@productbrain/cli 0.1.0-beta.96 → 0.1.0-beta.978

package/dist/__tests__/handshake.e2e.test.js

@@ -0,0 +1,1252 @@
+/**
+ * WP-421 S7 — table-driven E2E for the four authority-mode transitions
+ * (doneWhen #27). One shared tempdir fixture exercises four mode-transition
+ * rows in a `describe.each` so a regression in any single transition shows up
+ * with a row-named failure (e.g. "row 3 / project → govern").
+ *
+ * Why this stays CLI-side (not full handshake → Convex):
+ *
+ *   The full `runHandshake` round-trips the AKI gateway, listAssetsForUser,
+ *   and writeSetupReceipt. Those are exercised by the handshake.test.ts mocks
+ *   and the convex-test integration suite. This file pins the per-transition
+ *   filesystem contract that every handshake share regardless of mode:
+ *     - drift report classification (3 buckets) is correct for the fixture,
+ *     - PB-managed projection paths are inside the perimeter,
+ *     - user-owned files are NEVER touched,
+ *     - lock metadata in the manifest is read+honoured by the perimeter,
+ *     - dormant markers are idempotent across re-runs.
+ *
+ *   The four rows share ONE tempdir (per spec) — failures localize to the
+ *   `transitionName` column.
+ */
+import { mkdtempSync, rmSync, mkdirSync, readFileSync, writeFileSync, existsSync, renameSync } from 'fs';
+import { tmpdir } from 'os';
+import { join, dirname } from 'path';
+import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, it, vi } from 'vitest';
+import { classifyDriftBucket, DORMANT_MARKER, writeDormantMarkerToFile, } from '../commands/handshake.js';
+import { MARKER } from '../generators/adapters.js';
+import { assertSetupWritePath, SETUP_PERIMETER_VIOLATION } from '../setup/perimeter.js';
+import { readManifestStatus } from '../generators/manifest.js';
+import { createHash } from 'crypto';
+// ── Shared tempdir fixture ───────────────────────────────────────────────────
+let sharedRoot;
+let savedCwd;
+const FIXTURE_FILES = {
+    // PB-managed projection (clean): has MARKER + matching pb-hash trailer.
+    pbManagedClean: '.cursor/rules/pb-orient.mdc',
+    // User-edited projection: has MARKER + STALE pb-hash trailer (tampered bucket).
+    pbManagedTampered: '.cursor/rules/pb-tampered.mdc',
+    // User-owned: no MARKER, never touched by PB.
+    userOwned: '.cursor/rules/my-custom.mdc',
+    // Manifest at .productbrain/manifest.yaml carries adopted: + a platform-locked entry.
+    manifest: '.productbrain/manifest.yaml',
+};
+/** Compute the pb-hash trailer the projection path uses, so the fixture round-trips clean. */
+function buildCleanProjection(body) {
+    const HASH_TRAILER_REGEX = /^<!--\s*pb-hash:.*-->\s*$/gm;
+    const TIMESTAMP_REGEX = /^<!--\s*pb-generated-at:.*-->\s*$/gm;
+    const head = `${MARKER}\n${body}`;
+    const normalized = head
+        .replace(HASH_TRAILER_REGEX, '')
+        .replace(TIMESTAMP_REGEX, '')
+        .replace(/\r\n/g, '\n')
+        .replace(/\r/g, '\n')
+        .trimEnd();
+    const hash = createHash('sha256').update(normalized, 'utf8').digest('hex');
+    return `${normalized}\n<!-- pb-hash: sha256:${hash} -->`;
+}
+beforeAll(() => {
+    sharedRoot = mkdtempSync(join(tmpdir(), 'pb-wp421-s7-e2e-'));
+    mkdirSync(join(sharedRoot, '.productbrain'), { recursive: true });
+    mkdirSync(join(sharedRoot, '.cursor', 'rules'), { recursive: true });
+    mkdirSync(join(sharedRoot, '.claude', 'rules'), { recursive: true });
+    // Manifest with adopted: allowlist + platform-locked entry per spec.
+    // Note: version must be a string (validator rejects numeric); minimal YAML
+    // parser strips quotes so `"0.1"` round-trips as the string "0.1".
+    const manifestYaml = [
+        'version: "0.1"',
+        'materialize: observe',
+        'surfaces:',
+        '  - .cursor',
+        '  - .claude',
+        'adopted:',
+        '  - pb-orient',
+        '  - pb-tampered',
+        'lock:',
+        '  SETUP-RULE-PB-ORIENT: platform',
+        '',
+    ].join('\n');
+    writeFileSync(join(sharedRoot, FIXTURE_FILES.manifest), manifestYaml);
+    // PB-managed clean: MARKER + matching trailer.
+    writeFileSync(join(sharedRoot, FIXTURE_FILES.pbManagedClean), buildCleanProjection('# Orient skill\n\nClean body.\n'));
+    // PB-managed tampered: MARKER + trailer, but body edited downstream of the trailer.
+    const cleanForTamper = buildCleanProjection('# Tampered\n\nOriginal body.\n');
+    writeFileSync(join(sharedRoot, FIXTURE_FILES.pbManagedTampered), cleanForTamper.replace('Original body.', 'Original body.\n\nUSER EDITED HERE.'));
+    // User-owned: no MARKER. Must be inert under every transition.
+    writeFileSync(join(sharedRoot, FIXTURE_FILES.userOwned), '# My custom rule — authored by hand, no marker.\n');
+    savedCwd = process.cwd();
+    process.chdir(sharedRoot);
+});
+afterAll(() => {
+    process.chdir(savedCwd);
+    rmSync(sharedRoot, { recursive: true, force: true });
+});
+const ROWS = [
+    {
+        transitionName: 'bootstrap → observe',
+        fromMode: 'off',
+        toMode: 'observe',
+        writesProjections: false,
+        lowersToDormant: false,
+    },
+    {
+        transitionName: 'observe → project',
+        fromMode: 'observe',
+        toMode: 'project',
+        writesProjections: true,
+        lowersToDormant: false,
+    },
+    {
+        transitionName: 'project → govern',
+        fromMode: 'project',
+        toMode: 'govern',
+        writesProjections: true,
+        lowersToDormant: false,
+    },
+    {
+        transitionName: 'govern → off',
+        fromMode: 'govern',
+        toMode: 'off',
+        writesProjections: false,
+        lowersToDormant: true,
+    },
+];
+// ── Per-row assertions ───────────────────────────────────────────────────────
+describe('WP-421 S7 — table-driven E2E (doneWhen #27): four authority transitions over one shared tempdir', () => {
+    describe.each(ROWS)('row: $transitionName (fromMode=$fromMode → toMode=$toMode)', (row) => {
+        it('drift report buckets the three fixture files correctly', () => {
+            const cleanResult = classifyDriftBucket(join(process.cwd(), FIXTURE_FILES.pbManagedClean));
+            const tamperedResult = classifyDriftBucket(join(process.cwd(), FIXTURE_FILES.pbManagedTampered));
+            const userOwnedResult = classifyDriftBucket(join(process.cwd(), FIXTURE_FILES.userOwned));
+            expect(cleanResult, `${row.transitionName}: clean fixture must classify as pb-managed-clean`).not.toBeNull();
+            expect(cleanResult.bucket).toBe('pb-managed-clean');
+            expect(tamperedResult, `${row.transitionName}: tampered fixture must classify as pb-managed-tampered`).not.toBeNull();
+            expect(tamperedResult.bucket).toBe('pb-managed-tampered');
+            expect(tamperedResult.expectedHash).not.toBe(tamperedResult.actualHash);
+            expect(userOwnedResult, `${row.transitionName}: user-owned fixture must classify as user-owned`).not.toBeNull();
+            expect(userOwnedResult.bucket).toBe('user-owned');
+        });
+        it('manifest reader returns expected mode + surfaces + lock for the fixture', () => {
+            // The manifest itself does not change row-to-row; we only assert the
+            // shape that the perimeter consults. (Mode field tracking happens in
+            // the convex-test integration suite — there's no need to mutate the
+            // file here per row.)
+            const status = readManifestStatus(join(process.cwd(), '.productbrain'));
+            expect(status.parseStatus).toBe('ok');
+            expect(status.surfaces).toEqual(['.cursor', '.claude']);
+            expect(status.lock).toEqual({ 'SETUP-RULE-PB-ORIENT': 'platform' });
+            // Defense-in-depth: per DEC-963, when parseStatus !== 'ok', mode must
+            // never be 'project' or 'govern'. Our fixture is parseable so this is
+            // an OK assertion, but it pins the invariant for review.
+            if (status.parseStatus !== 'ok') {
+                expect(['off', 'observe']).toContain(status.mode);
+            }
+        });
+        it('perimeter accepts writes inside .cursor and .productbrain; rejects writes outside', () => {
+            const status = readManifestStatus(join(process.cwd(), '.productbrain'));
+            // PB-managed clean is inside .cursor/rules → allowed.
+            expect(() => assertSetupWritePath(join(process.cwd(), FIXTURE_FILES.pbManagedClean), status)).not.toThrow();
+            // .productbrain/skills/orient.md is hard-coded allowed.
+            expect(() => assertSetupWritePath(join(process.cwd(), '.productbrain', 'skills', 'orient.md'), status)).not.toThrow();
+            // Anything outside the perimeter (e.g. /tmp/foo or sibling dir) is refused.
+            const outside = join(sharedRoot, '..', 'definitely-outside-the-perimeter');
+            let caught = null;
+            try {
+                assertSetupWritePath(outside, status);
+            }
+            catch (err) {
+                caught = err;
+            }
+            expect(caught, `${row.transitionName}: perimeter must refuse outside-perimeter writes`).toBeInstanceOf(Error);
+            expect(caught.code).toBe(SETUP_PERIMETER_VIOLATION);
+        });
+        it('user-owned file is untouched after the transition (no MARKER, never written)', () => {
+            // Per row 2 (observe → project): "PB-managed projected, user-owned untouched."
+            // We assert the same invariant on every row — user-owned never gains a
+            // MARKER, never gains a dormant marker, never gets overwritten.
+            const userOwnedPath = join(process.cwd(), FIXTURE_FILES.userOwned);
+            const before = readFileSync(userOwnedPath, 'utf8');
+            // Simulate "what would PB do?" — try to drop a dormant marker. The
+            // function must skip user-owned files (no MARKER → return 'skipped').
+            const dormantResult = writeDormantMarkerToFile(userOwnedPath);
+            expect(dormantResult).toBe('skipped');
+            const after = readFileSync(userOwnedPath, 'utf8');
+            expect(after).toBe(before);
+            expect(after.includes(MARKER)).toBe(false);
+            expect(after.includes(DORMANT_MARKER)).toBe(false);
+        });
+        if (row.lowersToDormant) {
+            it('govern → off: dormant markers are placed on PB-managed files, idempotent on re-run', () => {
+                // Row 4 only. govern → off lowers all assets to dormant. The marker
+                // must be written exactly once even if the handshake runs N times in
+                // a row (doneWhen #20 idempotency).
+                const cleanPath = join(process.cwd(), FIXTURE_FILES.pbManagedClean);
+                // First call: marker is appended.
+                const first = writeDormantMarkerToFile(cleanPath);
+                expect(first).toBe('written');
+                // Second + third call: idempotent — must NOT append a second marker.
+                const second = writeDormantMarkerToFile(cleanPath);
+                const third = writeDormantMarkerToFile(cleanPath);
+                expect(second).toBe('already-dormant');
+                expect(third).toBe('already-dormant');
+                const content = readFileSync(cleanPath, 'utf8');
+                // Exactly one occurrence of DORMANT_MARKER.
+                const escaped = DORMANT_MARKER.replace(/[<>!-]/g, '\\$&');
+                const occurrences = (content.match(new RegExp(escaped, 'g')) ?? []).length;
+                expect(occurrences).toBe(1);
+            });
+        }
+        if (row.transitionName === 'project → govern') {
+            it('project → govern: lock metadata in manifest survives the transition (.lock honored)', () => {
+                // The manifest declares SETUP-RULE-PB-ORIENT: platform. This is the
+                // contract the fork-auth check (DEC-961) consults server-side — the
+                // CLI only reads the manifest and forwards. We assert the read.
+                const status = readManifestStatus(join(process.cwd(), '.productbrain'));
+                expect(status.lock['SETUP-RULE-PB-ORIENT']).toBe('platform');
+            });
+        }
+        if (row.transitionName === 'observe → project') {
+            it('observe → project: PB-managed paths resolve inside .cursor (perimeter-approved projection)', () => {
+                const status = readManifestStatus(join(process.cwd(), '.productbrain'));
+                // The two PB-managed fixture paths must both resolve inside the
+                // declared perimeter — that's what makes "observe → project" the
+                // transition that's allowed to write at all.
+                expect(() => assertSetupWritePath(join(process.cwd(), FIXTURE_FILES.pbManagedClean), status)).not.toThrow();
+                expect(() => assertSetupWritePath(join(process.cwd(), FIXTURE_FILES.pbManagedTampered), status)).not.toThrow();
+            });
+        }
+        if (row.transitionName === 'bootstrap → observe') {
+            it('bootstrap → observe: drift report runs without writes (read-only inspection)', () => {
+                // The 'observe' mode is read-only: handshake reports drift but never
+                // projects. Assert that running classifyDriftBucket on every fixture
+                // does not change the file content.
+                const before = {};
+                for (const [name, rel] of Object.entries(FIXTURE_FILES)) {
+                    if (name === 'manifest')
+                        continue;
+                    before[rel] = readFileSync(join(process.cwd(), rel), 'utf8');
+                }
+                for (const rel of Object.values(FIXTURE_FILES)) {
+                    classifyDriftBucket(join(process.cwd(), rel));
+                }
+                for (const [name, rel] of Object.entries(FIXTURE_FILES)) {
+                    if (name === 'manifest')
+                        continue;
+                    expect(readFileSync(join(process.cwd(), rel), 'utf8')).toBe(before[rel]);
+                }
+            });
+        }
+    });
+    // ── Cross-row sanity: the shared fixture survives every row, exists at end. ──
+    it('shared fixture: every fixture file still exists after all rows complete', () => {
+        for (const rel of Object.values(FIXTURE_FILES)) {
+            expect(existsSync(join(process.cwd(), rel))).toBe(true);
+        }
+    });
+});
+// ── WP-426 E3: round-trip — reprojection lands at authoringPath, no duplicate ─
+//
+// Simulates the DB → repo writeback loop (handshake.ts:1746-1840):
+//   1. An asset was authored at .productbrain/skills/my-foo.md (name "Foo Bar").
+//   2. The server now returns authoringPath: 'skills/my-foo.md' on the asset.
+//   3. setupAuthoringPath resolves to the authored path (not Foo Bar.md).
+//   4. Writing to that path creates my-foo.md only — no duplicate Foo Bar.md.
+//
+// Before WP-426 E3 the function ignored authoringPath and always name-derived,
+// so "Foo Bar.md" would be written — a duplicate when the file was actually at
+// "my-foo.md". This test locks the fixed behaviour.
+import { __test as handshakeTest } from '../commands/handshake.js';
+describe('WP-426 E3: round-trip — authoringPath wins; no duplicate file', () => {
+    let tmpRoot;
+    beforeAll(() => {
+        tmpRoot = mkdtempSync(join(tmpdir(), 'pb-wp426-e3-roundtrip-'));
+        mkdirSync(join(tmpRoot, '.productbrain', 'skills'), { recursive: true });
+        // Pre-place the file where the user originally authored it.
+        writeFileSync(join(tmpRoot, '.productbrain', 'skills', 'my-foo.md'), '---\nid: SETUP-FOO\nname: "Foo Bar"\n---\nContent.\n');
+    });
+    afterAll(() => {
+        rmSync(tmpRoot, { recursive: true, force: true });
+    });
+    it('resolves to the authoringPath location, not the name-derived location', () => {
+        const resolvedPath = handshakeTest.setupAuthoringPath(tmpRoot, {
+            entryId: 'SETUP-FOO',
+            name: 'Foo Bar',
+            assetKind: 'skill',
+            authoringPath: 'skills/my-foo.md',
+        });
+        expect(resolvedPath).toBe(join(tmpRoot, '.productbrain', 'skills', 'my-foo.md'));
+        // The name-derived path must NOT be what gets written.
+        expect(resolvedPath).not.toBe(join(tmpRoot, '.productbrain', 'skills', 'Foo Bar.md'));
+    });
+    it('writing to the resolved path does NOT create a duplicate Foo Bar.md', () => {
+        const resolvedPath = handshakeTest.setupAuthoringPath(tmpRoot, {
+            entryId: 'SETUP-FOO',
+            name: 'Foo Bar',
+            assetKind: 'skill',
+            authoringPath: 'skills/my-foo.md',
+        });
+        // Simulate the writeback: write to the resolved path (as the CLI does at handshake.ts:1840).
+        mkdirSync(dirname(resolvedPath), { recursive: true });
+        writeFileSync(resolvedPath, '---\nid: SETUP-FOO\nname: "Foo Bar"\n---\nReprojected content.\n');
+        // The authored file must exist at the authoringPath location.
+        expect(existsSync(join(tmpRoot, '.productbrain', 'skills', 'my-foo.md'))).toBe(true);
+        // The name-derived duplicate must NOT exist.
+        expect(existsSync(join(tmpRoot, '.productbrain', 'skills', 'Foo Bar.md'))).toBe(false);
+    });
+});
+// ── WP-426 E3 (Loop fix): TRUE runHandshake round-trip ───────────────────────
+//
+// Drives the full `runHandshake()` write loop through its kernel stubs so the
+// authoringPath field threads the complete path:
+//   server (listAssetsForUser) → dbAssetRows → personalAssets loop →
+//   setupAuthoringPath() → assertSetupWritePath → writeFileSync → disk
+//
+// doneWhen #3/#5 mandate that ".productbrain/skills/my-foo.md" lands on disk
+// (not the name-derived "Foo Bar.md") and that .authoring-sync.json records
+// the authoringPath-derived relative path for the entry.
+//
+// Why this sits in handshake.e2e.test.ts (not handshake-preview.test.ts):
+//   The preview file uses a virtual fs (vi.mock('fs')), which means writes go
+//   to an in-memory map and never touch the real filesystem. This test uses a
+//   REAL tempdir — writes are verified by existsSync/readFileSync on disk —
+//   proving the full I/O contract end-to-end.
+//
+// Kernel is stubbed via vi.doMock + vi.resetModules() per the probeStarterSetupSeeded
+// pattern in handshake.test.ts.  All other modules (generators, adapters, etc.)
+// are stubbed to avoid real network calls while keeping the fs path real.
+describe('WP-426 E3 (Loop fix): runHandshake round-trip — authoringPath lands on disk, no duplicate', () => {
+    let e2eRoot;
+    let cwdSpy;
+    beforeEach(() => {
+        vi.resetModules();
+        // Real tempdir — writes actually hit the filesystem.
+        e2eRoot = mkdtempSync(join(tmpdir(), 'pb-wp426-e3-loop-'));
+        mkdirSync(join(e2eRoot, '.productbrain'), { recursive: true });
+        // Real manifest.yaml so readManifestStatus (not mocked) returns mode='project'.
+        writeFileSync(join(e2eRoot, '.productbrain', 'manifest.yaml'), ['version: "0.1"', 'materialize: project', 'surfaces:', '  - .cursor', '  - .claude', ''].join('\n'));
+        // Point process.cwd() at the tempdir so runHandshake resolves all paths there.
+        cwdSpy = vi.spyOn(process, 'cwd').mockReturnValue(e2eRoot);
+        // ── Kernel stub: returns one personal skill with authoringPath set ─────────
+        // The asset has no bodyStorageId → body-fetch loop is skipped entirely.
+        // scope: 'personal' → enters the personalAssets writeback branch.
+        // lastProjectedHash: null → no conflict check; DB writeback proceeds unconditionally.
+        vi.doMock('../lib/client.js', () => ({
+            kernelCall: vi.fn().mockImplementation(async (tool) => {
+                if (tool === 'chain.workspaceReadiness')
+                    return null;
+                if (tool === 'chain.getOrientView')
+                    return null;
+                if (tool === 'chain.searchEntries')
+                    return [];
+                if (tool === 'setup.listAssetsForUser') {
+                    return {
+                        activeAssets: [
+                            {
+                                entryId: 'SETUP-SKILL-FOO',
+                                name: 'Foo Bar',
+                                description: 'A personal skill with an explicit authoring path.',
+                                body: '# Foo Bar\nPersonal skill body.',
+                                triggers: ['foo'],
+                                assetKind: 'skill',
+                                semanticRefs: [],
+                                disabledByOwner: false,
+                                lastProjectedHash: null,
+                                scope: 'personal',
+                                authoringPath: 'skills/my-foo.md', // ← WP-426 E3 field under test
+                            },
+                        ],
+                        dormantAssets: [],
+                        hasAnyReceipt: true,
+                    };
+                }
+                if (tool === 'setup.updateLastProjectedHash')
+                    return { ok: true };
+                if (tool === 'setup.getCurrentSetupState')
+                    return { effectiveMode: 'project' };
+                if (tool === 'setup.materializeSetup')
+                    return { ok: true, assetCount: 1, receiptWritten: true };
+                // Fail-open for any other call
+                return null;
+            }),
+            kernelCallWithSession: vi.fn().mockResolvedValue(null),
+        }));
+        // ── Config: return a valid auth config ────────────────────────────────────
+        vi.doMock('../lib/config.js', () => ({
+            getConfigOrGuide: vi.fn().mockResolvedValue({
+                apiKey: 'pb_sk_e2e_test',
+                siteUrl: 'https://test.convex.site',
+            }),
+        }));
+        // ── Repo detection: minimal stub ──────────────────────────────────────────
+        vi.doMock('../lib/repo-detect.js', () => ({
+            detectRepo: vi.fn().mockReturnValue({ name: 'e2e-test-repo', detectedStack: [], repoSlug: null }),
+            extractWorkspaceProfile: vi.fn().mockReturnValue(null),
+        }));
+        // ── Generator stubs: return minimal content; no disk reads needed ─────────
+        vi.doMock('../generators/adapters.js', () => ({
+            MARKER: 'auto-generated by pb handshake',
+            generateAgentsMd: vi.fn().mockReturnValue('<!-- auto-generated by pb handshake -->\nagents'),
+            generateClaudeMd: vi.fn().mockReturnValue('<!-- auto-generated by pb handshake -->\nclaude'),
+            generateCursorMdc: vi.fn().mockReturnValue('<!-- auto-generated by pb handshake -->\ncursor'),
+            generateCopilotMd: vi.fn().mockReturnValue('<!-- auto-generated by pb handshake -->\ncopilot'),
+        }));
+        vi.doMock('../generators/portable-knowledge.js', () => ({
+            readCanonicalSkills: vi.fn().mockReturnValue([]),
+            readCanonicalRules: vi.fn().mockReturnValue([]),
+            readPersonalLayer: vi.fn().mockReturnValue([]),
+            readPersonalSkillsLayer: vi.fn().mockReturnValue([]),
+            generateCursorSkill: vi.fn().mockReturnValue(''),
+            generateCursorRule: vi.fn().mockReturnValue(''),
+            generateCodexSkill: vi.fn().mockReturnValue(''),
+            generateClaudeRule: vi.fn().mockReturnValue(''),
+            generateCodexSkillIndex: vi.fn().mockReturnValue(''),
+            generateClaudeSkillRouter: vi.fn().mockReturnValue(''),
+            shouldEmitToTarget: vi.fn().mockReturnValue(false),
+            filterByLevel: vi.fn().mockImplementation((items) => items),
+            evaluateConditions: vi.fn().mockReturnValue({ included: true, reasons: [] }),
+            validateCodexSkills: vi.fn().mockReturnValue([]),
+            STAGE_TO_MAX_LEVEL: {},
+            LEVEL_ORDER: [],
+        }));
+        vi.doMock('../generators/briefing-md.js', () => ({
+            generateBriefingMd: vi.fn().mockReturnValue('briefing content'),
+        }));
+        vi.doMock('../generators/context-md.js', () => ({
+            generateContextMd: vi.fn().mockReturnValue('context content'),
+        }));
+        vi.doMock('../generators/chain-rules.js', () => ({
+            generateChainRules: vi.fn().mockResolvedValue({ content: '', rules: [], classified: {}, stats: { generatedRules: 0, suppressedByManual: 0, suppressedByZeroEntries: 0 }, gaps: [], sentinel: null }),
+        }));
+        vi.doMock('../generators/handshake-diff.js', () => ({
+            saveHandshakeState: vi.fn(),
+            loadPreviousState: vi.fn().mockReturnValue(null),
+            diffHandshakeState: vi.fn().mockReturnValue({ added: [], updated: [], removed: [] }),
+            formatDiff: vi.fn().mockReturnValue(''),
+            buildCurrentState: vi.fn().mockReturnValue({}),
+        }));
+        vi.doMock('../generators/surface-profiles.js', () => ({
+            resolveSurfaceProfile: vi.fn().mockReturnValue({ level: 'intermediate' }),
+        }));
+        vi.doMock('../generators/boundary-manifest.js', () => ({
+            generateBoundaryManifest: vi.fn().mockReturnValue(null),
+            getBoundaryEnforcementMode: vi.fn().mockReturnValue('advisory'),
+        }));
+        vi.doMock('../formatters/handshake.js', () => ({
+            formatHandshakeReport: vi.fn().mockReturnValue(''),
+        }));
+        vi.doMock('../lib/hook-intents.js', () => ({
+            composeHooksFromIntents: vi.fn().mockReturnValue({}),
+            getHookStatusForSurface: vi.fn().mockReturnValue([]),
+        }));
+        vi.doMock('../lib/method-registry.js', () => ({
+            loadMethodRegistry: vi.fn().mockResolvedValue({ methods: [], source: 'bundled', stale: false }),
+        }));
+        vi.doMock('../lib/workspaceVocabCache.js', () => ({
+            getOrFetchVocabCtx: vi.fn().mockResolvedValue(null),
+        }));
+        vi.doMock('../lib/telemetry.js', () => ({
+            trackEvent: vi.fn(),
+        }));
+        vi.doMock('../lib/session.js', () => ({
+            readSession: vi.fn().mockReturnValue(null),
+        }));
+        vi.doMock('../lib/canonicalRefs.js', () => ({
+            parseSemanticRefs: vi.fn().mockReturnValue([]),
+            replaceVocabTokens: vi.fn().mockImplementation((content) => content),
+        }));
+        vi.doMock('../surfaces/telemetry.js', () => ({
+            getReverseMapFallbackMessage: vi.fn().mockReturnValue(''),
+            reportReverseMapMissing: vi.fn(),
+        }));
+    });
+    afterEach(() => {
+        cwdSpy.mockRestore();
+        rmSync(e2eRoot, { recursive: true, force: true });
+        vi.restoreAllMocks();
+    });
+    it('DB asset with authoringPath lands at skills/my-foo.md, not at "Foo Bar.md"', async () => {
+        // Import runHandshake fresh in the doMock module scope.
+        const { runHandshake } = await import('../commands/handshake.js');
+        // Codex P2: capture stderr to prove the raise-cleanup pass does NOT log a false
+        // warning for the .codex surface — this workspace only enables .cursor + .claude.
+        const stderrLines = [];
+        vi.spyOn(process.stderr, 'write').mockImplementation((chunk) => {
+            if (typeof chunk === 'string')
+                stderrLines.push(chunk);
+            return true;
+        });
+        // Drive the full loop: apply=true activates writeMode which enters the
+        // personalAssets authoring-file writeback branch (handshake.ts:1733–1858).
+        await runHandshake({ apply: true });
+        // ── Assertion (a): file written at the authoringPath-derived location ──────
+        const authoredPath = join(e2eRoot, '.productbrain', 'skills', 'my-foo.md');
+        expect(existsSync(authoredPath), '.productbrain/skills/my-foo.md must exist after runHandshake writes back from DB').toBe(true);
+        // ── Assertion (b): no name-derived duplicate created ──────────────────────
+        const nameDerivedPath = join(e2eRoot, '.productbrain', 'skills', 'Foo Bar.md');
+        expect(existsSync(nameDerivedPath), '.productbrain/skills/Foo Bar.md must NOT be created (authoringPath wins)').toBe(false);
+        // ── Assertion (c): .authoring-sync.json records the correct relative path ──
+        const syncPath = join(e2eRoot, '.productbrain', '.authoring-sync.json');
+        expect(existsSync(syncPath), '.authoring-sync.json must be written by the sync-state persistence step').toBe(true);
+        const syncState = JSON.parse(readFileSync(syncPath, 'utf8'));
+        expect(syncState.version).toBe(1);
+        const entry = syncState.assets['SETUP-SKILL-FOO'];
+        expect(entry, '.authoring-sync.json must contain an entry for SETUP-SKILL-FOO').toBeDefined();
+        expect(entry.path).toBe('.productbrain/skills/my-foo.md');
+        expect(entry.path, 'sync entry path must be the authoringPath-derived relative path, not the name-derived one').not.toBe('.productbrain/skills/Foo Bar.md');
+        // ── Content sanity: written file contains the entryId frontmatter ─────────
+        const written = readFileSync(authoredPath, 'utf8');
+        expect(written).toContain('id: SETUP-SKILL-FOO');
+        expect(written).toContain('# Foo Bar');
+        // ── (Codex P2): the disabled .codex surface must be skipped silently — no
+        //    false "raise-cleanup failed" / "could not dormant-mark" warning. ───────
+        const allStderr = stderrLines.join('');
+        expect(allStderr, 'no false raise-cleanup warning for the disabled .codex surface').not.toContain('raise-cleanup failed');
+        expect(allStderr).not.toContain('could not dormant-mark');
+    });
+});
+// ── WP-426 E4: lowering — .dormant rename + purge cue + authoring copy untouched ─
+//
+// Drives runHandshake() with a kernel stub that returns the Foo asset in
+// dormantAssets. Pre-places the projected surface files (with MARKER) and the
+// .productbrain authoring copy. After runHandshake({apply:true}):
+//   - .codex/skills/Foo.md.dormant  ← renamed from .codex/skills/Foo.md
+//   - .cursor/rules/Foo.mdc.dormant ← renamed from .cursor/rules/Foo.mdc
+//   - originals (.md / .mdc) are gone
+//   - .productbrain/skills/Foo.md is UNTOUCHED (deriveDormantFilePaths never returns .productbrain paths)
+//   - stdout contains the purge cue
+//
+// Manual reactivation:
+//   After the lowering run, simulate the user renaming .codex/skills/Foo.md.dormant
+//   back to .codex/skills/Foo.md. Re-run with the asset still dormant. Assert:
+//   - .codex/skills/Foo.md is untouched (no re-dormant)
+//   - a drift TEN was queued via kernelCallWithSession('chain.createEntry', …)
+describe('WP-426 E4: lowering — .dormant rename + purge cue + authoring copy untouched', () => {
+    let e2eRoot;
+    let cwdSpy;
+    let stdoutLines;
+    let kernelCallWithSessionMock;
+    // ── Shared stub factory ───────────────────────────────────────────────────
+    async function setupMocks(opts = {}) {
+        vi.resetModules();
+        e2eRoot = mkdtempSync(join(tmpdir(), 'pb-wp426-e4-lower-'));
+        mkdirSync(join(e2eRoot, '.productbrain', 'skills'), { recursive: true });
+        mkdirSync(join(e2eRoot, '.codex', 'skills'), { recursive: true });
+        mkdirSync(join(e2eRoot, '.cursor', 'rules'), { recursive: true });
+        // Real manifest.yaml — mode='project' so writeMode is active
+        writeFileSync(join(e2eRoot, '.productbrain', 'manifest.yaml'), ['version: "0.1"', 'materialize: project', 'surfaces:', '  - .codex', '  - .cursor', '  - .claude', ''].join('\n'));
+        cwdSpy = vi.spyOn(process, 'cwd').mockReturnValue(e2eRoot);
+        stdoutLines = [];
+        vi.spyOn(process.stdout, 'write').mockImplementation((chunk, ...rest) => {
+            if (typeof chunk === 'string')
+                stdoutLines.push(chunk);
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            return process.stdout.write.__originalImpl ? true : true;
+        });
+        kernelCallWithSessionMock = vi.fn().mockResolvedValue(null);
+        vi.doMock('../lib/client.js', () => ({
+            kernelCall: vi.fn().mockImplementation(async (tool) => {
+                if (tool === 'chain.workspaceReadiness')
+                    return null;
+                if (tool === 'chain.getOrientView')
+                    return null;
+                if (tool === 'chain.searchEntries')
+                    return [];
+                if (tool === 'setup.listAssetsForUser') {
+                    return {
+                        activeAssets: opts.activeAssets ?? [],
+                        dormantAssets: opts.dormantAssets ?? [
+                            {
+                                entryId: 'SETUP-SKILL-FOO',
+                                name: 'Foo',
+                                description: 'A dormant skill',
+                                body: '# Foo\nSkill body.',
+                                triggers: [],
+                                assetKind: 'skill',
+                                semanticRefs: [],
+                                disabledByOwner: false,
+                                lastProjectedHash: null,
+                            },
+                            {
+                                entryId: 'SETUP-RULE-FOO',
+                                name: 'Foo',
+                                description: 'A dormant rule',
+                                body: '# Foo\nRule body.',
+                                triggers: [],
+                                assetKind: 'rule',
+                                semanticRefs: [],
+                                disabledByOwner: false,
+                                lastProjectedHash: null,
+                            },
+                        ],
+                        hasAnyReceipt: true,
+                    };
+                }
+                if (tool === 'setup.updateLastProjectedHash')
+                    return { ok: true };
+                if (tool === 'setup.getCurrentSetupState')
+                    return { effectiveMode: 'project' };
+                if (tool === 'setup.materializeSetup')
+                    return { ok: true, assetCount: 0, receiptWritten: true };
+                return null;
+            }),
+            kernelCallWithSession: kernelCallWithSessionMock,
+        }));
+        vi.doMock('../lib/config.js', () => ({
+            getConfigOrGuide: vi.fn().mockResolvedValue({ apiKey: 'pb_sk_e2e_test', siteUrl: 'https://test.convex.site' }),
+        }));
+        vi.doMock('../lib/repo-detect.js', () => ({
+            detectRepo: vi.fn().mockReturnValue({ name: 'e2e-test-repo', detectedStack: [], repoSlug: null }),
+            extractWorkspaceProfile: vi.fn().mockReturnValue(null),
+        }));
+        vi.doMock('../generators/adapters.js', () => ({
+            MARKER: 'auto-generated by pb handshake',
+            generateAgentsMd: vi.fn().mockReturnValue('<!-- auto-generated by pb handshake -->\nagents'),
+            generateClaudeMd: vi.fn().mockReturnValue('<!-- auto-generated by pb handshake -->\nclaude'),
+            generateCursorMdc: vi.fn().mockReturnValue('<!-- auto-generated by pb handshake -->\ncursor'),
+            generateCopilotMd: vi.fn().mockReturnValue('<!-- auto-generated by pb handshake -->\ncopilot'),
+        }));
+        vi.doMock('../generators/portable-knowledge.js', () => ({
+            readCanonicalSkills: vi.fn().mockReturnValue([]),
+            readCanonicalRules: vi.fn().mockReturnValue([]),
+            readPersonalLayer: vi.fn().mockReturnValue([]),
+            readPersonalSkillsLayer: vi.fn().mockReturnValue([]),
+            generateCursorSkill: vi.fn().mockReturnValue(''),
+            generateCursorRule: vi.fn().mockReturnValue(''),
+            generateCodexSkill: vi.fn().mockReturnValue(''),
+            generateClaudeRule: vi.fn().mockReturnValue(''),
+            generateCodexSkillIndex: vi.fn().mockReturnValue(''),
+            generateClaudeSkillRouter: vi.fn().mockReturnValue(''),
+            shouldEmitToTarget: vi.fn().mockReturnValue(false),
+            filterByLevel: vi.fn().mockImplementation((items) => items),
+            evaluateConditions: vi.fn().mockReturnValue({ included: true, reasons: [] }),
+            validateCodexSkills: vi.fn().mockReturnValue([]),
+            STAGE_TO_MAX_LEVEL: {},
+            LEVEL_ORDER: [],
+        }));
+        vi.doMock('../generators/briefing-md.js', () => ({ generateBriefingMd: vi.fn().mockReturnValue('briefing') }));
+        vi.doMock('../generators/context-md.js', () => ({ generateContextMd: vi.fn().mockReturnValue('context') }));
+        vi.doMock('../generators/chain-rules.js', () => ({
+            generateChainRules: vi.fn().mockResolvedValue({ content: '', rules: [], classified: {}, stats: { generatedRules: 0, suppressedByManual: 0, suppressedByZeroEntries: 0 }, gaps: [], sentinel: null }),
+        }));
+        vi.doMock('../generators/handshake-diff.js', () => ({
+            saveHandshakeState: vi.fn(),
+            loadPreviousState: vi.fn().mockReturnValue(null),
+            diffHandshakeState: vi.fn().mockReturnValue({ added: [], updated: [], removed: [] }),
+            formatDiff: vi.fn().mockReturnValue(''),
+            buildCurrentState: vi.fn().mockReturnValue({}),
+        }));
+        vi.doMock('../generators/surface-profiles.js', () => ({
+            resolveSurfaceProfile: vi.fn().mockReturnValue({ level: 'intermediate' }),
+        }));
+        vi.doMock('../generators/boundary-manifest.js', () => ({
+            generateBoundaryManifest: vi.fn().mockReturnValue(null),
+            getBoundaryEnforcementMode: vi.fn().mockReturnValue('advisory'),
+        }));
+        vi.doMock('../formatters/handshake.js', () => ({ formatHandshakeReport: vi.fn().mockReturnValue('') }));
+        vi.doMock('../lib/hook-intents.js', () => ({
+            composeHooksFromIntents: vi.fn().mockReturnValue({}),
+            getHookStatusForSurface: vi.fn().mockReturnValue([]),
+        }));
+        vi.doMock('../lib/method-registry.js', () => ({
+            loadMethodRegistry: vi.fn().mockResolvedValue({ methods: [], source: 'bundled', stale: false }),
+        }));
+        vi.doMock('../lib/workspaceVocabCache.js', () => ({ getOrFetchVocabCtx: vi.fn().mockResolvedValue(null) }));
+        vi.doMock('../lib/telemetry.js', () => ({ trackEvent: vi.fn() }));
+        vi.doMock('../lib/session.js', () => ({
+            readSession: vi.fn().mockReturnValue({ sessionId: 'test-session-id', userId: 'test-user' }),
+        }));
+        vi.doMock('../lib/canonicalRefs.js', () => ({
+            parseSemanticRefs: vi.fn().mockReturnValue([]),
+            replaceVocabTokens: vi.fn().mockImplementation((content) => content),
+        }));
+        vi.doMock('../surfaces/telemetry.js', () => ({
+            getReverseMapFallbackMessage: vi.fn().mockReturnValue(''),
+            reportReverseMapMissing: vi.fn(),
+        }));
+    }
+    afterEach(() => {
+        cwdSpy?.mockRestore();
+        if (e2eRoot && existsSync(e2eRoot))
+            rmSync(e2eRoot, { recursive: true, force: true });
+        vi.restoreAllMocks();
+    });
+    it('E4: lowering — .dormant files created for ALL surface paths (skill + rule), originals gone, authoring copy untouched, purge cue in stdout', async () => {
+        await setupMocks();
+        // FIX 3: pre-place ALL four surface paths that deriveDormantFilePaths emits
+        // for the two dormant assets (skill "Foo" + rule "Foo"):
+        //   skill → .cursor/skills/Foo/SKILL.md  (cursor skill subdir)
+        //         + .codex/skills/Foo.md          (codex skill)
+        //   rule  → .cursor/rules/Foo.mdc         (cursor rule)
+        //         + .claude/rules/Foo.md          (claude rule)
+        mkdirSync(join(e2eRoot, '.cursor', 'skills', 'Foo'), { recursive: true });
+        mkdirSync(join(e2eRoot, '.claude', 'rules'), { recursive: true });
+        const cursorSkillPath = join(e2eRoot, '.cursor', 'skills', 'Foo', 'SKILL.md');
+        const codexSkillPath = join(e2eRoot, '.codex', 'skills', 'Foo.md');
+        const cursorRulePath = join(e2eRoot, '.cursor', 'rules', 'Foo.mdc');
+        const claudeRulePath = join(e2eRoot, '.claude', 'rules', 'Foo.md');
+        const authoringCopy = join(e2eRoot, '.productbrain', 'skills', 'Foo.md');
+        const markedContent = (label) => `<!-- auto-generated by pb handshake -->\n# Foo ${label}\n`;
+        writeFileSync(cursorSkillPath, markedContent('cursor-skill'));
+        writeFileSync(codexSkillPath, markedContent('codex-skill'));
+        writeFileSync(cursorRulePath, markedContent('cursor-rule'));
+        writeFileSync(claudeRulePath, markedContent('claude-rule'));
+        writeFileSync(authoringCopy, '---\nid: SETUP-SKILL-FOO\nname: "Foo"\n---\nHand-authored content.\n');
+        const { runHandshake } = await import('../commands/handshake.js');
+        await runHandshake({ apply: true });
+        // ── All four .dormant files must be created
+        expect(existsSync(`${cursorSkillPath}.dormant`), '.cursor/skills/Foo/SKILL.md.dormant must exist').toBe(true);
+        expect(existsSync(`${codexSkillPath}.dormant`), '.codex/skills/Foo.md.dormant must exist').toBe(true);
+        expect(existsSync(`${cursorRulePath}.dormant`), '.cursor/rules/Foo.mdc.dormant must exist').toBe(true);
+        expect(existsSync(`${claudeRulePath}.dormant`), '.claude/rules/Foo.md.dormant must exist').toBe(true);
+        // ── All four originals must be gone
+        expect(existsSync(cursorSkillPath), '.cursor/skills/Foo/SKILL.md original must be gone').toBe(false);
+        expect(existsSync(codexSkillPath), '.codex/skills/Foo.md original must be gone').toBe(false);
+        expect(existsSync(cursorRulePath), '.cursor/rules/Foo.mdc original must be gone').toBe(false);
+        expect(existsSync(claudeRulePath), '.claude/rules/Foo.md original must be gone').toBe(false);
+        // ── .productbrain authoring copy must be untouched
+        expect(existsSync(authoringCopy), '.productbrain/skills/Foo.md authoring copy must be untouched').toBe(true);
+        // ── purge cue in stdout
+        const allOutput = stdoutLines.join('');
+        expect(allOutput, 'stdout must contain the purge cue').toContain('pb setup observe --purge');
+        // ── .authoring-sync.json dormantRenamed registry must include all four surface paths
+        const syncPath = join(e2eRoot, '.productbrain', '.authoring-sync.json');
+        expect(existsSync(syncPath), '.authoring-sync.json must exist').toBe(true);
+        const syncState = JSON.parse(readFileSync(syncPath, 'utf8'));
+        expect(syncState.dormantRenamed, 'dormantRenamed must include cursor skill subdir path').toContain('.cursor/skills/Foo/SKILL.md');
+        expect(syncState.dormantRenamed, 'dormantRenamed must include codex skill path').toContain('.codex/skills/Foo.md');
+        expect(syncState.dormantRenamed, 'dormantRenamed must include cursor rule path').toContain('.cursor/rules/Foo.mdc');
+        expect(syncState.dormantRenamed, 'dormantRenamed must include claude rule path').toContain('.claude/rules/Foo.md');
+    });
+    it('E4: manual reactivation — reactivated file left untouched, drift TEN queued ONCE; N+3 run never re-dormants', async () => {
+        // FIX 2: Strengthened reactivation test.
+        // Run N+1 (detection): pre-staged state → TEN fires, path moves to dormantReactivated.
+        // Run N+2 (hands-off): path in dormantReactivated → skipped silently, file still live, NO second TEN.
+        await setupMocks();
+        const skillPath = join(e2eRoot, '.codex', 'skills', 'Foo.md');
+        // ── Pre-stage a post-lowering filesystem state:
+        //    • .codex/skills/Foo.md.dormant exists (was previously lowered)
+        //    • .productbrain/.authoring-sync.json already has the registry entry
+        //    • The user has then renamed .dormant back to .md (manual reactivation)
+        //
+        // We do NOT run a first handshake — we directly write the state that would
+        // exist after a prior lowering run. This avoids module-reset issues between
+        // two sequential runHandshake calls in the same test.
+        // .dormant file from prior lowering (user will "manually rename" it back)
+        writeFileSync(`${skillPath}.dormant`, '<!-- auto-generated by pb handshake -->\n# Foo\nSkill body.\n<!-- pb-status: dormant -->\n');
+        // Simulate user renaming .dormant → live (manual reactivation)
+        renameSync(`${skillPath}.dormant`, skillPath);
+        expect(existsSync(skillPath)).toBe(true);
+        expect(existsSync(`${skillPath}.dormant`)).toBe(false);
+        // Pre-write the .authoring-sync.json registry as if the prior lowering run had done it.
+        // Only skill path in dormantRenamed; no dormantReactivated yet.
+        const syncPath = join(e2eRoot, '.productbrain', '.authoring-sync.json');
+        writeFileSync(syncPath, JSON.stringify({
+            version: 1,
+            assets: {},
+            dormantRenamed: ['.codex/skills/Foo.md', '.cursor/rules/Foo.mdc'],
+            dormantReactivated: [],
+        }, null, 2) + '\n');
+        // Also ensure the rule .dormant is present (not manually reactivated, only the skill was)
+        mkdirSync(join(e2eRoot, '.cursor', 'rules'), { recursive: true });
+        const ruleDormantPath = join(e2eRoot, '.cursor', 'rules', 'Foo.mdc.dormant');
+        writeFileSync(ruleDormantPath, '<!-- auto-generated by pb handshake -->\n# Foo\nRule body.\n<!-- pb-status: dormant -->\n');
+        // ── Run N+1: FIRST detection of manual reactivation
+        const { runHandshake: runHandshake1 } = await import('../commands/handshake.js');
+        await runHandshake1({ apply: true });
+        // ── After N+1: reactivated file must remain live
+        expect(existsSync(skillPath), 'N+1: .codex/skills/Foo.md must remain live (user reactivated it)').toBe(true);
+        expect(existsSync(`${skillPath}.dormant`), 'N+1: .dormant must NOT be recreated for the reactivated file').toBe(false);
+        // ── After N+1: .authoring-sync.json must have path in dormantReactivated, not dormantRenamed (FIX 2a)
+        const syncState1 = JSON.parse(readFileSync(syncPath, 'utf8'));
+        expect(syncState1.dormantReactivated, 'N+1: dormantReactivated must include the reactivated skill path').toContain('.codex/skills/Foo.md');
+        expect(syncState1.dormantRenamed ?? [], 'N+1: dormantRenamed must NOT include the reactivated skill path').not.toContain('.codex/skills/Foo.md');
+        // ── After N+1: exactly one drift TEN was queued
+        const createEntryCalls1 = kernelCallWithSessionMock.mock.calls.filter((call) => call[0] === 'chain.createEntry');
+        expect(createEntryCalls1.length, 'N+1: at least one chain.createEntry call (drift TEN) must be made').toBeGreaterThan(0);
+        const driftCall1 = createEntryCalls1.find((call) => {
+            const args = call[1];
+            return (args.collectionSlug === 'tensions' &&
+                typeof args.data?.description === 'string' &&
+                args.data.description.includes('manually reactivated'));
+        });
+        expect(driftCall1, 'N+1: drift TEN for manual reactivation must be queued').toBeDefined();
+        const tenCountAfterN1 = createEntryCalls1.filter((call) => {
+            const args = call[1];
+            return (args.collectionSlug === 'tensions' &&
+                args.data.description?.includes('manually reactivated'));
+        }).length;
+        // ── Run N+2 (FIX 2b): asset still dormant, path now in dormantReactivated.
+        //    The hands-off set must prevent any re-dormant AND any second TEN.
+        vi.resetModules();
+        // Re-setup mocks for the second run (fresh module registry)
+        await setupMocks();
+        // Restore the .authoring-sync.json state that N+1 left (setupMocks creates a fresh e2eRoot, so we must
+        // re-use the same root by restoring after setupMocks overwrites it).
+        // Since setupMocks creates a new e2eRoot, we need to write the N+1 post-state into the new root.
+        // Instead, we directly write the dormantReactivated state to simulate what N+1 wrote.
+        writeFileSync(skillPath, '<!-- auto-generated by pb handshake -->\n# Foo\nSkill body.\n');
+        writeFileSync(syncPath, JSON.stringify({
+            version: 1,
+            assets: {},
+            dormantRenamed: ['.cursor/rules/Foo.mdc'], // skill moved out
+            dormantReactivated: ['.codex/skills/Foo.md'], // skill in hands-off set
+        }, null, 2) + '\n');
+        // Rule dormant still present (untouched)
+        writeFileSync(join(e2eRoot, '.cursor', 'rules', 'Foo.mdc.dormant'), '<!-- auto-generated by pb handshake -->\n# Foo\nRule body.\n<!-- pb-status: dormant -->\n');
+        const { runHandshake: runHandshake2 } = await import('../commands/handshake.js');
+        await runHandshake2({ apply: true });
+        // ── After N+2: skill file must STILL be live (not re-dormanted)
+        expect(existsSync(skillPath), 'N+2: .codex/skills/Foo.md must still be live (hands-off set)').toBe(true);
+        expect(existsSync(`${skillPath}.dormant`), 'N+2: .dormant must NOT be created on the second run').toBe(false);
+        // ── After N+2: NO new drift TEN for the already-reactivated path (TEN fires once)
+        const createEntryCalls2 = kernelCallWithSessionMock.mock.calls.filter((call) => call[0] === 'chain.createEntry');
+        const newReactivationTens = createEntryCalls2.filter((call) => {
+            const args = call[1];
+            return (args.collectionSlug === 'tensions' &&
+                args.data.description?.includes('manually reactivated'));
+        }).length;
+        expect(newReactivationTens, 'N+2: no additional reactivation TEN must be queued (hands-off set; TEN fires once)').toBe(0);
+    });
+    // Codex P2: dormant renames must honor the run's --surfaces selection, not just the
+    // perimeter. `--surfaces cursor` may only rename cursor surfaces; .claude/.codex must
+    // be left untouched even though they are declared in manifest.surfaces.
+    it('E4 (Codex P2): --surfaces cursor lowers only cursor surfaces; .claude/.codex untouched', async () => {
+        await setupMocks();
+        mkdirSync(join(e2eRoot, '.cursor', 'skills', 'Foo'), { recursive: true });
+        mkdirSync(join(e2eRoot, '.claude', 'rules'), { recursive: true });
+        const cursorSkillPath = join(e2eRoot, '.cursor', 'skills', 'Foo', 'SKILL.md');
+        const codexSkillPath = join(e2eRoot, '.codex', 'skills', 'Foo.md');
+        const cursorRulePath = join(e2eRoot, '.cursor', 'rules', 'Foo.mdc');
+        const claudeRulePath = join(e2eRoot, '.claude', 'rules', 'Foo.md');
+        const marked = (label) => `<!-- auto-generated by pb handshake -->\n# Foo ${label}\n`;
+        writeFileSync(cursorSkillPath, marked('cursor-skill'));
+        writeFileSync(codexSkillPath, marked('codex-skill'));
+        writeFileSync(cursorRulePath, marked('cursor-rule'));
+        writeFileSync(claudeRulePath, marked('claude-rule'));
+        const { runHandshake } = await import('../commands/handshake.js');
+        await runHandshake({ apply: true, surfaces: ['cursor'] });
+        // ── cursor surfaces lowered to .dormant
+        expect(existsSync(`${cursorSkillPath}.dormant`), 'cursor skill must be lowered').toBe(true);
+        expect(existsSync(`${cursorRulePath}.dormant`), 'cursor rule must be lowered').toBe(true);
+        expect(existsSync(cursorSkillPath), 'cursor skill original gone').toBe(false);
+        expect(existsSync(cursorRulePath), 'cursor rule original gone').toBe(false);
+        // ── non-requested surfaces left fully untouched (no .dormant, originals intact)
+        expect(existsSync(`${codexSkillPath}.dormant`), 'codex must NOT be lowered (--surfaces cursor)').toBe(false);
+        expect(existsSync(`${claudeRulePath}.dormant`), 'claude must NOT be lowered (--surfaces cursor)').toBe(false);
+        expect(existsSync(codexSkillPath), 'codex skill original intact').toBe(true);
+        expect(existsSync(claudeRulePath), 'claude rule original intact').toBe(true);
+    });
+});
+// ── WP-426 E4: raise — orphan .dormant removed after re-projection; drift on edited copy ─
+//
+// Drives runHandshake() with a kernel stub. The raise-cleanup pass runs in the
+// `if (writeMode)` block after the dormant pass. It iterates over active assets,
+// calls deriveDormantFilePaths, and runs restoreSurfaceFromDormant(filePath).
+//
+// restoreSurfaceFromDormant compares the EXISTING fresh projection on disk against
+// the .dormant copy. In the real flow, the write loop re-projects the surface fresh
+// before the raise pass runs. In the test, we pre-place the fresh .md to simulate
+// what the write loop does (since readCanonicalSkills returns [] in these tests, the
+// write loop doesn't write .codex/skills/*.md via the codex skill loop).
+//
+// Test structure:
+//   1. Two-pass roundtrip: lower via runHandshake (pass 1) → pre-place fresh .md →
+//      raise via runHandshake (pass 2). Assert .md exists, .dormant gone.
+//   2. Edited variant: pre-place edited .dormant + fresh .md → runHandshake →
+//      assert .dormant preserved + drift TEN queued.
+//   3. Both-registries prune: pre-place with path in both dormantRenamed AND
+//      dormantReactivated → raise → assert both pruned.
+describe('WP-426 E4: raise — orphan .dormant removed, drift on edited copy, both registries pruned', () => {
+    let e2eRoot;
+    let cwdSpy;
+    let kernelCallWithSessionMock;
+    // ── Shared mock setup factory — mirrors the E4 lowering pattern ──────────
+    async function setupRaiseMocks(opts = {}) {
+        vi.resetModules();
+        e2eRoot = mkdtempSync(join(tmpdir(), 'pb-wp426-e4-raise-'));
+        mkdirSync(join(e2eRoot, '.productbrain', 'skills'), { recursive: true });
+        mkdirSync(join(e2eRoot, '.codex', 'skills'), { recursive: true });
+        mkdirSync(join(e2eRoot, '.cursor', 'rules'), { recursive: true });
+        mkdirSync(join(e2eRoot, '.cursor', 'skills', 'Foo'), { recursive: true });
+        mkdirSync(join(e2eRoot, '.claude', 'rules'), { recursive: true });
+        // Real manifest — mode='project' so writeMode is active
+        writeFileSync(join(e2eRoot, '.productbrain', 'manifest.yaml'), ['version: "0.1"', 'materialize: project', 'surfaces:', '  - .codex', '  - .cursor', '  - .claude', ''].join('\n'));
+        cwdSpy = vi.spyOn(process, 'cwd').mockReturnValue(e2eRoot);
+        vi.spyOn(process.stdout, 'write').mockImplementation(() => true);
+        kernelCallWithSessionMock = vi.fn().mockResolvedValue(null);
+        vi.doMock('../lib/client.js', () => ({
+            kernelCall: vi.fn().mockImplementation(async (tool) => {
+                if (tool === 'chain.workspaceReadiness')
+                    return null;
+                if (tool === 'chain.getOrientView')
+                    return null;
+                if (tool === 'chain.searchEntries')
+                    return [];
+                if (tool === 'setup.listAssetsForUser') {
+                    return {
+                        activeAssets: opts.activeAssets ?? [],
+                        dormantAssets: opts.dormantAssets ?? [],
+                        hasAnyReceipt: true,
+                    };
+                }
+                if (tool === 'setup.updateLastProjectedHash')
+                    return { ok: true };
+                if (tool === 'setup.getCurrentSetupState')
+                    return { effectiveMode: 'project' };
+                if (tool === 'setup.materializeSetup')
+                    return { ok: true, assetCount: 0, receiptWritten: true };
+                return null;
+            }),
+            kernelCallWithSession: kernelCallWithSessionMock,
+        }));
+        vi.doMock('../lib/config.js', () => ({
+            getConfigOrGuide: vi.fn().mockResolvedValue({ apiKey: 'pb_sk_e2e_test', siteUrl: 'https://test.convex.site' }),
+        }));
+        vi.doMock('../lib/repo-detect.js', () => ({
+            detectRepo: vi.fn().mockReturnValue({ name: 'e2e-test-repo', detectedStack: [], repoSlug: null }),
+            extractWorkspaceProfile: vi.fn().mockReturnValue(null),
+        }));
+        vi.doMock('../generators/adapters.js', () => ({
+            MARKER: 'auto-generated by pb handshake',
+            generateAgentsMd: vi.fn().mockReturnValue('<!-- auto-generated by pb handshake -->\nagents'),
+            generateClaudeMd: vi.fn().mockReturnValue('<!-- auto-generated by pb handshake -->\nclaude'),
+            generateCursorMdc: vi.fn().mockReturnValue('<!-- auto-generated by pb handshake -->\ncursor'),
+            generateCopilotMd: vi.fn().mockReturnValue('<!-- auto-generated by pb handshake -->\ncopilot'),
+        }));
+        vi.doMock('../generators/portable-knowledge.js', () => ({
+            readCanonicalSkills: vi.fn().mockReturnValue([]),
+            readCanonicalRules: vi.fn().mockReturnValue([]),
+            readPersonalLayer: vi.fn().mockReturnValue([]),
+            readPersonalSkillsLayer: vi.fn().mockReturnValue([]),
+            generateCursorSkill: vi.fn().mockReturnValue(''),
+            generateCursorRule: vi.fn().mockReturnValue(''),
+            generateCodexSkill: vi.fn().mockReturnValue(''),
+            generateClaudeRule: vi.fn().mockReturnValue(''),
+            generateCodexSkillIndex: vi.fn().mockReturnValue(''),
+            generateClaudeSkillRouter: vi.fn().mockReturnValue(''),
+            shouldEmitToTarget: vi.fn().mockReturnValue(false),
+            filterByLevel: vi.fn().mockImplementation((items) => items),
+            evaluateConditions: vi.fn().mockReturnValue({ included: true, reasons: [] }),
+            validateCodexSkills: vi.fn().mockReturnValue([]),
+            STAGE_TO_MAX_LEVEL: {},
+            LEVEL_ORDER: [],
+        }));
+        vi.doMock('../generators/briefing-md.js', () => ({ generateBriefingMd: vi.fn().mockReturnValue('briefing') }));
+        vi.doMock('../generators/context-md.js', () => ({ generateContextMd: vi.fn().mockReturnValue('context') }));
+        vi.doMock('../generators/chain-rules.js', () => ({
+            generateChainRules: vi.fn().mockResolvedValue({ content: '', rules: [], classified: {}, stats: { generatedRules: 0, suppressedByManual: 0, suppressedByZeroEntries: 0 }, gaps: [], sentinel: null }),
+        }));
+        vi.doMock('../generators/handshake-diff.js', () => ({
+            saveHandshakeState: vi.fn(),
+            loadPreviousState: vi.fn().mockReturnValue(null),
+            diffHandshakeState: vi.fn().mockReturnValue({ added: [], updated: [], removed: [] }),
+            formatDiff: vi.fn().mockReturnValue(''),
+            buildCurrentState: vi.fn().mockReturnValue({}),
+        }));
+        vi.doMock('../generators/surface-profiles.js', () => ({
+            resolveSurfaceProfile: vi.fn().mockReturnValue({ level: 'intermediate' }),
+        }));
+        vi.doMock('../generators/boundary-manifest.js', () => ({
+            generateBoundaryManifest: vi.fn().mockReturnValue(null),
+            getBoundaryEnforcementMode: vi.fn().mockReturnValue('advisory'),
+        }));
+        vi.doMock('../formatters/handshake.js', () => ({ formatHandshakeReport: vi.fn().mockReturnValue('') }));
+        vi.doMock('../lib/hook-intents.js', () => ({
+            composeHooksFromIntents: vi.fn().mockReturnValue({}),
+            getHookStatusForSurface: vi.fn().mockReturnValue([]),
+        }));
+        vi.doMock('../lib/method-registry.js', () => ({
+            loadMethodRegistry: vi.fn().mockResolvedValue({ methods: [], source: 'bundled', stale: false }),
+        }));
+        vi.doMock('../lib/workspaceVocabCache.js', () => ({ getOrFetchVocabCtx: vi.fn().mockResolvedValue(null) }));
+        vi.doMock('../lib/telemetry.js', () => ({ trackEvent: vi.fn() }));
+        vi.doMock('../lib/session.js', () => ({
+            readSession: vi.fn().mockReturnValue({ sessionId: 'test-session-id', userId: 'test-user' }),
+        }));
+        vi.doMock('../lib/canonicalRefs.js', () => ({
+            parseSemanticRefs: vi.fn().mockReturnValue([]),
+            replaceVocabTokens: vi.fn().mockImplementation((content) => content),
+        }));
+        vi.doMock('../surfaces/telemetry.js', () => ({
+            getReverseMapFallbackMessage: vi.fn().mockReturnValue(''),
+            reportReverseMapMissing: vi.fn(),
+        }));
+    }
+    afterEach(() => {
+        cwdSpy?.mockRestore();
+        if (e2eRoot && existsSync(e2eRoot))
+            rmSync(e2eRoot, { recursive: true, force: true });
+        vi.restoreAllMocks();
+    });
+    it('E4: raise roundtrip — lower via runHandshake, then raise via runHandshake; .md exists, .dormant gone, registries pruned', async () => {
+        // ── Pass 1: lower — asset in dormantAssets → .dormant rename
+        await setupRaiseMocks({
+            dormantAssets: [{
+                    entryId: 'SETUP-SKILL-FOO',
+                    name: 'Foo',
+                    description: 'A skill',
+                    body: '# Foo\nSkill body.',
+                    triggers: [],
+                    assetKind: 'skill',
+                    semanticRefs: [],
+                    disabledByOwner: false,
+                    lastProjectedHash: null,
+                }],
+            activeAssets: [],
+        });
+        const codexSkillPath = join(e2eRoot, '.codex', 'skills', 'Foo.md');
+        const syncPath = join(e2eRoot, '.productbrain', '.authoring-sync.json');
+        // Pre-place the surface file with MARKER so the lowering pass can rename it
+        writeFileSync(codexSkillPath, '<!-- auto-generated by pb handshake -->\n# Foo\nSkill body.\n');
+        const { runHandshake: runLower } = await import('../commands/handshake.js');
+        await runLower({ apply: true });
+        // Verify lowering worked: .dormant exists, original gone, registry updated
+        expect(existsSync(`${codexSkillPath}.dormant`), 'after lower: .dormant must exist').toBe(true);
+        expect(existsSync(codexSkillPath), 'after lower: original must be gone').toBe(false);
+        const syncAfterLower = JSON.parse(readFileSync(syncPath, 'utf8'));
+        expect(syncAfterLower.dormantRenamed).toContain('.codex/skills/Foo.md');
+        // ── Pass 2: raise — asset back in activeAssets; fresh .md pre-placed to simulate write loop
+        vi.resetModules();
+        const savedRoot = e2eRoot; // preserve before setupRaiseMocks might reset
+        await setupRaiseMocks({
+            activeAssets: [{
+                    entryId: 'SETUP-SKILL-FOO',
+                    name: 'Foo',
+                    description: 'A skill',
+                    body: '# Foo\nSkill body.',
+                    triggers: [],
+                    assetKind: 'skill',
+                    semanticRefs: [],
+                    disabledByOwner: false,
+                    lastProjectedHash: null,
+                    scope: 'personal',
+                }],
+            dormantAssets: [],
+        });
+        // setupRaiseMocks creates a new e2eRoot — restore the saved root so we test
+        // against the lowered FS state from pass 1.
+        rmSync(e2eRoot, { recursive: true, force: true });
+        e2eRoot = savedRoot;
+        cwdSpy.mockReturnValue(e2eRoot);
+        // Simulate what the write loop does: re-project the surface fresh.
+        // (The codex skill loop doesn't write .codex/skills/*.md in test env because
+        // readCanonicalSkills returns []; pre-placing it models the real write-loop output.)
+        writeFileSync(codexSkillPath, '<!-- auto-generated by pb handshake -->\n# Foo\nSkill body.\n');
+        const { runHandshake: runRaise } = await import('../commands/handshake.js');
+        await runRaise({ apply: true });
+        // ── .md exists, .dormant gone
+        expect(existsSync(codexSkillPath), 'after raise: .codex/skills/Foo.md must exist').toBe(true);
+        expect(existsSync(`${codexSkillPath}.dormant`), 'after raise: .dormant must be gone').toBe(false);
+        // ── dormantRenamed pruned
+        const syncAfterRaise = JSON.parse(readFileSync(syncPath, 'utf8'));
+        expect(syncAfterRaise.dormantRenamed ?? [], 'dormantRenamed must not contain the raised path').not.toContain('.codex/skills/Foo.md');
+        expect(syncAfterRaise.dormantReactivated ?? [], 'dormantReactivated must not contain the raised path').not.toContain('.codex/skills/Foo.md');
+    });
+    it('E4: raise with edited .dormant — .dormant preserved and drift TEN queued', async () => {
+        // Pre-place state: fresh .md + edited .dormant (bodies differ) → orphan-drift.
+        await setupRaiseMocks({
+            activeAssets: [{
+                    entryId: 'SETUP-SKILL-FOO',
+                    name: 'Foo',
+                    description: 'A skill',
+                    body: '# Foo\nSkill body.',
+                    triggers: [],
+                    assetKind: 'skill',
+                    semanticRefs: [],
+                    disabledByOwner: false,
+                    lastProjectedHash: null,
+                    scope: 'personal',
+                }],
+            dormantAssets: [],
+        });
+        const codexSkillPath = join(e2eRoot, '.codex', 'skills', 'Foo.md');
+        const syncPath = join(e2eRoot, '.productbrain', '.authoring-sync.json');
+        // Fresh .md (simulates write loop output)
+        writeFileSync(codexSkillPath, '<!-- auto-generated by pb handshake -->\n# Foo\nSkill body.\n');
+        // Edited .dormant — body differs from fresh → restoreSurfaceFromDormant returns 'orphan-drift'
+        writeFileSync(`${codexSkillPath}.dormant`, '<!-- auto-generated by pb handshake -->\n# Foo\nUSER EDITED CONTENT HERE.\n<!-- pb-status: dormant -->\n');
+        // Registry shows this path was previously lowered
+        writeFileSync(syncPath, JSON.stringify({
+            version: 1, assets: {}, dormantRenamed: ['.codex/skills/Foo.md'], dormantReactivated: [],
+        }, null, 2) + '\n');
+        const { runHandshake } = await import('../commands/handshake.js');
+        await runHandshake({ apply: true });
+        // .md still exists (write loop placed it; raise-cleanup doesn't remove it)
+        expect(existsSync(codexSkillPath), 'edited variant: .md must exist').toBe(true);
+        // .dormant preserved (body differs → orphan-drift)
+        expect(existsSync(`${codexSkillPath}.dormant`), 'edited variant: edited .dormant must be preserved').toBe(true);
+        // drift TEN queued
+        const driftCalls = kernelCallWithSessionMock.mock.calls.filter((call) => {
+            const args = call[1];
+            return (call[0] === 'chain.createEntry' &&
+                args.collectionSlug === 'tensions' &&
+                typeof args.data?.description === 'string' &&
+                args.data.description.includes('edited while dormant'));
+        });
+        expect(driftCalls.length, 'edited variant: drift TEN must be queued').toBeGreaterThan(0);
+    });
+    it('E4: raise also prunes dormantReactivated registry (carry-over obligation)', async () => {
+        // Pre-place fresh .md + matching .dormant (bodies match) + path in BOTH registries.
+        // After raise: .dormant removed, BOTH entries pruned.
+        await setupRaiseMocks({
+            activeAssets: [{
+                    entryId: 'SETUP-SKILL-FOO',
+                    name: 'Foo',
+                    description: 'A skill',
+                    body: '# Foo\nSkill body.',
+                    triggers: [],
+                    assetKind: 'skill',
+                    semanticRefs: [],
+                    disabledByOwner: false,
+                    lastProjectedHash: null,
+                    scope: 'personal',
+                }],
+            dormantAssets: [],
+        });
+        const codexSkillPath = join(e2eRoot, '.codex', 'skills', 'Foo.md');
+        const syncPath = join(e2eRoot, '.productbrain', '.authoring-sync.json');
+        // Fresh .md (simulates write loop output)
+        writeFileSync(codexSkillPath, '<!-- auto-generated by pb handshake -->\n# Foo\nSkill body.\n');
+        // Matching .dormant (bodies match after stripping DORMANT_MARKER)
+        writeFileSync(`${codexSkillPath}.dormant`, '<!-- auto-generated by pb handshake -->\n# Foo\nSkill body.\n<!-- pb-status: dormant -->\n');
+        // Registry: path in BOTH dormantRenamed AND dormantReactivated
+        writeFileSync(syncPath, JSON.stringify({
+            version: 1, assets: {},
+            dormantRenamed: ['.codex/skills/Foo.md'],
+            dormantReactivated: ['.codex/skills/Foo.md'],
+        }, null, 2) + '\n');
+        const { runHandshake } = await import('../commands/handshake.js');
+        await runHandshake({ apply: true });
+        // .dormant removed (bodies match)
+        expect(existsSync(`${codexSkillPath}.dormant`), 'carry-over: .dormant must be removed on raise').toBe(false);
+        // BOTH registries pruned
+        const syncAfterRaise = JSON.parse(readFileSync(syncPath, 'utf8'));
+        expect(syncAfterRaise.dormantRenamed ?? [], 'carry-over: dormantRenamed must be pruned').not.toContain('.codex/skills/Foo.md');
+        expect(syncAfterRaise.dormantReactivated ?? [], 'carry-over: dormantReactivated must be pruned').not.toContain('.codex/skills/Foo.md');
+    });
+    // Codex P1: registry pruning must happen for ANY active asset on raise — even when no
+    // .dormant sibling exists this run. A surface that was manually reactivated earlier leaves
+    // no .dormant (restoreSurfaceFromDormant → 'skipped'), but its path lingers in
+    // dormantReactivated. The old code only pruned on 'restored', so the hands-off entry was
+    // permanent and a future lowering could never re-dormant the surface. The fix prunes
+    // unconditionally for active assets.
+    it('E4 (Codex P1): raise prunes dormantReactivated even when no .dormant sibling exists', async () => {
+        await setupRaiseMocks({
+            activeAssets: [{
+                    entryId: 'SETUP-RULE-FOO',
+                    name: 'Foo',
+                    description: 'An active rule that was manually reactivated earlier (no .dormant left)',
+                    body: '# Foo\nRule body.',
+                    triggers: [],
+                    assetKind: 'rule',
+                    semanticRefs: [],
+                    disabledByOwner: false,
+                    lastProjectedHash: null,
+                    scope: 'personal',
+                }],
+            dormantAssets: [],
+        });
+        const cursorRulePath = join(e2eRoot, '.cursor', 'rules', 'Foo.mdc');
+        const claudeRulePath = join(e2eRoot, '.claude', 'rules', 'Foo.md');
+        const syncPath = join(e2eRoot, '.productbrain', '.authoring-sync.json');
+        // Live files present (asset is active + re-projected), but NO .dormant siblings:
+        // the user manually reactivated earlier, so restoreSurfaceFromDormant returns 'skipped'.
+        writeFileSync(cursorRulePath, '<!-- auto-generated by pb handshake -->\n# Foo\nRule body.\n');
+        writeFileSync(claudeRulePath, '<!-- auto-generated by pb handshake -->\n# Foo\nRule body.\n');
+        expect(existsSync(`${cursorRulePath}.dormant`), 'setup: cursor .dormant must be absent').toBe(false);
+        expect(existsSync(`${claudeRulePath}.dormant`), 'setup: claude .dormant must be absent').toBe(false);
+        // Registry still lists both paths in the hands-off set from the earlier reactivation.
+        writeFileSync(syncPath, JSON.stringify({
+            version: 1, assets: {},
+            dormantRenamed: [],
+            dormantReactivated: ['.cursor/rules/Foo.mdc', '.claude/rules/Foo.md'],
+        }, null, 2) + '\n');
+        const { runHandshake } = await import('../commands/handshake.js');
+        await runHandshake({ apply: true });
+        // The hands-off entries must be pruned even though no .dormant existed this run,
+        // so a future lowering can re-dormant the surface again.
+        const syncAfterRaise = JSON.parse(readFileSync(syncPath, 'utf8'));
+        expect(syncAfterRaise.dormantReactivated ?? [], 'cursor path must be pruned from dormantReactivated').not.toContain('.cursor/rules/Foo.mdc');
+        expect(syncAfterRaise.dormantReactivated ?? [], 'claude path must be pruned from dormantReactivated').not.toContain('.claude/rules/Foo.md');
+    });
+    // WP-426 E4 Domain Expert fix: surface-filtered raise must NOT false-flag orphan-drift
+    //
+    // Simulates a raise where the cursor surface was NOT written this run (e.g. --surfaces codex).
+    // The cursor .dormant file exists from a prior lowering, but the cursor live .md was never
+    // written back by the write loop. The raise-cleanup pass must NOT treat the absent live file
+    // as evidence of a user edit → must NOT queue an 'edited while dormant' drift TEN.
+    //
+    // Implementation: we do NOT pre-place the cursor live file, simulating a surface-filtered run
+    // where the cursor loop was skipped. The codex surface IS written (pre-placed) so a full-surface
+    // raise would succeed for codex; only cursor is left absent.
+    it('E4: surface-filtered raise — absent live file skips, no false orphan-drift TEN, .dormant preserved', async () => {
+        await setupRaiseMocks({
+            activeAssets: [{
+                    entryId: 'SETUP-RULE-FOO',
+                    name: 'Foo',
+                    description: 'A rule that is active but cursor surface was not written this run',
+                    body: '# Foo\nRule body.',
+                    triggers: [],
+                    assetKind: 'rule',
+                    semanticRefs: [],
+                    disabledByOwner: false,
+                    lastProjectedHash: null,
+                    scope: 'personal',
+                }],
+            dormantAssets: [],
+        });
+        // Cursor rule path — corresponds to deriveDormantFilePaths for assetKind:'rule'
+        const cursorRulePath = join(e2eRoot, '.cursor', 'rules', 'Foo.mdc');
+        const claudeRulePath = join(e2eRoot, '.claude', 'rules', 'Foo.md');
+        const syncPath = join(e2eRoot, '.productbrain', '.authoring-sync.json');
+        // ── Pre-place state simulating a prior lowering that created .dormant files
+        //    for both cursor and claude, then a surface-filtered raise where neither
+        //    live file was written back by the write loop (both are absent).
+        writeFileSync(`${cursorRulePath}.dormant`, '<!-- auto-generated by pb handshake -->\n# Foo\nRule body.\n<!-- pb-status: dormant -->\n');
+        writeFileSync(`${claudeRulePath}.dormant`, '<!-- auto-generated by pb handshake -->\n# Foo\nRule body.\n<!-- pb-status: dormant -->\n');
+        // Registry shows both paths were previously lowered
+        writeFileSync(syncPath, JSON.stringify({
+            version: 1, assets: {},
+            dormantRenamed: ['.cursor/rules/Foo.mdc', '.claude/rules/Foo.md'],
+            dormantReactivated: [],
+        }, null, 2) + '\n');
+        // Crucially: neither cursorRulePath nor claudeRulePath is pre-placed (surface-filtered run)
+        expect(existsSync(cursorRulePath), 'setup: cursor live file must be absent').toBe(false);
+        expect(existsSync(claudeRulePath), 'setup: claude live file must be absent').toBe(false);
+        const { runHandshake } = await import('../commands/handshake.js');
+        await runHandshake({ apply: true });
+        // ── (a) .dormant files must still be present (not cleaned up for absent live files)
+        expect(existsSync(`${cursorRulePath}.dormant`), 'surface-filtered: cursor .dormant must be preserved').toBe(true);
+        expect(existsSync(`${claudeRulePath}.dormant`), 'surface-filtered: claude .dormant must be preserved').toBe(true);
+        // ── (b) NO 'edited while dormant' drift TEN must have been queued
+        const driftCalls = kernelCallWithSessionMock.mock.calls.filter((call) => {
+            const args = call[1];
+            return (call[0] === 'chain.createEntry' &&
+                args.collectionSlug === 'tensions' &&
+                typeof args.data?.description === 'string' &&
+                args.data.description.includes('edited while dormant'));
+        });
+        expect(driftCalls.length, 'surface-filtered: no false orphan-drift TEN must be queued').toBe(0);
+        // ── (c) no orphan-drift for the absent cursor / claude surface paths
+        //    (verified by the absence of drift TEN calls above; belt-and-suspenders check)
+        expect(existsSync(cursorRulePath), 'surface-filtered: cursor live file must remain absent').toBe(false);
+        expect(existsSync(claudeRulePath), 'surface-filtered: claude live file must remain absent').toBe(false);
+        // ── (d) Codex P2: because the .dormant files still exist (restore skipped, no fresh
+        //    live file), the dormantRenamed registry evidence must be KEPT — not pruned — so a
+        //    later manual .dormant→live reactivation is still recognized as previouslyRenamed.
+        const syncAfterRaise = JSON.parse(readFileSync(syncPath, 'utf8'));
+        expect(syncAfterRaise.dormantRenamed ?? [], 'surface-filtered: cursor registry evidence must be kept').toContain('.cursor/rules/Foo.mdc');
+        expect(syncAfterRaise.dormantRenamed ?? [], 'surface-filtered: claude registry evidence must be kept').toContain('.claude/rules/Foo.md');
+    });
+});
+//# sourceMappingURL=handshake.e2e.test.js.map