@indigoai-us/hq-cloud 6.12.5 → 6.13.0

package/dist/types.d.ts

@@ -68,7 +68,7 @@ export interface JournalEntry {
      * the same paths as orphans, then garbage-collected.
      */
     removedAt?: string;
-    removedReason?: "scope_shrink" | "narrow_apply" | "manual";
+    removedReason?: "scope_shrink" | "narrow_apply" | "manual" | "local-delete";
     /**
      * Durable automatic-pull retention marker. Set when a scope shrink keeps an
      * out-of-scope caller-authored or unknown-author entry on disk instead of
@@ -77,6 +77,16 @@ export interface JournalEntry {
      * the entry becomes in-scope again.
      */
     outOfScopeProtected?: boolean;
+    /**
+     * Journal-honesty marker. Set when a conflict was resolved by KEEPing a local
+     * copy that diverges from the remote: the entry still records the remote
+     * `remoteEtag` (so the conflict can't re-fire — the #137 invariant), but the
+     * local bytes never matched that remote. The currency-gated delete planner
+     * refuses to propagate a delete for such an entry — its currency would
+     * falsely "match" on HEAD, and deleting would destroy the divergent remote
+     * version. Cleared by any genuine download (which makes local == remote).
+     */
+    localDiverges?: boolean;
 }
 /**
  * Per-pull boundary record (Journal v2, US-005).

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,IAAI,GAAG,MAAM,CAAC;IACzB;;;;;;;;;;OAUG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,cAAc,GAAG,cAAc,GAAG,QAAQ,CAAC;IAC3D;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,UAAU;IACzB,6DAA6D;IAC7D,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,yCAAyC;IACzC,QAAQ,EAAE,KAAK,GAAG,QAAQ,GAAG,QAAQ,CAAC;IACtC;;;OAGG;IACH,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,mBAAmB,EAAE,OAAO,CAAC;IAC7B,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,WAAW;IAC1B;;;;;OAKG;IACH,OAAO,EAAE,GAAG,GAAG,GAAG,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACpC;;;;OAIG;IACH,KAAK,CAAC,EAAE,UAAU,EAAE,CAAC;CACtB;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,UAAU;IACzB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,UAAU;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,yBAAyB;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,4EAA4E;IAC5E,IAAI,EAAE,MAAM,CAAC;IACb,qCAAqC;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB;IACjB,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;;;;;;;OAaG;IACH,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAC/B;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,+CAA+C;IAC/C,IAAI,EAAE,MAAM,CAAC;IACb,qCAAqC;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gFAAgF;IAChF,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChC;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,8DAA8D;IAC9D,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;;;OASG;IACH,SAAS,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IACrD,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB;;;;;;;;;;;OAWG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;CACnC;AASD,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,qEAAqE;IACrE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,4DAA4D;IAC5D,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,CAAC,CAAC;IACX,SAAS,EAAE,kBAAkB,EAAE,CAAC;CACjC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,IAAI,GAAG,MAAM,CAAC;IACzB;;;;;;;;;;OAUG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,cAAc,GAAG,cAAc,GAAG,QAAQ,GAAG,cAAc,CAAC;IAC5E;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,UAAU;IACzB,6DAA6D;IAC7D,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,yCAAyC;IACzC,QAAQ,EAAE,KAAK,GAAG,QAAQ,GAAG,QAAQ,CAAC;IACtC;;;OAGG;IACH,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,mBAAmB,EAAE,OAAO,CAAC;IAC7B,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,WAAW;IAC1B;;;;;OAKG;IACH,OAAO,EAAE,GAAG,GAAG,GAAG,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACpC;;;;OAIG;IACH,KAAK,CAAC,EAAE,UAAU,EAAE,CAAC;CACtB;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,UAAU;IACzB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,UAAU;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,yBAAyB;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,4EAA4E;IAC5E,IAAI,EAAE,MAAM,CAAC;IACb,qCAAqC;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB;IACjB,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;;;;;;;OAaG;IACH,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAC/B;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,+CAA+C;IAC/C,IAAI,EAAE,MAAM,CAAC;IACb,qCAAqC;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gFAAgF;IAChF,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChC;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,8DAA8D;IAC9D,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;;;OASG;IACH,SAAS,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IACrD,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB;;;;;;;;;;;OAWG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;CACnC;AASD,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,qEAAqE;IACrE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,4DAA4D;IAC5D,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,CAAC,CAAC;IACX,SAAS,EAAE,kBAAkB,EAAE,CAAC;CACjC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cloud",
-  "version": "6.12.5",
+  "version": "6.13.0",
   "description": "HQ by Indigo cloud sync engine — bidirectional S3 sync for mobile access",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/bin/sync-runner.test.ts

@@ -3580,6 +3580,47 @@ describe("resolvePullScope", () => {
     expect(scope.prefixSet).toEqual(["knowledge/", "shared/"]);
   });
 
+  // Regression lock-in (Michal / ridge report): a non-owner member whose
+  // ONLY grant is a COMPANY-WIDE write grant (surfaced by the server as
+  // `source: "open"`) on a projects prefix — and who has NO direct
+  // person/group/email grant — MUST resolve a non-empty shared scope that
+  // COVERS that prefix. The reported bug was the push resolving an empty/
+  // sparse prefixSet here (ignoring company-wide grants), so every file was
+  // scope-excluded (403 SCOPE_EXCEEDS_PARENT on old clients, silent no-op on
+  // 5.54.1). resolvePullScope treats a company-wide `open` grant identically
+  // to a direct grant; this test guards against a future filter that drops
+  // `source: "open"` and re-introduces the silent-drop regression.
+  it("honors a company-wide-only write grant as the shared push scope (no empty-prune)", async () => {
+    const scope = await resolvePullScope(
+      stubClient({
+        listMyMemberships: async () => [membership("cmp_a", "mk_a")],
+        getMembershipSyncConfig: async () => ({
+          membershipId: "mk_a",
+          syncMode: "shared",
+          isDefault: false,
+        }),
+        // Exactly one grant, company-wide WRITE, no direct grant.
+        listMyExplicitGrants: async () =>
+          [
+            {
+              companyUid: "cmp_a",
+              path: "projects/alpha/",
+              permission: "write",
+              source: "open",
+            },
+          ] as never,
+      }),
+      "cmp_a",
+      "acme",
+    );
+    expect(scope.syncMode).toBe("shared");
+    // The granted prefix is present — NOT an empty set (which would scope-
+    // exclude every file and silently push nothing).
+    expect(scope.prefixSet).toEqual(["projects/alpha/"]);
+    expect(scope.prefixSet).not.toEqual([]);
+    expect(scope.prefixSet?.length).toBeGreaterThan(0);
+  });
+
   it("normalizes real-world mixed/glob grant paths into company-relative prefixes", async () => {
     // The exact shapes observed in the live hq-pro vault for `indigo`:
     // bare glob, full-anchored + /*, full-anchored exact file, slug-anchored

package/src/cli/share.test.ts

@@ -2470,6 +2470,61 @@ describe("share", () => {
     expect(journal.files["core/policies/old.md"]).toBeUndefined();
   });
 
+  it("currency-gated: propagates the S3 delete for a local-delete tombstone (pull-leg producer hand-off)", async () => {
+    // The pull-leg producer stamped a persisting `local-delete` tombstone for a
+    // file the user deleted (no respawn). The cross-leg hand-off: on the next
+    // push the S3 object must actually be DELETED and the entry dropped, so the
+    // deletion propagates to the cloud + every other surface.
+    const companyRoot = path.join(tmpDir, "companies", "acme");
+    fs.mkdirSync(companyRoot, { recursive: true });
+    const journalPath = path.join(stateDir, "sync-journal.acme.json");
+    fs.writeFileSync(
+      journalPath,
+      JSON.stringify({
+        version: "2",
+        lastSync: new Date().toISOString(),
+        files: {
+          "docs/deleted.md": {
+            hash: "h",
+            size: 100,
+            syncedAt: new Date().toISOString(),
+            direction: "down",
+            remoteEtag: "abc123",
+            removedAt: new Date().toISOString(),
+            removedReason: "local-delete",
+          },
+        },
+        pulls: [],
+      }),
+    );
+
+    // HEAD returns the same etag — this device had the current version, so the
+    // currency-gated delete is safe to propagate.
+    vi.mocked(headRemoteFile).mockResolvedValueOnce({
+      lastModified: new Date(),
+      etag: '"abc123"',
+      size: 100,
+    });
+
+    const result = await share({
+      paths: [companyRoot],
+      company: "acme",
+      vaultConfig: mockConfig,
+      hqRoot: tmpDir,
+      skipUnchanged: true,
+      propagateDeletes: true,
+      propagateDeletePolicy: "currency-gated",
+    });
+
+    expect(result.filesDeleted).toBe(1);
+    expect(deleteRemoteFile).toHaveBeenCalledWith(
+      expect.anything(),
+      "docs/deleted.md",
+    );
+    const journal = JSON.parse(fs.readFileSync(journalPath, "utf-8"));
+    expect(journal.files["docs/deleted.md"]).toBeUndefined();
+  });
+
   it("currency-gated: refuses delete + emits stale-etag event when remote moved since last sync", async () => {
     const companyRoot = path.join(tmpDir, "companies", "acme");
     fs.mkdirSync(companyRoot, { recursive: true });
@@ -2531,6 +2586,70 @@ describe("share", () => {
     expect(result.filesTombstoned).toBe(0);
   });
 
+  it("currency-gated: refuses delete for a divergent-local entry (journal-honesty — never delete a remote the local never genuinely matched)", async () => {
+    const companyRoot = path.join(tmpDir, "companies", "acme");
+    fs.mkdirSync(companyRoot, { recursive: true });
+    // A keep-conflict recorded the REMOTE etag (so the conflict can't re-fire —
+    // the #137 invariant) but the kept LOCAL content DIVERGED from that remote
+    // (`localDiverges:true`). The local copy was then deleted. The currency HEAD
+    // would MATCH the recorded etag — the trap — yet the etag never reflected a
+    // genuine local==remote sync, so propagating the delete would destroy the
+    // (different) remote version. Must be REFUSED, not propagated.
+    const journalPath = path.join(stateDir, "sync-journal.acme.json");
+    fs.writeFileSync(
+      journalPath,
+      JSON.stringify({
+        version: "2",
+        lastSync: new Date().toISOString(),
+        files: {
+          "core/policies/kept.md": {
+            hash: "local-divergent-hash",
+            size: 100,
+            syncedAt: new Date().toISOString(),
+            direction: "down",
+            remoteEtag: "abc123",
+            localDiverges: true,
+          },
+        },
+        pulls: [],
+      }),
+    );
+
+    // Deliberately NO HEAD mock: the divergence guard short-circuits BEFORE the
+    // currency HEAD, so `headRemoteFile` is never called for this entry — the
+    // refusal costs no network round-trip (asserted below).
+    const events: Array<{ type: string; path?: string; reason?: string }> = [];
+    const result = await share({
+      paths: [companyRoot],
+      company: "acme",
+      vaultConfig: mockConfig,
+      hqRoot: tmpDir,
+      skipUnchanged: true,
+      propagateDeletes: true,
+      propagateDeletePolicy: "currency-gated",
+      onEvent: (e) => events.push(e as { type: string }),
+    });
+
+    // No remote DELETE — the recorded etag never reflected a genuine sync.
+    expect(result.filesDeleted).toBe(0);
+    expect(deleteRemoteFile).not.toHaveBeenCalledWith(
+      expect.anything(),
+      "core/policies/kept.md",
+    );
+    // Refusal short-circuits before the currency HEAD — no network needed.
+    expect(headRemoteFile).not.toHaveBeenCalled();
+    // Journal entry preserved, not silently dropped.
+    const journal = JSON.parse(fs.readFileSync(journalPath, "utf-8"));
+    expect(journal.files["core/policies/kept.md"]).toBeDefined();
+    // Surfaced as a refusal with the divergent-local reason.
+    const refused = events.find((e) => e.type === "delete-refused-stale-etag");
+    expect(refused).toMatchObject({
+      type: "delete-refused-stale-etag",
+      path: "core/policies/kept.md",
+      reason: "divergent-local",
+    });
+  });
+
   it("currency-gated: tombstones journal entry when remote returns 404 (out-of-band cleanup)", async () => {
     const companyRoot = path.join(tmpDir, "companies", "acme");
     fs.mkdirSync(companyRoot, { recursive: true });

package/src/cli/share.ts

@@ -1987,7 +1987,11 @@ function resolveDeleteScopeRoots(
  *                          tracked. `journalEtag` and `remoteEtag` are
  *                          placeholder sentinels — do not display as ETags.
  */
-type RefusedStaleReason = "stale-etag" | "legacy-no-etag" | "bulk-asymmetry";
+type RefusedStaleReason =
+  | "stale-etag"
+  | "legacy-no-etag"
+  | "bulk-asymmetry"
+  | "divergent-local";
 
 /**
  * Bulk-asymmetry circuit-breaker — refuses to convert a suspiciously-large
@@ -2241,6 +2245,22 @@ async function computeDeletePlan(
     // documentation of the policy-side intent.
     if (isEphemeralPath(relativeKey)) continue;
 
+    // Journal-honesty guard: an entry flagged `localDiverges` recorded the
+    // remote etag only to silence a re-fired conflict (#137) — the local copy
+    // NEVER matched that remote. Its currency would falsely "match" on HEAD, so
+    // propagating a delete would destroy the divergent remote version. Refuse it
+    // regardless of policy, and do NOT count it toward the bulk-asymmetry ratio
+    // (it isn't a genuine mirror-loss candidate). Cleared by a real download.
+    if (entry.localDiverges) {
+      plan.refusedStale.push({
+        key: relativeKey,
+        journalEtag: entry.remoteEtag ?? "<divergent-local>",
+        remoteEtag: "<not-checked>",
+        reason: "divergent-local",
+      });
+      continue;
+    }
+
     if (policy === "all") {
       // policy:"all" is the explicit-opt-out emergency-reconcile mode; the
       // bulk-asymmetry guard skips this branch (caller asserted intent).

package/src/cli/sync.test.ts

@@ -279,6 +279,76 @@ describe("sync", () => {
     expect(fs.readFileSync(path.join(companyDocs, "handoff.md"), "utf-8")).toBe("local version");
   });
 
+  it("conflict keep marks the entry localDiverges (journal-honesty: kept copy never matched the recorded remote etag)", async () => {
+    const companyDocs = path.join(tmpDir, "companies", "acme", "docs");
+    fs.mkdirSync(companyDocs, { recursive: true });
+    fs.writeFileSync(path.join(companyDocs, "handoff.md"), "local version");
+    fs.writeFileSync(
+      journalPath,
+      JSON.stringify({
+        version: "1",
+        lastSync: new Date().toISOString(),
+        files: {
+          "docs/handoff.md": {
+            hash: "old-hash-from-last-sync",
+            size: 20,
+            syncedAt: new Date(Date.now() - 3600000).toISOString(),
+            direction: "down",
+          },
+        },
+      }),
+    );
+
+    const result = await sync({
+      company: "acme",
+      onConflict: "keep",
+      vaultConfig: mockConfig,
+      hqRoot: tmpDir,
+    });
+
+    expect(result.conflicts).toBe(1);
+    const journal = JSON.parse(fs.readFileSync(journalPath, "utf-8"));
+    // remoteEtag still recorded so the conflict can't re-fire (#137 invariant)…
+    expect(journal.files["docs/handoff.md"].remoteEtag).toBeTruthy();
+    // …but the kept-local copy is flagged divergent so a later currency-gated
+    // delete cannot fire on a journal that lies about local==remote.
+    expect(journal.files["docs/handoff.md"].localDiverges).toBe(true);
+  });
+
+  it("a genuine download clears a stale localDiverges flag (entry is now truly local==remote)", async () => {
+    const companyDocs = path.join(tmpDir, "companies", "acme", "docs");
+    fs.mkdirSync(companyDocs, { recursive: true });
+    fs.writeFileSync(
+      journalPath,
+      JSON.stringify({
+        version: "2",
+        lastSync: new Date().toISOString(),
+        files: {
+          "docs/handoff.md": {
+            hash: "old-divergent-hash",
+            size: 20,
+            syncedAt: new Date(Date.now() - 3600000).toISOString(),
+            direction: "down",
+            remoteEtag: "old-etag",
+            localDiverges: true,
+          },
+        },
+        pulls: [],
+      }),
+    );
+    // Remote advanced to a new etag; local absent → genuine download lands the
+    // remote bytes, so local==remote now and the divergence flag must clear.
+    vi.mocked(s3Module.listRemoteFiles).mockResolvedValueOnce([
+      { key: "docs/handoff.md", size: 42, lastModified: new Date(), etag: '"new-etag"' },
+    ]);
+
+    await sync({ company: "acme", vaultConfig: mockConfig, hqRoot: tmpDir });
+
+    expect(fs.existsSync(path.join(companyDocs, "handoff.md"))).toBe(true);
+    const journal = JSON.parse(fs.readFileSync(journalPath, "utf-8"));
+    expect(journal.files["docs/handoff.md"]?.localDiverges).toBeFalsy();
+  });
+
   it("emits a conflict event with path + resolution on hash mismatch", async () => {
     const companyDocs = path.join(tmpDir, "companies", "acme", "docs");
     fs.mkdirSync(companyDocs, { recursive: true });
@@ -884,6 +954,192 @@ describe("sync", () => {
     expect(journal.files[trackedKey]).toBeUndefined();
   });
 
+  it("local journal tombstone suppresses drift-restore: a deleted-but-still-remote key is NOT re-downloaded (no respawn)", async () => {
+    // Repro of the intermittent delete-respawn: the user deleted a clean file,
+    // its delete has not (yet) cleared the S3 object, and the SERVER
+    // FILE_TOMBSTONE fetch is degraded (empty map — the logged failure mode).
+    // The only intent record is the LOCAL journal tombstone (`removedAt`).
+    // The drift-restore path must honor it and NOT re-download the key.
+    const key = "docs/handoff.md";
+    const localPath = path.join(tmpDir, "companies", "acme", key);
+
+    // Remote still lists the object, etag matching the journal, lastModified
+    // BEFORE the local delete — a stale resurrection of a deleted key, not a
+    // genuine remote re-create.
+    vi.mocked(s3Module.listRemoteFiles).mockResolvedValueOnce([
+      {
+        key,
+        size: 42,
+        lastModified: new Date(Date.now() - 2 * 86_400_000),
+        etag: '"abc123"',
+      },
+    ]);
+    // Degraded-fetch case: server FILE_TOMBSTONE map is EMPTY.
+    setupFetchMock({ tombstones: [] });
+
+    // Local file ABSENT (user deleted it). Journal entry is a TOMBSTONE,
+    // recent enough to survive TTL GC.
+    fs.writeFileSync(
+      journalPath,
+      JSON.stringify({
+        version: "2",
+        lastSync: "2026-06-19T00:00:00.000Z",
+        files: {
+          [key]: {
+            hash: "deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef",
+            size: 42,
+            syncedAt: "2026-06-19T00:00:00.000Z",
+            direction: "down",
+            remoteEtag: "abc123",
+            removedAt: new Date().toISOString(),
+            removedReason: "local-delete",
+          },
+        },
+        pulls: [],
+      }),
+    );
+
+    await sync({
+      company: "acme",
+      vaultConfig: mockConfig,
+      hqRoot: tmpDir,
+      onEvent: () => {},
+    });
+
+    // The intentionally-deleted key must NOT be re-materialised.
+    expect(s3Module.downloadFile).not.toHaveBeenCalledWith(
+      expect.anything(),
+      key,
+      expect.anything(),
+    );
+    expect(fs.existsSync(localPath)).toBe(false);
+  });
+
+  it("pull producer: a single clean/current/non-divergent missing file is tombstoned (intentional delete), not drift-restored", async () => {
+    // The user deleted a genuinely-synced file. Its entry is clean (etag matches
+    // the current remote — currency holds), not divergent. The pull leg must
+    // treat the absence as an intentional delete: stamp a persisting
+    // `local-delete` tombstone and SKIP the re-download — not resurrect it.
+    const key = "docs/gone.md";
+    const localPath = path.join(tmpDir, "companies", "acme", key);
+    vi.mocked(s3Module.listRemoteFiles).mockResolvedValueOnce([
+      { key, size: 42, lastModified: new Date(), etag: '"cur123"' },
+    ]);
+    setupFetchMock({ tombstones: [] });
+    fs.writeFileSync(
+      journalPath,
+      JSON.stringify({
+        version: "2",
+        lastSync: new Date().toISOString(),
+        files: {
+          [key]: {
+            hash: "h",
+            size: 42,
+            syncedAt: new Date().toISOString(),
+            direction: "down",
+            remoteEtag: "cur123",
+          },
+        },
+        pulls: [],
+      }),
+    );
+
+    await sync({ company: "acme", vaultConfig: mockConfig, hqRoot: tmpDir });
+
+    expect(s3Module.downloadFile).not.toHaveBeenCalledWith(
+      expect.anything(),
+      key,
+      expect.anything(),
+    );
+    expect(fs.existsSync(localPath)).toBe(false);
+    const journal = JSON.parse(fs.readFileSync(journalPath, "utf-8"));
+    expect(journal.files[key]?.removedAt).toBeTruthy();
+    expect(journal.files[key]?.removedReason).toBe("local-delete");
+  });
+
+  it("pull producer: a BULK disappearance is drift-restored, NOT tombstoned (ridge-incident guard in the pull leg)", async () => {
+    // 12 clean files vanish at once (corrupt mirror / bulk rm / checkout). The
+    // bulk-asymmetry guard refuses to treat this as intent — every file is
+    // healed (re-downloaded), none tombstoned.
+    const keys = Array.from({ length: 12 }, (_, i) => `docs/f${i}.md`);
+    vi.mocked(s3Module.listRemoteFiles).mockResolvedValueOnce(
+      keys.map((k) => ({ key: k, size: 10, lastModified: new Date(), etag: `"e-${k}"` })),
+    );
+    setupFetchMock({ tombstones: [] });
+    const files: Record<string, unknown> = {};
+    for (const k of keys) {
+      files[k] = {
+        hash: "h",
+        size: 10,
+        syncedAt: new Date().toISOString(),
+        direction: "down",
+        remoteEtag: `e-${k}`,
+      };
+    }
+    fs.writeFileSync(
+      journalPath,
+      JSON.stringify({
+        version: "2",
+        lastSync: new Date().toISOString(),
+        files,
+        pulls: [],
+      }),
+    );
+
+    await sync({ company: "acme", vaultConfig: mockConfig, hqRoot: tmpDir });
+
+    // All restored, none tombstoned.
+    expect(s3Module.downloadFile).toHaveBeenCalledTimes(12);
+    const journal = JSON.parse(fs.readFileSync(journalPath, "utf-8"));
+    for (const k of keys) {
+      expect(journal.files[k]?.removedAt).toBeUndefined();
+    }
+  });
+
+  it("pull producer: a local-delete tombstone persists across pulls (not consumed/removed), so the delete stays propagatable", async () => {
+    // After the intentional-delete tombstone is stamped, a later pull must NOT
+    // drop the entry (the push leg still needs it to propagate the S3 delete).
+    // It stays skipped + preserved until the push propagates or TTL GC.
+    const key = "docs/gone.md";
+    const localPath = path.join(tmpDir, "companies", "acme", key);
+    vi.mocked(s3Module.listRemoteFiles).mockResolvedValueOnce([
+      { key, size: 42, lastModified: new Date(Date.now() - 2 * 86_400_000), etag: '"cur123"' },
+    ]);
+    setupFetchMock({ tombstones: [] });
+    fs.writeFileSync(
+      journalPath,
+      JSON.stringify({
+        version: "2",
+        lastSync: new Date().toISOString(),
+        files: {
+          [key]: {
+            hash: "h",
+            size: 42,
+            syncedAt: new Date().toISOString(),
+            direction: "down",
+            remoteEtag: "cur123",
+            removedAt: new Date().toISOString(),
+            removedReason: "local-delete",
+          },
+        },
+        pulls: [],
+      }),
+    );
+
+    await sync({ company: "acme", vaultConfig: mockConfig, hqRoot: tmpDir });
+
+    expect(s3Module.downloadFile).not.toHaveBeenCalledWith(
+      expect.anything(),
+      key,
+      expect.anything(),
+    );
+    expect(fs.existsSync(localPath)).toBe(false);
+    const journal = JSON.parse(fs.readFileSync(journalPath, "utf-8"));
+    // Entry PRESERVED as a tombstone, not removed.
+    expect(journal.files[key]?.removedAt).toBeTruthy();
+    expect(journal.files[key]?.removedReason).toBe("local-delete");
+  });
+
   it("aborts on --on-conflict abort", async () => {
     const companyDocs = path.join(tmpDir, "companies", "acme", "docs");
     fs.mkdirSync(companyDocs, { recursive: true });