@indigoai-us/hq-cloud 6.12.5 → 6.13.0

package/src/cli/sync.ts

@@ -34,6 +34,8 @@ import {
   normalizeEtag,
   migrateToV2,
   gcTombstones,
+  isTombstone,
+  tombstoneEntry,
   lastPullRecord,
   appendPullRecord,
   generatePullId,
@@ -213,7 +215,7 @@ export type SyncProgressEvent =
       path: string;
       journalEtag: string;
       remoteEtag: string;
-      reason: "stale-etag" | "legacy-no-etag" | "bulk-asymmetry";
+      reason: "stale-etag" | "legacy-no-etag" | "bulk-asymmetry" | "divergent-local";
     }
   | {
       /**
@@ -1209,6 +1211,14 @@ async function executeConflictItem(
       remoteFile.etag,
       item.localMtime.getTime(),
     );
+    // Journal-honesty: we recorded the remote etag so this conflict can't
+    // re-fire (#137), but the KEPT local copy diverges from that remote — it
+    // never matched it. Flag the entry so the currency-gated delete planner
+    // refuses to propagate a delete for it (its currency would falsely match on
+    // HEAD, and the delete would destroy the divergent remote version). Any
+    // genuine future download clears the flag by replacing the entry.
+    const keptEntry = getEntry(run.journal, remoteFile.key);
+    if (keptEntry) keptEntry.localDiverges = true;
     return null;
   }
 
@@ -1738,6 +1748,15 @@ interface PullPlan {
  * caller (`sync()`) is responsible for emitting the resulting plan event
  * before iterating `items`.
  */
+// Pull-leg intentional-delete bulk-asymmetry breaker. Mirrors the push leg's
+// BULK_ASYMMETRY_* (share.ts): an abnormally large fraction of clean files
+// vanishing at once is a corrupt mirror / bulk op / unmount (the ridge-incident
+// class), not intent — so at/above the threshold the pull leg drift-restores
+// every candidate instead of tombstoning it. Below it, a missing clean file is
+// an intentional delete.
+const PULL_INTENTIONAL_DELETE_MIN_ABS = 10;
+const PULL_INTENTIONAL_DELETE_RATIO = 0.1;
+
 function computePullPlan(
   remoteFiles: RemoteFile[],
   journal: SyncJournal,
@@ -1758,6 +1777,12 @@ function computePullPlan(
   fileTombstones: ReadonlyMap<string, CompanyTombstone> = new Map(),
 ): PullPlan {
   const items: PullPlanItem[] = [];
+  // Clean/current/non-divergent files missing locally — collected here, then
+  // resolved post-loop by the bulk-asymmetry decision (tombstone vs. restore).
+  const intentionalDeleteCandidates: Array<{
+    remoteFile: RemoteFile;
+    localPath: string;
+  }> = [];
 
   for (const remoteFile of remoteFiles) {
     const localPath = resolveContainedVaultPath(companyRoot, remoteFile.key);
@@ -1851,6 +1876,23 @@ function computePullPlan(
     const tombstoneSuppresses =
       tombstone !== undefined &&
       !isRemoteRecreateAfterTombstone(remoteFile, tombstone);
+    // LOCAL journal tombstone — this machine's own intentional-delete record,
+    // independent of the (best-effort, intermittently-degraded) server
+    // FILE_TOMBSTONE fetch above. When a clean local delete is classified, the
+    // push leg stamps `removedAt` on the journal entry; honoring it here makes
+    // the delete-vs-drift-restore outcome DETERMINISTIC, closing the
+    // intermittent respawn where a degraded tombstone fetch let the pull leg
+    // re-materialize an intentionally-deleted file. Reuses the same re-create
+    // guard (a remote object newer than the local delete is a genuine re-create
+    // and still downloads). Consulted ONLY on the `!localExists` re-download
+    // path below — never to delete a file that is present locally.
+    const localTombstoneSuppresses =
+      journalEntry !== undefined &&
+      isTombstone(journalEntry) &&
+      journalEntry.removedAt !== undefined &&
+      !isRemoteRecreateAfterTombstone(remoteFile, {
+        deletedAt: journalEntry.removedAt,
+      });
 
     // lstat (not existsSync/statSync) handles three cases the legacy
     // checks got wrong for symlinks:
@@ -2074,15 +2116,67 @@ function computePullPlan(
     // re-create": the classic resurrection ("remote present → I'm behind →
     // download") the planner must NOT do. Route to `tombstone-delete` so the
     // executor drops any stale journal entry and the key stays gone, instead of
-    // pulling the deleted object back in.
-    if (tombstoneSuppresses) {
+    // pulling the deleted object back in. `localTombstoneSuppresses` adds the
+    // same protection driven by this machine's own journal tombstone, so an
+    // intentional delete is not resurrected even when the server FILE_TOMBSTONE
+    // fetch is degraded.
+    if (tombstoneSuppresses || localTombstoneSuppresses) {
+      // A persisting `local-delete` tombstone (stamped by the intentional-delete
+      // producer below) must KEEP its journal entry — the push leg still needs
+      // it to propagate the S3 delete. Skip the re-download without dropping the
+      // entry. Other tombstone kinds (scope-shrink / FILE_TOMBSTONE) drop it.
+      if (journalEntry?.removedReason === "local-delete") {
+        continue;
+      }
       items.push({ action: "tombstone-delete", remoteFile, localPath });
       continue;
     }
 
+    // Intentional-delete producer: a clean, CURRENT (etag matches), non-divergent
+    // file that is MISSING locally is the user deleting a genuinely-synced file.
+    // Collect it; the post-loop bulk-asymmetry decision tombstones it (intent) or
+    // restores it (mass loss = accident). A stale-etag, divergent, tombstoned, or
+    // never-journaled missing file falls through to the normal download below.
+    if (
+      !localExists &&
+      journalEntry !== undefined &&
+      !isTombstone(journalEntry) &&
+      !journalEntry.localDiverges &&
+      journalEntry.remoteEtag !== undefined &&
+      normalizeEtag(remoteFile.etag) === journalEntry.remoteEtag
+    ) {
+      intentionalDeleteCandidates.push({ remoteFile, localPath });
+      continue;
+    }
+
     items.push({ action: "download", remoteFile, localPath, isNew: !localExists });
   }
 
+  // ── Intentional-delete bulk-asymmetry decision (pull-leg producer) ─────────
+  // Below the breaker → stamp a persisting `local-delete` tombstone (the
+  // suppression above keeps it from being re-pulled; the push leg propagates the
+  // S3 delete on its next pass). At/above → drift-restore EVERY candidate: a
+  // mass disappearance (corrupt mirror / bulk rm / checkout / unmount) is
+  // accidental loss, never intent (the ridge-incident guard).
+  const totalJournalEntries = Object.keys(journal.files).length;
+  const intentionalDeleteIsBulk =
+    intentionalDeleteCandidates.length >= PULL_INTENTIONAL_DELETE_MIN_ABS &&
+    totalJournalEntries > 0 &&
+    intentionalDeleteCandidates.length / totalJournalEntries >=
+      PULL_INTENTIONAL_DELETE_RATIO;
+  for (const cand of intentionalDeleteCandidates) {
+    if (intentionalDeleteIsBulk) {
+      items.push({
+        action: "download",
+        remoteFile: cand.remoteFile,
+        localPath: cand.localPath,
+        isNew: true,
+      });
+    } else {
+      tombstoneEntry(journal, cand.remoteFile.key, "local-delete");
+    }
+  }
+
   let filesToDownload = 0;
   let bytesToDownload = 0;
   let filesToSkip = 0;

package/src/journal.ts

@@ -537,7 +537,7 @@ export function appendPullRecord(
 export function tombstoneEntry(
   journal: SyncJournal,
   relativePath: string,
-  reason: "scope_shrink" | "narrow_apply" | "manual",
+  reason: "scope_shrink" | "narrow_apply" | "manual" | "local-delete",
   now: string = new Date().toISOString(),
 ): void {
   const entry = journal.files[relativePath];

package/src/types.ts

@@ -71,7 +71,7 @@ export interface JournalEntry {
    * the same paths as orphans, then garbage-collected.
    */
   removedAt?: string;
-  removedReason?: "scope_shrink" | "narrow_apply" | "manual";
+  removedReason?: "scope_shrink" | "narrow_apply" | "manual" | "local-delete";
   /**
    * Durable automatic-pull retention marker. Set when a scope shrink keeps an
    * out-of-scope caller-authored or unknown-author entry on disk instead of
@@ -80,6 +80,16 @@ export interface JournalEntry {
    * the entry becomes in-scope again.
    */
   outOfScopeProtected?: boolean;
+  /**
+   * Journal-honesty marker. Set when a conflict was resolved by KEEPing a local
+   * copy that diverges from the remote: the entry still records the remote
+   * `remoteEtag` (so the conflict can't re-fire — the #137 invariant), but the
+   * local bytes never matched that remote. The currency-gated delete planner
+   * refuses to propagate a delete for such an entry — its currency would
+   * falsely "match" on HEAD, and deleting would destroy the divergent remote
+   * version. Cleared by any genuine download (which makes local == remote).
+   */
+  localDiverges?: boolean;
 }
 
 /**