From e75627deff575b016e442fe07b4486a358ee6de8 Mon Sep 17 00:00:00 2001
From: Brian Majewski <brian.majewski@gmail.com>
Date: Mon, 8 Jun 2026 07:18:22 -0700
Subject: [PATCH] test: migrate twins undeclared store blobs
 (finalize-consistency, EGB-710)

---
 test/migrate.bats | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/test/migrate.bats b/test/migrate.bats
index cd7dd30..f3d2daa 100644
--- a/test/migrate.bats
+++ b/test/migrate.bats
@@ -140,6 +140,24 @@ m_file_src()   { mkdir -p "$HOME/keystores"; printf 'KS\x00\x01\x02\xffDATA\n' >
   [ "$status" -eq 0 ]                        # v1 kept (non-destructive)
 }
 
+@test "migrate twins a store blob even when the manifest no longer declares it" {
+  make_v1_store
+  m_gradle_src $'beaconClerkPkTest=pk_test_abc\n'
+  create_project_dir staleblob
+  printf 'gradle-properties ~/.gradle/gradle.properties beaconClerkPkTest\n' > .secrets-files
+  "$SECRETS_BIN" push staleblob >/dev/null 2>&1
+  # The blob is now in the store. Drop the external from the project's manifest
+  # entirely (and remove the legacy file) so NO manifest declares it.
+  printf '{"version":2,"dotenv":[".env",".env.staging"]}\n' > .secrets.json
+  rm -f .secrets-files
+  run bash -c "ls $SECRETS_DIR/staleblob/external/*.gradle-properties.age"
+  [ "$status" -eq 0 ]   # precondition: the v1 blob exists in the store
+  run "$SECRETS_BIN" migrate
+  [ "$status" -eq 0 ]
+  run bash -c "ls $SECRETS_DIR/staleblob/external/*.properties.age"
+  [ "$status" -eq 0 ]   # twinned despite not being declared anywhere
+}
+
 @test "migrate in a project with no manifest and no store blobs is a clean no-op" {
   make_v1_store
   local dir="$WORK_DIR/nomanifest"; mkdir -p "$dir"; cd "$dir"