@evident-ai/runner-synchroniser 3.4.1-dev.c03b461 → 3.4.1-dev.e91ca26

package/README.md

@@ -56,7 +56,7 @@ build time.
 | `env`                          | resolved config as shell-eval'able vars | `0` = ran; non-zero = tool broken                        |
 | `litestream-config`            | the generated `litestream.yml`          | `0` = ran; non-zero = tool broken                        |
 | `restore <claude\|opencode>`   | —                                       | `0` = ran; non-zero = tool broken                        |
-| `sync-once <claude\|opencode>` | —                                       | `0` = ran; non-zero = tool broken                        |
+| `sync-once <claude\|opencode>` | —                                       | `0` = uploaded/unchanged/absent/disabled; `40` = not persisted; other = tool broken |
 | `model-auth-ready`             | —                                       | `0` = ready, `10` = not ready; other = tool broken       |
 | `self-stop`                    | —                                       | `0` = stopped, `20` = keep the task; other = tool broken |
 | `session-db-classify <litestream-restore-exit-code> <attempt> [--on-unusable-replica=<prune\|leave\|clear\|crash>] [--recovery-occurred] [--fresh-db-fallback]` | — | `0` = restored/no-replica/disabled, `32` = re-run and ask again, `31` = unusable (booted fresh, replicates into the existing prefix), `30` = fatal; other = usage/tool broken |
@@ -250,8 +250,7 @@ and it can never repair corruption at a higher compaction level.
 
 `EVIDENT_ON_UNUSABLE_REPLICA` is a `runner/docker-images/fargate` (entrypoint) variable translated into the flag above at boot — this CLI never reads it, so it has no row in this README's Configuration table below; see [the Fargate image README](../docker-images/fargate/README.md#when-the-replica-is-unusable-evident_on_unusable_replica). An unrecognised value (including wrong casing, e.g. `Prune`) exits `2`, outside `entrypoint.sh`'s `0|10|20|30|31|32|33` allow-list — a typo **crash-loops the task on attempt 1** rather than falling back to `prune`, and also logs the misleading "credential persistence is DEGRADED" ERROR.
 
-See `specs/local-runner.feature`'s "Recovering session history at startup" scenarios for
-the behavioural anchor (31 comes online, 30 does not).
+The behavioural anchor is explicit: **31 comes online, 30 does not**.
 
 ### `session-db-verify`
 
@@ -327,15 +326,16 @@ same way it already reuses `SESSION-DB-REPLICA-UNUSABLE` for `session-db-classif
 
 ### Why the contract is asymmetric
 
-`restore` and `sync-once` **never** report a domain outcome through the exit code. A
-missing remote object, a corrupt local file, a failed upload, an IAM denial — all of
-those are logged and still exit `0`. None of them should abort a boot: a runner with no
-credentials yet is a runner a human can still log into.
+`restore` logs domain outcomes and still exits `0`: a missing remote object or a
+restore failure should not abort a boot, because a runner with no credentials yet
+is a runner a human can still log into. `sync-once` returns `40` when the current
+credential file is not persisted (`failed`, `hashFailed`, or `localInvalid`), while
+`absent` and `disabled` remain legitimate `0` outcomes.
 
-The consequence is the point: **any non-zero status from `restore`/`sync-once` means the
-tool itself broke** — bad arguments (`2`), an uncaught throw (`1`), or a bundle that
-would not run at all. The shell needs no case analysis to know something is wrong, so
-its "credential persistence is DEGRADED" error lives in exactly one helper.
+The consequence is the point: **any non-zero status from `restore` means the tool itself
+broke** — and `sync-once` uses `40` for its typed persistence answer; other non-zero
+statuses still mean bad arguments (`2`), an uncaught throw (`1`), or a bundle that would
+not run at all. The shell keeps that distinction in one helper.
 
 The **two predicates** — `model-auth-ready` and `self-stop` — each need to distinguish
 "the answer is no" from "the tool is broken", so each answers no with its own dedicated

package/dist/cli.js

@@ -62164,6 +62164,7 @@ var EXIT_SESSION_DB_UNUSABLE = 31;
 var EXIT_SESSION_DB_RETRY = 32;
 var EXIT_SESSION_DB_UNVERIFIABLE = 33;
 var EXIT_SESSION_DB_UNSEPARATED = 34;
+var EXIT_SYNC_NOT_PERSISTED = 40;
 var STATE_SUFFIX = ".synchash";
 var COMMANDS = shell_contract_default.commands;
 var USAGE = `Usage: runner-synchroniser <command> [args]
@@ -62314,6 +62315,7 @@ async function commandSyncOnce(name, config, deps) {
   if (result.hash !== null && result.hash !== lastHash) {
     await writeLastHash(fileOps, statePath, result.hash, log);
   }
+  return result.outcome.kind === "failed" || result.outcome.kind === "hashFailed" || result.outcome.kind === "localInvalid" ? EXIT_SYNC_NOT_PERSISTED : 0;
 }
 async function commandSessionDbClassify(args, config, deps) {
   const { fileOps, log } = deps;
@@ -62451,10 +62453,10 @@ ${USAGE}`);
   }
   if (command12 === "restore") {
     await commandRestore(name, config, deps);
+    return 0;
   } else {
-    await commandSyncOnce(name, config, deps);
+    return commandSyncOnce(name, config, deps);
   }
-  return 0;
 }
 function isEntryPoint() {
   const entry = process.argv[1];
@@ -62487,6 +62489,7 @@ export {
   EXIT_SESSION_DB_UNSEPARATED,
   EXIT_SESSION_DB_UNUSABLE,
   EXIT_SESSION_DB_UNVERIFIABLE,
+  EXIT_SYNC_NOT_PERSISTED,
   EXIT_USAGE,
   main
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@evident-ai/runner-synchroniser",
-  "version": "3.4.1-dev.c03b461",
+  "version": "3.4.1-dev.e91ca26",
   "description": "Restores and syncs the Evident runner's OpenCode credential stores (and litestream config) to an object store, so a runner survives task replacement with almost no state loss.",
   "type": "module",
   "main": "./dist/cli.js",