@mmnto/cli 1.111.1 → 1.113.0

package/dist/commands/doctor.test.js

@@ -4,7 +4,7 @@ import * as os from 'node:os';
 import * as path from 'node:path';
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 import { cleanTmpDir } from '../test-utils.js';
-import { AGENTS_MD_REDIRECT_PATTERN, BYPASS_THRESHOLD, checkAgentsMdCanonical, checkCompiledRules, checkConfig, checkEmbeddingConfig, checkFreezes, checkGitHooks, checkGrandfatheredRules, checkIndex, checkLinkedIndexes, checkOllama, checkSecretLeaks, checkSecretsFileTracked, checkStaleRules, checkStrategyRoot, checkUpgradeCandidates, CLAUDE_MD_REDIRECT_MAX_BYTES, doctorCommand, doctorGateFailed, findLegacyGrandfatheredRules, findStaleRules, MIN_CONTEXT_EVENTS, MIN_EVENTS, NON_CODE_THRESHOLD, resolveStrictTier, runSelfHealing, V_1_13_0_SHIP_DATE_ISO, } from './doctor.js';
+import { AGENTS_MD_REDIRECT_PATTERN, BYPASS_THRESHOLD, checkAgentsMdCanonical, checkCompiledRules, checkConfig, checkEmbeddingConfig, checkEstate, checkFreezes, checkGitHooks, checkGrandfatheredRules, checkIndex, checkLinkedIndexes, checkOllama, checkSecretLeaks, checkSecretsFileTracked, checkStaleRules, checkStrategyRoot, checkUpgradeCandidates, CLAUDE_MD_REDIRECT_MAX_BYTES, doctorCommand, doctorGateFailed, findLegacyGrandfatheredRules, findStaleRules, MIN_CONTEXT_EVENTS, MIN_EVENTS, NON_CODE_THRESHOLD, resolveStrictTier, runSelfHealing, V_1_13_0_SHIP_DATE_ISO, } from './doctor.js';
 // ─── Helpers ────────────────────────────────────────────
 function makeTmpDir() {
     return fs.mkdtempSync(path.join(os.tmpdir(), 'totem-doctor-'));
@@ -314,7 +314,15 @@ const EXPECTED_DIAGNOSTIC_NAMES = [
     'Stale Rules',
     'Grandfathered Rules',
     'Freeze state',
+    'Estate',
 ];
+/**
+ * The ambient `Estate` row reads the real user-level registry and shells git at
+ * every repo listed there. Every `doctorCommand` call in this suite passes an
+ * EMPTY registry through the seam so the suite stays hermetic — same reason the
+ * Ollama probe's `fetch` is mocked above.
+ */
+const HERMETIC = { estateSeamsForTest: { registry: {}, wtRoots: [] } };
 describe('doctorCommand', () => {
     let tmpDir;
     let originalCwd;
@@ -339,12 +347,12 @@ describe('doctorCommand', () => {
         vi.restoreAllMocks();
     });
     it('runs without throwing', async () => {
-        const results = await doctorCommand();
+        const results = await doctorCommand(HERMETIC);
         expect(results).toBeDefined();
         expect(results).toHaveLength(EXPECTED_DIAGNOSTIC_NAMES.length);
     });
     it('returns correct check names', async () => {
-        const results = await doctorCommand();
+        const results = await doctorCommand(HERMETIC);
         const names = results.map((r) => r.name);
         expect(names).toEqual(expect.arrayContaining([...EXPECTED_DIAGNOSTIC_NAMES]));
     });
@@ -372,7 +380,7 @@ describe('doctorCommand output', () => {
         vi.restoreAllMocks();
     });
     it('outputs all check names in console output', async () => {
-        await doctorCommand();
+        await doctorCommand(HERMETIC);
         const output = stderrSpy.mock.calls.map((args) => String(args[0])).join('\n');
         expect(output).toContain('Config');
         expect(output).toContain('Compiled Rules');
@@ -387,7 +395,7 @@ describe('doctorCommand output', () => {
         expect(output).toContain('Stale Rules');
     });
     it('outputs summary line with pass/warn/fail counts', async () => {
-        await doctorCommand();
+        await doctorCommand(HERMETIC);
         const output = stderrSpy.mock.calls.map((args) => String(args[0])).join('\n');
         expect(output).toMatch(/\d+ passed/);
         expect(output).toMatch(/\d+ warnings/);
@@ -429,7 +437,7 @@ describe('doctorCommand strict mode contract', () => {
         // Seed a guaranteed failure: no config means checkConfig returns `fail`.
         fs.unlinkSync(path.join(tmpDir, 'totem.config.ts'));
         process.exitCode = undefined;
-        const results = await doctorCommand({ strict: true });
+        const results = await doctorCommand({ ...HERMETIC, strict: true });
         expect(results.some((r) => r.status === 'fail')).toBe(true);
         expect(process.exitCode).toBeUndefined();
     });
@@ -437,14 +445,14 @@ describe('doctorCommand strict mode contract', () => {
         const exitSpy = vi.spyOn(process, 'exit').mockImplementation(((_) => {
             throw new Error('process.exit should not be called by doctorCommand');
         }));
-        await doctorCommand({ strict: true });
-        await doctorCommand({ strict: false });
-        await doctorCommand();
+        await doctorCommand({ ...HERMETIC, strict: true });
+        await doctorCommand({ ...HERMETIC, strict: false });
+        await doctorCommand(HERMETIC);
         expect(exitSpy).not.toHaveBeenCalled();
     });
     it('returns the same DiagnosticResult[] shape regardless of strict flag', async () => {
-        const resultsStrict = await doctorCommand({ strict: true });
-        const resultsLoose = await doctorCommand({ strict: false });
+        const resultsStrict = await doctorCommand({ ...HERMETIC, strict: true });
+        const resultsLoose = await doctorCommand({ ...HERMETIC, strict: false });
         expect(resultsStrict.map((r) => r.name)).toEqual(resultsLoose.map((r) => r.name));
     });
 });
@@ -492,6 +500,206 @@ describe('doctorGateFailed', () => {
         expect(doctorGateFailed(onlySkip, 'fail')).toBe(false);
         expect(doctorGateFailed(onlySkip, 'warn')).toBe(false);
     });
+    // Sensor-class rows report but never gate (mmnto-ai/totem#2580 ruled scope).
+    // The exemption rides the ROW, so widening the tier later cannot give a
+    // sensor teeth by accident.
+    it('a gateExempt warn row does not gate even under the warn tier', () => {
+        const estateWarn = [
+            ...clean,
+            { name: 'Estate', status: 'warn', message: '', gateExempt: true },
+        ];
+        expect(doctorGateFailed(estateWarn, 'warn')).toBe(false);
+        expect(doctorGateFailed(estateWarn, 'fail')).toBe(false);
+    });
+    it('a non-exempt warn row alongside an exempt one still gates under the warn tier', () => {
+        const mixed = [
+            { name: 'Estate', status: 'warn', message: '', gateExempt: true },
+            { name: 'C', status: 'warn', message: '' },
+        ];
+        expect(doctorGateFailed(mixed, 'warn')).toBe(true);
+        expect(doctorGateFailed(mixed, 'fail')).toBe(false);
+    });
+    // The exemption is scoped to ADVISORY statuses. A fail is a wiring failure
+    // and no row may hide one — sensor rows never emit `fail`, so the narrowing
+    // costs them nothing and closes the mislabelled-row hole.
+    it('a gateExempt FAIL row still gates in both tiers', () => {
+        const exemptFail = [
+            ...clean,
+            { name: 'Sensor', status: 'fail', message: '', gateExempt: true },
+        ];
+        expect(doctorGateFailed(exemptFail, 'fail')).toBe(true);
+        expect(doctorGateFailed(exemptFail, 'warn')).toBe(true);
+    });
+});
+// ─── Ambient estate row (mmnto-ai/totem#2580) ───────────
+describe('checkEstate', () => {
+    const registryOf = (...paths) => Object.fromEntries(paths.map((p) => [
+        p,
+        { path: p, chunkCount: 1, lastSync: '2026-08-01T00:00:00.000Z', embedder: 'test' },
+    ]));
+    let estateDir;
+    beforeEach(() => {
+        estateDir = fs.realpathSync(makeTmpDir());
+    });
+    afterEach(() => {
+        cleanTmpDir(estateDir);
+    });
+    /** Canned git for `repo`; every other path answers as its own toplevel. */
+    function seams(repo, opts = {}) {
+        const listing = [
+            `worktree ${repo.split(path.sep).join('/')}`,
+            `HEAD ${'a'.repeat(40)}`,
+            'branch refs/heads/main',
+            '',
+        ].join('\n');
+        const fold = (p) => process.platform === 'win32' ? path.resolve(p).toLowerCase() : path.resolve(p);
+        const toplevels = new Map(Object.entries(opts.toplevels ?? {}).map(([k, v]) => [fold(k), v]));
+        const failToplevel = new Set((opts.failToplevel ?? []).map(fold));
+        return {
+            registry: registryOf(repo),
+            now: Date.parse('2026-08-05T12:00:00.000Z'),
+            // Pinned so a machine that has actually run `totem wt create` cannot
+            // drag its real recorded roots into these assertions (#2580 slice 2).
+            wtRoots: [],
+            safeExec: ((_command, args = []) => {
+                if (opts.throws === true)
+                    throw new Error('git exploded');
+                const cwd = args[2] ?? '';
+                const verb = args.slice(3);
+                if (verb[0] === 'rev-parse' && verb[1] === '--show-toplevel') {
+                    if (failToplevel.has(fold(cwd)))
+                        throw new Error('not a git repository');
+                    return (toplevels.get(fold(cwd)) ?? path.resolve(cwd)).split(path.sep).join('/');
+                }
+                if (verb[0] === 'worktree') {
+                    if (fold(cwd) !== fold(repo))
+                        throw new Error('not a git repository');
+                    return listing;
+                }
+                if (verb[0] === 'rev-parse')
+                    return 'origin/main';
+                return '';
+            }),
+        };
+    }
+    it('skips when nothing is registered', async () => {
+        const result = await checkEstate({ registry: {}, wtRoots: [] });
+        expect(result.status).toBe('skip');
+        expect(result.message).toContain('No registered repos');
+    });
+    // A corrupt registry must not collapse into the clean "nothing registered"
+    // skip — the ambient row is the surface operators actually see, and it is
+    // the one that would hide the failure. Drives the REAL readRegistry (no
+    // registry seam) against a temp home holding an unparseable registry.json.
+    it('warns (not skip) when the registry exists but cannot be read', async () => {
+        const home = fs.realpathSync(makeTmpDir());
+        fs.mkdirSync(path.join(home, '.totem'), { recursive: true });
+        fs.writeFileSync(path.join(home, '.totem', 'registry.json'), '{ not json', 'utf-8');
+        const prevHome = process.env['HOME'];
+        const prevProfile = process.env['USERPROFILE'];
+        process.env['HOME'] = home;
+        process.env['USERPROFILE'] = home;
+        try {
+            const result = await checkEstate();
+            expect(result.status).toBe('warn');
+            expect(result.message).toContain('Registry unreadable');
+            expect(result.gateExempt).toBe(true);
+        }
+        finally {
+            if (prevHome === undefined)
+                delete process.env['HOME'];
+            else
+                process.env['HOME'] = prevHome;
+            if (prevProfile === undefined)
+                delete process.env['USERPROFILE'];
+            else
+                process.env['USERPROFILE'] = prevProfile;
+            cleanTmpDir(home);
+        }
+    });
+    it('passes quietly on a clean estate, naming missing and unscannable counts', async () => {
+        const repo = path.join(estateDir, 'repo');
+        fs.mkdirSync(repo, { recursive: true });
+        const gone = path.join(estateDir, 'vanished');
+        const base = seams(repo);
+        const result = await checkEstate({
+            ...base,
+            registry: registryOf(repo, gone),
+        });
+        expect(result.status).toBe('pass');
+        // The denominator is what was ENUMERATED — an entry that was missing, not a
+        // git root, or unprobeable was never looked inside and must not inflate it.
+        expect(result.message).toContain('1 enumerated repo(s)');
+        expect(result.message).toContain('(1 missing)');
+        expect(result.message).toContain('0 linked worktree(s)');
+        expect(result.gateExempt).toBe(true);
+    });
+    it('names the not-git-root and unprobeable counts too', async () => {
+        const repo = path.join(estateDir, 'repo');
+        fs.mkdirSync(repo, { recursive: true });
+        const inside = path.join(repo, 'packages');
+        fs.mkdirSync(inside, { recursive: true });
+        const broken = path.join(estateDir, 'broken');
+        fs.mkdirSync(broken, { recursive: true });
+        const result = await checkEstate({
+            ...seams(repo, { toplevels: { [inside]: repo }, failToplevel: [broken] }),
+            registry: registryOf(repo, inside, broken),
+        });
+        expect(result.status).toBe('pass');
+        expect(result.message).toContain('1 enumerated repo(s)');
+        expect(result.message).toContain('1 not-git-root');
+        expect(result.message).toContain('1 unprobeable');
+    });
+    it('warns with counts and the --estate remediation when husks exist', async () => {
+        const repo = path.join(estateDir, 'repo');
+        fs.mkdirSync(path.join(repo, '.claude', 'worktrees', 'agent-a'), { recursive: true });
+        fs.mkdirSync(path.join(repo, '.claude', 'worktrees', 'agent-b'), { recursive: true });
+        const result = await checkEstate(seams(repo));
+        expect(result.status).toBe('warn');
+        expect(result.message).toContain('2 husk candidate(s)');
+        expect(result.remediation).toContain('totem doctor --estate');
+        expect(result.gateExempt).toBe(true);
+    });
+    // A git that fails on every invocation is NOT a scan crash: the scan is
+    // fail-soft per probe, so this lands as unscannable rows and the row still
+    // reports. Asserted so the two failure classes stay distinguishable.
+    it('keeps reporting when every git probe fails, naming the unscannable count', async () => {
+        const repo = path.join(estateDir, 'repo');
+        fs.mkdirSync(repo, { recursive: true });
+        const result = await checkEstate(seams(repo, { throws: true }));
+        expect(result.status).toBe('pass');
+        expect(result.message).toContain('1 probe(s) unscannable');
+    });
+    it('warns (never throws) on a crash-class scan failure', async () => {
+        const repo = path.join(estateDir, 'repo');
+        fs.mkdirSync(repo, { recursive: true });
+        // A malformed registry is the reachable crash class: EVERY exec call site
+        // inside the scan is wrapped, so even a broken git seam degrades to
+        // unscannable rows (asserted above) rather than throwing. What the catch
+        // exists for is a crash BEFORE or AROUND the probes — a bad registry
+        // shape, or the dynamic core import failing.
+        const result = await checkEstate({ ...seams(repo), registry: { bad: null } });
+        expect(result.status).toBe('warn');
+        expect(result.message).toContain('Estate scan failed');
+    });
+    it('marks every row gateExempt so the sensor can never gate', async () => {
+        const repo = path.join(estateDir, 'repo');
+        fs.mkdirSync(repo, { recursive: true });
+        const huskRepo = path.join(estateDir, 'husk-repo');
+        fs.mkdirSync(path.join(huskRepo, '.claude', 'worktrees', 'agent-a'), { recursive: true });
+        // All FOUR real paths: skip / pass / husk-warn / crash-warn.
+        const rows = [
+            await checkEstate({ registry: {}, wtRoots: [] }),
+            await checkEstate(seams(repo)),
+            await checkEstate(seams(huskRepo)),
+            await checkEstate({ ...seams(repo), registry: { bad: null } }),
+        ];
+        expect(rows.map((r) => r.status)).toEqual(['skip', 'pass', 'warn', 'warn']);
+        expect(rows[2].message).toContain('husk candidate(s)');
+        for (const row of rows)
+            expect(row.gateExempt).toBe(true);
+        expect(doctorGateFailed(rows, 'warn')).toBe(false);
+    });
 });
 // ─── Secrets file tracking check ────────────────────────
 describe('checkSecretsFileTracked', () => {
@@ -2035,4 +2243,195 @@ describe('checkFreezes', () => {
         expect(result.message).toContain('underivable');
     });
 });
+// ─── Estate row × wt-registry coupling (#2580 slice 2) ──
+describe('checkEstate — wt-registry roots', () => {
+    let estateHome;
+    let prevHome;
+    let prevProfile;
+    beforeEach(() => {
+        estateHome = fs.realpathSync(makeTmpDir());
+        prevHome = process.env['HOME'];
+        prevProfile = process.env['USERPROFILE'];
+        process.env['HOME'] = estateHome;
+        process.env['USERPROFILE'] = estateHome;
+    });
+    afterEach(() => {
+        if (prevHome === undefined)
+            delete process.env['HOME'];
+        else
+            process.env['HOME'] = prevHome;
+        if (prevProfile === undefined)
+            delete process.env['USERPROFILE'];
+        else
+            process.env['USERPROFILE'] = prevProfile;
+        cleanTmpDir(estateHome);
+    });
+    function writeWtRegistry(contents) {
+        fs.mkdirSync(path.join(estateHome, '.totem'), { recursive: true });
+        fs.writeFileSync(path.join(estateHome, '.totem', 'worktrees.json'), contents, 'utf-8');
+    }
+    // Invariant 8 on the AMBIENT row: the sensor row must sweep what `--estate`
+    // sweeps, or a clean ambient line would contradict the explicit command.
+    it('sweeps the recorded DEFAULT root with an EMPTY sync registry, finding the husk', async () => {
+        // The default `~/.totem/worktrees` is the one recorded root that carries
+        // container semantics — it exists solely to hold worktrees.
+        const recorded = path.join(estateHome, '.totem', 'worktrees');
+        fs.mkdirSync(path.join(recorded, 'left-behind'), { recursive: true });
+        writeWtRegistry(JSON.stringify({ schemaVersion: 1, roots: [recorded], worktrees: {} }));
+        const result = await checkEstate({ registry: {} });
+        expect(result.status).toBe('warn');
+        expect(result.message).toContain('1 husk candidate(s)');
+        expect(result.gateExempt).toBe(true);
+    });
+    it('sweeps a NON-default recorded root with shape evidence only — no by-location husks', async () => {
+        // A recorded scratch root holds other things beside worktrees; an
+        // arbitrary directory there is NOT residue-by-location (finding 11).
+        const recorded = path.join(estateHome, 'scratch-root');
+        fs.mkdirSync(path.join(recorded, 'unrelated-project'), { recursive: true });
+        writeWtRegistry(JSON.stringify({ schemaVersion: 1, roots: [recorded], worktrees: {} }));
+        const result = await checkEstate({ registry: {} });
+        expect(result.status).toBe('pass');
+        expect(result.message).toContain('no stale worktrees or husk candidates');
+    });
+    it('surfaces the unreadable sync registry even when recorded roots keep the scan alive', async () => {
+        // Finding 1: a live recorded root routes AROUND the empty-registry
+        // short-circuit — the unreadable-registry disclosure must ride the live
+        // row, never vanish into a clean pass.
+        fs.mkdirSync(path.join(estateHome, '.totem'), { recursive: true });
+        fs.writeFileSync(path.join(estateHome, '.totem', 'registry.json'), '{ not json', 'utf-8');
+        const recorded = path.join(estateHome, '.totem', 'worktrees');
+        fs.mkdirSync(recorded, { recursive: true });
+        writeWtRegistry(JSON.stringify({ schemaVersion: 1, roots: [recorded], worktrees: {} }));
+        const result = await checkEstate({});
+        expect(result.status).toBe('warn');
+        expect(result.message).toContain('Sync registry unreadable');
+        // The scan itself still ran — the disclosure rides a live row, not a skip.
+        expect(result.message).toContain('no stale worktrees or husk candidates');
+        expect(result.remediation).toContain('registry.json');
+        // Warning text is flattened at interpolation (bot round, CR finding 2):
+        // a multi-line parse error must never forge extra doctor rows.
+        expect(result.message).not.toContain('\n');
+    });
+    it('keeps the unreadable-registry disclosure when the scan itself throws', async () => {
+        // Re-verification round 2, finding 4: the catch arm was the one row shape
+        // that dropped the disclosure — broken sync registry AND a scan failure
+        // must surface BOTH signals on the same row.
+        fs.mkdirSync(path.join(estateHome, '.totem'), { recursive: true });
+        fs.writeFileSync(path.join(estateHome, '.totem', 'registry.json'), '{ not json', 'utf-8');
+        // The seam getter throws AFTER the registry read populated its warnings —
+        // the nearest injectable stand-in for a scan-side failure, since
+        // `scanEstate` contains its own probe failures.
+        const seams = {};
+        Object.defineProperty(seams, 'wtRoots', {
+            get() {
+                throw new Error('scan-side failure');
+            },
+            enumerable: true,
+        });
+        const result = await checkEstate(seams);
+        expect(result.status).toBe('warn');
+        expect(result.message).toContain('Estate scan failed: scan-side failure');
+        expect(result.message).toContain('Sync registry unreadable');
+    });
+    it('keeps the WORKTREE-registry disclosure when the scan itself throws', async () => {
+        // The wt-side symmetry of the catch-arm fix (bot round, CR finding 3):
+        // `wtWarnings` is hoisted with `registryWarnings`, so an unreadable
+        // worktrees.json survives into the scan-failed row instead of silently
+        // vanishing with the throw.
+        writeWtRegistry('{ not json');
+        // One registry entry keeps the scan off the empty short-circuit; the
+        // throwing `safeExec` getter fires AFTER the worktree-registry read has
+        // populated its warnings, landing the row in the catch arm.
+        const seams = {
+            registry: {
+                [path.join(estateHome, 'repo')]: {
+                    path: path.join(estateHome, 'repo'),
+                    chunkCount: 0,
+                    lastSync: '2026-08-01T00:00:00.000Z',
+                    embedder: 'x',
+                },
+            },
+        };
+        Object.defineProperty(seams, 'safeExec', {
+            get() {
+                throw new Error('scan-side failure');
+            },
+            enumerable: true,
+        });
+        const result = await checkEstate(seams);
+        expect(result.status).toBe('warn');
+        expect(result.message).toContain('Estate scan failed: scan-side failure');
+        expect(result.message).toContain('Cannot read worktree registry');
+    });
+    it('still skips when the recorded root no longer exists (empty sweep, not a hole)', async () => {
+        writeWtRegistry(JSON.stringify({ schemaVersion: 1, roots: [path.join(estateHome, 'gone')], worktrees: {} }));
+        const result = await checkEstate({ registry: {} });
+        expect(result.status).toBe('skip');
+        expect(result.message).toContain('No registered repos');
+    });
+    it('treats an unreadable worktrees.json as degraded state, never a clean skip', async () => {
+        // Round 2, CR outside-diff finding, short-circuit half: an unreadable
+        // worktree registry yields zero roots — exactly what routes the row onto
+        // the empty short-circuit — so the skip arm itself must disclose it.
+        writeWtRegistry('{ not json');
+        const result = await checkEstate({ registry: {} });
+        expect(result.status).toBe('warn');
+        expect(result.message).toContain('Worktree registry unreadable');
+        expect(result.message).toContain('Cannot read worktree registry');
+        // The scan never ran — the row must not claim a clean sweep.
+        expect(result.message).not.toContain('no stale worktrees');
+        expect(result.remediation).toContain('worktrees.json');
+        // Degraded, but never a fail: the row is sensor-class.
+        expect(result.gateExempt).toBe(true);
+    });
+    it('names BOTH files in the remediation when both registries are unreadable', async () => {
+        // Round 3, CR inline: the sync-registry arm wins precedence and its
+        // message carries wtNote(), but a remediation naming only registry.json
+        // would leave the next run warning again on the file it never mentioned.
+        fs.mkdirSync(path.join(estateHome, '.totem'), { recursive: true });
+        fs.writeFileSync(path.join(estateHome, '.totem', 'registry.json'), '{ not json', 'utf-8');
+        writeWtRegistry('{ not json');
+        const result = await checkEstate();
+        expect(result.status).toBe('warn');
+        expect(result.message).toContain('Registry unreadable');
+        expect(result.message).toContain('Cannot read worktree registry');
+        expect(result.remediation).toContain('registry.json');
+        expect(result.remediation).toContain('worktrees.json');
+        expect(result.gateExempt).toBe(true);
+    });
+    it('demotes an otherwise-clean scan to warn when worktrees.json is unreadable', async () => {
+        // Round 2, CR outside-diff finding, clean-arm half: the scan ran (one
+        // registry entry routes past the short-circuit; a missing repo path needs
+        // no git), but an unreadable worktree registry may name recorded roots
+        // the sweep never saw — a green line would overstate the coverage.
+        writeWtRegistry('{ not json');
+        const missingRepo = path.join(estateHome, 'gone-repo');
+        const result = await checkEstate({
+            registry: {
+                [missingRepo]: {
+                    path: missingRepo,
+                    chunkCount: 0,
+                    lastSync: '2026-08-01T00:00:00.000Z',
+                    embedder: 'x',
+                },
+            },
+        });
+        expect(result.status).toBe('warn');
+        expect(result.message).toContain('no stale worktrees or husk candidates');
+        expect(result.message).toContain('Cannot read worktree registry');
+        expect(result.remediation).toContain('worktrees.json');
+        expect(result.gateExempt).toBe(true);
+    });
+    it('honours the wtRoots seam without reading the home file', async () => {
+        // The seam value flows through the same default-vs-standard partition as
+        // production roots, so container semantics need the default location.
+        const seamRoot = path.join(estateHome, '.totem', 'worktrees');
+        fs.mkdirSync(path.join(seamRoot, 'residue'), { recursive: true });
+        writeWtRegistry('{ not json');
+        const result = await checkEstate({ registry: {}, wtRoots: [seamRoot] });
+        expect(result.message).not.toContain('Cannot read worktree registry');
+        expect(result.status).toBe('warn');
+        expect(result.message).toContain('1 husk candidate(s)');
+    });
+});
 //# sourceMappingURL=doctor.test.js.map