@indigoai-us/hq-cloud 6.12.5 → 6.13.1

package/src/cli/share.test.ts

@@ -2470,6 +2470,61 @@ describe("share", () => {
     expect(journal.files["core/policies/old.md"]).toBeUndefined();
   });
 
+  it("currency-gated: propagates the S3 delete for a local-delete tombstone (pull-leg producer hand-off)", async () => {
+    // The pull-leg producer stamped a persisting `local-delete` tombstone for a
+    // file the user deleted (no respawn). The cross-leg hand-off: on the next
+    // push the S3 object must actually be DELETED and the entry dropped, so the
+    // deletion propagates to the cloud + every other surface.
+    const companyRoot = path.join(tmpDir, "companies", "acme");
+    fs.mkdirSync(companyRoot, { recursive: true });
+    const journalPath = path.join(stateDir, "sync-journal.acme.json");
+    fs.writeFileSync(
+      journalPath,
+      JSON.stringify({
+        version: "2",
+        lastSync: new Date().toISOString(),
+        files: {
+          "docs/deleted.md": {
+            hash: "h",
+            size: 100,
+            syncedAt: new Date().toISOString(),
+            direction: "down",
+            remoteEtag: "abc123",
+            removedAt: new Date().toISOString(),
+            removedReason: "local-delete",
+          },
+        },
+        pulls: [],
+      }),
+    );
+
+    // HEAD returns the same etag — this device had the current version, so the
+    // currency-gated delete is safe to propagate.
+    vi.mocked(headRemoteFile).mockResolvedValueOnce({
+      lastModified: new Date(),
+      etag: '"abc123"',
+      size: 100,
+    });
+
+    const result = await share({
+      paths: [companyRoot],
+      company: "acme",
+      vaultConfig: mockConfig,
+      hqRoot: tmpDir,
+      skipUnchanged: true,
+      propagateDeletes: true,
+      propagateDeletePolicy: "currency-gated",
+    });
+
+    expect(result.filesDeleted).toBe(1);
+    expect(deleteRemoteFile).toHaveBeenCalledWith(
+      expect.anything(),
+      "docs/deleted.md",
+    );
+    const journal = JSON.parse(fs.readFileSync(journalPath, "utf-8"));
+    expect(journal.files["docs/deleted.md"]).toBeUndefined();
+  });
+
   it("currency-gated: refuses delete + emits stale-etag event when remote moved since last sync", async () => {
     const companyRoot = path.join(tmpDir, "companies", "acme");
     fs.mkdirSync(companyRoot, { recursive: true });
@@ -2531,6 +2586,70 @@ describe("share", () => {
     expect(result.filesTombstoned).toBe(0);
   });
 
+  it("currency-gated: refuses delete for a divergent-local entry (journal-honesty — never delete a remote the local never genuinely matched)", async () => {
+    const companyRoot = path.join(tmpDir, "companies", "acme");
+    fs.mkdirSync(companyRoot, { recursive: true });
+    // A keep-conflict recorded the REMOTE etag (so the conflict can't re-fire —
+    // the #137 invariant) but the kept LOCAL content DIVERGED from that remote
+    // (`localDiverges:true`). The local copy was then deleted. The currency HEAD
+    // would MATCH the recorded etag — the trap — yet the etag never reflected a
+    // genuine local==remote sync, so propagating the delete would destroy the
+    // (different) remote version. Must be REFUSED, not propagated.
+    const journalPath = path.join(stateDir, "sync-journal.acme.json");
+    fs.writeFileSync(
+      journalPath,
+      JSON.stringify({
+        version: "2",
+        lastSync: new Date().toISOString(),
+        files: {
+          "core/policies/kept.md": {
+            hash: "local-divergent-hash",
+            size: 100,
+            syncedAt: new Date().toISOString(),
+            direction: "down",
+            remoteEtag: "abc123",
+            localDiverges: true,
+          },
+        },
+        pulls: [],
+      }),
+    );
+
+    // Deliberately NO HEAD mock: the divergence guard short-circuits BEFORE the
+    // currency HEAD, so `headRemoteFile` is never called for this entry — the
+    // refusal costs no network round-trip (asserted below).
+    const events: Array<{ type: string; path?: string; reason?: string }> = [];
+    const result = await share({
+      paths: [companyRoot],
+      company: "acme",
+      vaultConfig: mockConfig,
+      hqRoot: tmpDir,
+      skipUnchanged: true,
+      propagateDeletes: true,
+      propagateDeletePolicy: "currency-gated",
+      onEvent: (e) => events.push(e as { type: string }),
+    });
+
+    // No remote DELETE — the recorded etag never reflected a genuine sync.
+    expect(result.filesDeleted).toBe(0);
+    expect(deleteRemoteFile).not.toHaveBeenCalledWith(
+      expect.anything(),
+      "core/policies/kept.md",
+    );
+    // Refusal short-circuits before the currency HEAD — no network needed.
+    expect(headRemoteFile).not.toHaveBeenCalled();
+    // Journal entry preserved, not silently dropped.
+    const journal = JSON.parse(fs.readFileSync(journalPath, "utf-8"));
+    expect(journal.files["core/policies/kept.md"]).toBeDefined();
+    // Surfaced as a refusal with the divergent-local reason.
+    const refused = events.find((e) => e.type === "delete-refused-stale-etag");
+    expect(refused).toMatchObject({
+      type: "delete-refused-stale-etag",
+      path: "core/policies/kept.md",
+      reason: "divergent-local",
+    });
+  });
+
   it("currency-gated: tombstones journal entry when remote returns 404 (out-of-band cleanup)", async () => {
     const companyRoot = path.join(tmpDir, "companies", "acme");
     fs.mkdirSync(companyRoot, { recursive: true });

package/src/cli/share.ts

@@ -1987,7 +1987,11 @@ function resolveDeleteScopeRoots(
  *                          tracked. `journalEtag` and `remoteEtag` are
  *                          placeholder sentinels — do not display as ETags.
  */
-type RefusedStaleReason = "stale-etag" | "legacy-no-etag" | "bulk-asymmetry";
+type RefusedStaleReason =
+  | "stale-etag"
+  | "legacy-no-etag"
+  | "bulk-asymmetry"
+  | "divergent-local";
 
 /**
  * Bulk-asymmetry circuit-breaker — refuses to convert a suspiciously-large
@@ -2241,6 +2245,22 @@ async function computeDeletePlan(
     // documentation of the policy-side intent.
     if (isEphemeralPath(relativeKey)) continue;
 
+    // Journal-honesty guard: an entry flagged `localDiverges` recorded the
+    // remote etag only to silence a re-fired conflict (#137) — the local copy
+    // NEVER matched that remote. Its currency would falsely "match" on HEAD, so
+    // propagating a delete would destroy the divergent remote version. Refuse it
+    // regardless of policy, and do NOT count it toward the bulk-asymmetry ratio
+    // (it isn't a genuine mirror-loss candidate). Cleared by a real download.
+    if (entry.localDiverges) {
+      plan.refusedStale.push({
+        key: relativeKey,
+        journalEtag: entry.remoteEtag ?? "<divergent-local>",
+        remoteEtag: "<not-checked>",
+        reason: "divergent-local",
+      });
+      continue;
+    }
+
     if (policy === "all") {
       // policy:"all" is the explicit-opt-out emergency-reconcile mode; the
       // bulk-asymmetry guard skips this branch (caller asserted intent).

package/src/cli/sync.test.ts

@@ -279,6 +279,76 @@ describe("sync", () => {
     expect(fs.readFileSync(path.join(companyDocs, "handoff.md"), "utf-8")).toBe("local version");
   });
 
+  it("conflict keep marks the entry localDiverges (journal-honesty: kept copy never matched the recorded remote etag)", async () => {
+    const companyDocs = path.join(tmpDir, "companies", "acme", "docs");
+    fs.mkdirSync(companyDocs, { recursive: true });
+    fs.writeFileSync(path.join(companyDocs, "handoff.md"), "local version");
+    fs.writeFileSync(
+      journalPath,
+      JSON.stringify({
+        version: "1",
+        lastSync: new Date().toISOString(),
+        files: {
+          "docs/handoff.md": {
+            hash: "old-hash-from-last-sync",
+            size: 20,
+            syncedAt: new Date(Date.now() - 3600000).toISOString(),
+            direction: "down",
+          },
+        },
+      }),
+    );
+
+    const result = await sync({
+      company: "acme",
+      onConflict: "keep",
+      vaultConfig: mockConfig,
+      hqRoot: tmpDir,
+    });
+
+    expect(result.conflicts).toBe(1);
+    const journal = JSON.parse(fs.readFileSync(journalPath, "utf-8"));
+    // remoteEtag still recorded so the conflict can't re-fire (#137 invariant)…
+    expect(journal.files["docs/handoff.md"].remoteEtag).toBeTruthy();
+    // …but the kept-local copy is flagged divergent so a later currency-gated
+    // delete cannot fire on a journal that lies about local==remote.
+    expect(journal.files["docs/handoff.md"].localDiverges).toBe(true);
+  });
+
+  it("a genuine download clears a stale localDiverges flag (entry is now truly local==remote)", async () => {
+    const companyDocs = path.join(tmpDir, "companies", "acme", "docs");
+    fs.mkdirSync(companyDocs, { recursive: true });
+    fs.writeFileSync(
+      journalPath,
+      JSON.stringify({
+        version: "2",
+        lastSync: new Date().toISOString(),
+        files: {
+          "docs/handoff.md": {
+            hash: "old-divergent-hash",
+            size: 20,
+            syncedAt: new Date(Date.now() - 3600000).toISOString(),
+            direction: "down",
+            remoteEtag: "old-etag",
+            localDiverges: true,
+          },
+        },
+        pulls: [],
+      }),
+    );
+    // Remote advanced to a new etag; local absent → genuine download lands the
+    // remote bytes, so local==remote now and the divergence flag must clear.
+    vi.mocked(s3Module.listRemoteFiles).mockResolvedValueOnce([
+      { key: "docs/handoff.md", size: 42, lastModified: new Date(), etag: '"new-etag"' },
+    ]);
+
+    await sync({ company: "acme", vaultConfig: mockConfig, hqRoot: tmpDir });
+
+    expect(fs.existsSync(path.join(companyDocs, "handoff.md"))).toBe(true);
+    const journal = JSON.parse(fs.readFileSync(journalPath, "utf-8"));
+    expect(journal.files["docs/handoff.md"]?.localDiverges).toBeFalsy();
+  });
+
   it("emits a conflict event with path + resolution on hash mismatch", async () => {
     const companyDocs = path.join(tmpDir, "companies", "acme", "docs");
     fs.mkdirSync(companyDocs, { recursive: true });
@@ -884,6 +954,192 @@ describe("sync", () => {
     expect(journal.files[trackedKey]).toBeUndefined();
   });
 
+  it("local journal tombstone suppresses drift-restore: a deleted-but-still-remote key is NOT re-downloaded (no respawn)", async () => {
+    // Repro of the intermittent delete-respawn: the user deleted a clean file,
+    // its delete has not (yet) cleared the S3 object, and the SERVER
+    // FILE_TOMBSTONE fetch is degraded (empty map — the logged failure mode).
+    // The only intent record is the LOCAL journal tombstone (`removedAt`).
+    // The drift-restore path must honor it and NOT re-download the key.
+    const key = "docs/handoff.md";
+    const localPath = path.join(tmpDir, "companies", "acme", key);
+
+    // Remote still lists the object, etag matching the journal, lastModified
+    // BEFORE the local delete — a stale resurrection of a deleted key, not a
+    // genuine remote re-create.
+    vi.mocked(s3Module.listRemoteFiles).mockResolvedValueOnce([
+      {
+        key,
+        size: 42,
+        lastModified: new Date(Date.now() - 2 * 86_400_000),
+        etag: '"abc123"',
+      },
+    ]);
+    // Degraded-fetch case: server FILE_TOMBSTONE map is EMPTY.
+    setupFetchMock({ tombstones: [] });
+
+    // Local file ABSENT (user deleted it). Journal entry is a TOMBSTONE,
+    // recent enough to survive TTL GC.
+    fs.writeFileSync(
+      journalPath,
+      JSON.stringify({
+        version: "2",
+        lastSync: "2026-06-19T00:00:00.000Z",
+        files: {
+          [key]: {
+            hash: "deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef",
+            size: 42,
+            syncedAt: "2026-06-19T00:00:00.000Z",
+            direction: "down",
+            remoteEtag: "abc123",
+            removedAt: new Date().toISOString(),
+            removedReason: "local-delete",
+          },
+        },
+        pulls: [],
+      }),
+    );
+
+    await sync({
+      company: "acme",
+      vaultConfig: mockConfig,
+      hqRoot: tmpDir,
+      onEvent: () => {},
+    });
+
+    // The intentionally-deleted key must NOT be re-materialised.
+    expect(s3Module.downloadFile).not.toHaveBeenCalledWith(
+      expect.anything(),
+      key,
+      expect.anything(),
+    );
+    expect(fs.existsSync(localPath)).toBe(false);
+  });
+
+  it("pull producer: a single clean/current/non-divergent missing file is tombstoned (intentional delete), not drift-restored", async () => {
+    // The user deleted a genuinely-synced file. Its entry is clean (etag matches
+    // the current remote — currency holds), not divergent. The pull leg must
+    // treat the absence as an intentional delete: stamp a persisting
+    // `local-delete` tombstone and SKIP the re-download — not resurrect it.
+    const key = "docs/gone.md";
+    const localPath = path.join(tmpDir, "companies", "acme", key);
+    vi.mocked(s3Module.listRemoteFiles).mockResolvedValueOnce([
+      { key, size: 42, lastModified: new Date(), etag: '"cur123"' },
+    ]);
+    setupFetchMock({ tombstones: [] });
+    fs.writeFileSync(
+      journalPath,
+      JSON.stringify({
+        version: "2",
+        lastSync: new Date().toISOString(),
+        files: {
+          [key]: {
+            hash: "h",
+            size: 42,
+            syncedAt: new Date().toISOString(),
+            direction: "down",
+            remoteEtag: "cur123",
+          },
+        },
+        pulls: [],
+      }),
+    );
+
+    await sync({ company: "acme", vaultConfig: mockConfig, hqRoot: tmpDir });
+
+    expect(s3Module.downloadFile).not.toHaveBeenCalledWith(
+      expect.anything(),
+      key,
+      expect.anything(),
+    );
+    expect(fs.existsSync(localPath)).toBe(false);
+    const journal = JSON.parse(fs.readFileSync(journalPath, "utf-8"));
+    expect(journal.files[key]?.removedAt).toBeTruthy();
+    expect(journal.files[key]?.removedReason).toBe("local-delete");
+  });
+
+  it("pull producer: a BULK disappearance is drift-restored, NOT tombstoned (ridge-incident guard in the pull leg)", async () => {
+    // 12 clean files vanish at once (corrupt mirror / bulk rm / checkout). The
+    // bulk-asymmetry guard refuses to treat this as intent — every file is
+    // healed (re-downloaded), none tombstoned.
+    const keys = Array.from({ length: 12 }, (_, i) => `docs/f${i}.md`);
+    vi.mocked(s3Module.listRemoteFiles).mockResolvedValueOnce(
+      keys.map((k) => ({ key: k, size: 10, lastModified: new Date(), etag: `"e-${k}"` })),
+    );
+    setupFetchMock({ tombstones: [] });
+    const files: Record<string, unknown> = {};
+    for (const k of keys) {
+      files[k] = {
+        hash: "h",
+        size: 10,
+        syncedAt: new Date().toISOString(),
+        direction: "down",
+        remoteEtag: `e-${k}`,
+      };
+    }
+    fs.writeFileSync(
+      journalPath,
+      JSON.stringify({
+        version: "2",
+        lastSync: new Date().toISOString(),
+        files,
+        pulls: [],
+      }),
+    );
+
+    await sync({ company: "acme", vaultConfig: mockConfig, hqRoot: tmpDir });
+
+    // All restored, none tombstoned.
+    expect(s3Module.downloadFile).toHaveBeenCalledTimes(12);
+    const journal = JSON.parse(fs.readFileSync(journalPath, "utf-8"));
+    for (const k of keys) {
+      expect(journal.files[k]?.removedAt).toBeUndefined();
+    }
+  });
+
+  it("pull producer: a local-delete tombstone persists across pulls (not consumed/removed), so the delete stays propagatable", async () => {
+    // After the intentional-delete tombstone is stamped, a later pull must NOT
+    // drop the entry (the push leg still needs it to propagate the S3 delete).
+    // It stays skipped + preserved until the push propagates or TTL GC.
+    const key = "docs/gone.md";
+    const localPath = path.join(tmpDir, "companies", "acme", key);
+    vi.mocked(s3Module.listRemoteFiles).mockResolvedValueOnce([
+      { key, size: 42, lastModified: new Date(Date.now() - 2 * 86_400_000), etag: '"cur123"' },
+    ]);
+    setupFetchMock({ tombstones: [] });
+    fs.writeFileSync(
+      journalPath,
+      JSON.stringify({
+        version: "2",
+        lastSync: new Date().toISOString(),
+        files: {
+          [key]: {
+            hash: "h",
+            size: 42,
+            syncedAt: new Date().toISOString(),
+            direction: "down",
+            remoteEtag: "cur123",
+            removedAt: new Date().toISOString(),
+            removedReason: "local-delete",
+          },
+        },
+        pulls: [],
+      }),
+    );
+
+    await sync({ company: "acme", vaultConfig: mockConfig, hqRoot: tmpDir });
+
+    expect(s3Module.downloadFile).not.toHaveBeenCalledWith(
+      expect.anything(),
+      key,
+      expect.anything(),
+    );
+    expect(fs.existsSync(localPath)).toBe(false);
+    const journal = JSON.parse(fs.readFileSync(journalPath, "utf-8"));
+    // Entry PRESERVED as a tombstone, not removed.
+    expect(journal.files[key]?.removedAt).toBeTruthy();
+    expect(journal.files[key]?.removedReason).toBe("local-delete");
+  });
+
   it("aborts on --on-conflict abort", async () => {
     const companyDocs = path.join(tmpDir, "companies", "acme", "docs");
     fs.mkdirSync(companyDocs, { recursive: true });

package/src/cli/sync.ts

@@ -34,6 +34,8 @@ import {
   normalizeEtag,
   migrateToV2,
   gcTombstones,
+  isTombstone,
+  tombstoneEntry,
   lastPullRecord,
   appendPullRecord,
   generatePullId,
@@ -213,7 +215,7 @@ export type SyncProgressEvent =
       path: string;
       journalEtag: string;
       remoteEtag: string;
-      reason: "stale-etag" | "legacy-no-etag" | "bulk-asymmetry";
+      reason: "stale-etag" | "legacy-no-etag" | "bulk-asymmetry" | "divergent-local";
     }
   | {
       /**
@@ -1209,6 +1211,14 @@ async function executeConflictItem(
       remoteFile.etag,
       item.localMtime.getTime(),
     );
+    // Journal-honesty: we recorded the remote etag so this conflict can't
+    // re-fire (#137), but the KEPT local copy diverges from that remote — it
+    // never matched it. Flag the entry so the currency-gated delete planner
+    // refuses to propagate a delete for it (its currency would falsely match on
+    // HEAD, and the delete would destroy the divergent remote version). Any
+    // genuine future download clears the flag by replacing the entry.
+    const keptEntry = getEntry(run.journal, remoteFile.key);
+    if (keptEntry) keptEntry.localDiverges = true;
     return null;
   }
 
@@ -1738,6 +1748,15 @@ interface PullPlan {
  * caller (`sync()`) is responsible for emitting the resulting plan event
  * before iterating `items`.
  */
+// Pull-leg intentional-delete bulk-asymmetry breaker. Mirrors the push leg's
+// BULK_ASYMMETRY_* (share.ts): an abnormally large fraction of clean files
+// vanishing at once is a corrupt mirror / bulk op / unmount (the ridge-incident
+// class), not intent — so at/above the threshold the pull leg drift-restores
+// every candidate instead of tombstoning it. Below it, a missing clean file is
+// an intentional delete.
+const PULL_INTENTIONAL_DELETE_MIN_ABS = 10;
+const PULL_INTENTIONAL_DELETE_RATIO = 0.1;
+
 function computePullPlan(
   remoteFiles: RemoteFile[],
   journal: SyncJournal,
@@ -1758,6 +1777,12 @@ function computePullPlan(
   fileTombstones: ReadonlyMap<string, CompanyTombstone> = new Map(),
 ): PullPlan {
   const items: PullPlanItem[] = [];
+  // Clean/current/non-divergent files missing locally — collected here, then
+  // resolved post-loop by the bulk-asymmetry decision (tombstone vs. restore).
+  const intentionalDeleteCandidates: Array<{
+    remoteFile: RemoteFile;
+    localPath: string;
+  }> = [];
 
   for (const remoteFile of remoteFiles) {
     const localPath = resolveContainedVaultPath(companyRoot, remoteFile.key);
@@ -1851,6 +1876,23 @@ function computePullPlan(
     const tombstoneSuppresses =
       tombstone !== undefined &&
       !isRemoteRecreateAfterTombstone(remoteFile, tombstone);
+    // LOCAL journal tombstone — this machine's own intentional-delete record,
+    // independent of the (best-effort, intermittently-degraded) server
+    // FILE_TOMBSTONE fetch above. When a clean local delete is classified, the
+    // push leg stamps `removedAt` on the journal entry; honoring it here makes
+    // the delete-vs-drift-restore outcome DETERMINISTIC, closing the
+    // intermittent respawn where a degraded tombstone fetch let the pull leg
+    // re-materialize an intentionally-deleted file. Reuses the same re-create
+    // guard (a remote object newer than the local delete is a genuine re-create
+    // and still downloads). Consulted ONLY on the `!localExists` re-download
+    // path below — never to delete a file that is present locally.
+    const localTombstoneSuppresses =
+      journalEntry !== undefined &&
+      isTombstone(journalEntry) &&
+      journalEntry.removedAt !== undefined &&
+      !isRemoteRecreateAfterTombstone(remoteFile, {
+        deletedAt: journalEntry.removedAt,
+      });
 
     // lstat (not existsSync/statSync) handles three cases the legacy
     // checks got wrong for symlinks:
@@ -2074,15 +2116,67 @@ function computePullPlan(
     // re-create": the classic resurrection ("remote present → I'm behind →
     // download") the planner must NOT do. Route to `tombstone-delete` so the
     // executor drops any stale journal entry and the key stays gone, instead of
-    // pulling the deleted object back in.
-    if (tombstoneSuppresses) {
+    // pulling the deleted object back in. `localTombstoneSuppresses` adds the
+    // same protection driven by this machine's own journal tombstone, so an
+    // intentional delete is not resurrected even when the server FILE_TOMBSTONE
+    // fetch is degraded.
+    if (tombstoneSuppresses || localTombstoneSuppresses) {
+      // A persisting `local-delete` tombstone (stamped by the intentional-delete
+      // producer below) must KEEP its journal entry — the push leg still needs
+      // it to propagate the S3 delete. Skip the re-download without dropping the
+      // entry. Other tombstone kinds (scope-shrink / FILE_TOMBSTONE) drop it.
+      if (journalEntry?.removedReason === "local-delete") {
+        continue;
+      }
       items.push({ action: "tombstone-delete", remoteFile, localPath });
       continue;
     }
 
+    // Intentional-delete producer: a clean, CURRENT (etag matches), non-divergent
+    // file that is MISSING locally is the user deleting a genuinely-synced file.
+    // Collect it; the post-loop bulk-asymmetry decision tombstones it (intent) or
+    // restores it (mass loss = accident). A stale-etag, divergent, tombstoned, or
+    // never-journaled missing file falls through to the normal download below.
+    if (
+      !localExists &&
+      journalEntry !== undefined &&
+      !isTombstone(journalEntry) &&
+      !journalEntry.localDiverges &&
+      journalEntry.remoteEtag !== undefined &&
+      normalizeEtag(remoteFile.etag) === journalEntry.remoteEtag
+    ) {
+      intentionalDeleteCandidates.push({ remoteFile, localPath });
+      continue;
+    }
+
     items.push({ action: "download", remoteFile, localPath, isNew: !localExists });
   }
 
+  // ── Intentional-delete bulk-asymmetry decision (pull-leg producer) ─────────
+  // Below the breaker → stamp a persisting `local-delete` tombstone (the
+  // suppression above keeps it from being re-pulled; the push leg propagates the
+  // S3 delete on its next pass). At/above → drift-restore EVERY candidate: a
+  // mass disappearance (corrupt mirror / bulk rm / checkout / unmount) is
+  // accidental loss, never intent (the ridge-incident guard).
+  const totalJournalEntries = Object.keys(journal.files).length;
+  const intentionalDeleteIsBulk =
+    intentionalDeleteCandidates.length >= PULL_INTENTIONAL_DELETE_MIN_ABS &&
+    totalJournalEntries > 0 &&
+    intentionalDeleteCandidates.length / totalJournalEntries >=
+      PULL_INTENTIONAL_DELETE_RATIO;
+  for (const cand of intentionalDeleteCandidates) {
+    if (intentionalDeleteIsBulk) {
+      items.push({
+        action: "download",
+        remoteFile: cand.remoteFile,
+        localPath: cand.localPath,
+        isNew: true,
+      });
+    } else {
+      tombstoneEntry(journal, cand.remoteFile.key, "local-delete");
+    }
+  }
+
   let filesToDownload = 0;
   let bytesToDownload = 0;
   let filesToSkip = 0;

package/src/journal.test.ts

@@ -25,6 +25,7 @@ import {
   gcTombstones,
   generatePullId,
   TOMBSTONE_TTL_MS,
+  MAX_PULLS_PER_COMPANY,
   PERSONAL_VAULT_JOURNAL_SLUG,
   migratePersonalVaultJournal,
   listJournals,
@@ -463,6 +464,49 @@ describe("journal", () => {
         "2026-05-20T00:00:00.000Z",
       );
     });
+
+    it("bounds pulls per company and preserves newest lastPullRecord", () => {
+      const j: SyncJournal = {
+        version: "2",
+        lastSync: "",
+        files: {},
+        pulls: [],
+      };
+      const completedAt = (n: number) =>
+        `2026-05-20T00:00:${String(n).padStart(2, "0")}.000Z`;
+
+      for (let i = 0; i < MAX_PULLS_PER_COMPANY + 5; i++) {
+        appendPullRecord(
+          j,
+          pull({
+            pullId: `pull-a-${String(i).padStart(2, "0")}`,
+            companyUid: "cmp_a",
+            completedAt: completedAt(i),
+          }),
+        );
+      }
+      for (let i = 0; i < 3; i++) {
+        appendPullRecord(
+          j,
+          pull({
+            pullId: `pull-b-${i}`,
+            companyUid: "cmp_b",
+            completedAt: completedAt(i),
+          }),
+        );
+      }
+
+      const pulls = j.pulls ?? [];
+      const companyA = pulls.filter((p) => p.companyUid === "cmp_a");
+      const companyB = pulls.filter((p) => p.companyUid === "cmp_b");
+      expect(companyA).toHaveLength(MAX_PULLS_PER_COMPANY);
+      expect(companyB).toHaveLength(3);
+      expect(companyA[0].pullId).toBe("pull-a-05");
+      expect(companyA.at(-1)?.pullId).toBe("pull-a-54");
+      expect(companyA.some((p) => p.pullId === "pull-a-00")).toBe(false);
+      expect(lastPullRecord(j, "cmp_a")?.pullId).toBe("pull-a-54");
+      expect(lastPullRecord(j, "cmp_b")?.pullId).toBe("pull-b-2");
+    });
   });
 
   describe("tombstoneEntry + isTombstone", () => {