@indigoai-us/hq-cloud 6.14.18 → 6.14.20

package/src/cli/share.ts

@@ -41,7 +41,10 @@ import {
   wrapFilterWithPersonalVaultDefaults,
   type PersonalVaultExclusion,
 } from "../personal-vault-exclusions.js";
-import { isPersonalVaultDeletionExcluded } from "../personal-vault.js";
+import {
+  isGeneratedCoreMirrorKey,
+  isPersonalVaultDeletionExcluded,
+} from "../personal-vault.js";
 import { resolveConflict } from "./conflict.js";
 import type { ConflictStrategy } from "./conflict.js";
 import type { SyncProgressEvent } from "./sync.js";
@@ -590,6 +593,12 @@ export interface ShareOptions {
    * next push to erase it.
    */
   propagateDeletePolicy?: "currency-gated" | "owned-only" | "all";
+  /**
+   * Explicit vault-relative delete roots captured by a live watcher before a
+   * scoped push. These roots do not need to exist locally; delete execution
+   * still requires a current version-bound intent (or server tombstone).
+   */
+  deleteScopeRoots?: string[];
   /**
    * Hq-root-relative key prefixes whose journal entries should be
    * unconditionally decommissioned from the remote bucket and journal,
@@ -753,9 +762,27 @@ export interface ShareResult {
    * way to runner/UI consumers.
    */
   conflictPaths: string[];
+  /** Uncapped per-path delete outcomes used by scoped watcher publication. */
+  pathResults?: SharePathResult[];
   aborted: boolean;
 }
 
+export type ShareDeleteRefusalReason =
+  | "stale-etag"
+  | "legacy-no-etag"
+  | "bulk-asymmetry"
+  | "divergent-local"
+  | "missing-delete-intent"
+  | "intent-changed"
+  | "transfer-error";
+
+export interface SharePathResult {
+  path: string;
+  status: "accepted" | "refused";
+  operation: "delete" | "tombstone";
+  reason?: ShareDeleteRefusalReason;
+}
+
 /**
  * A conditional-write fence rejection — the SDK's 412 (`name:
  * "PreconditionFailed"`) or the presigned transport's mirror of it. Means
@@ -838,6 +865,7 @@ export async function share(options: ShareOptions): Promise<ShareResult> {
   const counters = createShareCounters();
   const filesRefusedStalePaths: string[] = [];
   const conflictPaths: string[] = [];
+  const pathResults: SharePathResult[] = [];
 
   const plans = await buildSharePlans(run);
   const uploadResult = await executeUploads(
@@ -852,6 +880,7 @@ export async function share(options: ShareOptions): Promise<ShareResult> {
       counters,
       filesRefusedStalePaths,
       uploadResult.abortFlightConflictPaths,
+      pathResults,
       true,
     );
   }
@@ -862,11 +891,19 @@ export async function share(options: ShareOptions): Promise<ShareResult> {
     plans.decommissionPlan,
     counters,
     filesRefusedStalePaths,
+    pathResults,
   );
   finalizeShareJournal(run);
   throwUploadWorkerErrors(uploadResult.workerErrors);
 
-  return buildShareResult(run, counters, filesRefusedStalePaths, conflictPaths, false);
+  return buildShareResult(
+    run,
+    counters,
+    filesRefusedStalePaths,
+    conflictPaths,
+    pathResults,
+    false,
+  );
 }
 
 type DeletePolicy = NonNullable<ShareOptions["propagateDeletePolicy"]>;
@@ -1070,7 +1107,27 @@ async function buildSharePlans(run: PushRunContext): Promise<SharePlans> {
   // `companies/{slug}/…` keys, so this only applies in company mode.
   const filesToShare =
     run.options.personalMode === true
-      ? collected
+      ? collected.filter((entry) => {
+          // `core/<type>` symlinks are generated projections of canonical
+          // personal/package content. Reindex or package wiring owns their
+          // lifecycle, so uploading them creates remote objects that a later
+          // pull can only materialize temporarily before reindex removes them.
+          // Keep ordinary core files eligible: only a symlink is derived.
+          const generatedCoreMirror =
+            entry.kind === "symlink" && isGeneratedCoreMirrorKey(entry.relativePath)
+          if (!generatedCoreMirror) return true;
+
+          // This is a type-aware companion to the path-only personal-vault
+          // default filters. `collectFiles` is the first seam that knows the
+          // entry is a symlink, so record it here for the same summary/result
+          // accounting used by the static exclusions.
+          if (!run.excludedSet.has(entry.relativePath)) {
+            run.excludedSet.add(entry.relativePath);
+            run.excludedById["generated-core-mirror"] =
+              (run.excludedById["generated-core-mirror"] ?? 0) + 1;
+          }
+          return false;
+        })
       : collected.filter((entry) => {
           if (!entry.relativePath.startsWith("companies/")) return true;
           run.emit({
@@ -1085,7 +1142,12 @@ async function buildSharePlans(run: PushRunContext): Promise<SharePlans> {
     run.skipUnchanged === true,
   );
   const deleteScopeRoots = run.propagateDeletes === true
-    ? resolveDeleteScopeRoots(run.paths, run.hqRoot, run.syncRoot)
+    ? resolveDeleteScopeRoots(
+        run.paths,
+        run.hqRoot,
+        run.syncRoot,
+        run.options.deleteScopeRoots,
+      )
     : [];
   const deletePlan: DeletePlan = run.propagateDeletes === true
     ? await computeDeletePlan(
@@ -1522,6 +1584,7 @@ async function executeDeletes(
   decommissionPlan: string[],
   counters: ShareCounters,
   filesRefusedStalePaths: string[],
+  pathResults: SharePathResult[],
 ): Promise<void> {
   const deleteItems = [
     ...deletePlan.toDelete.map((item) => ({ ...item, decommission: false })),
@@ -1543,6 +1606,9 @@ async function executeDeletes(
           entry!.localDeleteIntent!.version !== item.intentVersion ||
           !isLocallyAbsent(path.join(run.syncRoot, relativePath)))
       ) {
+        if (entry?.localDeleteIntent) {
+          delete entry.localDeleteIntent;
+        }
         counters.filesRefusedStale++;
         if (filesRefusedStalePaths.length < REFUSED_STALE_PATH_CAP) {
           filesRefusedStalePaths.push(relativePath);
@@ -1554,6 +1620,12 @@ async function executeDeletes(
           remoteEtag: "<not-checked>",
           reason: "intent-changed",
         });
+        pathResults.push({
+          path: relativePath,
+          status: "refused",
+          operation: "delete",
+          reason: "intent-changed",
+        });
         continue;
       }
       const size = entry?.size ?? 0;
@@ -1566,6 +1638,11 @@ async function executeDeletes(
         bytes: size,
         deleted: true,
       });
+      pathResults.push({
+        path: relativePath,
+        status: "accepted",
+        operation: "delete",
+      });
     } catch (err) {
       if (err instanceof VaultAuthError) throw err;
       run.emit({
@@ -1573,6 +1650,12 @@ async function executeDeletes(
         path: relativePath,
         message: err instanceof Error ? err.message : String(err),
       });
+      pathResults.push({
+        path: relativePath,
+        status: "refused",
+        operation: "delete",
+        reason: "transfer-error",
+      });
     }
   }
   for (const relativePath of deletePlan.toTombstone) {
@@ -1585,6 +1668,11 @@ async function executeDeletes(
       deleted: true,
       message: "tombstone (remote already 404)",
     });
+    pathResults.push({
+      path: relativePath,
+      status: "accepted",
+      operation: "tombstone",
+    });
   }
   const decommissionedSet =
     decommissionPlan.length > 0 ? new Set(decommissionPlan) : null;
@@ -1601,6 +1689,12 @@ async function executeDeletes(
       remoteEtag: refused.remoteEtag,
       reason: refused.reason,
     });
+    pathResults.push({
+      path: refused.key,
+      status: "refused",
+      operation: "delete",
+      reason: refused.reason,
+    });
   }
 }
 
@@ -1669,6 +1763,7 @@ function buildShareResult(
   counters: ShareCounters,
   filesRefusedStalePaths: string[],
   conflictPaths: string[],
+  pathResults: SharePathResult[],
   aborted: boolean,
 ): ShareResult {
   return {
@@ -1684,6 +1779,7 @@ function buildShareResult(
     filesExcludedByScope: run.scopeExcludedSet.size,
     filesExcludedByIgnore: run.ignoreExcludedSet.size,
     conflictPaths,
+    pathResults,
     aborted,
   };
 }
@@ -2043,8 +2139,26 @@ function resolveDeleteScopeRoots(
   paths: string[],
   hqRoot: string,
   syncRoot: string,
+  explicitRoots: readonly string[] = [],
 ): string[] {
   const prefixes = new Set<string>();
+  for (const root of explicitRoots) {
+    const normalized = root
+      .split("\\")
+      .join("/")
+      .replace(/^\.\/+/, "")
+      .replace(/\/+$/, "");
+    if (
+      normalized === "" ||
+      normalized === "." ||
+      path.posix.isAbsolute(normalized) ||
+      normalized === ".." ||
+      normalized.startsWith("../")
+    ) {
+      continue;
+    }
+    prefixes.add(normalized);
+  }
   for (const p of paths) {
     const absolutePath = path.isAbsolute(p) ? p : path.resolve(hqRoot, p);
     if (!fs.existsSync(absolutePath)) continue;
@@ -2296,23 +2410,19 @@ async function computeDeletePlan(
   // and the journal-mutation buckets are already settled before any I/O.
   type HeadCandidate = { key: string; journalEtag: string; intentVersion: 1 };
   const headCandidates: HeadCandidate[] = [];
-  // Litter drain bucket — kept separate from `plan.toDelete` so the
-  // bulk-asymmetry breaker (which moves toDelete + headCandidates into
-  // `refusedStale` when it trips) can't sweep these out. See
+  // Litter drain bucket — kept separate from normal delete candidates so
+  // the bulk-asymmetry accounting cannot sweep these in. See
   // `isVaultLitterArtifact` for the patterns and rationale: by construction
   // these aren't user content losses, so a high ratio of litter must not
   // refuse the drain — that's the whole point of the bypass. Merged into
   // `plan.toDelete` after the breaker check.
   const litterToDelete: string[] = [];
-  // Bulk-asymmetry tracking: count every in-scope journal entry (denominator)
-  // and every entry that would have been a delete-candidate before the guard
-  // (numerator). Numerator = headCandidates + owned-only/all toDelete picks +
-  // legacy-no-etag refusals. We do NOT count "ENOENT but ignore-filtered" or
-  // "ENOENT but ephemeral" — those drop out of the plan entirely on their own
-  // and don't reflect mirror-loss intent — and litter drains (see above),
-  // which are intentional ratchet-cleanup, not mass-delete intent.
+  // Current watcher intents are affirmative evidence of an observed delete,
+  // so only intent-less disappearances contribute to the mirror-loss breaker.
+  // An unmounted/wiped tree produces no intents and still trips it.
   let inScopeJournalEntries = 0;
-  let bulkCandidatePicks = 0;
+  let intentlessDisappearances = 0;
+  const intentlessKeys = new Set<string>();
 
   for (const [relativeKey, entry] of Object.entries(journal.files)) {
     const inScope = scopeRoots.some(
@@ -2399,6 +2509,13 @@ async function computeDeletePlan(
     }
 
     if (!hasCurrentLocalDeleteIntent(entry)) {
+      if (
+        policy === "currency-gated" ||
+        (policy === "owned-only" && entry.direction === "up")
+      ) {
+        intentlessDisappearances++;
+        intentlessKeys.add(relativeKey);
+      }
       plan.refusedStale.push({
         key: relativeKey,
         journalEtag: entry.remoteEtag ?? "<missing-delete-intent>",
@@ -2417,14 +2534,8 @@ async function computeDeletePlan(
       });
       continue;
     }
-    bulkCandidatePicks++;
     if (policy === "owned-only") {
       if (entry.direction !== "up") {
-        // Not a delete candidate under owned-only, but it WAS missing
-        // locally. Don't count it for the bulk guard — direction:'down'
-        // entries that vanish locally are silently ignored by this policy
-        // anyway, so they don't represent intent to mass-delete.
-        bulkCandidatePicks--;
         continue;
       }
       plan.toDelete.push({
@@ -2457,42 +2568,26 @@ async function computeDeletePlan(
   if (
     policy !== "all" &&
     !isBulkAsymmetryOverride() &&
-    bulkCandidatePicks >= BULK_ASYMMETRY_MIN_ABS &&
+    intentlessDisappearances >= BULK_ASYMMETRY_MIN_ABS &&
     inScopeJournalEntries > 0 &&
-    bulkCandidatePicks / inScopeJournalEntries >= BULK_ASYMMETRY_RATIO
+    intentlessDisappearances / inScopeJournalEntries >= BULK_ASYMMETRY_RATIO
   ) {
-    // Move every staged candidate (both already-bucketed toDelete from
-    // owned-only and queued headCandidates from currency-gated) into
-    // refusedStale with reason "bulk-asymmetry". Journal is not mutated;
-    // no DeleteObject is issued.
     const samplePaths: string[] = [];
-    const pushRefused = (key: string): void => {
-      plan.refusedStale.push({
-        key,
-        journalEtag: "<bulk-asymmetry>",
-        remoteEtag: "<not-checked>",
-        reason: "bulk-asymmetry",
-      });
+    for (const refused of plan.refusedStale) {
+      if (!intentlessKeys.has(refused.key)) continue;
+      refused.journalEtag = "<bulk-asymmetry>";
+      refused.remoteEtag = "<not-checked>";
+      refused.reason = "bulk-asymmetry";
       if (samplePaths.length < BULK_ASYMMETRY_SAMPLE_CAP) {
-        samplePaths.push(key);
+        samplePaths.push(refused.key);
       }
-    };
-    for (const item of plan.toDelete) pushRefused(item.key);
-    for (const c of headCandidates) pushRefused(c.key);
-    plan.toDelete = [];
+    }
     plan.bulkAsymmetry = {
-      candidates: bulkCandidatePicks,
+      candidates: intentlessDisappearances,
       inScope: inScopeJournalEntries,
-      ratio: bulkCandidatePicks / inScopeJournalEntries,
+      ratio: intentlessDisappearances / inScopeJournalEntries,
       samplePaths,
     };
-    // Litter still drains even when the breaker trips — see `litterToDelete`
-    // declaration. The breaker protects against corrupt-mirror mass-deletes
-    // of user content; litter cleanup is orthogonal and should never be
-    // refused for the same reason new-litter producer-side exclusions
-    // shouldn't block it.
-    plan.toDelete.push(...litterToDelete.map((key) => ({ key, intentVersion: null })));
-    return plan;
   }
 
   // Stage 2: bounded-parallel HEAD pass. Promise.all over chunks of size

package/src/cli/sync.test.ts

@@ -84,7 +84,10 @@ const mockVendResponse = {
 };
 
 function setupFetchMock(
-  opts: { tombstones?: Array<{ key: string; deletedAt: string }> } = {},
+  opts: {
+    tombstones?: Array<{ key: string; deletedAt: string }>;
+    tombstoneFailure?: boolean;
+  } = {},
 ) {
   const fetchMock = vi.fn().mockImplementation(async (url: string) => {
     const urlStr = String(url);
@@ -92,6 +95,7 @@ function setupFetchMock(
     // every legacy test exercises the no-suppression path; tests that need
     // suppression pass `{ tombstones }`.
     if (urlStr.includes("/v1/files/tombstones")) {
+      if (opts.tombstoneFailure) throw new Error("tombstone lookup unavailable");
       return {
         ok: true,
         status: 200,
@@ -1085,6 +1089,53 @@ describe("sync", () => {
     expect(journal.files[key]?.removedAt).toBeUndefined();
   });
 
+  it("tombstone lookup failure does not resurrect a current intent-backed delete", async () => {
+    const key = "docs/watcher-deleted.md";
+    const localPath = path.join(tmpDir, "companies", "acme", key);
+    vi.mocked(s3Module.listRemoteFiles).mockResolvedValueOnce([
+      { key, size: 42, lastModified: new Date(), etag: '"cur123"' },
+    ]);
+    setupFetchMock({ tombstoneFailure: true });
+    fs.writeFileSync(
+      journalPath,
+      JSON.stringify({
+        version: "2",
+        lastSync: new Date().toISOString(),
+        files: {
+          [key]: {
+            hash: "synced-hash",
+            size: 42,
+            syncedAt: new Date().toISOString(),
+            direction: "down",
+            kind: "file",
+            remoteEtag: "cur123",
+            localDeleteIntent: {
+              version: 1,
+              remoteEtag: "cur123",
+              localHash: "synced-hash",
+              localKind: "file",
+            },
+          },
+        },
+        pulls: [],
+      }),
+    );
+
+    await sync({ company: "acme", vaultConfig: mockConfig, hqRoot: tmpDir });
+
+    expect(s3Module.downloadFile).not.toHaveBeenCalledWith(
+      expect.anything(),
+      key,
+      expect.anything(),
+      expect.anything(),
+    );
+    expect(fs.existsSync(localPath)).toBe(false);
+    expect(
+      JSON.parse(fs.readFileSync(journalPath, "utf8")).files[key]
+        ?.removedReason,
+    ).toBe("local-delete");
+  });
+
   it("pull producer: a BULK disappearance is drift-restored, NOT tombstoned (ridge-incident guard in the pull leg)", async () => {
     // 12 clean files vanish at once (corrupt mirror / bulk rm / checkout). The
     // bulk-asymmetry guard refuses to treat this as intent — every file is
@@ -3480,6 +3531,104 @@ describe("sync", () => {
     });
   });
 
+  it("converges after reindex prunes a downloaded generated core mirror (DEV-1974)", async () => {
+    // Legacy personal-vault objects may be generated links below core/<type>.
+    // A pull materializes the link, then reindex removes it because its
+    // canonical source is elsewhere. The second pull must recognize the
+    // journaled symlink as generated state rather than downloading it again.
+    const linkKey = "core/policies/legacy-mirror.md";
+    const linkPath = path.join(tmpDir, linkKey);
+    const linkTarget = "../../personal/policies/legacy-mirror.md";
+    const remote = {
+      key: linkKey,
+      size: 48,
+      lastModified: new Date(),
+      etag: '"legacy-mirror"',
+    };
+
+    vi.mocked(s3Module.listRemoteFiles).mockResolvedValue([remote]);
+    vi.mocked(s3Module.downloadFile).mockImplementation(
+      async (_ctx: unknown, _key: string, localPath: string) => {
+        fs.mkdirSync(path.dirname(localPath), { recursive: true });
+        fs.symlinkSync(linkTarget, localPath);
+        return { metadata: {} };
+      },
+    );
+
+    const first = await sync({
+      company: "acme",
+      vaultConfig: mockConfig,
+      hqRoot: tmpDir,
+      personalMode: true,
+    });
+    expect(first.filesDownloaded).toBe(1);
+    expect(fs.lstatSync(linkPath).isSymbolicLink()).toBe(true);
+
+    // The real post-sync reindex removes this retired mirror. The unit test
+    // mocks reindex globally, so make that lifecycle transition explicit.
+    fs.unlinkSync(linkPath);
+
+    const second = await sync({
+      company: "acme",
+      vaultConfig: mockConfig,
+      hqRoot: tmpDir,
+      personalMode: true,
+    });
+
+    expect(second.filesDownloaded).toBe(0);
+    expect(vi.mocked(s3Module.downloadFile)).toHaveBeenCalledTimes(1);
+  });
+
+  it("pulls a changed canonical object after a generated core mirror journal entry", async () => {
+    const key = "core/policies/legacy-mirror.md";
+    const localPath = path.join(tmpDir, key);
+    const legacyMirror = {
+      key,
+      size: 48,
+      lastModified: new Date(),
+      etag: '"legacy-mirror"',
+    };
+    const canonicalReplacement = {
+      ...legacyMirror,
+      lastModified: new Date(Date.now() + 1_000),
+      etag: '"canonical-replacement"',
+    };
+
+    vi.mocked(s3Module.listRemoteFiles)
+      .mockResolvedValueOnce([legacyMirror])
+      .mockResolvedValueOnce([canonicalReplacement]);
+    vi.mocked(s3Module.downloadFile)
+      .mockImplementationOnce(async (_ctx: unknown, _key: string, destination: string) => {
+        fs.mkdirSync(path.dirname(destination), { recursive: true });
+        fs.symlinkSync("../../personal/policies/legacy-mirror.md", destination);
+        return { metadata: {} };
+      })
+      .mockImplementationOnce(async (_ctx: unknown, _key: string, destination: string) => {
+        fs.mkdirSync(path.dirname(destination), { recursive: true });
+        fs.writeFileSync(destination, "canonical replacement\n");
+        return { metadata: {} };
+      });
+
+    await sync({
+      company: "acme",
+      vaultConfig: mockConfig,
+      hqRoot: tmpDir,
+      personalMode: true,
+    });
+    fs.unlinkSync(localPath);
+
+    const second = await sync({
+      company: "acme",
+      vaultConfig: mockConfig,
+      hqRoot: tmpDir,
+      personalMode: true,
+    });
+
+    expect(second.filesDownloaded).toBe(1);
+    expect(fs.readFileSync(localPath, "utf8")).toBe("canonical replacement\n");
+    expect(vi.mocked(s3Module.downloadFile)).toHaveBeenCalledTimes(2);
+  });
+
   it("does not crash when local is a real directory at a remote-key path (EISDIR guard)", async () => {
     // Codex round-9 P2 follow-up: pre-fix, the pull planner's
     // post-lstat branch always called hashFile (readFileSync) on a

package/src/cli/sync.ts

@@ -48,7 +48,10 @@ import {
   PERSONAL_VAULT_JOURNAL_SLUG,
   migratePersonalVaultJournal,
 } from "../journal.js";
-import { PERSONAL_VAULT_MANIFEST_KEY } from "../personal-vault.js";
+import {
+  isGeneratedCoreMirrorKey,
+  PERSONAL_VAULT_MANIFEST_KEY,
+} from "../personal-vault.js";
 import { isPersonalVaultExcluded } from "../personal-vault-exclusions.js";
 import {
   buildScopeShrinkPlan,
@@ -2122,33 +2125,6 @@ interface PullPlan {
 const PULL_INTENTIONAL_DELETE_MIN_ABS = 10;
 const PULL_INTENTIONAL_DELETE_RATIO = 0.1;
 
-// The four release-shipped `core/<type>/` namespaces the personal-overlay
-// mirror (reindex) materializes into. A stale mirror symlink pushed to the
-// vault lands as a single object at exactly `core/<type>/<...>/<entry>`, and if
-// a later release ships a REAL directory of the same name, pull sees a
-// (local real dir) vs (remote single object) collision at that key forever.
-const OVERLAY_MIRROR_CORE_TYPES = ["knowledge", "policies", "workers", "settings"];
-
-/**
- * True when `key` is under a release-shipped personal-overlay-mirror core
- * namespace (`core/{knowledge,policies,workers,settings}/<entry>/...`).
- *
- * A remote LIST entry is always a single S3 object. A REAL release-shipped core
- * directory only ever syncs as child objects UNDER its key
- * (`core/knowledge/public/agent-browser/INDEX.md`), never as one object AT the
- * directory's own key — so a single object at such a key, colliding with a
- * local real directory, is unambiguously a stale overlay symlink marker, not
- * live core content. Pure path test — no I/O — safe inside the sync planner.
- */
-function isOverlayMirrorCoreKey(key: string): boolean {
-  const parts = key.split("/");
-  return (
-    parts.length >= 3 &&
-    parts[0] === "core" &&
-    OVERLAY_MIRROR_CORE_TYPES.includes(parts[1])
-  );
-}
-
 function computePullPlan(
   remoteFiles: RemoteFile[],
   journal: SyncJournal,
@@ -2305,6 +2281,26 @@ function computePullPlan(
 
     const journalEntry = getEntry(journal, remoteFile.key);
 
+    // Reindex and package wiring own symlinks under these `core/<type>`
+    // surfaces; their canonical sources are elsewhere. A prior pull records
+    // the remote object as a symlink, then reindex removes the generated link.
+    // Without this classification the next pull sees only an absent local path
+    // and downloads the same marker forever. Retain regular core files: the
+    // journal kind is the discriminator, because LIST exposes no object type.
+    // An unchanged ETag is also required: a remote writer can replace a legacy
+    // symlink with canonical file content at the same key, and that replacement
+    // must still be pulled.
+    if (
+      personalMode &&
+      journalEntry?.kind === "symlink" &&
+      isGeneratedCoreMirrorKey(remoteFile.key) &&
+      journalEntry.remoteEtag !== undefined &&
+      !hasRemoteChanged(remoteFile, journalEntry)
+    ) {
+      items.push({ action: "skip-excluded-policy", remoteFile, localPath });
+      continue;
+    }
+
     // ── FILE_TOMBSTONE consult (delete-resync) ───────────────────────────────
     // A remote object present in the LIST may be an intentionally-deleted key
     // (a peer re-pushed it, or its delete-marker hasn't propagated to this
@@ -2414,7 +2410,7 @@ function computePullPlan(
         // "rm -rf the local directory" advice below is actively dangerous here
         // (it would destroy release-shipped core content to pull inert derived
         // state), and it recurred on every sync. feedback_ce9aeede.
-        if (isOverlayMirrorCoreKey(remoteFile.key)) {
+        if (isGeneratedCoreMirrorKey(remoteFile.key)) {
           console.error(
             `  Note: ${remoteFile.key} is a stale personal-overlay marker ` +
               `shadowing a release-shipped core directory; keeping the local ` +

package/src/journal.test.ts

@@ -29,6 +29,7 @@ import {
   PERSONAL_VAULT_JOURNAL_SLUG,
   migratePersonalVaultJournal,
   listJournals,
+  markLocalDeleteIntent,
 } from "./journal.js";
 import type { SyncJournal, PullRecord } from "./types.js";
 
@@ -745,6 +746,50 @@ describe("journal", () => {
   // successful sync because it read one path keyed off the HQ-ROOT, while the
   // engine writes slug-sharded journals (personal vault + per-company).
   // `listJournals` is the all-shard enumeration the status surface now uses.
+  it("binds a local delete intent to the captured remote revision", () => {
+    const journal: SyncJournal = {
+      version: "2",
+      lastSync: "",
+      pulls: [],
+      files: {
+        "docs/a.md": {
+          hash: "local-hash",
+          size: 1,
+          syncedAt: new Date().toISOString(),
+          direction: "down",
+          kind: "file",
+          remoteEtag: "new-etag",
+        },
+      },
+    };
+
+    expect(
+      markLocalDeleteIntent(
+        journal,
+        "docs/a.md",
+        "local-hash",
+        "file",
+        "old-etag",
+      ),
+    ).toBe(false);
+    expect(journal.files["docs/a.md"]?.localDeleteIntent).toBeUndefined();
+
+    expect(
+      markLocalDeleteIntent(
+        journal,
+        "docs/a.md",
+        "local-hash",
+        "file",
+        "new-etag",
+      ),
+    ).toBe(true);
+    expect(journal.files["docs/a.md"]?.localDeleteIntent).toMatchObject({
+      remoteEtag: "new-etag",
+      localHash: "local-hash",
+      localKind: "file",
+    });
+  });
+
   describe("listJournals", () => {
     function seed(slug: string, files: SyncJournal["files"]): void {
       writeJournal(slug, {