@indigoai-us/hq-cloud 6.14.32 → 6.14.34

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cloud",
-  "version": "6.14.32",
+  "version": "6.14.34",
   "description": "HQ by Indigo cloud sync engine — bidirectional S3 sync for mobile access",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/bin/sync-runner-watch-loop.ts

@@ -136,6 +136,46 @@ export function journalEntriesForWatcherDelete(
   );
 }
 
+/**
+ * Bulk-intent quarantine thresholds. Deliberately the same shape and values as
+ * the engine's `BULK_ASYMMETRY_*` constants (`src/cli/share.ts`) so operators
+ * learn one rule and one knob: a disappearance covering >= 10 journal entries
+ * AND >= 10% of the shard is treated as suspect rather than deliberate.
+ */
+const WATCHER_BULK_INTENT_MIN_ABS = 10;
+const WATCHER_BULK_INTENT_RATIO = 0.1;
+
+/**
+ * Should a single `unlinkDir` expansion be quarantined instead of stamping a
+ * version-bound delete intent on every descendant journal entry?
+ *
+ * One filesystem event can cover an arbitrary subtree, so the producer is
+ * capable of minting thousands of individually-valid intents from a checkout
+ * swap, an unmount, a partial restore or an `rm -rf` — the 2026-07-30 mass
+ * deletion did exactly that. Quarantined entries are simply left intent-less,
+ * which the engine already refuses (`missing-delete-intent`); nothing is
+ * deleted locally or remotely and the next pull restores the tree.
+ *
+ * Pure so the threshold is unit-testable without a watcher or a journal.
+ */
+export function shouldQuarantineWatcherDeleteIntents(
+  expandedEntries: number,
+  journalEntries: number,
+): boolean {
+  if (expandedEntries < WATCHER_BULK_INTENT_MIN_ABS) return false;
+  if (journalEntries <= 0) return false;
+  return expandedEntries / journalEntries >= WATCHER_BULK_INTENT_RATIO;
+}
+
+/**
+ * Same operator escape hatch as the engine breaker — one knob for both layers.
+ * Set when a genuinely intentional large folder removal must propagate.
+ */
+function isBulkIntentOverride(): boolean {
+  const v = (process.env.HQ_SYNC_DELETE_BULK_OVERRIDE ?? "").toLowerCase();
+  return v === "1" || v === "true" || v === "yes";
+}
+
 function passExitCode(outcome: number | RunnerPassOutcome): number {
   return typeof outcome === "number" ? outcome : outcome.exitCode;
 }
@@ -490,11 +530,39 @@ export async function runWatchLoop(
     // Chokidar emits one unlink per file during rm -rf. Avoid walking the
     // whole shard for every exact-key event; directory unlinks alone need
     // descendant expansion.
-    for (const [key, entry] of journalEntriesForWatcherDelete(
+    const covered = journalEntriesForWatcherDelete(
       journal.files,
       coordinates.key,
       kind,
-    )) {
+    );
+
+    // Bulk-intent quarantine: one directory event must not be able to mint
+    // intents across a large fraction of the shard. Leaving them intent-less
+    // is the safe state — the engine refuses intent-less disappearances and
+    // the next pull restores the subtree.
+    const stampable = covered.filter(
+      ([, entry]) =>
+        entry?.remoteEtag && entry.kind && entry.removedAt === undefined,
+    );
+    if (
+      kind === "unlinkDir" &&
+      !isBulkIntentOverride() &&
+      shouldQuarantineWatcherDeleteIntents(
+        stampable.length,
+        Object.keys(journal.files).length,
+      )
+    ) {
+      process.stderr.write(
+        `hq-sync-runner: refusing to record delete intent for ${stampable.length} ` +
+          `of ${Object.keys(journal.files).length} journal entries under ` +
+          `"${coordinates.key || "<root>"}" — a single directory removal that large ` +
+          `is treated as a possible mirror loss. Nothing was deleted. ` +
+          `Set HQ_SYNC_DELETE_BULK_OVERRIDE=1 to propagate it deliberately.\n`,
+      );
+      return [];
+    }
+
+    for (const [key, entry] of stampable) {
       captureEntry(key, entry);
     }
 

package/src/bin/sync-runner.test.ts

@@ -42,6 +42,7 @@ import {
 import {
   adaptivePollMs,
   journalEntriesForWatcherDelete,
+  shouldQuarantineWatcherDeleteIntents,
 } from "./sync-runner-watch-loop.js";
 import {
   PERSONAL_VAULT_JOURNAL_SLUG,
@@ -7800,6 +7801,32 @@ describe("watcher delete intents without pre-seeded authorization", () => {
     ).toEqual([["knowledge/exact.md", exactEntry]]);
   });
 
+  // Bulk-intent quarantine. A single `unlinkDir` expands to every descendant
+  // journal entry, so without a ceiling one filesystem event — a checkout
+  // swap, an unmount, a partial restore — mints thousands of individually
+  // valid delete intents. Same thresholds as the engine's bulk-asymmetry
+  // breaker so there is one rule and one override knob across both layers.
+  it.each([
+    // [expanded, journalEntries, quarantined, why]
+    [11, 100, true, "11% of the shard, above both thresholds"],
+    [10, 100, true, "exactly at MIN_ABS and RATIO"],
+    [9, 100, false, "below MIN_ABS — ordinary cleanup must propagate"],
+    [9, 9, false, "100% ratio but below MIN_ABS floor"],
+    [10, 1000, false, "at MIN_ABS but only 1% of the shard"],
+    [50, 50, true, "the whole shard vanished at once"],
+    [0, 0, false, "empty journal never quarantines"],
+  ])(
+    "bulk-intent quarantine for %i of %i journal entries → %s (%s)",
+    (expanded, journalEntries, quarantined) => {
+      expect(
+        shouldQuarantineWatcherDeleteIntents(
+          expanded as number,
+          journalEntries as number,
+        ),
+      ).toBe(quarantined);
+    },
+  );
+
   it("keeps a deleted top-level personal file in the scoped push delete roots", async () => {
     const hqRoot = fs.mkdtempSync(path.join(os.tmpdir(), "hq-personal-delete-"));
     const key = "personal-note.md";
@@ -7974,7 +8001,14 @@ describe("watcher delete intents without pre-seeded authorization", () => {
     await stopHarness(h);
   });
 
-  it("unlinkDir records every tracked descendant across a 12-file breaker-sized subtree", async () => {
+  // Replaces #227's "unlinkDir records every tracked descendant across a
+  // 12-file breaker-sized subtree", which asserted that one directory event
+  // may mint an intent for the entire shard and wipe it remotely. That is the
+  // shape of the 2026-07-30 incident (1,108 files in one push), and the test
+  // name conceded it was breaker-sized. Quarantining is now the contract; the
+  // three tests below cover the refusal, the operator escape hatch, and the
+  // ordinary folder removal that must keep working.
+  it("unlinkDir covering the whole shard is quarantined: no intents, nothing deleted", async () => {
     const keys = Array.from(
       { length: 12 }, (_, i) => `knowledge/moved/f-${i}.md`,
     );
@@ -7984,7 +8018,72 @@ describe("watcher delete intents without pre-seeded authorization", () => {
     const snapshots = h.capture()(
       "companies/indigo/knowledge/moved", "unlinkDir",
     );
-    expect(snapshots).toHaveLength(12);
+    expect(snapshots).toHaveLength(0);
+    expect(
+      Object.values(readJournal("indigo").files).filter(
+        (entry) => entry.localDeleteIntent,
+      ),
+    ).toHaveLength(0);
+    fs.rmSync(subtree, { recursive: true, force: true });
+    h.watcher.emit("companies/indigo/knowledge/moved", {
+      paths: new Map([[subtree, "companies/indigo/knowledge/moved"]]),
+      changes: new Map([
+        [subtree, { kind: "unlinkDir", deleteSnapshots: snapshots }],
+      ]),
+    } as TreeChangeBatch);
+    h.tick();
+    await settle();
+    expect(h.remote.size).toBe(12);
+    expect(Object.keys(readJournal("indigo").files)).toHaveLength(12);
+    await stopHarness(h);
+  });
+
+  it("HQ_SYNC_DELETE_BULK_OVERRIDE=1 lets a whole-shard unlinkDir propagate", async () => {
+    process.env.HQ_SYNC_DELETE_BULK_OVERRIDE = "1";
+    try {
+      const keys = Array.from(
+        { length: 12 }, (_, i) => `knowledge/moved/f-${i}.md`,
+      );
+      const h = startDeleteHarness(keys);
+      await settle();
+      const subtree = path.join(h.companyRoot, "knowledge/moved");
+      const snapshots = h.capture()(
+        "companies/indigo/knowledge/moved", "unlinkDir",
+      );
+      expect(snapshots).toHaveLength(12);
+      fs.rmSync(subtree, { recursive: true, force: true });
+      h.watcher.emit("companies/indigo/knowledge/moved", {
+        paths: new Map([[subtree, "companies/indigo/knowledge/moved"]]),
+        changes: new Map([
+          [subtree, { kind: "unlinkDir", deleteSnapshots: snapshots }],
+        ]),
+      } as TreeChangeBatch);
+      h.tick();
+      await settle();
+      expect(h.remote.size).toBe(0);
+      expect(Object.keys(readJournal("indigo").files)).toHaveLength(0);
+      await stopHarness(h);
+    } finally {
+      delete process.env.HQ_SYNC_DELETE_BULK_OVERRIDE;
+    }
+  });
+
+  // The quarantine must not touch ordinary folder cleanup — that is the
+  // delete-resurrection bug #227 was written to fix, and it stays fixed.
+  it("an ordinary folder removal (10 of 120 entries) still records intents and propagates", async () => {
+    const removed = Array.from(
+      { length: 10 }, (_, i) => `knowledge/moved/f-${i}.md`,
+    );
+    const kept = Array.from(
+      { length: 110 }, (_, i) => `knowledge/keep/k-${i}.md`,
+    );
+    const h = startDeleteHarness([...removed, ...kept]);
+    await settle();
+    const subtree = path.join(h.companyRoot, "knowledge/moved");
+    const snapshots = h.capture()(
+      "companies/indigo/knowledge/moved", "unlinkDir",
+    );
+    expect(snapshots).toHaveLength(10);
     fs.rmSync(subtree, { recursive: true, force: true });
     h.watcher.emit("companies/indigo/knowledge/moved", {
       paths: new Map([[subtree, "companies/indigo/knowledge/moved"]]),
@@ -7994,8 +8093,8 @@ describe("watcher delete intents without pre-seeded authorization", () => {
     } as TreeChangeBatch);
     h.tick();
     await settle();
-    expect(h.remote.size).toBe(0);
-    expect(Object.keys(readJournal("indigo").files)).toHaveLength(0);
+    for (const key of removed) expect(h.remote.has(key)).toBe(false);
+    expect(h.remote.size).toBe(110);
     await stopHarness(h);
   });
 

package/src/cli/share.test.ts

@@ -4222,12 +4222,16 @@ describe("share", () => {
       missing,
       direction = "up" as "up" | "down",
       withIntents = true,
+      intentFor,
     }: {
       total: number;
       missing: number;
       direction?: "up" | "down";
       withIntents?: boolean;
+      /** Per-entry override of `withIntents`, for mixed-bucket cases. */
+      intentFor?: (index: number) => boolean;
     }): { companyRoot: string; journalPath: string } {
+      const hasIntent = intentFor ?? ((): boolean => withIntents);
       const companyRoot = path.join(tmpDir, "companies", "acme");
       fs.mkdirSync(companyRoot, { recursive: true });
       const files: Record<
@@ -4251,7 +4255,7 @@ describe("share", () => {
           direction,
           remoteEtag: `etag-${i}`,
           kind: "file",
-          ...(withIntents
+          ...(hasIntent(i)
             ? { localDeleteIntent: deleteIntent(`etag-${i}`, "h") }
             : {}),
         };
@@ -4336,14 +4340,25 @@ describe("share", () => {
       expect(perKeyRefusals.length).toBe(11);
     });
 
-    it("intent-backed 11/100 subtree disappearance bypasses the breaker and deletes every covered path", async () => {
-      const { companyRoot } = setupJournal({ total: 100, missing: 11 });
+    // Regression: hq-cloud #227 (v6.14.19) narrowed the breaker numerator to
+    // intent-less disappearances and, in the same change, shipped the watcher
+    // producer that stamps one intent per descendant of a vanished directory.
+    // The assertion this replaces ("intent-backed 11/100 bypasses the breaker
+    // and deletes every covered path") is that PR's own seven-day-old
+    // assertion, not established contract; it is what the 2026-07-30
+    // 1,108-file mass deletion looked like in test form. Intent currency is a
+    // per-file property and cannot stand in for whole-set health.
+    it("intent-backed 11/100 subtree disappearance ALSO trips the breaker: no delete is issued", async () => {
+      const { companyRoot, journalPath } = setupJournal({
+        total: 100,
+        missing: 11,
+      });
       vi.mocked(headRemoteFile).mockImplementation(async (_ctx, key) => ({
         etag: `etag-${parseInt(key.replace(/[^0-9]/g, ""), 10)}`,
         lastModified: new Date(),
         size: 5,
       }));
-      const events: Array<{ type: string }> = [];
+      const events: Array<{ type: string; [k: string]: unknown }> = [];
 
       const result = await share({
         paths: [companyRoot],
@@ -4356,11 +4371,147 @@ describe("share", () => {
         onEvent: (e) => events.push(e as { type: string }),
       });
 
-      expect(result.filesDeleted).toBe(11);
-      expect(deleteRemoteFile).toHaveBeenCalledTimes(11);
+      expect(result.filesDeleted).toBe(0);
+      expect(deleteRemoteFile).not.toHaveBeenCalled();
+      const summary = events.find(
+        (e) => e.type === "delete-refused-bulk-asymmetry",
+      ) as { candidates: number; inScope: number; ratio: number } | undefined;
+      expect(summary).toBeDefined();
+      expect(summary!.candidates).toBe(11);
+      expect(summary!.inScope).toBe(100);
+      // No HEAD for the would-be delete candidates — the trip short-circuits
+      // Stage 2 exactly as it does for intent-less disappearances.
+      const headedKeys = vi
+        .mocked(headRemoteFile)
+        .mock.calls.map((c) => c[1] as string);
+      for (let i = 0; i < 11; i++) {
+        expect(headedKeys).not.toContain(`f-${i.toString().padStart(4, "0")}.md`);
+      }
+      // Journal untouched — the entries stay recoverable.
+      const journal = JSON.parse(fs.readFileSync(journalPath, "utf-8"));
+      expect(Object.keys(journal.files).length).toBe(100);
+    });
+
+    // The core of the #227 regression, isolated: pre-#227 a trip emptied
+    // `plan.toDelete`; #227 replaced that with an in-place re-label of entries
+    // already in `refusedStale`, so the breaker stopped stopping anything it
+    // had not already refused for another reason. owned-only stages its picks
+    // directly into `toDelete` (no HEAD pass), so it is the sharpest probe of
+    // that one line.
+    it("a trip empties plan.toDelete: owned-only intent-backed 11/100 issues no DeleteObject", async () => {
+      const { companyRoot, journalPath } = setupJournal({
+        total: 100,
+        missing: 11,
+      });
+
+      const events: Array<{ type: string; [k: string]: unknown }> = [];
+      const result = await share({
+        paths: [companyRoot],
+        company: "acme",
+        vaultConfig: mockConfig,
+        hqRoot: tmpDir,
+        skipUnchanged: true,
+        propagateDeletes: true,
+        propagateDeletePolicy: "owned-only",
+        onEvent: (e) => events.push(e as { type: string }),
+      });
+
+      expect(result.filesDeleted).toBe(0);
+      expect(deleteRemoteFile).not.toHaveBeenCalled();
+      expect(result.filesRefusedStale).toBe(11);
+      const perKeyRefusals = events.filter(
+        (e) =>
+          e.type === "delete-refused-stale-etag" &&
+          e.reason === "bulk-asymmetry",
+      );
+      expect(perKeyRefusals.length).toBe(11);
+      const journal = JSON.parse(fs.readFileSync(journalPath, "utf-8"));
+      expect(Object.keys(journal.files).length).toBe(100);
+    });
+
+    it("vault litter still drains when the breaker trips", async () => {
+      // The trip short-circuits the Stage-2 HEAD pass, so the litter merge has
+      // to happen on that path too. Litter is never a user content loss, and
+      // refusing the ratchet-drain would leave conflict mirrors stuck in the
+      // vault for as long as the mirror looks unhealthy.
+      const { companyRoot, journalPath } = setupJournal({
+        total: 100,
+        missing: 11,
+        withIntents: false,
+      });
+      const litterKey = "CLAUDE.md.conflict-2026-05-13T19-40-40Z-e5797a.md";
+      const seeded = JSON.parse(fs.readFileSync(journalPath, "utf-8"));
+      seeded.files[litterKey] = {
+        hash: "h",
+        size: 5,
+        syncedAt: new Date().toISOString(),
+        direction: "up",
+        remoteEtag: "litter-etag",
+        kind: "file",
+      };
+      fs.writeFileSync(journalPath, JSON.stringify(seeded));
+      vi.mocked(headRemoteFile).mockImplementation(async (_ctx, key) => ({
+        etag: `etag-${parseInt(key.replace(/[^0-9]/g, ""), 10)}`,
+        lastModified: new Date(),
+        size: 5,
+      }));
+
+      const events: Array<{ type: string }> = [];
+      const result = await share({
+        paths: [companyRoot],
+        company: "acme",
+        vaultConfig: mockConfig,
+        hqRoot: tmpDir,
+        skipUnchanged: true,
+        propagateDeletes: true,
+        propagateDeletePolicy: "currency-gated",
+        onEvent: (e) => events.push(e as { type: string }),
+      });
+
       expect(
         events.find((e) => e.type === "delete-refused-bulk-asymmetry"),
-      ).toBeUndefined();
+      ).toBeDefined();
+      expect(result.filesDeleted).toBe(1);
+      expect(deleteRemoteFile).toHaveBeenCalledTimes(1);
+      expect(deleteRemoteFile).toHaveBeenCalledWith(
+        expect.anything(),
+        litterKey,
+      );
+    });
+
+    it("intent-backed and intent-less disappearances share one numerator: 6 + 5 of 100 trips", async () => {
+      const { companyRoot } = setupJournal({
+        total: 100,
+        missing: 11,
+        intentFor: (i) => i < 6,
+      });
+      vi.mocked(headRemoteFile).mockImplementation(async (_ctx, key) => ({
+        etag: `etag-${parseInt(key.replace(/[^0-9]/g, ""), 10)}`,
+        lastModified: new Date(),
+        size: 5,
+      }));
+
+      const events: Array<{ type: string; [k: string]: unknown }> = [];
+      const result = await share({
+        paths: [companyRoot],
+        company: "acme",
+        vaultConfig: mockConfig,
+        hqRoot: tmpDir,
+        skipUnchanged: true,
+        propagateDeletes: true,
+        propagateDeletePolicy: "currency-gated",
+        onEvent: (e) => events.push(e as { type: string }),
+      });
+
+      expect(result.filesDeleted).toBe(0);
+      expect(deleteRemoteFile).not.toHaveBeenCalled();
+      const summary = events.find(
+        (e) => e.type === "delete-refused-bulk-asymmetry",
+      ) as { candidates: number } | undefined;
+      expect(summary).toBeDefined();
+      // Neither bucket reaches MIN_ABS alone; together they are the whole
+      // prospective destructive set and must be counted as one.
+      expect(summary!.candidates).toBe(11);
     });
 
     it("does NOT trip at 9/100 (below ratio): all candidates delete normally", async () => {
@@ -4388,6 +4539,9 @@ describe("share", () => {
       expect(events.find((e) => e.type === "delete-refused-bulk-asymmetry")).toBeUndefined();
     });
 
+    // The two bypasses below are the sanctioned route for a genuinely
+    // intentional mass delete now that intent-backed candidates count toward
+    // the numerator. Both journals here carry current delete intents.
     it("HQ_SYNC_DELETE_BULK_OVERRIDE=1 bypasses the guard: 11/100 deletes proceed", async () => {
       process.env.HQ_SYNC_DELETE_BULK_OVERRIDE = "1";
       const { companyRoot } = setupJournal({ total: 100, missing: 11 });

package/src/cli/share.ts

@@ -2233,6 +2233,12 @@ type RefusedStaleReason =
  *   - `candidates / inScope >= BULK_ASYMMETRY_RATIO` (default 10%).
  *   - `candidates >= BULK_ASYMMETRY_MIN_ABS` (default 10).
  *
+ * `candidates` is the whole prospective destructive set, whether or not each
+ * entry carries a current watcher delete-intent. A live watcher stamps one
+ * intent per descendant when a directory disappears, so intent presence says
+ * nothing about whether the disappearance was deliberate — see the numerator
+ * comment in `computeDeletePlan` and the 2026-07-30 incident.
+ *
  * The MIN_ABS floor is what lets small intentional deletes through —
  * `rm 1 file` from a 5-entry mirror is 20% but 1 absolute candidate; never
  * tripped. The RATIO is what lets large intentional uploads-then-deletes
@@ -2431,18 +2437,37 @@ async function computeDeletePlan(
   // and the journal-mutation buckets are already settled before any I/O.
   type HeadCandidate = { key: string; journalEtag: string; intentVersion: 1 };
   const headCandidates: HeadCandidate[] = [];
-  // Litter drain bucket — kept separate from normal delete candidates so
-  // the bulk-asymmetry accounting cannot sweep these in. See
+  // Litter drain bucket — kept separate from `plan.toDelete` so the
+  // bulk-asymmetry breaker (which moves toDelete + headCandidates into
+  // `refusedStale` when it trips) can't sweep these out. See
   // `isVaultLitterArtifact` for the patterns and rationale: by construction
   // these aren't user content losses, so a high ratio of litter must not
   // refuse the drain — that's the whole point of the bypass. Merged into
   // `plan.toDelete` after the breaker check.
   const litterToDelete: string[] = [];
-  // Current watcher intents are affirmative evidence of an observed delete,
-  // so only intent-less disappearances contribute to the mirror-loss breaker.
-  // An unmounted/wiped tree produces no intents and still trips it.
+  // Bulk-asymmetry tracking: count every in-scope journal entry (denominator)
+  // and every entry that would have been a delete-candidate before the guard
+  // (numerator). The numerator is the WHOLE prospective destructive set:
+  // intent-backed picks (owned-only/all toDelete, currency-gated
+  // headCandidates, legacy-no-etag refusals) AND intent-less disappearances.
+  //
+  // 6.14.19 (#227) narrowed it to intent-less disappearances only, on the
+  // premise that a current watcher intent is affirmative evidence of a
+  // deliberate delete. A wiped, swapped, unmounted or partially-restored tree
+  // observed by a live watcher mints an intent per descendant, so that premise
+  // does not hold and the breaker stopped covering the exact failure mode it
+  // exists for (incident 2026-07-30: 1,108 intent-backed deletions in one
+  // push). Intent currency is a per-file property; the breaker is a whole-set
+  // health check, and the two must not be conflated.
+  //
+  // We do NOT count "ENOENT but ignore-filtered" or "ENOENT but ephemeral" —
+  // those drop out of the plan entirely on their own and don't reflect
+  // mirror-loss intent — nor litter drains (see above), which are intentional
+  // ratchet-cleanup, not mass-delete intent.
   let inScopeJournalEntries = 0;
-  let intentlessDisappearances = 0;
+  let bulkCandidatePicks = 0;
+  // Intent-less candidates already parked in `refusedStale`. On a trip they are
+  // re-labelled `bulk-asymmetry` in place rather than refused twice.
   const intentlessKeys = new Set<string>();
 
   for (const [relativeKey, entry] of Object.entries(journal.files)) {
@@ -2534,7 +2559,7 @@ async function computeDeletePlan(
         policy === "currency-gated" ||
         (policy === "owned-only" && entry.direction === "up")
       ) {
-        intentlessDisappearances++;
+        bulkCandidatePicks++;
         intentlessKeys.add(relativeKey);
       }
       plan.refusedStale.push({
@@ -2546,6 +2571,7 @@ async function computeDeletePlan(
       continue;
     }
 
+    bulkCandidatePicks++;
     if (policy === "all") {
       // policy:"all" is the explicit-opt-out emergency-reconcile mode; the
       // bulk-asymmetry guard skips this branch (caller asserted intent).
@@ -2557,6 +2583,11 @@ async function computeDeletePlan(
     }
     if (policy === "owned-only") {
       if (entry.direction !== "up") {
+        // Not a delete candidate under owned-only, but it WAS missing
+        // locally. Don't count it for the bulk guard — direction:'down'
+        // entries that vanish locally are silently ignored by this policy
+        // anyway, so they don't represent intent to mass-delete.
+        bulkCandidatePicks--;
         continue;
       }
       plan.toDelete.push({
@@ -2589,26 +2620,54 @@ async function computeDeletePlan(
   if (
     policy !== "all" &&
     !isBulkAsymmetryOverride() &&
-    intentlessDisappearances >= BULK_ASYMMETRY_MIN_ABS &&
+    bulkCandidatePicks >= BULK_ASYMMETRY_MIN_ABS &&
     inScopeJournalEntries > 0 &&
-    intentlessDisappearances / inScopeJournalEntries >= BULK_ASYMMETRY_RATIO
+    bulkCandidatePicks / inScopeJournalEntries >= BULK_ASYMMETRY_RATIO
   ) {
+    // Move every staged candidate (both already-bucketed toDelete from
+    // owned-only and queued headCandidates from currency-gated) into
+    // refusedStale with reason "bulk-asymmetry", and re-label the intent-less
+    // entries already parked there. Journal is not mutated; no DeleteObject is
+    // issued; the Stage-2 HEAD pass never runs.
     const samplePaths: string[] = [];
+    const noteSample = (key: string): void => {
+      if (samplePaths.length < BULK_ASYMMETRY_SAMPLE_CAP) samplePaths.push(key);
+    };
     for (const refused of plan.refusedStale) {
       if (!intentlessKeys.has(refused.key)) continue;
       refused.journalEtag = "<bulk-asymmetry>";
       refused.remoteEtag = "<not-checked>";
       refused.reason = "bulk-asymmetry";
-      if (samplePaths.length < BULK_ASYMMETRY_SAMPLE_CAP) {
-        samplePaths.push(refused.key);
-      }
+      noteSample(refused.key);
     }
+    const pushRefused = (key: string): void => {
+      plan.refusedStale.push({
+        key,
+        journalEtag: "<bulk-asymmetry>",
+        remoteEtag: "<not-checked>",
+        reason: "bulk-asymmetry",
+      });
+      noteSample(key);
+    };
+    for (const item of plan.toDelete) pushRefused(item.key);
+    for (const c of headCandidates) pushRefused(c.key);
+    // Emptying the delete list is what makes the trip a refusal rather than a
+    // label. #227 dropped this line, so a tripped breaker stopped nothing it
+    // had not already refused for another reason.
+    plan.toDelete = [];
     plan.bulkAsymmetry = {
-      candidates: intentlessDisappearances,
+      candidates: bulkCandidatePicks,
       inScope: inScopeJournalEntries,
-      ratio: intentlessDisappearances / inScopeJournalEntries,
+      ratio: bulkCandidatePicks / inScopeJournalEntries,
       samplePaths,
     };
+    // Litter still drains even when the breaker trips — see `litterToDelete`
+    // declaration. The breaker protects against corrupt-mirror mass-deletes
+    // of user content; litter cleanup is orthogonal and should never be
+    // refused for the same reason new-litter producer-side exclusions
+    // shouldn't block it.
+    plan.toDelete.push(...litterToDelete.map((key) => ({ key, intentVersion: null })));
+    return plan;
   }
 
   // Stage 2: bounded-parallel HEAD pass. Promise.all over chunks of size