mjs',
+        releaseEligibility: { status: 'blocked', blockers: ['artifact_release_approval_missing'] },
+        files: [],
+    };
+}
+function approvedStatus() {
+    const manifest = blockedManifest();
+    return {
+        ...status(),
+        entitledModes: ['scan', 'deep', 'release', 'report'],
+        publicationEnabled: true,
+        releaseBlockers: [],
+        entitlements: [{
+                id: ENTITLEMENT_ID,
+                kind: 'security_subscription',
+                providerStatus: 'active',
+                artifactStatus: 'rights_cleared',
+                unitLimit: 50,
+                consumedUnits: 0,
+                reservedUnits: 0,
+                remainingUnits: 50,
+                periodStart: '2026-10-01T00:00:00.000Z',
+                periodEnd: '2026-11-01T00:00:00.000Z',
+                cancelAtPeriodEnd: false,
+                requiredRuntime: manifest.identity,
+            }],
+    };
+}
+function approvedInspection() {
+    return { artifactRoot: 'synthetic-artifact', manifest: blockedManifest(), manifestSha256: '6'.repeat(64) };
+}
+function approvedDeps() {
+    return {
+        resolveConnection: async () => connection,
+        getStatus: async () => approvedStatus(),
+        inspectArtifact: async () => approvedInspection(),
+        assertArtifactEligible: () => { },
+    };
+}
+function retainedJournalInput(root, overrides = {}) {
+    return {
+        id: JOURNAL_ID,
+        apiUrl: connection.apiUrl,
+        appId: APP_ID,
+        clientRequestId: JOURNAL_ID,
+        entitlementId: ENTITLEMENT_ID,
+        mode: 'report',
+        parentRunId: null,
+        recoveryParentId: null,
+        recoveryRootId: null,
+        repo: root,
+        outDir: (0, node_path_1.join)(root, 'retained-vsg-output'),
+        artifactRoot: approvedInspection().artifactRoot,
+        artifactManifestSha256: approvedInspection().manifestSha256,
+        repositoryIdentity: approvedStatus().app.repositoryIdentity,
+        retainedCompleted: true,
+        localExit: 0,
+        acknowledgedExit: null,
+        reportPath: (0, node_path_1.join)(root, 'retained-vsg-output', 'lattice-report.json'),
+        ...overrides,
+    };
+}
+(0, node_test_1.default)('connect verifies app binding before saving and never writes the token to output', async () => {
+    const output = [];
+    const saved = [];
+    await (0, commands_js_1.runSecurityCommand)(['connect', '--app', APP_ID], {
+        env: { LATTICE_SECURITY_TOKEN: TOKEN },
+        getStatus: async (received) => {
+            strict_1.default.equal(received.token, TOKEN);
+            return status();
+        },
+        saveConnection: async (received) => { saved.push(received); },
+        stdout: (line) => output.push(line),
+    });
+    strict_1.default.equal(saved.length, 1);
+    strict_1.default.ok(output.every((line) => !line.includes(TOKEN)));
+    strict_1.default.match(output.join('\n'), /Connected Security app Fixture/);
+});
+(0, node_test_1.default)('connect refuses tokens in command arguments and does not save after failed verification', async () => {
+    const tokenErrors = [];
+    strict_1.default.equal(await (0, commands_js_1.runSecurityCommand)(['connect', '--app', APP_ID, '--token', TOKEN], {
+        stderr: (line) => tokenErrors.push(line),
+    }), 3);
+    strict_1.default.match(tokenErrors.join('\n'), /--token is forbidden/);
+    strict_1.default.doesNotMatch(tokenErrors.join('\n'), new RegExp(TOKEN));
+    let saved = false;
+    const verificationErrors = [];
+    strict_1.default.equal(await (0, commands_js_1.runSecurityCommand)(['connect', '--app', APP_ID], {
+        env: { LATTICE_SECURITY_TOKEN: TOKEN },
+        getStatus: async () => { throw new Error(`synthetic rejection ${TOKEN}`); },
+        saveConnection: async () => { saved = true; },
+        stderr: (line) => verificationErrors.push(line),
+    }), 3);
+    strict_1.default.match(verificationErrors.join('\n'), /synthetic rejection \[REDACTED\]/);
+    strict_1.default.doesNotMatch(verificationErrors.join('\n'), new RegExp(TOKEN));
+    strict_1.default.equal(saved, false);
+});
+(0, node_test_1.default)('status reports server blockers without exposing credentials', async () => {
+    const output = [];
+    await (0, commands_js_1.runSecurityCommand)(['status'], {
+        resolveConnection: async () => connection,
+        getStatus: async () => status(),
+        stdout: (line) => output.push(line),
+    });
+    strict_1.default.match(output.join('\n'), /Publication: disabled/);
+    strict_1.default.match(output.join('\n'), /commercial_artifact_unavailable/);
+    strict_1.default.doesNotMatch(output.join('\n'), new RegExp(TOKEN));
+});
+(0, node_test_1.default)('commercial commands reject legacy mutation flags and blocked artifacts before execution', async () => {
+    const mutationErrors = [];
+    strict_1.default.equal(await (0, commands_js_1.runSecurityCommand)(['scan', '--fix'], { stderr: (line) => mutationErrors.push(line) }), 3);
+    strict_1.default.match(mutationErrors.join('\n'), /cannot be combined/);
+    const blockedErrors = [];
+    strict_1.default.equal(await (0, commands_js_1.runSecurityCommand)(['scan'], {
+        resolveConnection: async () => connection,
+        getStatus: async () => status(),
+        inspectArtifact: async () => ({
+            artifactRoot: 'fixture', manifest: blockedManifest(), manifestSha256: '6'.repeat(64),
+        }),
+        stderr: (line) => blockedErrors.push(line),
+    }), 3);
+    strict_1.default.match(blockedErrors.join('\n'), /artifact_release_approval_missing.*commercial_artifact_unavailable/);
+});
+(0, node_test_1.default)('local commercial scan invokes the approved runtime without reserving cloud quota', async () => {
+    let began = false;
+    let finished = false;
+    const exit = await (0, commands_js_1.runSecurityCommand)(['scan', '--out', 'synthetic-out'], {
+        ...approvedDeps(),
+        beginRun: async () => { began = true; throw new Error('must not begin'); },
+        finishRun: async () => { finished = true; throw new Error('must not finish'); },
+        runRuntime: async (options) => {
+            strict_1.default.equal(options.mode, 'scan');
+            strict_1.default.equal(options.repositoryIdentity, 'github.com/example/fixture');
+            return { exitCode: 1, report: {}, compactReport: {}, reportPath: (0, node_path_1.join)(options.outDir, 'lattice-report.json') };
+        },
+        stdout: () => { },
+    });
+    strict_1.default.equal(exit, 1);
+    strict_1.default.equal(began, false);
+    strict_1.default.equal(finished, false);
+});
+(0, node_test_1.default)('published scan journals before begin and finishes the exact retained bytes', async () => {
+    const root = await node_fs_1.promises.mkdtemp((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'lattice-security-command-publish-'));
+    const events = [];
+    const bodies = [];
+    try {
+        const exit = await (0, commands_js_1.runSecurityCommand)(['scan', '--publish'], {
+            ...approvedDeps(),
+            journalRoot: root,
+            createBeginJournal: async (input, journalRoot) => {
+                events.push('journal');
+                const { createSecurityBeginJournal } = await import('./journal.js');
+                return createSecurityBeginJournal(input, journalRoot);
+            },
+            beginRun: async (_connection, input) => {
+                events.push('begin');
+                strict_1.default.equal(input.entitlementId, ENTITLEMENT_ID);
+                return {
+                    result: 'reserved', runId: RUN_ID, state: 'reserved',
+                    reservationExpiresAt: '2026-10-20T02:00:00.000Z', entitlementId: ENTITLEMENT_ID,
+                    grantKind: 'security_subscription', remainingUnits: 49, reservedUnits: 1,
+                };
+            },
+            runRuntime: async (options) => ({
+                exitCode: 0, report: { semanticVersion: '1.1' },
+                compactReport: { transportVersion: '3.0', runId: options.runId },
+                reportPath: (0, node_path_1.join)(options.outDir, 'lattice-report.json'),
+            }),
+            finishRun: async (_connection, runId, body) => {
+                events.push('finish');
+                strict_1.default.equal(runId, RUN_ID);
+                bodies.push(body);
+                return {
+                    result: 'finished', runId, state: 'finished', verdict: 'PASS',
+                    completedAt: '2026-10-20T00:00:00.000Z', contentExpiresAt: null, consumedUnit: true,
+                };
+            },
+            stdout: () => { },
+        });
+        strict_1.default.equal(exit, 0);
+        strict_1.default.deepEqual(events, ['journal', 'begin', 'finish']);
+        strict_1.default.deepEqual(JSON.parse(bodies[0]), {
+            outcome: 'completed', report: { transportVersion: '3.0', runId: RUN_ID },
+        });
+        strict_1.default.deepEqual(await node_fs_1.promises.readdir(root), []);
+    }
+    finally {
+        await node_fs_1.promises.rm(root, { recursive: true, force: true });
+    }
+});
+(0, node_test_1.default)('sync failure keeps the exact finish journal and maps a successful local scan to exit 2', async () => {
+    const root = await node_fs_1.promises.mkdtemp((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'lattice-security-command-pending-'));
+    const errors = [];
+    try {
+        const exit = await (0, commands_js_1.runSecurityCommand)(['scan', '--publish'], {
+            ...approvedDeps(),
+            journalRoot: root,
+            beginRun: async () => ({
+                result: 'reserved', runId: RUN_ID, state: 'reserved',
+                reservationExpiresAt: '2026-10-20T02:00:00.000Z', entitlementId: ENTITLEMENT_ID,
+                grantKind: 'security_subscription', remainingUnits: 49, reservedUnits: 1,
+            }),
+            runRuntime: async (options) => ({
+                exitCode: 0, report: {}, compactReport: { transportVersion: '3.0', runId: options.runId },
+                reportPath: (0, node_path_1.join)(options.outDir, 'lattice-report.json'),
+            }),
+            finishRun: async () => { throw new api_js_1.SecurityApiRequestError('offline', null, 'network_error', true); },
+            stderr: (line) => errors.push(line),
+        });
+        strict_1.default.equal(exit, 2);
+        const journals = await node_fs_1.promises.readdir(root);
+        strict_1.default.equal(journals.length, 1);
+        const metadata = JSON.parse(await node_fs_1.promises.readFile((0, node_path_1.join)(root, journals[0], 'journal.json'), 'utf8'));
+        strict_1.default.equal(metadata.state, 'pending_finish');
+        strict_1.default.equal(metadata.runId, RUN_ID);
+        strict_1.default.deepEqual(errors, [`Security result is local; cloud sync is pending for app ${APP_ID} in journal ${metadata.id}. Retry the exact saved request with lattice security publish --app ${APP_ID} --journal ${metadata.id}. This replays the immutable request and does not include agent-review findings added afterward.`]);
+    }
+    finally {
+        await node_fs_1.promises.rm(root, { recursive: true, force: true });
+    }
+});
+(0, node_test_1.default)('retrying an interrupted incomplete deep upload replays its exact body then prints review guidance without rescanning', async () => {
+    const root = await node_fs_1.promises.mkdtemp((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'lattice-security-review-journal-retry-'));
+    const repo = (0, node_path_1.join)(root, 'repo with spaces');
+    const outDir = (0, node_path_1.join)(repo, 'review output');
+    const journalRoot = (0, node_path_1.join)(root, 'journals');
+    const output = [];
+    const errors = [];
+    const reviewCheck = {
+        id: 'agent-review', status: 'missing', required: true,
+        coverageCodes: ['vsg.agent-review.not_run'], attributionIds: [],
+    };
+    let runtimeCalls = 0;
+    let beginCalls = 0;
+    let originalBody = '';
+    let retryBody = '';
+    try {
+        const firstExit = await (0, commands_js_1.runSecurityCommand)([
+            'deep', '--publish', '--allow-project-scripts', '--repo', repo, '--out', outDir,
+        ], {
+            ...approvedDeps(),
+            cwd: root,
+            journalRoot,
+            beginRun: async (_connection, input) => {
+                beginCalls += 1;
+                strict_1.default.equal(input.parentRunId, null);
+                return {
+                    result: 'reserved', runId: RUN_ID, state: 'reserved',
+                    reservationExpiresAt: '2999-01-01T00:00:00.000Z', entitlementId: ENTITLEMENT_ID,
+                    grantKind: 'security_subscription', remainingUnits: 49, reservedUnits: 1,
+                };
+            },
+            runRuntime: async (options) => {
+                runtimeCalls += 1;
+                return {
+                    exitCode: 2,
+                    report: { checks: [reviewCheck] },
+                    compactReport: { transportVersion: '3.0', runId: options.runId, checks: [reviewCheck] },
+                    reportPath: (0, node_path_1.join)(options.outDir, 'lattice-report.json'),
+                };
+            },
+            finishRun: async (_connection, _runId, body) => {
+                originalBody = body;
+                throw new api_js_1.SecurityApiRequestError('offline', null, 'network_error', true);
+            },
+            stdout: (line) => output.push(line),
+            stderr: (line) => errors.push(line),
+        });
+        strict_1.default.equal(firstExit, 2);
+        strict_1.default.equal(runtimeCalls, 1);
+        strict_1.default.equal(beginCalls, 1);
+        strict_1.default.doesNotMatch(output.join('\n'), /VSG requires local agent review|lattice security report/);
+        const [journalId] = await node_fs_1.promises.readdir(journalRoot);
+        const saved = await (0, journal_js_1.readSecurityPublishJournal)(journalId, journalRoot);
+        strict_1.default.equal(saved.exactRequestBody, originalBody);
+        strict_1.default.deepEqual(JSON.parse(saved.exactRequestBody), {
+            outcome: 'completed', report: {
+                transportVersion: '3.0', runId: RUN_ID, checks: [reviewCheck],
+            },
+        });
+        strict_1.default.match(errors.join('\n'), new RegExp(`lattice security publish --app ${APP_ID} --journal ${journalId}`));
+        strict_1.default.match(errors.join('\n'), /immutable request and does not include agent-review findings added afterward/);
+        const retryExit = await (0, commands_js_1.runSecurityCommand)(['publish', '--app', APP_ID, '--journal', journalId], {
+            resolveConnection: async () => connection,
+            journalRoot,
+            beginRun: async () => { beginCalls += 1; throw new Error('journal retry must not begin a second run'); },
+            runRuntime: async () => { runtimeCalls += 1; throw new Error('journal retry must not rescan'); },
+            exportReport: async () => { throw new Error('journal retry must not re-export'); },
+            finishRun: async (_connection, runId, body) => {
+                strict_1.default.equal(runId, RUN_ID);
+                retryBody = body;
+                return {
+                    result: 'finished', runId, state: 'finished', verdict: 'INCOMPLETE',
+                    completedAt: '2026-10-20T00:00:00.000Z', contentExpiresAt: null, consumedUnit: false,
+                };
+            },
+            stdout: (line) => output.push(line),
+        });
+        strict_1.default.equal(retryExit, 2);
+        strict_1.default.equal(retryBody, originalBody);
+        strict_1.default.equal(runtimeCalls, 1);
+        strict_1.default.equal(beginCalls, 1);
+        strict_1.default.ok(output.includes(`VSG requires local agent review. Open '${(0, node_path_1.join)(outDir, 'agent', 'brief.md')}' and complete the review with your chosen reviewer.`));
+        strict_1.default.ok(output.includes(`  lattice security report --app ${APP_ID} --repo '${repo}' --out '${outDir}'`));
+        strict_1.default.ok(output.includes(`  lattice security publish --app ${APP_ID} --repo '${repo}' --report '${outDir}' --parent-run ${RUN_ID}`));
+    }
+    finally {
+        await node_fs_1.promises.rm(root, { recursive: true, force: true });
+    }
+});
+(0, node_test_1.default)('nonretryable report rejection explains refusal and retains the local result without another reservation or finish', async () => {
+    const root = await node_fs_1.promises.mkdtemp((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'lattice-security-command-refused-'));
+    const errors = [];
+    let beginCalls = 0;
+    let finishCalls = 0;
+    try {
+        const exit = await (0, commands_js_1.runSecurityCommand)(['scan', '--publish'], {
+            ...approvedDeps(),
+            env: { LATTICE_SECURITY_TOKEN: TOKEN },
+            journalRoot: root,
+            beginRun: async () => {
+                beginCalls += 1;
+                return {
+                    result: 'reserved', runId: RUN_ID, state: 'reserved',
+                    reservationExpiresAt: '2026-10-20T02:00:00.000Z', entitlementId: ENTITLEMENT_ID,
+                    grantKind: 'security_subscription', remainingUnits: 49, reservedUnits: 1,
+                };
+            },
+            runRuntime: async (options) => ({
+                exitCode: 0, report: {}, compactReport: { transportVersion: '3.0', runId: options.runId },
+                reportPath: (0, node_path_1.join)(options.outDir, 'lattice-report.json'),
+            }),
+            finishRun: async () => {
+                finishCalls += 1;
+                throw new api_js_1.SecurityApiRequestError(`Unsupported finding identity: ${TOKEN}`, 422, 'report_rejected', false);
+            },
+            stderr: (line) => errors.push(line),
+        });
+        strict_1.default.equal(exit, 2);
+        strict_1.default.equal(beginCalls, 1);
+        strict_1.default.equal(finishCalls, 1);
+        const [journalId] = await node_fs_1.promises.readdir(root);
+        const metadata = JSON.parse(await node_fs_1.promises.readFile((0, node_path_1.join)(root, journalId, 'journal.json'), 'utf8'));
+        strict_1.default.equal(metadata.state, 'pending_finish');
+        strict_1.default.equal(metadata.runId, RUN_ID);
+        strict_1.default.match(errors.join('\n'), /Security publication was refused by the service HTTP 422 \(report_rejected\)/);
+        strict_1.default.match(errors.join('\n'), new RegExp(`local result and journal ${journalId} are retained`));
+        strict_1.default.doesNotMatch(errors.join('\n'), new RegExp(TOKEN));
+        strict_1.default.doesNotMatch(errors.join('\n'), /retry.*fix|network.*retry/i);
+    }
+    finally {
+        await node_fs_1.promises.rm(root, { recursive: true, force: true });
+    }
+});
+(0, node_test_1.default)('deep mode refuses project scripts unless consent is explicit', async () => {
+    let ran = false;
+    const errors = [];
+    strict_1.default.equal(await (0, commands_js_1.runSecurityCommand)(['deep'], {
+        ...approvedDeps(),
+        confirmProjectScripts: async () => false,
+        runRuntime: async () => { ran = true; throw new Error('must not run'); },
+        stderr: (line) => errors.push(line),
+    }), 3);
+    strict_1.default.match(errors.join('\n'), /requires consent/);
+    strict_1.default.equal(ran, false);
+});
+(0, node_test_1.default)('deep result requiring local review prints the exact fresh-report and parent-bound publication continuation', async () => {
+    const root = await node_fs_1.promises.mkdtemp((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'lattice-security-review-guidance-'));
+    const repo = (0, node_path_1.join)(root, 'repo with spaces');
+    const outDir = (0, node_path_1.join)(repo, 'review output');
+    const output = [];
+    try {
+        const exit = await (0, commands_js_1.runSecurityCommand)([
+            'deep', '--publish', '--allow-project-scripts', '--repo', repo, '--out', outDir,
+        ], {
+            ...approvedDeps(),
+            cwd: root,
+            journalRoot: (0, node_path_1.join)(root, 'journals'),
+            beginRun: async (_connection, input) => {
+                strict_1.default.equal(input.parentRunId, null);
+                return {
+                    result: 'reserved', runId: RUN_ID, state: 'reserved',
+                    reservationExpiresAt: '2999-01-01T00:00:00.000Z', entitlementId: ENTITLEMENT_ID,
+                    grantKind: 'security_subscription', remainingUnits: 49, reservedUnits: 1,
+                };
+            },
+            runRuntime: async (options) => ({
+                exitCode: 2,
+                report: { checks: [{ id: 'agent-review', status: 'missing', required: true }] },
+                compactReport: { transportVersion: '3.0', runId: options.runId },
+                reportPath: (0, node_path_1.join)(options.outDir, 'lattice-report.json'),
+            }),
+            finishRun: async (_connection, runId, body) => {
+                strict_1.default.equal(runId, RUN_ID);
+                strict_1.default.deepEqual(JSON.parse(body), {
+                    outcome: 'completed', report: { transportVersion: '3.0', runId: RUN_ID },
+                });
+                return {
+                    result: 'finished', runId, state: 'finished', verdict: 'INCOMPLETE',
+                    completedAt: '2026-10-20T00:00:00.000Z', contentExpiresAt: null, consumedUnit: false,
+                };
+            },
+            stdout: (line) => output.push(line),
+        });
+        strict_1.default.equal(exit, 2);
+        strict_1.default.ok(output.includes(`VSG requires local agent review. Open '${(0, node_path_1.join)(outDir, 'agent', 'brief.md')}' and complete the review with your chosen reviewer.`));
+        strict_1.default.ok(output.includes(`  lattice security report --app ${APP_ID} --repo '${repo}' --out '${outDir}'`));
+        strict_1.default.ok(output.includes(`Publish that fresh report as a retest of initial cloud run ${RUN_ID}:`));
+        strict_1.default.ok(output.includes(`  lattice security publish --app ${APP_ID} --repo '${repo}' --report '${outDir}' --parent-run ${RUN_ID}`));
+        strict_1.default.doesNotMatch(output.join('\n'), /report .*--publish|security deep .*review|automated review/i);
+    }
+    finally {
+        await node_fs_1.promises.rm(root, { recursive: true, force: true });
+    }
+});
+(0, node_test_1.default)('local review continuation does not invent an initial cloud run ID', async () => {
+    const root = await node_fs_1.promises.mkdtemp((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'lattice-security-local-review-guidance-'));
+    const output = [];
+    try {
+        strict_1.default.equal(await (0, commands_js_1.runSecurityCommand)(['deep', '--allow-project-scripts', '--out', 'review output'], {
+            ...approvedDeps(),
+            cwd: root,
+            runRuntime: async (options) => ({
+                exitCode: 2,
+                report: { checks: [{ id: 'agent-review', status: 'missing', required: true }] },
+                compactReport: {},
+                reportPath: (0, node_path_1.join)(options.outDir, 'lattice-report.json'),
+            }),
+            stdout: (line) => output.push(line),
+        }), 2);
+        strict_1.default.ok(output.includes('No initial cloud run ID is available for this local run; a parent-bound publication needs the actual initial run ID.'));
+        strict_1.default.doesNotMatch(output.join('\n'), /lattice security publish --app .*--report/);
+    }
+    finally {
+        await node_fs_1.promises.rm(root, { recursive: true, force: true });
+    }
+});
+(0, node_test_1.default)('local scanner exceptions map to incomplete while preflight status failures map to usage', async () => {
+    const scannerErrors = [];
+    strict_1.default.equal(await (0, commands_js_1.runSecurityCommand)(['scan'], {
+        ...approvedDeps(),
+        runRuntime: async () => { throw new Error('synthetic scanner failure'); },
+        stderr: (line) => scannerErrors.push(line),
+    }), 2);
+    strict_1.default.match(scannerErrors.join('\n'), /scanner failed/);
+    const statusErrors = [];
+    strict_1.default.equal(await (0, commands_js_1.runSecurityCommand)(['status'], {
+        resolveConnection: async () => connection,
+        getStatus: async () => { throw new api_js_1.SecurityApiRequestError('offline', null, 'network_error', true); },
+        stderr: (line) => statusErrors.push(line),
+    }), 3);
+    strict_1.default.match(statusErrors.join('\n'), /offline/);
+});
+(0, node_test_1.default)('retained report publish re-exports through the frozen artifact without rerunning scanners', async () => {
+    const root = await node_fs_1.promises.mkdtemp((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'lattice-security-command-report-'));
+    const parentRunId = '44444444-4444-4444-8444-444444444444';
+    const events = [];
+    try {
+        const exit = await (0, commands_js_1.runSecurityCommand)([
+            'publish', '--report', 'retained-vsg-output', '--parent-run', parentRunId,
+        ], {
+            ...approvedDeps(),
+            cwd: root,
+            journalRoot: (0, node_path_1.join)(root, 'journals'),
+            beginRun: async (_connection, input) => {
+                events.push('begin');
+                strict_1.default.equal(input.mode, 'report');
+                strict_1.default.equal(input.parentRunId, parentRunId);
+                return {
+                    result: 'reserved', runId: RUN_ID, state: 'reserved',
+                    reservationExpiresAt: '2026-10-20T02:00:00.000Z', entitlementId: ENTITLEMENT_ID,
+                    grantKind: 'security_subscription', remainingUnits: 49, reservedUnits: 1,
+                };
+            },
+            runRuntime: async () => { throw new Error('scanner must not run'); },
+            exportReport: async (options) => {
+                events.push(options.writeLocalReport === false ? 'preflight' : 'rebind');
+                strict_1.default.equal(options.mode, 'report');
+                if (options.writeLocalReport !== false)
+                    strict_1.default.equal(options.runId, RUN_ID);
+                return {
+                    report: { semanticVersion: '1.1', auditMode: 'deep' },
+                    compactReport: { transportVersion: '3.0', auditMode: 'deep' },
+                    reportPath: (0, node_path_1.join)(options.outDir, 'lattice-report.json'),
+                };
+            },
+            finishRun: async (_connection, runId) => {
+                events.push('finish');
+                return {
+                    result: 'finished', runId, state: 'finished', verdict: 'PASS',
+                    completedAt: '2026-10-20T00:00:00.000Z', contentExpiresAt: null, consumedUnit: true,
+                };
+            },
+            stdout: () => { },
+        });
+        strict_1.default.equal(exit, 0);
+        strict_1.default.deepEqual(events, ['preflight', 'begin', 'rebind', 'finish']);
+    }
+    finally {
+        await node_fs_1.promises.rm(root, { recursive: true, force: true });
+    }
+});
+(0, node_test_1.default)('retained report source changes are rejected before begin and classified after reservation', async () => {
+    const root = await node_fs_1.promises.mkdtemp((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'lattice-security-command-source-change-'));
+    const parentRunId = '44444444-4444-4444-8444-444444444444';
+    const sourceChanged = () => Object.assign(new Error('source changed'), { code: 'source_changed' });
+    try {
+        let began = false;
+        const preflightErrors = [];
+        strict_1.default.equal(await (0, commands_js_1.runSecurityCommand)([
+            'publish', '--report', 'retained-vsg-output', '--parent-run', parentRunId,
+        ], {
+            ...approvedDeps(),
+            cwd: root,
+            exportReport: async () => { throw sourceChanged(); },
+            beginRun: async () => { began = true; throw new Error('must not begin'); },
+            stderr: (line) => preflightErrors.push(line),
+        }), 3);
+        strict_1.default.equal(began, false);
+        strict_1.default.match(preflightErrors.join('\n'), /source changed/);
+        let exports = 0;
+        let finishBody = '';
+        strict_1.default.equal(await (0, commands_js_1.runSecurityCommand)([
+            'publish', '--report', 'retained-vsg-output', '--parent-run', parentRunId,
+        ], {
+            ...approvedDeps(),
+            cwd: root,
+            journalRoot: (0, node_path_1.join)(root, 'journals'),
+            exportReport: async (options) => {
+                exports += 1;
+                if (exports === 2)
+                    throw sourceChanged();
+                return { report: {}, compactReport: {}, reportPath: (0, node_path_1.join)(options.outDir, 'lattice-report.json') };
+            },
+            beginRun: async () => ({
+                result: 'reserved', runId: RUN_ID, state: 'reserved',
+                reservationExpiresAt: '2026-10-20T02:00:00.000Z', entitlementId: ENTITLEMENT_ID,
+                grantKind: 'security_subscription', remainingUnits: 49, reservedUnits: 1,
+            }),
+            finishRun: async (_connection, runId, body) => {
+                finishBody = body;
+                return {
+                    result: 'aborted', runId, state: 'aborted', verdict: null,
+                    completedAt: '2026-10-20T00:00:00.000Z', contentExpiresAt: null, consumedUnit: false,
+                };
+            },
+            stderr: () => { },
+        }), 2);
+        strict_1.default.equal(exports, 2);
+        strict_1.default.deepEqual(JSON.parse(finishBody), { outcome: 'aborted', reason: 'source_changed' });
+    }
+    finally {
+        await node_fs_1.promises.rm(root, { recursive: true, force: true });
+    }
+});
+(0, node_test_1.default)('expired pending finish recovers from retained evidence without rerunning scanners', async () => {
+    const root = await node_fs_1.promises.mkdtemp((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'lattice-security-command-expired-finish-'));
+    const oldBody = '{"outcome":"completed","report":{"transportVersion":"3.0","runId":"old"}}';
+    try {
+        await (0, journal_js_1.createSecurityPublishJournal)({
+            ...retainedJournalInput(root, { parentRunId: BASELINE_RUN_ID }),
+            runId: RUN_ID,
+            reservationExpiresAt: '2000-01-01T00:00:00.000Z',
+        }, oldBody, root);
+        const beginIds = [];
+        let scans = 0;
+        let exports = 0;
+        let finishedBody = '';
+        const exit = await (0, commands_js_1.runSecurityCommand)(['publish', '--journal', JOURNAL_ID], {
+            ...approvedDeps(),
+            journalRoot: root,
+            beginRun: async (_connection, input) => {
+                beginIds.push(input.clientRequestId);
+                strict_1.default.equal(input.mode, 'report');
+                strict_1.default.equal(input.parentRunId, BASELINE_RUN_ID);
+                return {
+                    result: 'reserved', runId: CHILD_RUN_ID, state: 'reserved',
+                    reservationExpiresAt: '2999-01-01T00:00:00.000Z', entitlementId: ENTITLEMENT_ID,
+                    grantKind: 'security_subscription', remainingUnits: 49, reservedUnits: 1,
+                };
+            },
+            runRuntime: async () => { scans += 1; throw new Error('scanner must not run'); },
+            exportReport: async (options) => {
+                exports += 1;
+                return {
+                    report: {}, compactReport: { transportVersion: '3.0', runId: options.runId },
+                    reportPath: (0, node_path_1.join)(options.outDir, 'lattice-report.json'),
+                };
+            },
+            finishRun: async (_connection, runId, body) => {
+                strict_1.default.equal(runId, CHILD_RUN_ID);
+                strict_1.default.equal((await (0, journal_js_1.readSecurityPublishJournal)(JOURNAL_ID, root)).exactRequestBody, oldBody);
+                finishedBody = body;
+                return {
+                    result: 'finished', runId, state: 'finished', verdict: 'PASS',
+                    completedAt: '2026-10-20T00:00:00.000Z', contentExpiresAt: null, consumedUnit: true,
+                };
+            },
+            stdout: () => { },
+        });
+        strict_1.default.equal(exit, 0);
+        strict_1.default.equal(scans, 0);
+        strict_1.default.equal(exports, 2);
+        strict_1.default.equal(beginIds.length, 1);
+        strict_1.default.notEqual(beginIds[0], JOURNAL_ID);
+        const receipt = JSON.parse(await node_fs_1.promises.readFile((0, node_path_1.join)(root, `${JOURNAL_ID}.ack.json`), 'utf8'));
+        strict_1.default.equal(receipt.finalJournalId, beginIds[0]);
+        strict_1.default.deepEqual(await node_fs_1.promises.readdir((0, node_path_1.join)(root, JOURNAL_ID)), ['recovery.json']);
+        await strict_1.default.rejects(node_fs_1.promises.lstat((0, node_path_1.join)(root, beginIds[0])), { code: 'ENOENT' });
+        strict_1.default.equal(JSON.parse(finishedBody).report.runId, CHILD_RUN_ID);
+        let retryFinishes = 0;
+        strict_1.default.equal(await (0, commands_js_1.runSecurityCommand)(['publish', '--journal', JOURNAL_ID], {
+            resolveConnection: async () => connection,
+            journalRoot: root,
+            finishRun: async () => { retryFinishes += 1; throw new Error('must not retry'); },
+            stdout: () => { },
+        }), 0);
+        strict_1.default.equal(await (0, commands_js_1.runSecurityCommand)(['publish', '--journal', beginIds[0]], {
+            resolveConnection: async () => connection,
+            journalRoot: root,
+            finishRun: async () => { retryFinishes += 1; throw new Error('must not retry'); },
+            stdout: () => { },
+        }), 0);
+        strict_1.default.equal(retryFinishes, 0);
+    }
+    finally {
+        await node_fs_1.promises.rm(root, { recursive: true, force: true });
+    }
+});
+(0, node_test_1.default)('expired begin replay without retained evidence stops without a replacement begin or scanner', async () => {
+    const root = await node_fs_1.promises.mkdtemp((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'lattice-security-command-expired-begin-'));
+    try {
+        await (0, journal_js_1.createSecurityBeginJournal)({
+            ...retainedJournalInput(root, {
+                retainedCompleted: false,
+                localExit: null,
+                reportPath: null,
+            }),
+        }, root);
+        const beginIds = [];
+        let scans = 0;
+        const errors = [];
+        const exit = await (0, commands_js_1.runSecurityCommand)(['publish', '--journal', JOURNAL_ID], {
+            resolveConnection: async () => connection,
+            journalRoot: root,
+            beginRun: async (_connection, input) => {
+                beginIds.push(input.clientRequestId);
+                return {
+                    result: 'replay', runId: RUN_ID, state: 'expired',
+                    reservationExpiresAt: '2000-01-01T00:00:00.000Z', entitlementId: ENTITLEMENT_ID,
+                    grantKind: 'security_subscription', remainingUnits: 50, reservedUnits: 0,
+                };
+            },
+            runRuntime: async () => { scans += 1; throw new Error('scanner must not run'); },
+            stderr: (line) => errors.push(line),
+        });
+        strict_1.default.equal(exit, 3);
+        strict_1.default.deepEqual(beginIds, [JOURNAL_ID]);
+        strict_1.default.equal(scans, 0);
+        await strict_1.default.rejects(node_fs_1.promises.lstat((0, node_path_1.join)(root, JOURNAL_ID, 'recovery.json')), { code: 'ENOENT' });
+        strict_1.default.match(errors.join('\n'), /expired before a completed result was retained/);
+    }
+    finally {
+        await node_fs_1.promises.rm(root, { recursive: true, force: true });
+    }
+});
+(0, node_test_1.default)('result-ready and orphan-body interruptions resume from retained output without a scanner rerun', async () => {
+    for (const orphanBody of [false, true]) {
+        const root = await node_fs_1.promises.mkdtemp((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'lattice-security-command-result-ready-'));
+        try {
+            const pending = await (0, journal_js_1.createSecurityBeginJournal)({
+                ...retainedJournalInput(root, {
+                    mode: 'scan',
+                    retainedCompleted: false,
+                    localExit: null,
+                    reportPath: null,
+                }),
+            }, root);
+            const reserved = await (0, journal_js_1.setSecurityJournalReservation)(pending, {
+                runId: RUN_ID,
+                reservationExpiresAt: '2999-01-01T00:00:00.000Z',
+            }, root);
+            await (0, journal_js_1.setSecurityJournalResult)(reserved, {
+                reportPath: (0, node_path_1.join)(root, 'retained-vsg-output', 'lattice-report.json'),
+                localExit: 0,
+            }, root);
+            if (orphanBody) {
+                await node_fs_1.promises.writeFile((0, node_path_1.join)(root, JOURNAL_ID, 'finish-request.json'), '{"partial":"orphaned-before-metadata-rename"}');
+            }
+            let scans = 0;
+            let finishedBody = '';
+            const exit = await (0, commands_js_1.runSecurityCommand)(['publish', '--journal', JOURNAL_ID], {
+                ...approvedDeps(),
+                journalRoot: root,
+                runRuntime: async () => { scans += 1; throw new Error('scanner must not run'); },
+                exportReport: async (options) => ({
+                    report: {}, compactReport: { transportVersion: '3.0', runId: options.runId },
+                    reportPath: (0, node_path_1.join)(options.outDir, 'lattice-report.json'),
+                }),
+                finishRun: async (_connection, runId, body) => {
+                    finishedBody = body;
+                    return {
+                        result: 'finished', runId, state: 'finished', verdict: 'PASS',
+                        completedAt: '2026-10-20T00:00:00.000Z', contentExpiresAt: null, consumedUnit: true,
+                    };
+                },
+                stdout: () => { },
+            });
+            strict_1.default.equal(exit, 0);
+            strict_1.default.equal(scans, 0);
+            strict_1.default.equal(JSON.parse(finishedBody).report.runId, RUN_ID);
+            strict_1.default.deepEqual(await node_fs_1.promises.readdir(root), []);
+        }
+        finally {
+            await node_fs_1.promises.rm(root, { recursive: true, force: true });
+        }
+    }
+});
+(0, node_test_1.default)('recovery child created before begin is revalidated before any lease request', async () => {
+    const root = await node_fs_1.promises.mkdtemp((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'lattice-security-command-recovery-prebegin-'));
+    try {
+        await (0, journal_js_1.createSecurityPublishJournal)({
+            ...retainedJournalInput(root, { parentRunId: BASELINE_RUN_ID }),
+            runId: RUN_ID,
+            reservationExpiresAt: '2000-01-01T00:00:00.000Z',
+        }, '{"outcome":"completed","report":{}}', root);
+        const recovery = await (0, journal_js_1.createOrReadSecurityRecovery)(JOURNAL_ID, root);
+        await (0, journal_js_1.createSecurityBeginJournal)({
+            ...retainedJournalInput(root, {
+                id: recovery.childJournalId,
+                clientRequestId: recovery.childJournalId,
+                parentRunId: BASELINE_RUN_ID,
+                recoveryParentId: JOURNAL_ID,
+                recoveryRootId: JOURNAL_ID,
+            }),
+        }, root);
+        let begins = 0;
+        const errors = [];
+        const sourceChanged = Object.assign(new Error('synthetic source changed'), { code: 'source_changed' });
+        const exit = await (0, commands_js_1.runSecurityCommand)(['publish', '--journal', JOURNAL_ID], {
+            ...approvedDeps(),
+            journalRoot: root,
+            exportReport: async () => { throw sourceChanged; },
+            beginRun: async () => { begins += 1; throw new Error('must not begin'); },
+            stderr: (line) => errors.push(line),
+        });
+        strict_1.default.equal(exit, 3);
+        strict_1.default.equal(begins, 0);
+        strict_1.default.match(errors.join('\n'), /synthetic source changed/);
+        strict_1.default.equal((await (0, journal_js_1.readSecurityJournal)(recovery.childJournalId, root)).state, 'begin_pending');
+    }
+    finally {
+        await node_fs_1.promises.rm(root, { recursive: true, force: true });
+    }
+});
+(0, node_test_1.default)('source change after recovery reservation sends one exact abort and retains its exit in the receipt', async () => {
+    const root = await node_fs_1.promises.mkdtemp((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'lattice-security-command-recovery-source-change-'));
+    try {
+        await (0, journal_js_1.createSecurityPublishJournal)({
+            ...retainedJournalInput(root, { parentRunId: BASELINE_RUN_ID }),
+            runId: RUN_ID,
+            reservationExpiresAt: '2000-01-01T00:00:00.000Z',
+        }, '{"outcome":"completed","report":{}}', root);
+        let exports = 0;
+        let begins = 0;
+        const finishBodies = [];
+        const sourceChanged = Object.assign(new Error('synthetic source changed after begin'), { code: 'source_changed' });
+        const deps = {
+            ...approvedDeps(),
+            journalRoot: root,
+            exportReport: async (options) => {
+                exports += 1;
+                if (exports === 2)
+                    throw sourceChanged;
+                return { report: {}, compactReport: {}, reportPath: (0, node_path_1.join)(options.outDir, 'lattice-report.json') };
+            },
+            beginRun: async () => {
+                begins += 1;
+                return {
+                    result: 'reserved', runId: CHILD_RUN_ID, state: 'reserved',
+                    reservationExpiresAt: '2999-01-01T00:00:00.000Z', entitlementId: ENTITLEMENT_ID,
+                    grantKind: 'security_subscription', remainingUnits: 49, reservedUnits: 1,
+                };
+            },
+            finishRun: async (_connection, runId, body) => {
+                finishBodies.push(body);
+                if (finishBodies.length === 1)
+                    throw new api_js_1.SecurityApiRequestError('synthetic offline', null, 'network_error', true);
+                return {
+                    result: 'aborted', runId, state: 'aborted', verdict: null,
+                    completedAt: '2026-10-20T00:00:00.000Z', contentExpiresAt: null, consumedUnit: false,
+                };
+            },
+            stderr: () => { },
+            stdout: () => { },
+        };
+        strict_1.default.equal(await (0, commands_js_1.runSecurityCommand)(['publish', '--journal', JOURNAL_ID], deps), 2);
+        strict_1.default.equal(begins, 1);
+        strict_1.default.equal(exports, 2);
+        strict_1.default.deepEqual(JSON.parse(finishBodies[0]), { outcome: 'aborted', reason: 'source_changed' });
+        strict_1.default.equal(await (0, commands_js_1.runSecurityCommand)(['publish', '--journal', JOURNAL_ID], deps), 2);
+        strict_1.default.equal(new Set(finishBodies).size, 1);
+        strict_1.default.equal(finishBodies.length, 2);
+        const receipt = JSON.parse(await node_fs_1.promises.readFile((0, node_path_1.join)(root, `${JOURNAL_ID}.ack.json`), 'utf8'));
+        strict_1.default.equal(receipt.localExit, 2);
+        strict_1.default.equal(await (0, commands_js_1.runSecurityCommand)(['publish', '--journal', JOURNAL_ID], {
+            resolveConnection: async () => connection,
+            journalRoot: root,
+            finishRun: async () => { throw new Error('must not retry'); },
+            stdout: () => { },
+        }), 2);
+        strict_1.default.equal(finishBodies.length, 2);
+    }
+    finally {
+        await node_fs_1.promises.rm(root, { recursive: true, force: true });
+    }
+});
+(0, node_test_1.default)('concurrent expired resumes share one durable recovery child request ID', async () => {
+    const root = await node_fs_1.promises.mkdtemp((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'lattice-security-command-concurrent-recovery-'));
+    try {
+        await (0, journal_js_1.createSecurityPublishJournal)({
+            ...retainedJournalInput(root, { mode: 'scan', parentRunId: null }),
+            runId: RUN_ID,
+            reservationExpiresAt: '2000-01-01T00:00:00.000Z',
+        }, '{"outcome":"completed","report":{}}', root);
+        const beginIds = [];
+        const deps = {
+            ...approvedDeps(),
+            journalRoot: root,
+            beginRun: async (_connection, input) => {
+                beginIds.push(input.clientRequestId);
+                strict_1.default.equal(input.mode, 'scan');
+                strict_1.default.equal(input.parentRunId, null);
+                return {
+                    result: 'reserved', runId: CHILD_RUN_ID, state: 'reserved',
+                    reservationExpiresAt: '2999-01-01T00:00:00.000Z', entitlementId: ENTITLEMENT_ID,
+                    grantKind: 'security_subscription', remainingUnits: 49, reservedUnits: 1,
+                };
+            },
+            exportReport: async (options) => ({
+                report: {}, compactReport: { transportVersion: '3.0', runId: options.runId },
+                reportPath: (0, node_path_1.join)(options.outDir, 'lattice-report.json'),
+            }),
+            finishRun: async () => ({
+                result: 'finished', runId: CHILD_RUN_ID, state: 'finished', verdict: 'PASS',
+                completedAt: '2026-10-20T00:00:00.000Z', contentExpiresAt: null, consumedUnit: true,
+            }),
+            stdout: () => { },
+            stderr: () => { },
+        };
+        strict_1.default.deepEqual(await Promise.all(Array.from({ length: 8 }, () => (0, commands_js_1.runSecurityCommand)(['publish', '--journal', JOURNAL_ID], deps))), Array.from({ length: 8 }, () => 0));
+        strict_1.default.equal(new Set(beginIds).size, 1);
+        const receipt = JSON.parse(await node_fs_1.promises.readFile((0, node_path_1.join)(root, `${JOURNAL_ID}.ack.json`), 'utf8'));
+        strict_1.default.equal(receipt.finalJournalId, beginIds[0]);
+        strict_1.default.deepEqual((await node_fs_1.promises.readdir(root)).sort(), [
+            `${JOURNAL_ID}.ack.json`, `${receipt.finalJournalId}.ack.json`, JOURNAL_ID,
+        ].sort());
+        strict_1.default.deepEqual(await node_fs_1.promises.readdir((0, node_path_1.join)(root, JOURNAL_ID)), ['recovery.json']);
+    }
+    finally {
+        await node_fs_1.promises.rm(root, { recursive: true, force: true });
+    }
+});
+(0, node_test_1.default)('expired recovery preserves one-attempt pending sync semantics while offline', async () => {
+    const root = await node_fs_1.promises.mkdtemp((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'lattice-security-command-recovery-offline-'));
+    let finishCalls = 0;
+    try {
+        await (0, journal_js_1.createSecurityPublishJournal)({
+            ...retainedJournalInput(root, { mode: 'scan', parentRunId: null }),
+            runId: RUN_ID,
+            reservationExpiresAt: '2000-01-01T00:00:00.000Z',
+        }, '{"outcome":"completed","report":{}}', root);
+        strict_1.default.equal(await (0, commands_js_1.runSecurityCommand)(['publish', '--journal', JOURNAL_ID], {
+            ...approvedDeps(),
+            journalRoot: root,
+            beginRun: async () => ({
+                result: 'reserved', runId: CHILD_RUN_ID, state: 'reserved',
+                reservationExpiresAt: '2999-01-01T00:00:00.000Z', entitlementId: ENTITLEMENT_ID,
+                grantKind: 'security_subscription', remainingUnits: 49, reservedUnits: 1,
+            }),
+            exportReport: async (options) => ({
+                report: {}, compactReport: { transportVersion: '3.0', runId: options.runId },
+                reportPath: (0, node_path_1.join)(options.outDir, 'lattice-report.json'),
+            }),
+            finishRun: async () => {
+                finishCalls += 1;
+                throw new api_js_1.SecurityApiRequestError('synthetic offline', null, 'network_error', true);
+            },
+            stdout: () => { },
+            stderr: () => { },
+        }), 2);
+        strict_1.default.equal(finishCalls, 1);
+        const recovery = await (0, journal_js_1.readSecurityRecovery)(JOURNAL_ID, root);
+        strict_1.default.ok(recovery);
+        strict_1.default.equal((await (0, journal_js_1.readSecurityJournal)(recovery.childJournalId, root)).state, 'pending_finish');
+        await strict_1.default.rejects(node_fs_1.promises.lstat((0, node_path_1.join)(root, `${JOURNAL_ID}.ack.json`)), { code: 'ENOENT' });
+    }
+    finally {
+        await node_fs_1.promises.rm(root, { recursive: true, force: true });
+    }
+});
+(0, node_test_1.default)('a terminal receipt and retained recovery identity stop a preflight loser from minting a new child', async () => {
+    const root = await node_fs_1.promises.mkdtemp((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'lattice-security-command-terminal-recovery-race-'));
+    let releaseLoser;
+    let loserReachedPreflight;
+    const loserGate = new Promise((resolve) => { releaseLoser = resolve; });
+    const loserReady = new Promise((resolve) => { loserReachedPreflight = resolve; });
+    let statusCalls = 0;
+    const beginIds = [];
+    try {
+        await (0, journal_js_1.createSecurityPublishJournal)({
+            ...retainedJournalInput(root, { mode: 'scan', parentRunId: null }),
+            runId: RUN_ID,
+            reservationExpiresAt: '2000-01-01T00:00:00.000Z',
+        }, '{"outcome":"completed","report":{}}', root);
+        const deps = {
+            ...approvedDeps(),
+            journalRoot: root,
+            getStatus: async () => {
+                statusCalls += 1;
+                if (statusCalls === 1) {
+                    loserReachedPreflight();
+                    await loserGate;
+                }
+                return approvedStatus();
+            },
+            beginRun: async (_connection, input) => {
+                beginIds.push(input.clientRequestId);
+                return {
+                    result: 'reserved', runId: CHILD_RUN_ID, state: 'reserved',
+                    reservationExpiresAt: '2999-01-01T00:00:00.000Z', entitlementId: ENTITLEMENT_ID,
+                    grantKind: 'security_subscription', remainingUnits: 49, reservedUnits: 1,
+                };
+            },
+            exportReport: async (options) => ({
+                report: {}, compactReport: { transportVersion: '3.0', runId: options.runId },
+                reportPath: (0, node_path_1.join)(options.outDir, 'lattice-report.json'),
+            }),
+            finishRun: async () => ({
+                result: 'finished', runId: CHILD_RUN_ID, state: 'finished', verdict: 'PASS',
+                completedAt: '2026-10-20T00:00:00.000Z', contentExpiresAt: null, consumedUnit: true,
+            }),
+            stdout: () => { },
+        };
+        const loser = (0, commands_js_1.runSecurityCommand)(['publish', '--journal', JOURNAL_ID], deps);
+        await loserReady;
+        strict_1.default.equal(await (0, commands_js_1.runSecurityCommand)(['publish', '--journal', JOURNAL_ID], deps), 0);
+        const retainedIdentity = await (0, journal_js_1.readSecurityRecovery)(JOURNAL_ID, root);
+        strict_1.default.ok(retainedIdentity);
+        releaseLoser();
+        strict_1.default.equal(await loser, 0);
+        strict_1.default.deepEqual(beginIds, [retainedIdentity.childJournalId]);
+        strict_1.default.deepEqual(await node_fs_1.promises.readdir((0, node_path_1.join)(root, JOURNAL_ID)), ['recovery.json']);
+    }
+    finally {
+        releaseLoser();
+        await node_fs_1.promises.rm(root, { recursive: true, force: true });
+    }
+});
+(0, node_test_1.default)('cleanup failure after finish keeps an acknowledged journal and never retries the network', async () => {
+    const root = await node_fs_1.promises.mkdtemp((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'lattice-security-command-cleanup-only-'));
+    let finishCalls = 0;
+    try {
+        const warnings = [];
+        const exit = await (0, commands_js_1.runSecurityCommand)(['scan', '--publish'], {
+            ...approvedDeps(),
+            journalRoot: root,
+            beginRun: async () => ({
+                result: 'reserved', runId: RUN_ID, state: 'reserved',
+                reservationExpiresAt: '2999-01-01T00:00:00.000Z', entitlementId: ENTITLEMENT_ID,
+                grantKind: 'security_subscription', remainingUnits: 49, reservedUnits: 1,
+            }),
+            runRuntime: async (options) => ({
+                exitCode: 0, report: {}, compactReport: { transportVersion: '3.0', runId: options.runId },
+                reportPath: (0, node_path_1.join)(options.outDir, 'lattice-report.json'),
+            }),
+            finishRun: async (_connection, runId) => {
+                finishCalls += 1;
+                return {
+                    result: 'finished', runId, state: 'finished', verdict: 'PASS',
+                    completedAt: '2026-10-20T00:00:00.000Z', contentExpiresAt: null, consumedUnit: true,
+                };
+            },
+            removeJournal: async () => { throw new Error('synthetic cleanup lock'); },
+            stdout: () => { },
+            stderr: (line) => warnings.push(line),
+        });
+        strict_1.default.equal(exit, 0);
+        strict_1.default.equal(finishCalls, 1);
+        strict_1.default.match(warnings.join('\n'), /cloud result was accepted; local journal cleanup remains/);
+        const [journalId] = await node_fs_1.promises.readdir(root);
+        strict_1.default.equal((await (0, journal_js_1.readSecurityJournal)(journalId, root)).state, 'acknowledged');
+        strict_1.default.equal(await (0, commands_js_1.runSecurityCommand)(['publish', '--journal', journalId], {
+            resolveConnection: async () => connection,
+            journalRoot: root,
+            finishRun: async () => { finishCalls += 1; throw new Error('must not retry'); },
+            stdout: () => { },
+        }), 0);
+        strict_1.default.equal(finishCalls, 1);
+        strict_1.default.deepEqual(await node_fs_1.promises.readdir(root), []);
+    }
+    finally {
+        await node_fs_1.promises.rm(root, { recursive: true, force: true });
+    }
+});
+//# sourceMappingURL=commands.test.js.map