@indigoai-us/hq-cloud 5.37.0 → 5.38.0

package/src/cli/sync.ts

@@ -135,12 +135,47 @@ export type SyncProgressEvent =
        *     `journalEtag` and `remoteEtag` are sentinel strings
        *     (`<legacy-no-etag>` / `<unknown>`) — do not render as ETags.
        *     Consumers should branch on `reason`, not on the etag values.
+       *
+       *   - `"bulk-asymmetry"`: the bulk-asymmetry circuit-breaker tripped
+       *     (see `delete-refused-bulk-asymmetry`). Each candidate that would
+       *     have been deleted also surfaces here for path-level visibility.
+       *     `journalEtag` and `remoteEtag` are sentinel strings
+       *     (`<bulk-asymmetry>` / `<not-checked>`) since no HEAD was issued.
        */
       type: "delete-refused-stale-etag";
       path: string;
       journalEtag: string;
       remoteEtag: string;
-      reason: "stale-etag" | "legacy-no-etag";
+      reason: "stale-etag" | "legacy-no-etag" | "bulk-asymmetry";
+    }
+  | {
+      /**
+       * Emitted at most ONCE per `share()` call when the bulk-asymmetry
+       * circuit-breaker tripped: a large fraction of the in-scope journal
+       * entries are missing locally, suggesting the local mirror is corrupt
+       * (moved hqRoot, partial restore, fresh clone over inherited state,
+       * unmounted volume, accidental `rm -rf`) rather than a deliberate
+       * delete. The engine refuses to convert the missing entries into
+       * remote `DeleteObject` calls; every refused candidate also surfaces
+       * via `delete-refused-stale-etag` with `reason: "bulk-asymmetry"`.
+       *
+       * Trip condition: `candidates >= 10 AND candidates / inScope >= 0.10`.
+       * Bypass: set `HQ_SYNC_DELETE_BULK_OVERRIDE=1` (truthy: `1|true|yes`,
+       * case-insensitive) OR pass `propagateDeletePolicy: "all"` (the
+       * existing emergency-reconcile policy which already opts out of
+       * safety gates).
+       *
+       * `candidates` is the number of journal entries whose local file is
+       * missing AND would have been delete-candidates absent the guard;
+       * `inScope` is the total journal entries under the share's scope
+       * roots; `ratio = candidates / inScope`; `samplePaths` carries up to
+       * 10 refused keys for diagnostic display.
+       */
+      type: "delete-refused-bulk-asymmetry";
+      candidates: number;
+      inScope: number;
+      ratio: number;
+      samplePaths: string[];
     }
   | {
       /**