amalgm 0.1.245 → 0.1.246

package/runtime/scripts/amalgm-mcp/tests/workspace-transition.test.js

@@ -1,1446 +0,0 @@
-'use strict';
-
-const test = require('node:test');
-const assert = require('node:assert/strict');
-const fs = require('fs');
-const os = require('os');
-const path = require('path');
-const { execFile, spawn } = require('child_process');
-const { promisify } = require('util');
-
-const execFileAsync = promisify(execFile);
-const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'amalgm-transition-test-'));
-process.env.AMALGM_DIR = path.join(tempRoot, '.amalgm');
-
-const {
-  TransitionError,
-  applyFiles,
-  applyGitMetadataTransaction,
-  branchReceiptCrossed,
-  crossedFileReceiptPaths,
-  ensureEmptyIndex,
-  gitMetadataReceiptCrossed,
-  moveHeadToCard,
-  recoverFileTransactions,
-  recoverGitMetadataTransactions,
-  releaseBranchReceipt,
-  releaseFileReceipts,
-  releaseGitMetadataReceipts,
-  updateBranchRefs,
-} = require('../workspace/transition');
-const { captureCheckpoint, captureWorktreeDiff } = require('../workspace/git');
-
-test.after(() => {
-  fs.rmSync(tempRoot, { recursive: true, force: true });
-});
-
-async function git(cwd, ...args) {
-  const { stdout } = await execFileAsync('git', [
-    '-c', 'user.email=test@amalgm.test',
-    '-c', 'user.name=Amalgm Test',
-    '-c', 'commit.gpgsign=false',
-    ...args,
-  ], {
-    cwd,
-    env: { ...process.env, GIT_TERMINAL_PROMPT: '0', LC_ALL: 'C' },
-  });
-  return stdout.trim();
-}
-
-async function makeRepo(name) {
-  const repo = path.join(tempRoot, name);
-  fs.mkdirSync(repo, { recursive: true });
-  await git(repo, 'init', '-b', 'main');
-  fs.writeFileSync(path.join(repo, 'file.txt'), 'one\n');
-  await git(repo, 'add', '.');
-  await git(repo, 'commit', '-m', 'one');
-  const first = await git(repo, 'rev-parse', 'HEAD');
-  fs.writeFileSync(path.join(repo, 'file.txt'), 'two\n');
-  await git(repo, 'commit', '-am', 'two');
-  const second = await git(repo, 'rev-parse', 'HEAD');
-  fs.writeFileSync(path.join(repo, 'file.txt'), 'three\n');
-  await git(repo, 'commit', '-am', 'three');
-  const third = await git(repo, 'rev-parse', 'HEAD');
-  return { repo, first, second, third };
-}
-
-async function branch(repo, name) {
-  try {
-    return await git(repo, 'rev-parse', '--verify', `refs/heads/${name}`);
-  } catch {
-    return null;
-  }
-}
-
-async function gitPath(repo, relativePath) {
-  const value = await git(repo, 'rev-parse', '--git-path', relativePath);
-  return path.isAbsolute(value) ? value : path.resolve(repo, value);
-}
-
-function replaceThroughLock(file, content) {
-  const lock = `${file}.lock`;
-  fs.writeFileSync(lock, content);
-  fs.renameSync(lock, file);
-}
-
-function delayedNode(source) {
-  const child = spawn(process.execPath, ['-e', source], {
-    stdio: ['ignore', 'pipe', 'pipe'],
-  });
-  return {
-    child,
-    done: new Promise((resolve, reject) => {
-      let stderr = '';
-      child.stderr.on('data', (chunk) => { stderr += chunk; });
-      child.once('error', reject);
-      child.once('exit', (code, signal) => {
-        if (code === 0) resolve();
-        else reject(new Error(`delayed test writer exited ${code || signal}: ${stderr}`));
-      });
-    }),
-  };
-}
-
-test('branch creates, updates, and deletes land in one expected-old transaction', async () => {
-  const { repo, first, second, third } = await makeRepo('atomic');
-  await git(repo, 'branch', 'move-me', first);
-  await git(repo, 'branch', 'delete-me', second);
-
-  await updateBranchRefs(repo, [
-    { branch: 'create-me', expectedOid: null, oid: third },
-    { branch: 'move-me', expectedOid: first, oid: second },
-    { branch: 'delete-me', expectedOid: second, oid: null },
-  ]);
-
-  assert.equal(await branch(repo, 'create-me'), third);
-  assert.equal(await branch(repo, 'move-me'), second);
-  assert.equal(await branch(repo, 'delete-me'), null);
-});
-
-test('branch deletion excludes a concurrent HEAD attachment with Git own lock', async () => {
-  const { repo, first } = await makeRepo('branch-delete-head-guard');
-  await git(repo, 'branch', 'delete-me', first);
-  const transitionFile = path.resolve(__dirname, '../workspace/transition.js');
-  await updateBranchRefs(
-    repo,
-    [{ branch: 'delete-me', expectedOid: first, oid: null }],
-    null,
-    {
-      afterHeadGuard: async () => {
-        const recoverSource = `
-          process.env.AMALGM_DIR = ${JSON.stringify(process.env.AMALGM_DIR)};
-          require(${JSON.stringify(transitionFile)})
-            .recoverGitMetadataTransactions(${JSON.stringify(repo)});
-        `;
-        await assert.rejects(
-          execFileAsync(process.execPath, ['-e', recoverSource]),
-          (error) => /guard owner \d+ is still active/.test(String(error.stderr)),
-        );
-        await assert.rejects(
-          git(repo, 'symbolic-ref', 'HEAD', 'refs/heads/delete-me'),
-          /HEAD\.lock|cannot lock ref 'HEAD'/,
-        );
-      },
-    },
-  );
-  assert.equal(await git(repo, 'symbolic-ref', '--short', 'HEAD'), 'main');
-  assert.equal(await branch(repo, 'delete-me'), null);
-  assert.equal(fs.existsSync(`${await gitPath(repo, 'HEAD')}.lock`), false);
-});
-
-test('branch deletion refuses the branch currently named by HEAD', async () => {
-  const { repo, third } = await makeRepo('branch-delete-current-head');
-  await assert.rejects(
-    updateBranchRefs(repo, [
-      { branch: 'main', expectedOid: third, oid: null },
-    ]),
-    (error) => (
-      error instanceof TransitionError
-      && error.action === 'guard-branch-delete'
-    ),
-  );
-  assert.equal(await git(repo, 'symbolic-ref', '--short', 'HEAD'), 'main');
-  assert.equal(await branch(repo, 'main'), third);
-});
-
-test('branch deletion refuses a branch checked out in a linked worktree', async () => {
-  const { repo, first } = await makeRepo('branch-delete-linked-head');
-  await git(repo, 'branch', 'delete-me', first);
-  const linked = path.join(tempRoot, 'branch-delete-linked-head-peer');
-  await git(repo, 'worktree', 'add', linked, 'delete-me');
-  await assert.rejects(
-    updateBranchRefs(repo, [
-      { branch: 'delete-me', expectedOid: first, oid: null },
-    ]),
-    (error) => (
-      error instanceof TransitionError
-      && error.action === 'guard-branch-delete'
-    ),
-  );
-  assert.equal(await git(linked, 'symbolic-ref', '--short', 'HEAD'), 'delete-me');
-  assert.equal(await branch(repo, 'delete-me'), first);
-});
-
-test('linked worktree HEAD cannot enter a branch deletion transaction', async () => {
-  const { repo, first } = await makeRepo('branch-delete-linked-race');
-  await git(repo, 'branch', 'delete-me', first);
-  const linked = path.join(tempRoot, 'branch-delete-linked-race-peer');
-  await git(repo, 'worktree', 'add', '-b', 'peer', linked, first);
-  await updateBranchRefs(
-    repo,
-    [{ branch: 'delete-me', expectedOid: first, oid: null }],
-    null,
-    {
-      afterHeadGuard: async () => {
-        await assert.rejects(
-          git(linked, 'symbolic-ref', 'HEAD', 'refs/heads/delete-me'),
-          /HEAD\.lock|cannot lock ref 'HEAD'/,
-        );
-      },
-    },
-  );
-  assert.equal(await git(linked, 'symbolic-ref', '--short', 'HEAD'), 'peer');
-  assert.equal(await branch(repo, 'delete-me'), null);
-  assert.equal(fs.existsSync(`${await gitPath(linked, 'HEAD')}.lock`), false);
-});
-
-test('a temporarily missing linked checkout still has its registered HEAD guarded', async () => {
-  const { repo, first } = await makeRepo('branch-delete-missing-linked-race');
-  await git(repo, 'branch', 'delete-me', first);
-  const linked = path.join(tempRoot, 'branch-delete-missing-linked-race-peer');
-  const displaced = `${linked}-displaced`;
-  await git(repo, 'worktree', 'add', '-b', 'peer', linked, first);
-  fs.renameSync(linked, displaced);
-
-  await updateBranchRefs(
-    repo,
-    [{ branch: 'delete-me', expectedOid: first, oid: null }],
-    null,
-    {
-      afterHeadGuard: async () => {
-        fs.renameSync(displaced, linked);
-        await assert.rejects(
-          git(linked, 'symbolic-ref', 'HEAD', 'refs/heads/delete-me'),
-          /HEAD\.lock|cannot lock ref 'HEAD'/,
-        );
-      },
-    },
-  );
-
-  assert.equal(await git(linked, 'symbolic-ref', '--short', 'HEAD'), 'peer');
-  assert.equal(await branch(repo, 'delete-me'), null);
-});
-
-test('a newly registered worktree invalidates the sealed deletion namespace', async () => {
-  const { repo, first } = await makeRepo('branch-delete-new-worktree-race');
-  await git(repo, 'branch', 'delete-me', first);
-  const linked = path.join(tempRoot, 'branch-delete-new-worktree-race-peer');
-  await assert.rejects(
-    updateBranchRefs(
-      repo,
-      [{ branch: 'delete-me', expectedOid: first, oid: null }],
-      null,
-      {
-        afterHeadGuard: () => git(repo, 'worktree', 'add', linked, 'delete-me'),
-      },
-    ),
-    (error) => (
-      error instanceof TransitionError
-      && error.action === 'guard-git-worktree-namespace'
-    ),
-  );
-  assert.equal(await git(linked, 'symbolic-ref', '--short', 'HEAD'), 'delete-me');
-  assert.equal(await branch(repo, 'delete-me'), first);
-  assert.equal(fs.statSync(await gitPath(repo, 'worktrees')).isDirectory(), true);
-});
-
-test('remove and re-add under one worktree name invalidates deletion', async () => {
-  const { repo, first } = await makeRepo('branch-delete-worktree-registration-replace');
-  await git(repo, 'branch', 'delete-me', first);
-  const peer = path.join(tempRoot, 'branch-delete-worktree-registration-replace-peer');
-  const stable = path.join(tempRoot, 'branch-delete-worktree-registration-replace-stable');
-  await git(repo, 'worktree', 'add', '-b', 'peer', peer, first);
-  await git(repo, 'worktree', 'add', '-b', 'stable', stable, first);
-  let enteredGuardedTransaction = false;
-
-  await assert.rejects(
-    updateBranchRefs(
-      repo,
-      [{ branch: 'delete-me', expectedOid: first, oid: null }],
-      null,
-      {
-        afterHeadGuard: async () => {
-          await git(repo, 'worktree', 'remove', '--force', peer);
-          await git(repo, 'worktree', 'add', peer, 'delete-me');
-        },
-        afterWorktreeNamespaceGuard: () => {
-          enteredGuardedTransaction = true;
-        },
-      },
-    ),
-  );
-
-  assert.equal(enteredGuardedTransaction, false);
-  assert.equal(await branch(repo, 'delete-me'), first);
-  assert.equal(await git(peer, 'symbolic-ref', '--short', 'HEAD'), 'delete-me');
-  assert.equal(fs.statSync(await gitPath(repo, 'worktrees')).isDirectory(), true);
-});
-
-test('same-membership worktree namespace replacement invalidates deletion', async () => {
-  const { repo, first } = await makeRepo('branch-delete-worktree-namespace-replace');
-  await git(repo, 'branch', 'delete-me', first);
-  const worktrees = await gitPath(repo, 'worktrees');
-  const displaced = `${worktrees}.before-test`;
-  await assert.rejects(
-    updateBranchRefs(
-      repo,
-      [{ branch: 'delete-me', expectedOid: first, oid: null }],
-      null,
-      {
-        afterHeadGuard: () => {
-          fs.renameSync(worktrees, displaced);
-          fs.mkdirSync(worktrees);
-        },
-      },
-    ),
-    (error) => (
-      error instanceof TransitionError
-      && error.action === 'guard-git-worktree-namespace'
-    ),
-  );
-  assert.equal(await branch(repo, 'delete-me'), first);
-  fs.rmdirSync(worktrees);
-  fs.renameSync(displaced, worktrees);
-});
-
-test('the guarded worktree namespace rejects a new linked worktree', async () => {
-  const { repo, first } = await makeRepo('branch-delete-worktree-namespace');
-  await git(repo, 'branch', 'delete-me', first);
-  const linked = path.join(tempRoot, 'branch-delete-worktree-namespace-peer');
-  const transitionFile = path.resolve(__dirname, '../workspace/transition.js');
-  await updateBranchRefs(
-    repo,
-    [{ branch: 'delete-me', expectedOid: first, oid: null }],
-    null,
-    {
-      afterWorktreeNamespaceGuard: async () => {
-        const recoverSource = `
-          process.env.AMALGM_DIR = ${JSON.stringify(process.env.AMALGM_DIR)};
-          require(${JSON.stringify(transitionFile)})
-            .recoverGitMetadataTransactions(${JSON.stringify(repo)});
-        `;
-        await assert.rejects(
-          execFileAsync(process.execPath, ['-e', recoverSource]),
-          (error) => /guard owner \d+ is still active/.test(String(error.stderr)),
-        );
-        await assert.rejects(
-          git(repo, 'worktree', 'add', linked, 'delete-me'),
-          /worktrees|Not a directory|not a directory/,
-        );
-      },
-    },
-  );
-  assert.equal(await branch(repo, 'delete-me'), null);
-  assert.equal(fs.existsSync(linked), false);
-  assert.equal(fs.statSync(await gitPath(repo, 'worktrees')).isDirectory(), true);
-});
-
-test('a mixed checked-ref and deletion crash leaves exact per-branch receipts', async () => {
-  const { repo, first, second, third } = await makeRepo('branch-delete-split-recovery');
-  const operation = 'e'.repeat(64);
-  await git(repo, 'branch', 'delete-me', first);
-  await assert.rejects(
-    updateBranchRefs(
-      repo,
-      [
-        { branch: 'main', expectedOid: third, oid: second },
-        { branch: 'delete-me', expectedOid: first, oid: null },
-      ],
-      operation,
-      {
-        afterNonDeletionBatch: () => {
-          throw new Error('simulated process death between branch batches');
-        },
-      },
-    ),
-    /simulated process death/,
-  );
-  assert.equal(await branch(repo, 'main'), second);
-  assert.equal(await branch(repo, 'delete-me'), first);
-  assert.equal(await branchReceiptCrossed(repo, operation, 'main'), true);
-  assert.equal(await branchReceiptCrossed(repo, operation, 'delete-me'), false);
-
-  await updateBranchRefs(repo, [
-    { branch: 'delete-me', expectedOid: first, oid: null },
-  ], operation);
-  assert.equal(await branch(repo, 'delete-me'), null);
-  assert.equal(await branchReceiptCrossed(repo, operation, 'delete-me'), true);
-  await releaseBranchReceipt(repo, operation);
-});
-
-test('restart removes an owned HEAD guard before retrying branch deletion', async () => {
-  const { repo, first } = await makeRepo('branch-delete-guard-recovery');
-  await git(repo, 'branch', 'delete-me', first);
-  const transitionFile = path.resolve(
-    __dirname,
-    '../workspace/transition.js',
-  );
-  const source = `
-    process.env.AMALGM_DIR = ${JSON.stringify(process.env.AMALGM_DIR)};
-    const { updateBranchRefs } = require(${JSON.stringify(transitionFile)});
-    updateBranchRefs(
-      ${JSON.stringify(repo)},
-      [{ branch: 'delete-me', expectedOid: ${JSON.stringify(first)}, oid: null }],
-      ${JSON.stringify('d'.repeat(64))},
-      { afterHeadGuard: () => process.exit(86) },
-    );
-  `;
-  await assert.rejects(
-    execFileAsync(process.execPath, ['-e', source]),
-    (error) => error.code === 86,
-  );
-  const headLock = `${await gitPath(repo, 'HEAD')}.lock`;
-  assert.equal(fs.existsSync(headLock), true);
-  assert.equal(await branch(repo, 'delete-me'), first);
-
-  recoverGitMetadataTransactions(repo);
-  assert.equal(fs.existsSync(headLock), false);
-  await updateBranchRefs(repo, [
-    { branch: 'delete-me', expectedOid: first, oid: null },
-  ]);
-  assert.equal(await branch(repo, 'delete-me'), null);
-});
-
-test('restart restores an exchanged worktree namespace before repo observation', async () => {
-  const { repo, first } = await makeRepo('branch-delete-namespace-recovery');
-  await git(repo, 'branch', 'delete-me', first);
-  const transitionFile = path.resolve(
-    __dirname,
-    '../workspace/transition.js',
-  );
-  const source = `
-    process.env.AMALGM_DIR = ${JSON.stringify(process.env.AMALGM_DIR)};
-    const { updateBranchRefs } = require(${JSON.stringify(transitionFile)});
-    updateBranchRefs(
-      ${JSON.stringify(repo)},
-      [{ branch: 'delete-me', expectedOid: ${JSON.stringify(first)}, oid: null }],
-      ${JSON.stringify('f'.repeat(64))},
-      { afterWorktreeNamespaceGuard: () => process.exit(86) },
-    );
-  `;
-  await assert.rejects(
-    execFileAsync(process.execPath, ['-e', source]),
-    (error) => error.code === 86,
-  );
-  const worktrees = await gitPath(repo, 'worktrees');
-  assert.equal(fs.statSync(worktrees).isFile(), true);
-  assert.equal(fs.existsSync(`${await gitPath(repo, 'HEAD')}.lock`), true);
-  assert.equal(await branch(repo, 'delete-me'), first);
-
-  recoverGitMetadataTransactions(repo);
-  assert.equal(fs.statSync(worktrees).isDirectory(), true);
-  assert.equal(fs.existsSync(`${await gitPath(repo, 'HEAD')}.lock`), false);
-  assert.equal(await branch(repo, 'delete-me'), first);
-
-  await updateBranchRefs(repo, [
-    { branch: 'delete-me', expectedOid: first, oid: null },
-  ], 'f'.repeat(64));
-  assert.equal(await branch(repo, 'delete-me'), null);
-  await releaseBranchReceipt(repo, 'f'.repeat(64));
-});
-
-test('namespace recovery resumes after restore crossed but receipt cleanup crashed', async () => {
-  const { repo, first } = await makeRepo('branch-delete-namespace-cleanup-recovery');
-  await git(repo, 'branch', 'delete-me', first);
-  const transitionFile = path.resolve(
-    __dirname,
-    '../workspace/transition.js',
-  );
-  const source = `
-    process.env.AMALGM_DIR = ${JSON.stringify(process.env.AMALGM_DIR)};
-    const { updateBranchRefs } = require(${JSON.stringify(transitionFile)});
-    updateBranchRefs(
-      ${JSON.stringify(repo)},
-      [{ branch: 'delete-me', expectedOid: ${JSON.stringify(first)}, oid: null }],
-      ${JSON.stringify('9'.repeat(64))},
-      { afterWorktreeNamespaceGuard: () => process.exit(86) },
-    );
-  `;
-  await assert.rejects(
-    execFileAsync(process.execPath, ['-e', source]),
-    (error) => error.code === 86,
-  );
-
-  const records = path.join(
-    process.env.AMALGM_DIR,
-    'state',
-    'workspace-git-worktree-guards',
-  );
-  const [recordName] = fs.readdirSync(records);
-  const transaction = JSON.parse(
-    fs.readFileSync(path.join(records, recordName), 'utf8'),
-  );
-  const worktrees = path.join(transaction.root, 'worktrees');
-  const prepared = path.join(
-    transaction.root,
-    'amalgm-metadata-apply',
-    `${transaction.id}.target`,
-  );
-  const swapping = path.join(
-    transaction.root,
-    'amalgm-metadata-apply',
-    `${transaction.id}.restore-gap`,
-  );
-  fs.renameSync(worktrees, swapping);
-  fs.renameSync(prepared, worktrees);
-  fs.renameSync(swapping, prepared);
-  fs.unlinkSync(prepared);
-
-  const replaced = `${worktrees}.replaced`;
-  fs.renameSync(worktrees, replaced);
-  fs.mkdirSync(worktrees);
-  assert.throws(
-    () => recoverGitMetadataTransactions(repo),
-    /worktree namespace guard receipt is incomplete/,
-  );
-  fs.rmdirSync(worktrees);
-  fs.renameSync(replaced, worktrees);
-
-  recoverGitMetadataTransactions(repo);
-  assert.equal(fs.statSync(worktrees).isDirectory(), true);
-  assert.equal(fs.existsSync(path.join(
-    transaction.root,
-    'amalgm-metadata-apply',
-    `${transaction.id}.claimed`,
-  )), false);
-  assert.equal(fs.existsSync(path.join(records, recordName)), false);
-  assert.equal(await branch(repo, 'delete-me'), first);
-});
-
-test('a renamed checkout recovers guards by physical repository identity', async () => {
-  const { repo, first } = await makeRepo('branch-delete-renamed-recovery');
-  await git(repo, 'branch', 'delete-me', first);
-  const transitionFile = path.resolve(
-    __dirname,
-    '../workspace/transition.js',
-  );
-  const source = `
-    process.env.AMALGM_DIR = ${JSON.stringify(process.env.AMALGM_DIR)};
-    const { updateBranchRefs } = require(${JSON.stringify(transitionFile)});
-    updateBranchRefs(
-      ${JSON.stringify(repo)},
-      [{ branch: 'delete-me', expectedOid: ${JSON.stringify(first)}, oid: null }],
-      ${JSON.stringify('8'.repeat(64))},
-      { afterWorktreeNamespaceGuard: () => process.exit(86) },
-    );
-  `;
-  await assert.rejects(
-    execFileAsync(process.execPath, ['-e', source]),
-    (error) => error.code === 86,
-  );
-  const moved = `${repo}-moved`;
-  fs.renameSync(repo, moved);
-
-  recoverGitMetadataTransactions(moved);
-  assert.equal(fs.statSync(await gitPath(moved, 'worktrees')).isDirectory(), true);
-  assert.equal(fs.existsSync(`${await gitPath(moved, 'HEAD')}.lock`), false);
-  assert.equal(await branch(moved, 'delete-me'), first);
-});
-
-test('a linked worktree recovers a process death after namespace exchange', async () => {
-  const { repo, first } = await makeRepo('branch-delete-linked-namespace-recovery');
-  await git(repo, 'branch', 'delete-me', first);
-  const linked = path.join(tempRoot, 'branch-delete-linked-namespace-recovery-peer');
-  await git(repo, 'worktree', 'add', '-b', 'peer', linked, first);
-  const operation = 'b'.repeat(64);
-  const worktrees = await gitPath(repo, 'worktrees');
-  const transitionFile = path.resolve(
-    __dirname,
-    '../workspace/transition.js',
-  );
-  const source = `
-    process.env.AMALGM_DIR = ${JSON.stringify(process.env.AMALGM_DIR)};
-    const { updateBranchRefs } = require(${JSON.stringify(transitionFile)});
-    updateBranchRefs(
-      ${JSON.stringify(linked)},
-      [{ branch: 'delete-me', expectedOid: ${JSON.stringify(first)}, oid: null }],
-      ${JSON.stringify(operation)},
-      { afterWorktreeNamespaceGuard: () => process.exit(86) },
-    );
-  `;
-  await assert.rejects(
-    execFileAsync(process.execPath, ['-e', source]),
-    (error) => error.code === 86,
-  );
-  assert.equal(fs.statSync(worktrees).isFile(), true);
-
-  recoverGitMetadataTransactions(linked);
-  assert.equal(fs.statSync(worktrees).isDirectory(), true);
-  assert.equal(await git(linked, 'symbolic-ref', '--short', 'HEAD'), 'peer');
-  assert.equal(await branch(repo, 'delete-me'), first);
-
-  await updateBranchRefs(linked, [
-    { branch: 'delete-me', expectedOid: first, oid: null },
-  ], operation);
-  assert.equal(await branch(repo, 'delete-me'), null);
-  await releaseBranchReceipt(linked, operation);
-});
-
-test('a sibling linked worktree recovers a namespace guard left by its peer', async () => {
-  const { repo, first } = await makeRepo('branch-delete-sibling-namespace-recovery');
-  await git(repo, 'branch', 'delete-me', first);
-  const origin = path.join(tempRoot, 'branch-delete-sibling-namespace-recovery-origin');
-  const sibling = path.join(tempRoot, 'branch-delete-sibling-namespace-recovery-sibling');
-  await git(repo, 'worktree', 'add', '-b', 'origin', origin, first);
-  await git(repo, 'worktree', 'add', '-b', 'sibling', sibling, first);
-  const operation = '6'.repeat(64);
-  const worktrees = await gitPath(repo, 'worktrees');
-  const transitionFile = path.resolve(__dirname, '../workspace/transition.js');
-  const source = `
-    process.env.AMALGM_DIR = ${JSON.stringify(process.env.AMALGM_DIR)};
-    const { updateBranchRefs } = require(${JSON.stringify(transitionFile)});
-    updateBranchRefs(
-      ${JSON.stringify(origin)},
-      [{ branch: 'delete-me', expectedOid: ${JSON.stringify(first)}, oid: null }],
-      ${JSON.stringify(operation)},
-      { afterWorktreeNamespaceGuard: () => process.exit(86) },
-    );
-  `;
-  await assert.rejects(
-    execFileAsync(process.execPath, ['-e', source]),
-    (error) => error.code === 86,
-  );
-  assert.equal(fs.statSync(worktrees).isFile(), true);
-
-  recoverGitMetadataTransactions(sibling);
-  assert.equal(fs.statSync(worktrees).isDirectory(), true);
-  assert.equal(await git(sibling, 'symbolic-ref', '--short', 'HEAD'), 'sibling');
-  assert.equal(await branch(repo, 'delete-me'), first);
-
-  await updateBranchRefs(sibling, [
-    { branch: 'delete-me', expectedOid: first, oid: null },
-  ], operation);
-  assert.equal(await branch(repo, 'delete-me'), null);
-  await releaseBranchReceipt(sibling, operation);
-});
-
-test('a linked worktree alias finds its namespace guard after process death', async () => {
-  const { repo, first } = await makeRepo('branch-delete-linked-alias-recovery');
-  await git(repo, 'branch', 'delete-me', first);
-  const linked = path.join(tempRoot, 'branch-delete-linked-alias-recovery-peer');
-  const alias = path.join(tempRoot, 'branch-delete-linked-alias-recovery-alias');
-  await git(repo, 'worktree', 'add', '-b', 'peer', linked, first);
-  fs.symlinkSync(linked, alias, 'dir');
-  const operation = '7'.repeat(64);
-  const worktrees = await gitPath(repo, 'worktrees');
-  const transitionFile = path.resolve(
-    __dirname,
-    '../workspace/transition.js',
-  );
-  const source = `
-    process.env.AMALGM_DIR = ${JSON.stringify(process.env.AMALGM_DIR)};
-    const { updateBranchRefs } = require(${JSON.stringify(transitionFile)});
-    updateBranchRefs(
-      ${JSON.stringify(alias)},
-      [{ branch: 'delete-me', expectedOid: ${JSON.stringify(first)}, oid: null }],
-      ${JSON.stringify(operation)},
-      { afterWorktreeNamespaceGuard: () => process.exit(86) },
-    );
-  `;
-  await assert.rejects(
-    execFileAsync(process.execPath, ['-e', source]),
-    (error) => error.code === 86,
-  );
-  assert.equal(fs.statSync(worktrees).isFile(), true);
-
-  // The linked checkout cannot ask Git for its common directory while the
-  // registration namespace is sealed. Its device/inode identity must find
-  // the record even though the dead process entered through a symlink alias.
-  recoverGitMetadataTransactions(linked);
-  assert.equal(fs.statSync(worktrees).isDirectory(), true);
-  assert.equal(await git(linked, 'symbolic-ref', '--short', 'HEAD'), 'peer');
-  assert.equal(await branch(repo, 'delete-me'), first);
-
-  await updateBranchRefs(linked, [
-    { branch: 'delete-me', expectedOid: first, oid: null },
-  ], operation);
-  assert.equal(await branch(repo, 'delete-me'), null);
-  await releaseBranchReceipt(linked, operation);
-});
-
-test('the main checkout restores a namespace guard left by a linked checkout', async () => {
-  const { repo, first } = await makeRepo('branch-delete-cross-checkout-recovery');
-  await git(repo, 'branch', 'delete-me', first);
-  const linked = path.join(tempRoot, 'branch-delete-cross-checkout-recovery-peer');
-  await git(repo, 'worktree', 'add', '-b', 'peer', linked, first);
-  const operation = 'c'.repeat(64);
-  const worktrees = await gitPath(repo, 'worktrees');
-  const transitionFile = path.resolve(
-    __dirname,
-    '../workspace/transition.js',
-  );
-  const source = `
-    process.env.AMALGM_DIR = ${JSON.stringify(process.env.AMALGM_DIR)};
-    const { updateBranchRefs } = require(${JSON.stringify(transitionFile)});
-    updateBranchRefs(
-      ${JSON.stringify(linked)},
-      [{ branch: 'delete-me', expectedOid: ${JSON.stringify(first)}, oid: null }],
-      ${JSON.stringify(operation)},
-      { afterWorktreeNamespaceGuard: () => process.exit(86) },
-    );
-  `;
-  await assert.rejects(
-    execFileAsync(process.execPath, ['-e', source]),
-    (error) => error.code === 86,
-  );
-  assert.equal(fs.statSync(worktrees).isFile(), true);
-
-  recoverGitMetadataTransactions(repo);
-  assert.equal(fs.statSync(worktrees).isDirectory(), true);
-  assert.equal(await branch(repo, 'delete-me'), first);
-
-  // The ordinary retry reaches the linked checkout, releases its own stale
-  // HEAD guard, and then performs the one ref transaction.
-  await updateBranchRefs(repo, [
-    { branch: 'delete-me', expectedOid: first, oid: null },
-  ], operation);
-  assert.equal(await branch(repo, 'delete-me'), null);
-  await releaseBranchReceipt(repo, operation);
-});
-
-test('concurrent attempts of one branch operation cannot release each other', async () => {
-  const { repo, first } = await makeRepo('branch-delete-same-operation-concurrency');
-  await git(repo, 'branch', 'delete-me', first);
-  const operation = '5'.repeat(64);
-  const ready = path.join(tempRoot, 'branch-delete-same-operation.ready');
-  const proceed = path.join(tempRoot, 'branch-delete-same-operation.proceed');
-  const transitionFile = path.resolve(__dirname, '../workspace/transition.js');
-  const source = `
-    process.env.AMALGM_DIR = ${JSON.stringify(process.env.AMALGM_DIR)};
-    const fs = require('fs');
-    const { updateBranchRefs } = require(${JSON.stringify(transitionFile)});
-    (async () => {
-      await updateBranchRefs(
-        ${JSON.stringify(repo)},
-        [{ branch: 'delete-me', expectedOid: ${JSON.stringify(first)}, oid: null }],
-        ${JSON.stringify(operation)},
-        {
-          afterHeadGuard: async () => {
-            fs.writeFileSync(${JSON.stringify(ready)}, 'ready');
-            while (!fs.existsSync(${JSON.stringify(proceed)})) {
-              await new Promise((resolve) => setTimeout(resolve, 10));
-            }
-          },
-        },
-      );
-    })().catch((error) => {
-      console.error(error);
-      process.exit(1);
-    });
-  `;
-  const owner = delayedNode(source);
-  const deadline = Date.now() + 5_000;
-  while (!fs.existsSync(ready) && Date.now() < deadline) {
-    await new Promise((resolve) => setTimeout(resolve, 10));
-  }
-  assert.equal(fs.existsSync(ready), true);
-
-  await assert.rejects(
-    updateBranchRefs(
-      repo,
-      [{ branch: 'delete-me', expectedOid: first, oid: null }],
-      operation,
-    ),
-    /guard owner \d+ is still active|Git HEAD lock is already held/,
-  );
-  fs.writeFileSync(proceed, 'proceed');
-  await owner.done;
-
-  assert.equal(await branch(repo, 'delete-me'), null);
-  assert.equal(fs.existsSync(`${await gitPath(repo, 'HEAD')}.lock`), false);
-  assert.equal(fs.statSync(await gitPath(repo, 'worktrees')).isDirectory(), true);
-  await releaseBranchReceipt(repo, operation);
-});
-
-test('a branch transaction carries and releases its own crossing receipt', async () => {
-  const { repo, first, second } = await makeRepo('branch-receipt');
-  const operation = 'a'.repeat(64);
-  await git(repo, 'branch', 'feature', first);
-
-  assert.equal(await branchReceiptCrossed(repo, operation), false);
-  await updateBranchRefs(repo, [
-    { branch: 'feature', expectedOid: first, oid: second },
-  ], operation);
-  assert.equal(await branchReceiptCrossed(repo, operation), true);
-
-  await git(repo, 'update-ref', 'refs/heads/feature', first, second);
-  assert.equal(await branchReceiptCrossed(repo, operation), true);
-  await releaseBranchReceipt(repo, operation);
-  await releaseBranchReceipt(repo, operation);
-  assert.equal(await branchReceiptCrossed(repo, operation), false);
-});
-
-test('one operation records independent receipts for multiple branch batches', async () => {
-  const { repo, first, second, third } = await makeRepo('multi-branch-receipts');
-  const operation = '9'.repeat(64);
-  await updateBranchRefs(repo, [
-    { branch: 'first-batch', expectedOid: null, oid: second },
-  ], operation);
-  await updateBranchRefs(repo, [
-    { branch: 'second-batch', expectedOid: null, oid: third },
-  ], operation);
-  assert.equal(await branchReceiptCrossed(repo, operation, 'first-batch'), true);
-  assert.equal(await branchReceiptCrossed(repo, operation, 'second-batch'), true);
-  assert.equal(await branch(repo, 'first-batch'), second);
-  assert.equal(await branch(repo, 'second-batch'), third);
-  assert.notEqual(first, second);
-  await releaseBranchReceipt(repo, operation);
-  assert.equal(await branchReceiptCrossed(repo, operation), false);
-});
-
-test('a Git index crash before lock rename has no crossing receipt', async () => {
-  const { repo } = await makeRepo('index-pre-cross-receipt');
-  const operation = 'b'.repeat(64);
-  const index = await gitPath(repo, 'index');
-  const expected = fs.readFileSync(index);
-  const target = Buffer.from('prepared replacement index bytes\n');
-
-  assert.throws(
-    () => applyGitMetadataTransaction(
-      repo,
-      'index',
-      expected,
-      target,
-      operation,
-      { crashBeforeInstall: true },
-    ),
-    /native workspace file transaction failed/,
-  );
-  assert.equal(fs.readFileSync(index).equals(expected), true);
-  assert.equal(gitMetadataReceiptCrossed(repo, operation, 'index'), false);
-  assert.equal(fs.existsSync(`${index}.lock`), false);
-});
-
-test('a crossed index receipt survives a revert and a later Git lock', async () => {
-  const { repo } = await makeRepo('index-post-cross-receipt');
-  const operation = 'c'.repeat(64);
-  const index = await gitPath(repo, 'index');
-  const expected = fs.readFileSync(index);
-  const target = Buffer.from('official replacement index bytes\n');
-
-  assert.throws(
-    () => applyGitMetadataTransaction(
-      repo,
-      'index',
-      expected,
-      target,
-      operation,
-      { crashAfterInstall: true },
-    ),
-    /native workspace file transaction failed/,
-  );
-  assert.equal(fs.readFileSync(index).equals(target), true);
-
-  replaceThroughLock(index, expected);
-  fs.writeFileSync(`${index}.lock`, 'later user-owned lock\n');
-  assert.equal(gitMetadataReceiptCrossed(repo, operation, 'index'), true);
-  releaseGitMetadataReceipts(repo, operation, 'index');
-  releaseGitMetadataReceipts(repo, operation, 'index');
-  assert.equal(fs.readFileSync(`${index}.lock`, 'utf8'), 'later user-owned lock\n');
-  assert.equal(gitMetadataReceiptCrossed(repo, operation, 'index'), false);
-  fs.unlinkSync(`${index}.lock`);
-});
-
-test('a crossed HEAD receipt survives a later switch back', async () => {
-  const { repo, first } = await makeRepo('head-post-cross-receipt');
-  const operation = 'd'.repeat(64);
-  const head = await gitPath(repo, 'HEAD');
-  const expected = fs.readFileSync(head);
-  const target = Buffer.from(`${first}\n`);
-
-  applyGitMetadataTransaction(repo, 'HEAD', expected, target, operation);
-  assert.equal(fs.readFileSync(head).equals(target), true);
-  replaceThroughLock(head, expected);
-  assert.equal(gitMetadataReceiptCrossed(repo, operation, 'HEAD'), true);
-  releaseGitMetadataReceipts(repo, operation, 'HEAD');
-  assert.equal(gitMetadataReceiptCrossed(repo, operation, 'HEAD'), false);
-  assert.equal(fs.readFileSync(head).equals(expected), true);
-});
-
-test('Git metadata receipt release resumes after native cleanup but before JSON removal', async () => {
-  for (const [component, operation] of [
-    ['index', '1'.repeat(64)],
-    ['HEAD', '2'.repeat(64)],
-  ]) {
-    const { repo, first } = await makeRepo(`release-gap-${component}`);
-    const destination = await gitPath(repo, component);
-    const expected = fs.readFileSync(destination);
-    const target = component === 'HEAD'
-      ? Buffer.from(`${first}\n`)
-      : Buffer.from('release-gap-index\n');
-    applyGitMetadataTransaction(repo, component, expected, target, operation);
-    const receiptDir = path.join(path.dirname(destination), 'amalgm-metadata-apply');
-    for (const name of fs.readdirSync(receiptDir)) {
-      if (name.endsWith('.target') || name.endsWith('.claimed')) {
-        fs.rmSync(path.join(receiptDir, name));
-      }
-    }
-    releaseGitMetadataReceipts(repo, operation, component);
-    assert.equal(
-      fs.readdirSync(receiptDir).some((name) => name.endsWith('.json')),
-      false,
-    );
-  }
-});
-
-test('missing-index initialization cannot erase a staged index won by a racing user', async () => {
-  const repo = path.join(tempRoot, 'empty-index-race');
-  fs.mkdirSync(repo);
-  await git(repo, 'init', '-b', 'main');
-  fs.writeFileSync(path.join(repo, 'local.txt'), 'local bytes\n');
-  const operation = '3'.repeat(64);
-  await assert.rejects(
-    ensureEmptyIndex(repo, operation, {
-      afterAbsent: async () => {
-        await git(repo, 'add', 'local.txt');
-      },
-    }),
-    (error) => error instanceof TransitionError,
-  );
-  assert.match(await git(repo, 'diff', '--cached', '--name-only'), /local\.txt/);
-});
-
-test('a large index target is prepared as a file instead of embedded in JSON', async () => {
-  const { repo } = await makeRepo('large-index-receipt');
-  const operation = 'f'.repeat(64);
-  const index = await gitPath(repo, 'index');
-  const privateGitDir = path.dirname(index);
-  const expected = fs.readFileSync(index);
-  const target = Buffer.alloc(17 * 1024 * 1024, 0x61);
-
-  applyGitMetadataTransaction(repo, 'index', expected, target, operation);
-  const receiptDir = path.join(privateGitDir, 'amalgm-metadata-apply');
-  const record = fs.readdirSync(receiptDir).find((name) => name.endsWith('.json'));
-  assert.ok(record);
-  assert.ok(fs.statSync(path.join(receiptDir, record)).size < 2048);
-  assert.equal(fs.readFileSync(index).equals(target), true);
-  assert.equal(gitMetadataReceiptCrossed(repo, operation, 'index'), true);
-  releaseGitMetadataReceipts(repo, operation, 'index');
-});
-
-test('Git metadata receipts live in a linked worktree private Git directory', async () => {
-  const { repo, first } = await makeRepo('linked-metadata-main');
-  const linked = path.join(tempRoot, 'linked-metadata-worktree');
-  await git(repo, 'worktree', 'add', '-b', 'linked-metadata', linked, first);
-  const operation = 'e'.repeat(64);
-  const head = await gitPath(linked, 'HEAD');
-  const privateGitDir = path.dirname(head);
-  const commonValue = await git(linked, 'rev-parse', '--git-common-dir');
-  const commonGitDir = path.isAbsolute(commonValue)
-    ? fs.realpathSync(commonValue)
-    : fs.realpathSync(path.resolve(linked, commonValue));
-  const expected = fs.readFileSync(head);
-  const target = Buffer.from(`${first}\n`);
-
-  applyGitMetadataTransaction(linked, 'HEAD', expected, target, operation);
-  assert.equal(gitMetadataReceiptCrossed(linked, operation, 'HEAD'), true);
-  assert.equal(
-    fs.existsSync(path.join(privateGitDir, 'amalgm-metadata-apply')),
-    true,
-  );
-  if (privateGitDir !== commonGitDir) {
-    assert.equal(
-      fs.existsSync(path.join(commonGitDir, 'amalgm-metadata-apply')),
-      false,
-    );
-  }
-  releaseGitMetadataReceipts(linked, operation, 'HEAD');
-});
-
-test('one stale expected value aborts every branch movement', async () => {
-  const { repo, first, second, third } = await makeRepo('stale');
-  await git(repo, 'branch', 'unchanged-create');
-  await git(repo, 'branch', 'stale-update', second);
-  await git(repo, 'branch', 'unchanged-delete', first);
-
-  await assert.rejects(
-    updateBranchRefs(repo, [
-      { branch: 'new-branch', expectedOid: null, oid: third },
-      { branch: 'stale-update', expectedOid: first, oid: third },
-      { branch: 'unchanged-delete', expectedOid: first, oid: null },
-    ]),
-    (error) => error instanceof TransitionError
-      && error.action === 'update-branch-refs',
-  );
-
-  assert.equal(await branch(repo, 'new-branch'), null);
-  assert.equal(await branch(repo, 'stale-update'), second);
-  assert.equal(await branch(repo, 'unchanged-delete'), first);
-});
-
-test('a card metadata move leaves pending index and working bytes untouched', async () => {
-  const { repo, first, third } = await makeRepo('head-only');
-  const operation = '7'.repeat(64);
-  await git(repo, 'reset', '--hard', first);
-  fs.writeFileSync(path.join(repo, 'staged.txt'), 'staged local bytes\n');
-  await git(repo, 'add', 'staged.txt');
-  fs.writeFileSync(path.join(repo, 'file.txt'), 'unstaged local bytes\n');
-
-  await moveHeadToCard(repo, {
-    expectedBranch: 'main',
-    expectedOid: first,
-    expectedTargetOid: first,
-    targetBranch: 'main',
-    targetOid: third,
-    operation,
-  });
-
-  assert.equal(await git(repo, 'rev-parse', 'HEAD'), third);
-  assert.equal(fs.readFileSync(path.join(repo, 'file.txt'), 'utf8'), 'unstaged local bytes\n');
-  assert.equal(fs.readFileSync(path.join(repo, 'staged.txt'), 'utf8'), 'staged local bytes\n');
-  assert.match(await git(repo, 'diff', '--cached', '--name-only'), /staged\.txt/);
-
-  await moveHeadToCard(repo, {
-    expectedBranch: 'main',
-    expectedOid: first,
-    expectedTargetOid: first,
-    targetBranch: 'main',
-    targetOid: third,
-    operation,
-  });
-  assert.equal(await git(repo, 'rev-parse', 'HEAD'), third);
-  await releaseBranchReceipt(repo, operation);
-});
-
-test('an interrupted file replacement leaves the old file whole and replay lands the new file whole', async () => {
-  const { repo } = await makeRepo('atomic-file');
-  const file = path.join(repo, 'file.txt');
-  const write = {
-    path: 'file.txt',
-    content: Buffer.from('official replacement\n'),
-    mode: '100644',
-    expected: {
-      kind: 'file',
-      content: Buffer.from('three\n'),
-      exec: false,
-    },
-    testCrashAfterExtraction: true,
-  };
-  assert.throws(
-    () => applyFiles(repo, [write], 'interrupted'),
-    /native workspace file transaction failed/,
-  );
-
-  recoverFileTransactions(repo);
-  assert.deepEqual([...crossedFileReceiptPaths(repo, 'interrupted', ['file.txt'])], []);
-  assert.equal(fs.readFileSync(file, 'utf8'), 'three\n');
-  assert.equal(
-    fs.readdirSync(repo).some((name) => name.startsWith('.amalgm-apply-')),
-    false,
-  );
-
-  applyFiles(repo, [{ ...write, testCrashAfterExtraction: false }], 'interrupted');
-  assert.equal(fs.readFileSync(file, 'utf8'), 'official replacement\n');
-  assert.deepEqual([...crossedFileReceiptPaths(repo, 'interrupted', ['file.txt'])], ['file.txt']);
-  releaseFileReceipts(repo, 'interrupted');
-});
-
-test('an official add remains crossed after a later local delete', async () => {
-  const { repo } = await makeRepo('add-delete-receipt');
-  const operation = 'add-delete';
-  const write = {
-    path: 'added.txt',
-    content: Buffer.from('official add\n'),
-    mode: '100644',
-    expected: null,
-  };
-  applyFiles(repo, [write], operation);
-  fs.unlinkSync(path.join(repo, 'added.txt'));
-
-  assert.deepEqual(
-    [...crossedFileReceiptPaths(repo, operation, ['added.txt'])],
-    ['added.txt'],
-  );
-  applyFiles(repo, [write], operation);
-  assert.equal(fs.existsSync(path.join(repo, 'added.txt')), false);
-  releaseFileReceipts(repo, operation);
-  releaseFileReceipts(repo, operation);
-});
-
-test('retained receipts are invisible to status, untracked listing, and capture', async () => {
-  const { repo } = await makeRepo('receipt-is-not-content');
-  const operation = 'receipt-is-not-content';
-  applyFiles(repo, [{
-    path: 'added.txt',
-    content: Buffer.from('official add\n'),
-    mode: '100644',
-    expected: null,
-  }], operation);
-
-  const status = await git(repo, 'status', '--porcelain=v1', '--untracked-files=all');
-  const untracked = await git(repo, 'ls-files', '--others', '--exclude-standard');
-  const captured = await captureWorktreeDiff(repo);
-  const checkpoint = await captureCheckpoint(repo);
-  assert.doesNotMatch(status, /\.amalgm-apply-/);
-  assert.doesNotMatch(untracked, /\.amalgm-apply-/);
-  assert.doesNotMatch(captured.diff, /\.amalgm-apply-/);
-  assert.doesNotMatch(checkpoint.worktreeDiff, /\.amalgm-apply-/);
-
-  const lookalike = path.join(repo, '.amalgm-apply-not-a-receipt');
-  fs.mkdirSync(lookalike);
-  fs.writeFileSync(path.join(lookalike, 'user.txt'), 'user content\n');
-  assert.match(
-    await git(repo, 'ls-files', '--others', '--exclude-standard'),
-    /\.amalgm-apply-not-a-receipt\/user\.txt/,
-  );
-  releaseFileReceipts(repo, operation);
-});
-
-test('linked worktrees exclude receipts through Git without clobbering a racing user edit', async () => {
-  const { repo, first } = await makeRepo('linked-receipt-main');
-  const linked = path.join(tempRoot, 'linked-receipt-worktree');
-  await git(repo, 'worktree', 'add', '-b', 'linked-receipt', linked, first);
-  const exclude = await gitPath(linked, 'info/exclude');
-  fs.writeFileSync(exclude, 'user-before\n');
-
-  const readFileSync = fs.readFileSync;
-  let raced = false;
-  fs.readFileSync = (file, ...args) => {
-    const value = readFileSync(file, ...args);
-    if (!raced && path.resolve(String(file)) === path.resolve(exclude)) {
-      raced = true;
-      fs.appendFileSync(exclude, 'user-racing\n');
-    }
-    return value;
-  };
-  try {
-    applyFiles(linked, [{
-      path: 'file.txt',
-      content: Buffer.from('official replacement\n'),
-      mode: '100644',
-      expected: {
-        kind: 'file',
-        content: Buffer.from('one\n'),
-        exec: false,
-      },
-    }], 'linked-receipt');
-  } finally {
-    fs.readFileSync = readFileSync;
-  }
-
-  const excludeContent = fs.readFileSync(exclude, 'utf8');
-  assert.match(excludeContent, /^user-before\nuser-racing\n/m);
-  assert.match(excludeContent, /\.amalgm-apply-\[0-9a-f\]/);
-  assert.equal(raced, true);
-  assert.doesNotMatch(
-    await git(linked, 'ls-files', '--others', '--exclude-standard'),
-    /\.amalgm-apply-/,
-  );
-  assert.doesNotMatch(
-    (await captureCheckpoint(linked)).worktreeDiff,
-    /\.amalgm-apply-/,
-  );
-  releaseFileReceipts(linked, 'linked-receipt');
-});
-
-test('an official delete remains crossed after a later local recreate', async () => {
-  const { repo } = await makeRepo('delete-recreate-receipt');
-  const operation = 'delete-recreate';
-  const write = {
-    path: 'file.txt',
-    content: null,
-    expected: {
-      kind: 'file',
-      content: Buffer.from('three\n'),
-      exec: false,
-    },
-  };
-  applyFiles(repo, [write], operation);
-  fs.writeFileSync(path.join(repo, 'file.txt'), 'three\n');
-
-  assert.deepEqual(
-    [...crossedFileReceiptPaths(repo, operation, ['file.txt'])],
-    ['file.txt'],
-  );
-  applyFiles(repo, [write], operation);
-  assert.equal(fs.readFileSync(path.join(repo, 'file.txt'), 'utf8'), 'three\n');
-  releaseFileReceipts(repo, operation);
-});
-
-test('an official replacement remains crossed after a later return to its source bytes', async () => {
-  const { repo } = await makeRepo('replace-source-receipt');
-  const operation = 'replace-source';
-  const write = {
-    path: 'file.txt',
-    content: Buffer.from('official replacement\n'),
-    mode: '100644',
-    expected: {
-      kind: 'file',
-      content: Buffer.from('three\n'),
-      exec: false,
-    },
-  };
-  applyFiles(repo, [write], operation);
-  fs.writeFileSync(path.join(repo, 'file.txt'), 'three\n');
-
-  assert.deepEqual(
-    [...crossedFileReceiptPaths(repo, operation, ['file.txt'])],
-    ['file.txt'],
-  );
-  applyFiles(repo, [write], operation);
-  assert.equal(fs.readFileSync(path.join(repo, 'file.txt'), 'utf8'), 'three\n');
-  releaseFileReceipts(repo, operation);
-});
-
-test('an official symlink add remains crossed after a later local delete', async () => {
-  const { repo } = await makeRepo('symlink-add-delete-receipt');
-  const operation = 'symlink-add-delete';
-  const write = {
-    path: 'link.txt',
-    content: Buffer.from('missing-target'),
-    mode: '120000',
-    expected: null,
-  };
-  applyFiles(repo, [write], operation);
-  fs.unlinkSync(path.join(repo, 'link.txt'));
-
-  assert.deepEqual(
-    [...crossedFileReceiptPaths(repo, operation, ['link.txt'])],
-    ['link.txt'],
-  );
-  applyFiles(repo, [write], operation);
-  assert.equal(fs.existsSync(path.join(repo, 'link.txt')), false);
-  releaseFileReceipts(repo, operation);
-});
-
-test('a crash before crossing and an unrelated sibling write produce no receipt', async () => {
-  const { repo } = await makeRepo('pre-cross-sibling');
-  const operation = 'pre-cross-sibling';
-  assert.throws(
-    () => applyFiles(repo, [{
-      path: 'added.txt',
-      content: Buffer.from('official add\n'),
-      mode: '100644',
-      expected: null,
-      testCrashBeforeInstall: true,
-    }], operation),
-    /native workspace file transaction failed/,
-  );
-  fs.writeFileSync(path.join(repo, 'sibling.txt'), 'unrelated local write\n');
-
-  recoverFileTransactions(repo);
-  assert.deepEqual(
-    [...crossedFileReceiptPaths(repo, operation, ['added.txt'])],
-    [],
-  );
-  assert.equal(fs.existsSync(path.join(repo, 'added.txt')), false);
-  assert.equal(
-    fs.readFileSync(path.join(repo, 'sibling.txt'), 'utf8'),
-    'unrelated local write\n',
-  );
-});
-
-test('a pre-opened writer keeps its inode visible and its later save survives', async () => {
-  const { repo } = await makeRepo('pre-opened-writer');
-  const file = path.join(fs.realpathSync(repo), 'file.txt');
-  const descriptor = fs.openSync(file, 'r+');
-  try {
-    assert.throws(
-      () => applyFiles(repo, [{
-        path: 'file.txt',
-        content: Buffer.from('official replacement\n'),
-        mode: '100644',
-        expected: {
-          kind: 'file',
-          content: Buffer.from('three\n'),
-          exec: false,
-        },
-      }], 'pre-opened-writer'),
-      /local file changed before ordered apply/,
-    );
-    fs.ftruncateSync(descriptor, 0);
-    fs.writeSync(descriptor, 'late local save\n', 0, 'utf8');
-    fs.fsyncSync(descriptor);
-  } finally {
-    fs.closeSync(descriptor);
-  }
-  recoverFileTransactions(repo);
-  assert.equal(fs.readFileSync(file, 'utf8'), 'late local save\n');
-});
-
-test('a save before extraction is restored as local state instead of overwritten', async () => {
-  const { repo } = await makeRepo('source-extraction-race');
-  const file = path.join(fs.realpathSync(repo), 'file.txt');
-  const writer = delayedNode(`
-    const fs = require('fs');
-    setTimeout(() => fs.writeFileSync(${JSON.stringify(file)}, 'newer local save\\n'), 60);
-  `);
-  assert.throws(
-    () => applyFiles(repo, [{
-      path: 'file.txt',
-      content: Buffer.from('official replacement\n'),
-      mode: '100644',
-      expected: {
-        kind: 'file',
-        content: Buffer.from('three\n'),
-        exec: false,
-      },
-      testPauseAfterParentOpenMillis: 250,
-    }], 'source-race'),
-    /local file changed before ordered apply/,
-  );
-  await writer.done;
-  recoverFileTransactions(repo);
-  assert.equal(fs.readFileSync(file, 'utf8'), 'newer local save\n');
-});
-
-test('a save after extraction wins the exclusive target installation race', async () => {
-  const { repo } = await makeRepo('exclusive-install-race');
-  const file = path.join(fs.realpathSync(repo), 'file.txt');
-  const writer = delayedNode(`
-    const fs = require('fs');
-    setTimeout(() => fs.writeFileSync(${JSON.stringify(file)}, 'newer local save\\n'), 100);
-  `);
-  assert.throws(
-    () => applyFiles(repo, [{
-      path: 'file.txt',
-      content: Buffer.from('official replacement\n'),
-      mode: '100644',
-      expected: {
-        kind: 'file',
-        content: Buffer.from('three\n'),
-        exec: false,
-      },
-      testPauseBeforeInstallMillis: 300,
-    }], 'install-race'),
-    /local writer ownership is unresolved/,
-  );
-  await writer.done;
-  recoverFileTransactions(repo);
-  assert.equal(fs.readFileSync(file, 'utf8'), 'newer local save\n');
-});
-
-test('a parent swapped to a symlink cannot redirect an ordered write outside the repo', async () => {
-  const { repo } = await makeRepo('parent-swap-race');
-  const nested = path.join(repo, 'nested');
-  const held = path.join(repo, 'nested-local');
-  const external = path.join(tempRoot, 'parent-swap-external');
-  fs.mkdirSync(nested);
-  fs.mkdirSync(external);
-  fs.writeFileSync(path.join(nested, 'file.txt'), 'local floor\n');
-  fs.writeFileSync(path.join(external, 'file.txt'), 'external bytes\n');
-  const writer = delayedNode(`
-    const fs = require('fs');
-    setTimeout(() => {
-      fs.renameSync(${JSON.stringify(nested)}, ${JSON.stringify(held)});
-      fs.symlinkSync(${JSON.stringify(external)}, ${JSON.stringify(nested)});
-    }, 80);
-  `);
-
-  assert.throws(
-    () => applyFiles(repo, [{
-      path: 'nested/file.txt',
-      content: Buffer.from('official replacement\n'),
-      mode: '100644',
-      expected: {
-        kind: 'file',
-        content: Buffer.from('local floor\n'),
-        exec: false,
-      },
-      testPauseAfterParentOpenMillis: 300,
-    }], 'parent-swap'),
-    (error) => (
-      error instanceof TransitionError
-      && error.action === 'apply-files'
-    ),
-  );
-  await writer.done;
-  assert.equal(fs.readFileSync(path.join(external, 'file.txt'), 'utf8'), 'external bytes\n');
-  assert.equal(fs.readFileSync(path.join(held, 'file.txt'), 'utf8'), 'local floor\n');
-});
-
-test('exclusive file transactions install and replace dangling symlinks', async () => {
-  const { repo } = await makeRepo('symlink-transaction');
-  const file = path.join(fs.realpathSync(repo), 'file.txt');
-  applyFiles(repo, [{
-    path: 'file.txt',
-    content: Buffer.from('missing-first'),
-    mode: '120000',
-    expected: {
-      kind: 'file',
-      content: Buffer.from('three\n'),
-      exec: false,
-    },
-  }], 'symlink-first');
-  assert.equal(fs.lstatSync(file).isSymbolicLink(), true);
-  assert.equal(fs.readlinkSync(file), 'missing-first');
-
-  applyFiles(repo, [{
-    path: 'file.txt',
-    content: Buffer.from('missing-second'),
-    mode: '120000',
-    expected: {
-      kind: 'symlink',
-      content: Buffer.from('missing-first'),
-      exec: false,
-    },
-  }], 'symlink-second');
-  assert.equal(fs.lstatSync(file).isSymbolicLink(), true);
-  assert.equal(fs.readlinkSync(file), 'missing-second');
-});
-
-test('a separate Git directory is never used for workspace data movement', async () => {
-  const repo = path.join(tempRoot, 'separate-git-worktree');
-  const gitDir = path.join(tempRoot, 'separate-git-metadata');
-  fs.mkdirSync(repo, { recursive: true });
-  await git(repo, 'init', '-b', 'main', '--separate-git-dir', gitDir);
-  const file = path.join(repo, 'file.txt');
-  fs.writeFileSync(file, 'floor\n');
-  await git(repo, 'add', 'file.txt');
-  await git(repo, 'commit', '-m', 'floor');
-
-  const renameSync = fs.renameSync;
-  const linkSync = fs.linkSync;
-  const crossesGitBoundary = (from, to) => (
-    from.startsWith(`${fs.realpathSync(repo)}${path.sep}`)
-    && to.startsWith(`${fs.realpathSync(gitDir)}${path.sep}`)
-  ) || (
-    from.startsWith(`${fs.realpathSync(gitDir)}${path.sep}`)
-    && to.startsWith(`${fs.realpathSync(repo)}${path.sep}`)
-  );
-  fs.renameSync = (from, to) => {
-    if (crossesGitBoundary(from, to)) {
-      const error = new Error('simulated cross-device workspace move');
-      error.code = 'EXDEV';
-      throw error;
-    }
-    return renameSync(from, to);
-  };
-  fs.linkSync = (from, to) => {
-    if (crossesGitBoundary(from, to)) {
-      const error = new Error('simulated cross-device workspace link');
-      error.code = 'EXDEV';
-      throw error;
-    }
-    return linkSync(from, to);
-  };
-  try {
-    applyFiles(repo, [{
-      path: 'file.txt',
-      content: Buffer.from('official\n'),
-      mode: '100644',
-      expected: {
-        kind: 'file',
-        content: Buffer.from('floor\n'),
-        exec: false,
-      },
-    }], 'separate-git-dir');
-  } finally {
-    fs.renameSync = renameSync;
-    fs.linkSync = linkSync;
-  }
-
-  assert.equal(fs.readFileSync(file, 'utf8'), 'official\n');
-  releaseFileReceipts(repo, 'separate-git-dir');
-  assert.deepEqual(fs.readdirSync(repo).sort(), ['.git', 'file.txt']);
-});