@productbrain/cli 0.1.0-beta.109 → 0.1.0-beta.10908

package/dist/__tests__/handshake-preview.test.js

@@ -3,13 +3,15 @@
  * STD-197: preview is the new default (no --apply flag = no writes).
  */
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
-import { createHash } from 'crypto';
 const { vfs, MOCK_MARKER, MOCK_CWD, MOCK_HOME } = vi.hoisted(() => ({
     vfs: {},
     MOCK_MARKER: 'auto-generated by pb handshake',
     MOCK_CWD: '/tmp/pb-preview-cwd',
     MOCK_HOME: '/tmp/pb-preview-home',
 }));
+const { execSyncMock } = vi.hoisted(() => ({
+    execSyncMock: vi.fn(),
+}));
 vi.mock('fs', () => ({
     mkdirSync: vi.fn(),
     writeFileSync: vi.fn((path, content) => {
@@ -23,8 +25,12 @@ vi.mock('fs', () => ({
     }),
     readdirSync: vi.fn(() => []),
     copyFileSync: vi.fn(),
+    realpathSync: vi.fn((path) => path),
 }));
 vi.mock('os', () => ({ homedir: vi.fn(() => MOCK_HOME) }));
+vi.mock('child_process', () => ({
+    execSync: (...args) => execSyncMock(...args),
+}));
 vi.mock('../lib/prompts.js', () => ({
     select: vi.fn(() => Promise.resolve('work')),
     confirm: vi.fn(() => Promise.resolve(false)),
@@ -34,6 +40,14 @@ vi.mock('../lib/prompts.js', () => ({
 }));
 vi.mock('../lib/client.js', () => ({
     kernelCall: vi.fn().mockResolvedValue([]),
+    kernelCallWithSession: vi.fn().mockResolvedValue(undefined),
+}));
+vi.mock('../lib/session.js', () => ({
+    readSession: vi.fn(() => null),
+    writeSession: vi.fn(),
+    clearSession: vi.fn(),
+    readClosedMarker: vi.fn(() => null),
+    addCapturedEntry: vi.fn(),
 }));
 vi.mock('../lib/config.js', () => ({
     getConfigOrGuide: vi.fn().mockResolvedValue({
@@ -47,10 +61,12 @@ vi.mock('../lib/repo-detect.js', () => ({
 }));
 vi.mock('../generators/adapters.js', () => ({
     MARKER: MOCK_MARKER,
+    CLAUDE_BRIEFING_POINTER: 'Your workspace briefing is served by `pb session start`.',
     generateAgentsMd: vi.fn().mockImplementation(() => `<!-- ${MOCK_MARKER} -->\nagents content`),
     generateClaudeMd: vi.fn().mockImplementation(() => `<!-- ${MOCK_MARKER} -->\nclaude content`),
     generateCursorMdc: vi.fn().mockImplementation(() => `<!-- ${MOCK_MARKER} -->\ncursor content`),
     generateCopilotMd: vi.fn().mockImplementation(() => `<!-- ${MOCK_MARKER} -->\ncopilot content`),
+    generateCopilotInstructionFiles: vi.fn().mockReturnValue([]),
 }));
 vi.mock('../generators/portable-knowledge.js', () => ({
     readCanonicalSkills: vi.fn().mockReturnValue([]),
@@ -60,15 +76,11 @@ vi.mock('../generators/portable-knowledge.js', () => ({
     generateCursorSkill: vi.fn().mockReturnValue(''),
     generateCursorRule: vi.fn().mockReturnValue(''),
     generateCodexSkill: vi.fn().mockReturnValue(''),
-    generateClaudeRule: vi.fn().mockReturnValue(''),
     generateCodexSkillIndex: vi.fn().mockReturnValue(''),
-    generateClaudeSkillRouter: vi.fn().mockReturnValue(''),
     shouldEmitToTarget: vi.fn().mockReturnValue(false),
     filterByLevel: vi.fn().mockImplementation((items) => items),
     evaluateConditions: vi.fn().mockReturnValue({ included: true, reasons: [] }),
     validateCodexSkills: vi.fn().mockReturnValue([]),
-    STAGE_TO_MAX_LEVEL: {},
-    LEVEL_ORDER: [],
 }));
 vi.mock('../generators/briefing-md.js', () => ({
     generateBriefingMd: vi.fn().mockReturnValue('briefing content'),
@@ -76,15 +88,8 @@ vi.mock('../generators/briefing-md.js', () => ({
 vi.mock('../generators/context-md.js', () => ({
     generateContextMd: vi.fn().mockReturnValue('context content'),
 }));
-vi.mock('../generators/chain-rules.js', () => ({
-    generateChainRules: vi.fn().mockReturnValue({ content: '', stats: {} }),
-}));
-vi.mock('../generators/handshake-diff.js', () => ({
-    saveHandshakeState: vi.fn(),
-    loadPreviousState: vi.fn().mockReturnValue(null),
-    diffHandshakeState: vi.fn().mockReturnValue({ added: [], updated: [], removed: [] }),
-    formatDiff: vi.fn().mockReturnValue(''),
-    buildCurrentState: vi.fn().mockReturnValue({}),
+vi.mock('../generators/everyone-rules-md.js', () => ({
+    generateEveryoneRulesMd: vi.fn().mockReturnValue('everyone rules content'),
 }));
 vi.mock('../generators/surface-profiles.js', () => ({
     resolveSurfaceProfile: vi.fn().mockReturnValue({ level: 'intermediate' }),
@@ -113,25 +118,15 @@ vi.mock('../lib/method-registry.js', () => ({
 import { readdirSync, writeFileSync } from 'fs';
 import { formatHandshakeReport } from '../formatters/handshake.js';
 import { kernelCall } from '../lib/client.js';
+import { detectRepo } from '../lib/repo-detect.js';
 import { readManifestStatus } from '../generators/manifest.js';
-import { generateCursorSkill, shouldEmitToTarget } from '../generators/portable-knowledge.js';
+import { generateCursorSkill, shouldEmitToTarget, readCanonicalSkills } from '../generators/portable-knowledge.js';
 import { runHandshake } from '../commands/handshake.js';
+const ORIENT_VIEW = { briefing: { purpose: 'One truth for people and agents' } };
 function capturedReport() {
     const calls = vi.mocked(formatHandshakeReport).mock.calls;
     return calls.length > 0 ? calls[calls.length - 1][0] : null;
 }
-function setupAuthoringTestHash(asset) {
-    const canonical = {
-        entryId: asset.entryId,
-        name: asset.name,
-        description: asset.description,
-        assetKind: asset.assetKind,
-        triggers: asset.triggers ?? [],
-        semanticRefs: asset.semanticRefs ?? [],
-        body: asset.body.replace(/\r\n/g, '\n').replace(/\r/g, '\n').trimEnd(),
-    };
-    return `sha256:${createHash('sha256').update(JSON.stringify(canonical), 'utf8').digest('hex')}`;
-}
 describe('runHandshake — preview/apply/dryRun invariants (WP-332 S1)', () => {
     let cwdSpy;
     beforeEach(() => {
@@ -142,6 +137,18 @@ describe('runHandshake — preview/apply/dryRun invariants (WP-332 S1)', () => {
         vi.spyOn(console, 'error').mockImplementation(() => { });
         vi.spyOn(console, 'warn').mockImplementation(() => { });
         vi.mocked(readdirSync).mockReturnValue([]);
+        execSyncMock.mockReset();
+        execSyncMock.mockImplementation(() => {
+            throw new Error('no git');
+        });
+        vi.mocked(detectRepo).mockReturnValue({
+            name: 'test-repo',
+            description: null,
+            gitRemote: null,
+            repoSlug: null,
+            detectedStack: [],
+            isMonorepo: false,
+        });
         vi.mocked(readManifestStatus).mockReturnValue({
             mode: 'project',
             surfaces: ['.cursor', '.claude', '.codex', '.github'],
@@ -149,6 +156,8 @@ describe('runHandshake — preview/apply/dryRun invariants (WP-332 S1)', () => {
             parseStatus: 'ok',
             manifest: null,
         });
+        // TASK-554: getOrientView always serves the briefing's facts; every other call resolves [].
+        vi.mocked(kernelCall).mockImplementation(async (tool) => (tool === 'chain.getOrientView' ? ORIENT_VIEW : []));
     });
     afterEach(() => {
         cwdSpy.mockRestore();
@@ -165,105 +174,249 @@ describe('runHandshake — preview/apply/dryRun invariants (WP-332 S1)', () => {
         await runHandshake({ dryRun: true });
         expect(writeFileSync).not.toHaveBeenCalled();
     });
-    it('apply + observe authority is preview-only and writes nothing', async () => {
-        vi.mocked(readManifestStatus).mockReturnValue({
-            mode: 'observe',
-            surfaces: ['.cursor'],
-            lock: {},
-            parseStatus: 'ok',
-            manifest: null,
-        });
-        await runHandshake({ apply: true, surfaces: ['cursor'] });
-        expect(writeFileSync).not.toHaveBeenCalled();
-        expect(vi.mocked(kernelCall).mock.calls.some(([tool]) => tool === 'setup.materializeSetup')).toBe(false);
-        expect(capturedReport()?.filesWritten).toEqual([]);
-        expect(capturedReport()?.filesSkipped?.some((f) => f.reason === 'preview-only (materialize: observe)')).toBe(true);
+    it('PR #912 round 11 (Codex P1): PB_JSON=1 suppresses progress lines so stdout carries one JSON document', async () => {
+        const priorPbJson = process.env.PB_JSON;
+        process.env.PB_JSON = '1';
+        const writeSpy = vi.spyOn(process.stdout, 'write').mockImplementation(() => true);
+        let chunks;
+        try {
+            await runHandshake({ apply: true });
+            // Read the recorded calls BEFORE mockRestore() — restore also clears mock.calls (it does
+            // everything mockReset()/mockClear() do, plus restoring the real implementation).
+            chunks = writeSpy.mock.calls.map(([chunk]) => String(chunk));
+        }
+        finally {
+            if (priorPbJson === undefined)
+                delete process.env.PB_JSON;
+            else
+                process.env.PB_JSON = priorPbJson;
+            writeSpy.mockRestore();
+        }
+        // No progress prose ("Detecting repo: ...", "Fetching workspace context...") reached stdout.
+        expect(chunks.some((c) => c.includes('Detecting repo'))).toBe(false);
+        expect(chunks.some((c) => c.includes('Fetching workspace context'))).toBe(false);
+        // What did reach stdout parses as JSON once concatenated (a leading blank-line write is fine —
+        // JSON.parse tolerates surrounding whitespace).
+        const combined = chunks.join('').trim();
+        expect(() => JSON.parse(combined)).not.toThrow();
     });
-    it('apply + govern authority writes files and invokes materializeSetup (KEY-24 complement to observe)', async () => {
+    it('PR #912 round 12 (Codex P2): PB_JSON=1 does NOT suppress logErr — warnings still reach stderr', async () => {
+        // WP-776 S3d/S3f: the original fixture ("DB baseline changed" during authoring sync) is
+        // deleted along with the setup-assets system. An unregistered manifest surface is a
+        // still-live, simpler logErr() trigger (surfaces/registry.ts's real, unmocked
+        // validateSurfacesForMode) that proves the same PB_JSON invariant.
         vi.mocked(readManifestStatus).mockReturnValue({
-            mode: 'govern',
-            surfaces: ['.cursor'],
+            mode: 'project',
+            surfaces: ['.cursor', '.not-a-real-surface'],
             lock: {},
             parseStatus: 'ok',
             manifest: null,
         });
-        await runHandshake({ apply: true, surfaces: ['cursor'] });
-        expect(writeFileSync).toHaveBeenCalled();
-        expect(vi.mocked(kernelCall).mock.calls.some(([tool]) => tool === 'setup.materializeSetup')).toBe(true);
-        expect(capturedReport()?.filesSkipped?.some((f) => f.reason === 'preview-only (materialize: observe)')).toBeFalsy();
+        const priorPbJson = process.env.PB_JSON;
+        process.env.PB_JSON = '1';
+        const stdoutSpy = vi.spyOn(process.stdout, 'write').mockImplementation(() => true);
+        const stderrSpy = vi.spyOn(process.stderr, 'write').mockImplementation(() => true);
+        let stderrChunks;
+        try {
+            await runHandshake({ apply: true });
+            stderrChunks = stderrSpy.mock.calls.map(([chunk]) => String(chunk));
+        }
+        finally {
+            if (priorPbJson === undefined)
+                delete process.env.PB_JSON;
+            else
+                process.env.PB_JSON = priorPbJson;
+            stdoutSpy.mockRestore();
+            stderrSpy.mockRestore();
+        }
+        expect(stderrChunks.some((c) => c.includes('manifest surface ".not-a-real-surface" is not registered'))).toBe(true);
     });
-    it('--surfaces is an intersection with manifest.surfaces, not a superset', async () => {
-        vi.mocked(readManifestStatus).mockReturnValue({
-            mode: 'project',
-            surfaces: ['.cursor'],
-            lock: {},
-            parseStatus: 'ok',
-            manifest: null,
+    it('PR #912 round 13 (Codex P1, security): pb --json handshake never leaks an HTTPS git-remote credential or raw Convex fields', async () => {
+        vfs[`${MOCK_CWD}/.productbrain/briefing.md`] = 'Driving entry: WP-462.';
+        vi.mocked(detectRepo).mockReturnValue({
+            name: 'test-repo',
+            description: null,
+            // A credential embedded in the remote — must never reach JSON output verbatim.
+            gitRemote: 'https://user:token@github.com/org/repo.git',
+            repoSlug: null,
+            detectedStack: [],
+            isMonorepo: false,
         });
-        vi.mocked(shouldEmitToTarget).mockImplementation((_entry, target) => target === 'cursor');
-        vi.mocked(generateCursorSkill).mockImplementation((skill) => skill.body);
         vi.mocked(kernelCall).mockImplementation(async (tool) => {
-            if (tool === 'chain.workspaceReadiness')
-                return null;
-            if (tool === 'chain.getOrientView')
-                return null;
-            if (tool === 'chain.searchEntries')
-                return [];
-            if (tool === 'setup.listAssetsForUser') {
-                return [{
-                        entryId: 'SETUP-SKILL-INTERSECTION',
-                        name: 'Intersection',
-                        description: 'Intersection',
-                        body: '# Intersection',
-                        triggers: [],
-                        assetKind: 'skill',
-                        semanticRefs: [],
-                        disabledByOwner: false,
-                        lastProjectedHash: null,
-                    }];
+            if (tool === 'chain.searchEntries') {
+                // A raw Convex document — _id/_creationTime must be stripped before JSON serialization.
+                return [{ _id: 'kx7raw000000000000000000', _creationTime: 1700000000000, entryId: 'WP-462', name: 'Some Entry' }];
             }
-            if (tool === 'setup.getCurrentSetupState')
-                return { effectiveMode: 'observe' };
-            if (tool === 'setup.recordTransition')
-                return { ok: true, receiptId: 'r1', deduped: false };
-            return [];
+            return tool === 'chain.getOrientView' ? ORIENT_VIEW : [];
         });
-        await runHandshake({ apply: true, surfaces: ['claude'] });
-        expect(writeFileSync).not.toHaveBeenCalledWith(expect.stringContaining('/.cursor/skills/Intersection/SKILL.md'), expect.any(String));
+        const priorPbJson = process.env.PB_JSON;
+        process.env.PB_JSON = '1';
+        const writeSpy = vi.spyOn(process.stdout, 'write').mockImplementation(() => true);
+        let combined;
+        try {
+            await runHandshake({ apply: true });
+            combined = writeSpy.mock.calls.map(([chunk]) => String(chunk)).join('').trim();
+        }
+        finally {
+            if (priorPbJson === undefined)
+                delete process.env.PB_JSON;
+            else
+                process.env.PB_JSON = priorPbJson;
+            writeSpy.mockRestore();
+        }
+        expect(combined).not.toContain('user:token@');
+        expect(combined).not.toContain('_creationTime');
+        expect(combined).not.toContain('kx7raw000000000000000000');
+        const parsed = JSON.parse(combined);
+        expect(parsed.repo.gitRemote).toBe('https://github.com/org/repo.git');
+        expect(parsed.matchedEntries).toContainEqual({ entryId: 'WP-462', name: 'Some Entry' });
+    });
+    it('threads sanitized local startup signals into the orient view call', async () => {
+        vfs[`${MOCK_CWD}/.productbrain/briefing.md`] = 'Driving entry: WP-462. Review PR #177 and DEC-1244.';
+        execSyncMock.mockImplementation((cmd) => {
+            if (cmd === 'git branch --show-current')
+                return 'wp462-rcrt-activation\n';
+            if (cmd === 'git diff --name-only HEAD')
+                return 'convex/agentKnowledge/startupResolver.ts\n.env.local\n';
+            if (cmd === 'git rev-parse --short HEAD')
+                return 'abc1234\n';
+            throw new Error(`unexpected command: ${cmd}`);
+        });
+        await runHandshake({ apply: true, quiet: true });
+        const orientCall = vi.mocked(kernelCall).mock.calls.find(([tool]) => tool === 'chain.getOrientView');
+        expect(orientCall).toBeDefined();
+        const args = orientCall[1];
+        expect(args.tier).toBe('standard');
+        expect(args.task).toContain('WP-462');
+        expect(args.task).toContain('PR #177');
+        expect(args.task).toContain('DEC-1244');
+        expect(args.startupSignals).toMatchObject({
+            sourceSurface: 'cli',
+            resolverVersion: 'startup-resolution-v1',
+            branchName: 'wp462-rcrt-activation',
+            worktreeName: 'pb-preview-cwd',
+            changedPaths: ['convex/agentKnowledge/startupResolver.ts'],
+            reviewedArtifactRefs: ['WP-462', 'PR #177', 'DEC-1244'],
+            commitSha: 'abc1234',
+        });
+    });
+    it('marks bare `pb handshake` calls with queryable invocation attribution', async () => {
+        // 'session-start' is no longer a live caller shape — session start/close stopped calling
+        // runHandshake entirely (WP-759/TASK-232, DEC-1736). 'handshake' is the invocationPath the
+        // bare `pb handshake` command (index.ts) actually passes today.
+        execSyncMock.mockImplementation((cmd) => {
+            if (cmd === 'git branch --show-current')
+                return 'wp462-rcrt-activation\n';
+            if (cmd === 'git diff --name-only HEAD')
+                return 'convex/agentKnowledge/startupResolver.ts\n';
+            if (cmd === 'git rev-parse --short HEAD')
+                return 'abc1234\n';
+            throw new Error(`unexpected command: ${cmd}`);
+        });
+        await runHandshake({ apply: true, quiet: true, invocationPath: 'handshake' });
+        const orientCall = vi.mocked(kernelCall).mock.calls.find(([tool]) => tool === 'chain.getOrientView');
+        expect(orientCall).toBeDefined();
+        expect(orientCall[1].invocationPath).toBe('handshake');
     });
-    it('apply records a mode-change transition when manifest mode differs from current setup state', async () => {
+    it('does not invent a startup task when local evidence is empty, but still emits an attribution envelope (Codex@704)', async () => {
+        // execSync throws "no git" by default → no branch/commit/path facts.
+        await runHandshake({ apply: true, quiet: true });
+        const orientCall = vi.mocked(kernelCall).mock.calls.find(([tool]) => tool === 'chain.getOrientView');
+        expect(orientCall).toBeDefined();
+        const args = orientCall[1];
+        expect(args.tier).toBe('standard');
+        // Codex@704: returning {} here would drop the whole startup block and lose
+        // attribution + the queryable domain-unresolved row in exactly the low-evidence
+        // case the resolver is meant to surface. A minimal envelope must still ride.
+        expect(args.startupSignals).toBeDefined();
+        expect(args.startupSignals.resolverVersion).toBe('startup-resolution-v1');
+        expect(args.startupSignals.sourceSurface).toBe('cli');
+        // No invented task; no fabricated evidence fields.
+        expect(args.task).toBeUndefined();
+        expect(args.startupSignals.taskText).toBeUndefined();
+        expect(args.startupSignals.changedPaths).toBeUndefined();
+        expect(args.startupSignals.reviewedArtifactRefs).toBeUndefined();
+    });
+    it('does not derive startup task text from sanitized-out paths, but keeps attribution (Codex@704)', async () => {
+        execSyncMock.mockImplementation((cmd) => {
+            if (cmd === 'git branch --show-current')
+                return 'misc-cleanup\n';
+            if (cmd === 'git diff --name-only HEAD')
+                return '.env.local\n';
+            if (cmd === 'git rev-parse --short HEAD')
+                return 'abc1234\n';
+            // merge-base / branch-delta unavailable in this fixture.
+            throw new Error(`unexpected command: ${cmd}`);
+        });
+        await runHandshake({ apply: true, quiet: true });
+        const orientCall = vi.mocked(kernelCall).mock.calls.find(([tool]) => tool === 'chain.getOrientView');
+        expect(orientCall).toBeDefined();
+        const args = orientCall[1];
+        expect(args.tier).toBe('standard');
+        // The only "evidence" was a secret-bearing path (.env.local) that sanitization
+        // drops — so no task is invented and no changedPaths leak — but the
+        // attribution envelope (branch + commit) still rides (Codex@704).
+        expect(args.task).toBeUndefined();
+        expect(args.startupSignals).toBeDefined();
+        expect(args.startupSignals.branchName).toBe('misc-cleanup');
+        expect(args.startupSignals.commitSha).toBe('abc1234');
+        expect(args.startupSignals.changedPaths).toBeUndefined();
+        expect(args.startupSignals.taskText).toBeUndefined();
+    });
+    it('apply + observe authority leaves the coding-tool surfaces preview-only and refreshes PB\'s own .productbrain files (TASK-554, TEN-4036)', async () => {
         vi.mocked(readManifestStatus).mockReturnValue({
-            mode: 'project',
+            mode: 'observe',
             surfaces: ['.cursor'],
-            lock: { 'SETUP-SKILL-TRANSITION': 'workspace' },
+            lock: {},
             parseStatus: 'ok',
             manifest: null,
         });
+        await runHandshake({ apply: true, surfaces: ['cursor'] });
+        const written = vi.mocked(writeFileSync).mock.calls.map(([path]) => String(path));
+        expect(written).toEqual(expect.arrayContaining([`${MOCK_CWD}/.productbrain/context.md`, `${MOCK_CWD}/.productbrain/generated/everyone-rules.md`]));
+        expect(written.every((path) => path.startsWith(`${MOCK_CWD}/.productbrain/`))).toBe(true);
+        expect(capturedReport()?.filesSkipped).toEqual(expect.arrayContaining([
+            { path: '.cursor/rules/chain.mdc', reason: 'preview-only (materialize: observe)' },
+        ]));
+    });
+    it('apply + materialize off (no .productbrain folder) writes nothing', async () => {
+        vi.mocked(readManifestStatus).mockReturnValue({ mode: 'off', surfaces: [], lock: {}, parseStatus: 'absent', manifest: null });
+        await runHandshake({ apply: true });
+        expect(writeFileSync).not.toHaveBeenCalled();
+        expect(capturedReport()?.filesSkipped).toEqual(expect.arrayContaining([
+            { path: '.productbrain/context.md', reason: 'preview-only (materialize: off)' },
+        ]));
+    });
+    it('a failed orient fetch names both briefing files as not written (RULE-659)', async () => {
         vi.mocked(kernelCall).mockImplementation(async (tool) => {
-            if (tool === 'chain.workspaceReadiness')
-                return null;
             if (tool === 'chain.getOrientView')
-                return null;
-            if (tool === 'chain.searchEntries')
-                return [];
-            if (tool === 'setup.listAssetsForUser')
-                return [];
-            if (tool === 'setup.getCurrentSetupState')
-                return { effectiveMode: 'observe' };
-            if (tool === 'setup.recordTransition')
-                return { ok: true, receiptId: 'r1', deduped: false };
+                throw new Error('network down');
             return [];
         });
         await runHandshake({ apply: true });
-        expect(kernelCall).toHaveBeenCalledWith('setup.recordTransition', {
-            fromMode: 'observe',
-            toMode: 'project',
-            parseStatus: 'ok',
+        expect(capturedReport()?.filesSkipped).toEqual(expect.arrayContaining([
+            { path: '.productbrain/context.md', reason: 'briefing unavailable — the orient fetch failed' },
+            { path: '.productbrain/generated/everyone-rules.md', reason: 'briefing unavailable — the orient fetch failed' },
+        ]));
+        expect(vi.mocked(writeFileSync).mock.calls.some(([path]) => String(path).endsWith('context.md'))).toBe(false);
+    });
+    it('apply + govern authority writes files (OBJ-24 complement to observe)', async () => {
+        // WP-776 S3d/S3f: the setup.materializeSetup assertion is dropped — that receipt write is
+        // deleted along with the rest of the setup-assets system (see handshake.ts's own comment
+        // at the old step 8b). The write-mode invariant itself (govern authority actually writes,
+        // unlike observe) still holds and is still worth guarding.
+        vi.mocked(readManifestStatus).mockReturnValue({
+            mode: 'govern',
             surfaces: ['.cursor'],
-            lock: { 'SETUP-SKILL-TRANSITION': 'workspace' },
+            lock: {},
+            parseStatus: 'ok',
+            manifest: null,
         });
+        await runHandshake({ apply: true, surfaces: ['cursor'] });
+        expect(writeFileSync).toHaveBeenCalled();
+        expect(capturedReport()?.filesSkipped?.some((f) => f.reason === 'preview-only (materialize: observe)')).toBeFalsy();
     });
-    it('apply bulk-imports .productbrain authoring files with frontmatter id before DB projection', async () => {
+    it('--surfaces is an intersection with manifest.surfaces, not a superset', async () => {
         vi.mocked(readManifestStatus).mockReturnValue({
             mode: 'project',
             surfaces: ['.cursor'],
@@ -271,55 +424,19 @@ describe('runHandshake — preview/apply/dryRun invariants (WP-332 S1)', () => {
             parseStatus: 'ok',
             manifest: null,
         });
-        const skillPath = `${MOCK_CWD}/.productbrain/skills/local.md`;
-        vfs[`${MOCK_CWD}/.productbrain/skills`] = '';
-        vfs[skillPath] = [
-            '---',
-            'id: SETUP-SKILL-FRONTMATTER',
-            'name: Local Skill',
-            'description: Local description',
-            'triggers:',
-            '  - local',
-            'semanticRefs:',
-            '  - entry:WP-423',
-            '---',
-            '# Local Skill',
-            '',
-            'Body.',
-        ].join('\n');
-        vi.mocked(readdirSync).mockImplementation((path) => {
-            if (String(path).endsWith('/.productbrain/skills'))
-                return ['local.md'];
-            return [];
-        });
-        vi.mocked(kernelCall).mockImplementation(async (tool) => {
-            if (tool === 'chain.workspaceReadiness')
-                return null;
-            if (tool === 'chain.getOrientView')
-                return null;
-            if (tool === 'chain.searchEntries')
-                return [];
-            // WP-428 S2 (Critical #1): CLI now calls ingestSetupAssetWithBody per-asset.
-            if (tool === 'setup.ingestSetupAssetWithBody')
-                return { action: 'created', entryId: 'SETUP-SKILL-FRONTMATTER' };
-            if (tool === 'setup.listAssetsForUser')
-                return [];
-            if (tool === 'setup.getCurrentSetupState')
-                return { effectiveMode: 'project' };
-            return [];
-        });
-        await runHandshake({ apply: true });
-        // WP-428 S2: CLI now calls ingestSetupAssetWithBody per-asset (not ingestSetupAssetsBatch).
-        expect(kernelCall).toHaveBeenCalledWith('setup.ingestSetupAssetWithBody', expect.objectContaining({
-            entryId: 'SETUP-SKILL-LOCAL',
-            frontmatterId: 'SETUP-SKILL-FRONTMATTER',
-            name: 'Local Skill',
-            description: 'Local description',
-            assetKind: 'skill',
-            triggers: ['local'],
-            semanticRefs: ['entry:WP-423'],
-        }));
+        vi.mocked(shouldEmitToTarget).mockImplementation((_entry, target) => target === 'cursor');
+        vi.mocked(generateCursorSkill).mockImplementation(() => '# Intersection');
+        vi.mocked(readCanonicalSkills).mockReturnValueOnce([
+            { name: 'Intersection', description: 'Intersection', triggers: [], body: '# Intersection', sourcePath: 'local' },
+        ]);
+        await runHandshake({ apply: true, surfaces: ['claude'] });
+        expect(writeFileSync).not.toHaveBeenCalledWith(expect.stringContaining('/.cursor/skills/Intersection/SKILL.md'), expect.any(String));
     });
+    // WP-776 S3d/S3f: "apply records a mode-change transition..." and "apply bulk-imports
+    // .productbrain authoring files..." are deleted — both tested the DB-first setup-asset
+    // source (setup.recordTransition, setup.ingestSetupAssetWithBody), which is gone along with
+    // the rest of the setup-assets system. `pb handshake` now always reads skills/rules from the
+    // filesystem; there is no DB projection or transition receipt left to test.
     it('preview mode reports unchanged for files with identical content', async () => {
         const agentsPath = `${MOCK_CWD}/AGENTS.md`;
         vfs[agentsPath] = `<!-- ${MOCK_MARKER} -->\nagents content`;
@@ -329,451 +446,55 @@ describe('runHandshake — preview/apply/dryRun invariants (WP-332 S1)', () => {
         const entry = report?.previewPlan?.find((e) => e.path.includes('AGENTS.md') && e.status === 'unchanged');
         expect(entry).toBeDefined();
     });
-    it('forked adapter (file exists without MARKER) = forked in previewPlan, no write', async () => {
+    it('user-owned adapter (file exists without MARKER) = would-augment in previewPlan, no write (TEN-2155)', async () => {
+        // TEN-2155: user-owned CLAUDE.md/AGENTS.md (no MARKER) are now AUGMENTED with a PB
+        // region rather than left fully untouched. In preview mode this shows as 'would-augment'
+        // in the previewPlan. No bytes are written to disk in preview mode.
         const agentsPath = `${MOCK_CWD}/AGENTS.md`;
         vfs[agentsPath] = '# Custom AGENTS\nNo auto-generated marker here.';
         await runHandshake({});
         expect(writeFileSync).not.toHaveBeenCalled();
         const report = capturedReport();
-        const entry = report?.previewPlan?.find((e) => e.path.includes('AGENTS.md') && e.status === 'forked');
+        const entry = report?.previewPlan?.find((e) => e.path.includes('AGENTS.md') && e.status === 'would-augment');
         expect(entry).toBeDefined();
+        // Never labelled as a "forked" conflict the user must --force away.
+        const forkedEntry = report?.previewPlan?.find((e) => e.status === 'forked');
+        expect(forkedEntry).toBeUndefined();
     });
-    it('apply mode projects DB setup assets with body-derived refs, disabled filtering, and hash trailers', async () => {
-        vi.mocked(shouldEmitToTarget).mockImplementation((_entry, target) => target === 'cursor');
-        vi.mocked(generateCursorSkill).mockImplementation((skill) => skill.body);
-        vi.mocked(kernelCall).mockImplementation(async (tool, args) => {
-            if (tool === 'chain.workspaceReadiness')
-                return null;
-            if (tool === 'chain.getOrientView')
-                return null;
-            if (tool === 'chain.searchEntries')
-                return [];
-            if (tool === 'setup.listAssetsForUser') {
-                return [
-                    {
-                        entryId: 'SETUP-SKILL-NO-REFS',
-                        name: 'No Refs',
-                        description: 'No ref skill',
-                        body: '# No refs\nPlain body.',
-                        triggers: [],
-                        assetKind: 'skill',
-                        semanticRefs: [],
-                        disabledByOwner: false,
-                        lastProjectedHash: null,
-                    },
-                    {
-                        entryId: 'SETUP-SKILL-WITH-REF',
-                        name: 'With Ref',
-                        description: 'Ref skill',
-                        body: '# With ref\nUse {{ref:entry:WP-345}}.',
-                        triggers: [],
-                        assetKind: 'skill',
-                        semanticRefs: ['entry:WP-345'],
-                        disabledByOwner: false,
-                        lastProjectedHash: null,
-                    },
-                    {
-                        entryId: 'SETUP-SKILL-DISABLED',
-                        name: 'Disabled Skill',
-                        description: 'Disabled',
-                        body: '# Disabled',
-                        triggers: [],
-                        assetKind: 'skill',
-                        semanticRefs: [],
-                        disabledByOwner: true,
-                        lastProjectedHash: null,
-                    },
-                    {
-                        entryId: 'SETUP-BUNDLE-DEMO',
-                        name: 'Bundle Demo',
-                        description: 'Bundle',
-                        body: '# Bundle',
-                        triggers: [],
-                        assetKind: 'bundle',
-                        semanticRefs: [],
-                        disabledByOwner: false,
-                        lastProjectedHash: null,
-                    },
-                ];
-            }
-            if (tool === 'setup.resolveSemanticRefs') {
-                expect(args?.semanticRefs).toEqual(['entry:WP-345']);
-                return [{ ref: 'entry:WP-345', resolved: { entryId: 'WP-345', name: 'Dynamic Skills' } }];
-            }
-            if (tool === 'setup.updateLastProjectedHash')
-                return { ok: true };
-            if (tool === 'setup.materializeSetup')
-                return { ok: true, assetCount: 2, receiptWritten: true };
-            return [];
-        });
-        await runHandshake({ apply: true, surfaces: ['cursor'] });
-        const writes = vi.mocked(writeFileSync).mock.calls.map(([path, content]) => ({
-            path: String(path),
-            content: String(content),
-        }));
-        const noRefs = writes.find((w) => w.path.endsWith('/.cursor/skills/No Refs/SKILL.md'));
-        const withRef = writes.find((w) => w.path.endsWith('/.cursor/skills/With Ref/SKILL.md'));
-        expect(noRefs?.content).toContain('Plain body.');
-        expect(noRefs?.content).toContain('<!-- pb-hash: sha256:');
-        expect(withRef?.content).toContain('Use {{ref:entry:WP-345}}.');
-        expect(withRef?.content).toContain('<!-- pb-hash: sha256:');
-        expect(writes.some((w) => w.path.includes('Disabled Skill'))).toBe(false);
-        expect(writes.some((w) => w.path.includes('Bundle Demo'))).toBe(false);
-        const hashUpdates = vi.mocked(kernelCall).mock.calls.filter(([tool]) => tool === 'setup.updateLastProjectedHash');
-        expect(hashUpdates).toHaveLength(2);
-        expect(hashUpdates.map(([, args]) => args.entryId).sort()).toEqual([
-            'SETUP-SKILL-NO-REFS',
-            'SETUP-SKILL-WITH-REF',
-        ]);
-    });
-    it('does not update lastProjectedHash when a DB asset projection is forked and skipped', async () => {
-        vi.mocked(shouldEmitToTarget).mockImplementation((_entry, target) => target === 'cursor');
-        vi.mocked(generateCursorSkill).mockImplementation((skill) => skill.body);
-        vi.mocked(kernelCall).mockImplementation(async (tool) => {
-            if (tool === 'chain.workspaceReadiness')
-                return null;
-            if (tool === 'chain.getOrientView')
-                return null;
-            if (tool === 'chain.searchEntries')
-                return [];
-            if (tool === 'setup.listAssetsForUser') {
-                return [
-                    {
-                        entryId: 'SETUP-SKILL-FORKED',
-                        name: 'Forked Skill',
-                        description: 'Forked',
-                        body: '# Forked\nBody.',
-                        triggers: [],
-                        assetKind: 'skill',
-                        semanticRefs: [],
-                        disabledByOwner: false,
-                        lastProjectedHash: null,
-                    },
-                ];
-            }
-            if (tool === 'setup.materializeSetup')
-                return { ok: true, assetCount: 1, receiptWritten: true };
-            return [];
-        });
-        vfs[`${MOCK_CWD}/.cursor/skills/Forked Skill/SKILL.md`] = '# User fork\nNo generated marker.';
-        await runHandshake({ apply: true, surfaces: ['cursor'] });
-        expect(vi.mocked(kernelCall).mock.calls.some(([tool]) => tool === 'setup.updateLastProjectedHash')).toBe(false);
-    });
-    it('writes missing caller-owned personal DB assets back to .productbrain authoring files', async () => {
-        vi.mocked(kernelCall).mockImplementation(async (tool) => {
-            if (tool === 'chain.workspaceReadiness')
-                return null;
-            if (tool === 'chain.getOrientView')
-                return null;
-            if (tool === 'chain.searchEntries')
-                return [];
-            if (tool === 'setup.listAssetsForUser') {
-                return {
-                    activeAssets: [
-                        {
-                            entryId: 'SETUP-SKILL-PERSONAL',
-                            name: 'Personal Skill',
-                            description: 'Personal authoring row.',
-                            body: '# Personal Skill\nBody.',
-                            triggers: ['personal'],
-                            assetKind: 'skill',
-                            semanticRefs: ['entry:WP-423'],
-                            disabledByOwner: false,
-                            lastProjectedHash: null,
-                            scope: 'personal',
-                        },
-                    ],
-                    dormantAssets: [],
-                    hasAnyReceipt: true,
-                };
-            }
-            if (tool === 'setup.updateLastProjectedHash')
-                return { ok: true };
-            if (tool === 'setup.materializeSetup')
-                return { ok: true, assetCount: 1, receiptWritten: true };
-            return [];
-        });
-        await runHandshake({ apply: true });
-        const path = `${MOCK_CWD}/.productbrain/skills/Personal Skill.md`;
-        expect(vfs[path]).toContain('id: SETUP-SKILL-PERSONAL');
-        expect(vfs[path]).toContain('# Personal Skill\nBody.');
-        expect(vi.mocked(kernelCall).mock.calls.some(([tool]) => tool === 'setup.updateLastProjectedHash')).toBe(true);
-    });
-    it('writes newer DB edits over a tracked authoring file unchanged from baseline', async () => {
-        const baselineHash = setupAuthoringTestHash({
-            entryId: 'SETUP-SKILL-DB-WINS',
-            name: 'DB Wins',
-            description: 'DB should win.',
-            assetKind: 'skill',
-            body: '# Original',
-        });
-        vfs[`${MOCK_CWD}/.productbrain/skills`] = '';
-        vfs[`${MOCK_CWD}/.productbrain/skills/DB Wins.md`] = [
-            '---',
-            'id: SETUP-SKILL-DB-WINS',
-            'name: "DB Wins"',
-            'description: "DB should win."',
-            'assetKind: skill',
-            '---',
-            '# Original',
-            '',
-        ].join('\n');
-        vfs[`${MOCK_CWD}/.productbrain/.authoring-sync.json`] = JSON.stringify({
-            version: 1,
-            assets: {
-                'SETUP-SKILL-DB-WINS': {
-                    path: '.productbrain/skills/DB Wins.md',
-                    hash: baselineHash,
-                },
-            },
-        });
-        vi.mocked(readdirSync).mockImplementation((path) => {
-            if (String(path).endsWith('/.productbrain/skills'))
-                return ['DB Wins.md'];
-            return [];
-        });
-        vi.mocked(kernelCall).mockImplementation(async (tool) => {
-            if (tool === 'chain.workspaceReadiness')
-                return null;
-            if (tool === 'chain.getOrientView')
-                return null;
-            if (tool === 'chain.searchEntries')
-                return [];
-            // WP-428 S2 (Critical #1): CLI now calls ingestSetupAssetWithBody per-asset.
-            if (tool === 'setup.ingestSetupAssetWithBody') {
-                return { action: 'unchanged', entryId: 'SETUP-SKILL-DB-WINS' };
-            }
-            if (tool === 'setup.listAssetsForUser') {
-                return {
-                    activeAssets: [
-                        {
-                            entryId: 'SETUP-SKILL-DB-WINS',
-                            name: 'DB Wins',
-                            description: 'DB should win.',
-                            body: '# DB edit',
-                            triggers: [],
-                            assetKind: 'skill',
-                            semanticRefs: [],
-                            disabledByOwner: false,
-                            lastProjectedHash: baselineHash,
-                            scope: 'personal',
-                        },
-                    ],
-                    dormantAssets: [],
-                    hasAnyReceipt: true,
-                };
-            }
-            if (tool === 'setup.updateLastProjectedHash')
-                return { ok: true };
-            if (tool === 'setup.materializeSetup')
-                return { ok: true, assetCount: 1, receiptWritten: true };
-            return [];
-        });
-        await runHandshake({ apply: true });
-        expect(vfs[`${MOCK_CWD}/.productbrain/skills/DB Wins.md`]).toContain('# DB edit');
-        expect(vi.mocked(kernelCall).mock.calls.some(([tool]) => tool === 'setup.updateLastProjectedHash')).toBe(true);
-    });
-    it('marks personal DB assets dormant when their tracked authoring file is deleted', async () => {
-        const syncedHash = setupAuthoringTestHash({
-            entryId: 'SETUP-SKILL-DELETED',
-            name: 'Deleted Skill',
-            description: 'Deleted authoring row.',
-            assetKind: 'skill',
-            body: '# Deleted Skill\nBody.',
-        });
-        vfs[`${MOCK_CWD}/.productbrain/.authoring-sync.json`] = JSON.stringify({
-            version: 1,
-            assets: {
-                'SETUP-SKILL-DELETED': {
-                    path: '.productbrain/skills/Deleted Skill.md',
-                    hash: syncedHash,
-                },
-            },
-        });
-        vi.mocked(kernelCall).mockImplementation(async (tool) => {
-            if (tool === 'chain.workspaceReadiness')
-                return null;
-            if (tool === 'chain.getOrientView')
-                return null;
-            if (tool === 'chain.searchEntries')
-                return [];
-            if (tool === 'setup.listAssetsForUser') {
-                return {
-                    activeAssets: [
-                        {
-                            entryId: 'SETUP-SKILL-DELETED',
-                            name: 'Deleted Skill',
-                            description: 'Deleted authoring row.',
-                            body: '# Deleted Skill\nBody.',
-                            triggers: [],
-                            assetKind: 'skill',
-                            semanticRefs: [],
-                            disabledByOwner: false,
-                            lastProjectedHash: syncedHash,
-                            scope: 'personal',
-                        },
-                    ],
-                    dormantAssets: [],
-                    hasAnyReceipt: true,
-                };
-            }
-            if (tool === 'setup.markPersonalSetupAssetDormantFromSync')
-                return { action: 'dormant', entryId: 'SETUP-SKILL-DELETED' };
-            if (tool === 'setup.materializeSetup')
-                return { ok: true, assetCount: 0, receiptWritten: true };
-            return [];
-        });
-        await runHandshake({ apply: true });
-        expect(vi.mocked(kernelCall).mock.calls).toContainEqual([
-            'setup.markPersonalSetupAssetDormantFromSync',
-            { entryId: 'SETUP-SKILL-DELETED', expectedLastProjectedHash: syncedHash },
-        ]);
-    });
-    it('does not mark a stale tracked deletion dormant when the DB baseline changed', async () => {
-        vfs[`${MOCK_CWD}/.productbrain/.authoring-sync.json`] = JSON.stringify({
-            version: 1,
-            assets: {
-                'SETUP-SKILL-STALE': {
-                    path: '.productbrain/skills/Stale Skill.md',
-                    hash: 'sha256:old-baseline',
-                },
-            },
-        });
-        vi.mocked(kernelCall).mockImplementation(async (tool) => {
-            if (tool === 'chain.workspaceReadiness')
-                return null;
-            if (tool === 'chain.getOrientView')
-                return null;
-            if (tool === 'chain.searchEntries')
-                return [];
-            if (tool === 'setup.listAssetsForUser') {
-                return {
-                    activeAssets: [
-                        {
-                            entryId: 'SETUP-SKILL-STALE',
-                            name: 'Stale Skill',
-                            description: 'DB changed after local sync.',
-                            body: '# Stale Skill\nUpdated DB body.',
-                            triggers: [],
-                            assetKind: 'skill',
-                            semanticRefs: [],
-                            disabledByOwner: false,
-                            lastProjectedHash: 'sha256:new-baseline',
-                            scope: 'personal',
-                        },
-                    ],
-                    dormantAssets: [],
-                    hasAnyReceipt: true,
-                };
-            }
-            if (tool === 'setup.updateLastProjectedHash')
-                return { ok: true };
-            if (tool === 'setup.materializeSetup')
-                return { ok: true, assetCount: 1, receiptWritten: true };
-            return [];
-        });
-        await runHandshake({ apply: true });
-        expect(vi.mocked(kernelCall).mock.calls.some(([tool]) => tool === 'setup.markPersonalSetupAssetDormantFromSync')).toBe(false);
-        expect(vfs[`${MOCK_CWD}/.productbrain/skills/Stale Skill.md`]).toContain('Updated DB body.');
-    });
-    it('does not write a stale snapshot back when dormant sync returns a server-side conflict', async () => {
-        const listedHash = setupAuthoringTestHash({
-            entryId: 'SETUP-SKILL-RACE',
-            name: 'Race Skill',
-            description: 'Race during sync.',
-            assetKind: 'skill',
-            body: '# Race Skill\nDB body.',
-        });
-        vfs[`${MOCK_CWD}/.productbrain/.authoring-sync.json`] = JSON.stringify({
-            version: 1,
-            assets: {
-                'SETUP-SKILL-RACE': {
-                    path: '.productbrain/skills/Race Skill.md',
-                    hash: listedHash,
-                },
-            },
-        });
-        vi.mocked(kernelCall).mockImplementation(async (tool) => {
-            if (tool === 'chain.workspaceReadiness')
-                return null;
-            if (tool === 'chain.getOrientView')
-                return null;
-            if (tool === 'chain.searchEntries')
-                return [];
-            if (tool === 'setup.listAssetsForUser') {
-                return {
-                    activeAssets: [
-                        {
-                            entryId: 'SETUP-SKILL-RACE',
-                            name: 'Race Skill',
-                            description: 'Race during sync.',
-                            body: '# Race Skill\nDB body.',
-                            triggers: [],
-                            assetKind: 'skill',
-                            semanticRefs: [],
-                            disabledByOwner: false,
-                            lastProjectedHash: listedHash,
-                            scope: 'personal',
-                        },
-                    ],
-                    dormantAssets: [],
-                    hasAnyReceipt: true,
-                };
-            }
-            if (tool === 'setup.markPersonalSetupAssetDormantFromSync')
-                return { action: 'conflict', entryId: 'SETUP-SKILL-RACE' };
-            if (tool === 'setup.updateLastProjectedHash')
-                return { ok: true };
-            if (tool === 'setup.materializeSetup')
-                return { ok: true, assetCount: 1, receiptWritten: true };
-            return [];
-        });
-        await runHandshake({ apply: true });
-        expect(vi.mocked(kernelCall).mock.calls).toContainEqual([
-            'setup.markPersonalSetupAssetDormantFromSync',
-            { entryId: 'SETUP-SKILL-RACE', expectedLastProjectedHash: listedHash },
-        ]);
-        expect(vfs[`${MOCK_CWD}/.productbrain/skills/Race Skill.md`]).toBeUndefined();
-        expect(vi.mocked(kernelCall).mock.calls.some(([tool, args]) => tool === 'setup.updateLastProjectedHash' &&
-            args?.entryId === 'SETUP-SKILL-RACE')).toBe(false);
-    });
-    it('does not mark a missing personal authoring file dormant on a fresh clone without local tracking state', async () => {
-        vi.mocked(kernelCall).mockImplementation(async (tool) => {
-            if (tool === 'chain.workspaceReadiness')
-                return null;
-            if (tool === 'chain.getOrientView')
-                return null;
-            if (tool === 'chain.searchEntries')
-                return [];
-            if (tool === 'setup.listAssetsForUser') {
-                return {
-                    activeAssets: [
-                        {
-                            entryId: 'SETUP-SKILL-FRESH',
-                            name: 'Fresh Skill',
-                            description: 'Fresh clone row.',
-                            body: '# Fresh Skill\nBody.',
-                            triggers: [],
-                            assetKind: 'skill',
-                            semanticRefs: [],
-                            disabledByOwner: false,
-                            lastProjectedHash: 'sha256:previous',
-                            scope: 'personal',
-                        },
-                    ],
-                    dormantAssets: [],
-                    hasAnyReceipt: true,
-                };
-            }
-            if (tool === 'setup.updateLastProjectedHash')
-                return { ok: true };
-            if (tool === 'setup.materializeSetup')
-                return { ok: true, assetCount: 1, receiptWritten: true };
-            return [];
-        });
-        await runHandshake({ apply: true });
-        expect(vi.mocked(kernelCall).mock.calls.some(([tool]) => tool === 'setup.markPersonalSetupAssetDormantFromSync')).toBe(false);
-        expect(vfs[`${MOCK_CWD}/.productbrain/skills/Fresh Skill.md`]).toContain('id: SETUP-SKILL-FRESH');
+    it('apply: user-owned files (no MARKER) are augmented with a PB region, not skipped (TEN-2155)', async () => {
+        // TEN-2155: user-owned CLAUDE.md/AGENTS.md get a pb:region spliced in — they are
+        // NOT added to userOwnedSkipped. Their original content is preserved; only the PB
+        // region block is appended. They must appear in filesWritten, not filesSkipped.
+        const claudePath = `${MOCK_CWD}/CLAUDE.md`;
+        const agentsPath = `${MOCK_CWD}/AGENTS.md`;
+        const userClaude = '# My own CLAUDE.md\nNo auto-generated marker.';
+        const userAgents = '# My own AGENTS.md\nNo auto-generated marker.';
+        vfs[claudePath] = userClaude;
+        vfs[agentsPath] = userAgents;
+        const report = await runHandshake({ apply: true });
+        // Augmented files appear in filesWritten, not userOwnedSkipped.
+        expect(report?.filesWritten).toEqual(expect.arrayContaining(['CLAUDE.md', 'AGENTS.md']));
+        expect(report?.userOwnedSkipped ?? []).not.toEqual(expect.arrayContaining(['CLAUDE.md']));
+        expect(report?.userOwnedSkipped ?? []).not.toEqual(expect.arrayContaining(['AGENTS.md']));
+        // The augmented content on disk must contain the original user content.
+        expect(vfs[claudePath]).toContain(userClaude);
+        expect(vfs[agentsPath]).toContain(userAgents);
+        // And the PB region sentinel must be present (the full sentinel includes a comment suffix).
+        expect(vfs[claudePath]).toContain('<!-- pb:region:start');
+        expect(vfs[agentsPath]).toContain('<!-- pb:region:start');
     });
+    // WP-776 S3d/S3f: the remaining DB-first setup-asset projection/authoring-sync tests that
+    // used to live here (project DB setup assets with refs/hash trailers, skip updating
+    // lastProjectedHash on a forked write, write personal DB assets back to .productbrain
+    // authoring files, write newer DB edits over a tracked file, mark personal DB assets dormant
+    // on authoring-file deletion, refuse a stale dormant-mark when the DB baseline changed,
+    // refuse a stale snapshot write on a server-side sync conflict, refuse a dormant-mark with no
+    // local tracking state, and the 'user-owned files never trigger a drift TEN' regression guard)
+    // are all deleted — every one of them exercised setup.listAssetsForUser / setup.
+    // ingestSetupAssetWithBody / setup.markPersonalSetupAssetDormantFromSync / setup.
+    // updateLastProjectedHash / setup.materializeSetup, none of which exist any more.
+    // `pb handshake` reads skills/rules from the filesystem only now (see the '--surfaces is an
+    // intersection' test above); there is no DB-sourced asset, authoring sync, or dormant-marking
+    // behavior left to test.
 });
 //# sourceMappingURL=handshake-preview.test.js.map