@indigoai-us/hq-cloud 6.14.47 → 6.14.48

package/src/cli/share.ts

@@ -32,6 +32,7 @@ import {
   hashSymlinkTarget,
   updateEntry,
   removeEntry,
+  isTombstone,
   normalizeEtag,
   PERSONAL_VAULT_JOURNAL_SLUG,
   migratePersonalVaultJournal,
@@ -300,6 +301,7 @@ export const _testing = {
   collectFiles,
   resolveNamedPath,
   isWithinLexicalOrReal,
+  defaultConsoleLogger,
 };
 
 /**
@@ -646,8 +648,10 @@ export interface ShareOptions {
    * belong in THIS bucket regardless of local state" and uses the same
    * DeleteObject + journal-removal path as `propagateDeletes`.
    *
-   * Honors `propagateDeletePolicy` — `"owned-only"` (default) only
-   * decommissions journal entries with `direction === "up"`, so a
+   * Honors `propagateDeletePolicy`. Under `"owned-only"` (this function's
+   * own fallback when the caller passes nothing; every live caller passes
+   * `resolveDeletePolicy()`, which defaults to `"currency-gated"`) only
+   * journal entries with `direction === "up"` are decommissioned, so a
    * misconfigured caller never erases content pulled from elsewhere.
    *
    * Independent of `propagateDeletes`: callers can opt into decommission
@@ -893,6 +897,7 @@ export type ShareDeleteRefusalReason =
   | "divergent-local"
   | "missing-delete-intent"
   | "intent-changed"
+  | "recreated-locally"
   | "transfer-error";
 
 export interface SharePathResult {
@@ -1093,7 +1098,7 @@ const REFUSED_STALE_PATH_CAP = 50;
 
 async function createPushRunContext(options: ShareOptions): Promise<PushRunContext> {
   const { paths, company, message, onConflict, vaultConfig, entityContext, hqRoot, skipUnchanged, propagateDeletes } = options;
-  let propagateDeletePolicy: DeletePolicy =
+  const propagateDeletePolicy: DeletePolicy =
     options.propagateDeletePolicy ?? "owned-only";
   const baseEmit = options.onEvent ?? defaultConsoleLogger;
 
@@ -1123,9 +1128,30 @@ async function createPushRunContext(options: ShareOptions): Promise<PushRunConte
     ? entityContext
     : await resolveEntityContext(companyRef, vaultConfig!);
 
-  if (ctx.uid.startsWith("prs_") && propagateDeletePolicy === "owned-only") {
-    propagateDeletePolicy = "currency-gated";
-  }
+  // NOTE (removed 6.14.48): a `prs_`-scoped coercion used to silently rewrite
+  // `owned-only` -> `currency-gated` here (366721b). It was correct for the
+  // problem it was written against and is now actively harmful, for three
+  // reasons that only became true later:
+  //
+  //   1. Its ONLY reachable effect in production was to override an EXPLICIT
+  //      `owned-only`. Every live caller passes a policy
+  //      (`sync-runner-company.ts` -> `resolveDeletePolicy()`), and that
+  //      resolver already defaults to `currency-gated`. So the coercion never
+  //      fired on a default run — it fired exactly when an operator had set
+  //      `HQ_SYNC_DELETE_POLICY=owned-only`, i.e. the documented rollback.
+  //   2. Once delete authorization moved to ETag currency (no watcher-minted
+  //      intent required), that override stopped being cosmetic: an operator
+  //      reaching for the rollback because deletes were misbehaving would keep
+  //      getting intent-less etag-only deletes on their personal vault. A
+  //      rollback knob that silently exempts a vault is not a rollback knob.
+  //   3. Its motivating bug — the May-27 `personal/.obsidian/*.drift-*` leak —
+  //      is fixed twice over by mechanisms that postdate it: the vault-litter
+  //      drain (6.0.2) drains `.drift-*` markers ahead of every policy gate,
+  //      and etag-gated deletes propagate an intent-less `direction:"down"`
+  //      removal under the default policy without needing any coercion.
+  //
+  // So `owned-only` now means owned-only on every vault kind. It is the strict
+  // rollback path and must stay strictly stricter than the default everywhere.
 
   // Mirror push progress into the shared cross-process snapshot (see sync.ts).
   // Record the friendly company slug, or null for the personal vault so the
@@ -1553,10 +1579,12 @@ async function executeUploads(
           localHash,
           lstat.size,
           "up",
-          remoteMeta.etag,
-          lstat.mtimeMs,
-          undefined,
-          item.kind,
+          absolutePath,
+          {
+            remoteEtag: remoteMeta.etag,
+            mtimeMs: lstat.mtimeMs,
+            kind: item.kind,
+          },
         );
         run.emit({ type: "reconciled", path: relativePath, direction: "push" });
         counters.filesSkipped++;
@@ -1638,10 +1666,8 @@ async function executeUploads(
         localHash,
         size,
         "up",
-        etag,
-        mtimeMs,
-        undefined,
-        item.kind,
+        absolutePath,
+        { remoteEtag: etag, mtimeMs, kind: item.kind },
       );
       if (run.message) {
         run.journal.files[relativePath] = {
@@ -1807,21 +1833,34 @@ async function executeDeletes(
     }
     try {
       const entry = run.journal.files[relativePath];
-      if (
+      // Last-second absence re-check. Applies to EVERY propagated delete,
+      // intent-backed or etag-only: a pull leg or the user can recreate the
+      // file between planning and applying, and deleting it remotely then
+      // destroys a file that exists locally right now. This used to sit inside
+      // the intent-version check, which meant it was skipped for any item
+      // carrying `intentVersion: null` — harmless while that only covered
+      // litter and decommission, but not once etag-only candidates travel that
+      // way too.
+      //
+      // Codec boundary: journal keys are canonical; the probe must use the
+      // ENCODED local path or a win32 colon key always looks absent (a raw `:`
+      // name can never exist on disk) and the remote delete proceeds while the
+      // encoded local file is still present.
+      const recreatedLocally =
+        !item.decommission &&
+        !isLocallyAbsent(localPathForVaultKey(run.syncRoot, relativePath));
+      const intentChanged =
         !item.decommission &&
         item.intentVersion !== null &&
         (!hasCurrentLocalDeleteIntent(entry) ||
-          entry!.localDeleteIntent!.version !== item.intentVersion ||
-          // Codec boundary: journal keys are canonical; the last-second
-          // absence re-check must probe the ENCODED local path or a win32
-          // colon key always looks absent (a raw `:` name can never exist
-          // on disk) and the remote delete proceeds while the encoded local
-          // file is still present.
-          !isLocallyAbsent(localPathForVaultKey(run.syncRoot, relativePath)))
-      ) {
+          entry!.localDeleteIntent!.version !== item.intentVersion);
+      if (recreatedLocally || intentChanged) {
         if (entry?.localDeleteIntent) {
           delete entry.localDeleteIntent;
         }
+        const refusalReason = recreatedLocally
+          ? ("recreated-locally" as const)
+          : ("intent-changed" as const);
         counters.filesRefusedStale++;
         if (filesRefusedStalePaths.length < REFUSED_STALE_PATH_CAP) {
           filesRefusedStalePaths.push(relativePath);
@@ -1831,13 +1870,13 @@ async function executeDeletes(
           path: relativePath,
           journalEtag: entry?.remoteEtag ?? "<missing-delete-intent>",
           remoteEtag: "<not-checked>",
-          reason: "intent-changed",
+          reason: refusalReason,
         });
         pathResults.push({
           path: relativePath,
           status: "refused",
           operation: "delete",
-          reason: "intent-changed",
+          reason: refusalReason,
         });
         continue;
       }
@@ -2183,6 +2222,32 @@ function defaultConsoleLogger(event: SyncProgressEvent): void {
       // Per-key lines stay compact so a 100-candidate refusal doesn't bury
       // the summary banner.
       console.error(`  ⚠ bulk-asymmetry refusal, kept on remote: ${event.path}`);
+    } else if (event.reason === "missing-delete-intent") {
+      // NEITHER etag is meaningful here: no HEAD was issued, so `remoteEtag`
+      // is the `<not-checked>` sentinel, and `journalEtag` is the entry's
+      // real recorded etag. Printing them under the `stale-etag` wording
+      // (which this branch used to fall through to) reads as an etag
+      // conflict and has repeatedly sent operators chasing a currency bug
+      // that does not exist — the actual cause is that no watcher observed
+      // the removal, so no delete authorization was ever recorded.
+      console.error(
+        `  ⚠ no-delete-authorization, kept on remote: ${event.path} ` +
+          `(the sync watcher did not observe this removal, so the delete was never authorized)`,
+      );
+    } else if (event.reason === "recreated-locally") {
+      console.error(
+        `  ⚠ recreated-locally, kept on remote: ${event.path} ` +
+          `(the file exists locally again, so the delete was abandoned)`,
+      );
+    } else if (event.reason === "divergent-local") {
+      // Same trap as above — `remoteEtag` is `<not-checked>`. The entry's
+      // recorded etag was stamped only to silence a re-fired conflict; the
+      // local copy never matched it, so propagating the delete would destroy
+      // divergent remote work.
+      console.error(
+        `  ⚠ divergent-local, kept on remote: ${event.path} ` +
+          `(the local copy never matched the recorded remote version; pull to reconcile first)`,
+      );
     } else {
       console.error(
         `  ⚠ stale-etag, kept on remote: ${event.path} (journal=${event.journalEtag}, remote=${event.remoteEtag})`,
@@ -2911,7 +2976,8 @@ type RefusedStaleReason =
   | "bulk-asymmetry"
   | "divergent-local"
   | "missing-delete-intent"
-  | "intent-changed";
+  | "intent-changed"
+  | "recreated-locally";
 
 /**
  * Bulk-asymmetry circuit-breaker — refuses to convert a suspiciously-large
@@ -3134,7 +3200,7 @@ async function computeDeletePlan(
   // all), or queue it for HEAD (currency-gated). Keeping this synchronous
   // means the HEAD pass below sees a single, deduplicated candidate list
   // and the journal-mutation buckets are already settled before any I/O.
-  type HeadCandidate = { key: string; journalEtag: string; intentVersion: 1 };
+  type HeadCandidate = { key: string; journalEtag: string; intentVersion: 1 | null };
   const headCandidates: HeadCandidate[] = [];
   // Litter drain bucket — kept separate from `plan.toDelete` so the
   // bulk-asymmetry breaker (which moves toDelete + headCandidates into
@@ -3177,6 +3243,41 @@ async function computeDeletePlan(
         relativeKey.startsWith(`${root}/`),
     );
     if (!inScope) continue;
+
+    // A tombstoned entry has ALREADY had its disposition decided — by a scope
+    // shrink, `hq sync narrow --apply`, a manual prune, or a pull-side
+    // intentional-delete record. It must never be re-evaluated as a fresh
+    // delete candidate.
+    //
+    // This matters most for `all` -> `shared`: `tombstoneEntry` deliberately
+    // KEEPS `hash`, `direction` and `remoteEtag` (so a recovery flow can see
+    // what was there), and the shrink removes the file locally. Every one of
+    // those entries therefore presents as locally-absent, intent-less and
+    // etag-current — which, now that authorization is etag-only, is an
+    // instruction to delete another member's files out of the shared company
+    // vault, for the crime of having narrowed one's own sync scope.
+    //
+    // Until now the ONLY thing standing in the way was `shouldSync` happening
+    // to carry a `prefixSet` (see `createPushRunContext`); any run that
+    // resolved no prefix set — a degraded scope lookup, a caller that does not
+    // set one — would have walked straight through. That is far too load-
+    // bearing for an implicit dependency, so the invariant is stated here
+    // directly.
+    //
+    // `local-delete` is the ONE reason that must pass: the pull leg stamps it
+    // as a deliberate producer hand-off ("the user removed this; push leg,
+    // finish the job"), and skipping it would strand exactly the deletes this
+    // change exists to enable. Every other reason — scope_shrink,
+    // narrow_apply, manual, or an absent/unrecognised one — means "stop
+    // tracking, do NOT touch the remote", so the test is written fail-closed:
+    // only the explicit hand-off is let through.
+    //
+    // Skipped BEFORE `inScopeJournalEntries++` so these inflate neither the
+    // numerator nor the denominator of the bulk-asymmetry ratio. Excluding
+    // them from the denominator can only make the breaker MORE likely to trip,
+    // which is the safe direction.
+    if (isTombstone(entry) && entry.removedReason !== "local-delete") continue;
+
     inScopeJournalEntries++;
     const localPath = localPathForVaultKey(syncRoot, relativeKey);
 
@@ -3256,13 +3357,78 @@ async function computeDeletePlan(
     }
 
     if (!hasCurrentLocalDeleteIntent(entry)) {
-      if (
-        policy === "currency-gated" ||
-        (policy === "owned-only" && entry.direction === "up")
-      ) {
+      // A delete intent is minted ONLY by a live watcher, at the instant it
+      // observes the unlink. Three of the four ways HQ syncs never construct a
+      // watcher at all — outpost/agent boxes run a one-shot runner, `hq sync
+      // now` is one-shot, and the desktop app drops `--event-push` (and with it
+      // the whole TreeWatcher) whenever Instant-sync is off. On those surfaces
+      // an intent can never exist, so requiring one made deletes structurally
+      // impossible rather than merely gated. Files deleted while no watcher was
+      // running also stranded permanently: the file is already gone, so no
+      // watcher can ever retroactively witness it.
+      //
+      // `currency-gated` therefore authorizes on ETag currency alone. The
+      // per-file question it answers is unchanged — "is the remote object still
+      // exactly what this journal recorded, i.e. has no peer touched it since"
+      // — and a mismatch still refuses (`stale-etag`) so a peer's newer work is
+      // never destroyed.
+      //
+      // The whole-set question ("does my local mirror look catastrophically
+      // empty") is NOT answered by the ETag, and must not be conflated with it:
+      // in the steady state nobody has overwritten anything, so a moved hqRoot,
+      // unmounted volume, fresh clone or partial restore presents mass-ENOENT
+      // with perfectly matching ETags. That is exactly how the 2026-05-25
+      // indigo vault mass-delete destroyed 559 objects. The bulk-asymmetry
+      // breaker below is the guard for that class and is deliberately left
+      // intact — these candidates are counted into `bulkCandidatePicks` on the
+      // SAME line as intent-backed ones, so relaxing the per-file gate cannot
+      // weaken the whole-set one. See policy `sync-delete-bulk-asymmetry-guard`
+      // (hard) and workspace/reports/indigo-vault-mass-delete-debug.md.
+      //
+      // `owned-only` keeps requiring an intent: it is the documented rollback
+      // knob, and an operator who selects it is asking for the stricter path.
+      if (policy === "owned-only") {
+        // Still counted into the breaker exactly as before: an owned-only run
+        // whose mirror has gone missing must trip the whole-set guard even
+        // though each individual key is refused for want of an intent.
+        if (entry.direction === "up") {
+          bulkCandidatePicks++;
+          intentlessKeys.add(relativeKey);
+        }
+        plan.refusedStale.push({
+          key: relativeKey,
+          journalEtag: entry.remoteEtag ?? "<missing-delete-intent>",
+          remoteEtag: "<not-checked>",
+          reason: "missing-delete-intent",
+        });
+        continue;
+      }
+      if (policy === "currency-gated") {
         bulkCandidatePicks++;
         intentlessKeys.add(relativeKey);
+        // No etag on record ⇒ nothing to compare ⇒ no authorization. Refused
+        // for the same reason an intent-backed legacy entry is (below).
+        if (!entry.remoteEtag) {
+          plan.refusedStale.push({
+            key: relativeKey,
+            journalEtag: "<legacy-no-etag>",
+            remoteEtag: "<unknown>",
+            reason: "legacy-no-etag",
+          });
+          continue;
+        }
+        headCandidates.push({
+          key: relativeKey,
+          journalEtag: entry.remoteEtag,
+          intentVersion: null,
+        });
+        continue;
       }
+      // policy === "all" is deliberately NOT relaxed here. It already skips the
+      // bulk-asymmetry breaker, so letting it skip the intent gate too would
+      // make it a wholly unguarded mass delete — a strictly larger blast radius
+      // than this change is scoped to. It keeps refusing intent-less entries
+      // exactly as before.
       plan.refusedStale.push({
         key: relativeKey,
         journalEtag: entry.remoteEtag ?? "<missing-delete-intent>",

package/src/cli/sync.ts

@@ -238,7 +238,8 @@ export type SyncProgressEvent =
         | "bulk-asymmetry"
         | "divergent-local"
         | "missing-delete-intent"
-        | "intent-changed";
+        | "intent-changed"
+        | "recreated-locally";
     }
   | {
       /**
@@ -1471,9 +1472,12 @@ async function executeConflictItem(
       item.localHash,
       item.localSize,
       "down",
-      remoteFile.etag,
-      item.localMtime.getTime(),
-      item.localSnapshot.kind === "symlink" ? "symlink" : "file",
+      localPath,
+      {
+        remoteEtag: remoteFile.etag,
+        mtimeMs: item.localMtime.getTime(),
+        kind: item.localSnapshot.kind === "symlink" ? "symlink" : "file",
+      },
     );
     run.emit({ type: "reconciled", path: remoteFile.key, direction: "pull" });
     counters.filesSkipped++;
@@ -1561,9 +1565,12 @@ async function executeConflictItem(
       item.localHash,
       item.localSize,
       "down",
-      remoteFile.etag,
-      item.localMtime.getTime(),
-      item.localSnapshot.kind === "symlink" ? "symlink" : "file",
+      localPath,
+      {
+        remoteEtag: remoteFile.etag,
+        mtimeMs: item.localMtime.getTime(),
+        kind: item.localSnapshot.kind === "symlink" ? "symlink" : "file",
+      },
     );
     // Journal-honesty: we recorded the remote etag so this conflict can't
     // re-fire (#137), but the KEPT local copy diverges from that remote — it
@@ -1694,10 +1701,13 @@ async function downloadOne(
       hash,
       size,
       "down",
-      remoteFile.etag,
-      localLstat.mtimeMs,
-      createdBySub,
-      isLocalSymlink ? "symlink" : "file",
+      localPath,
+      {
+        remoteEtag: remoteFile.etag,
+        mtimeMs: localLstat.mtimeMs,
+        ...(createdBySub !== undefined ? { createdBySub } : {}),
+        kind: isLocalSymlink ? "symlink" : "file",
+      },
     );
 
     const priorEntry = getEntry(run.journal, remoteFile.key);

package/src/journal.test.ts

@@ -16,6 +16,7 @@ import {
   readJournal,
   writeJournal,
   updateEntry,
+  PrematureJournalEntryError,
   migrateToV2,
   normalizeJournalKeys,
   appendPullRecord,
@@ -208,12 +209,54 @@ describe("journal", () => {
   describe("updateEntry", () => {
     it("stamps lastSync and the per-file syncedAt", () => {
       const j: SyncJournal = { version: "1", lastSync: "", files: {} };
-      updateEntry(j, "foo.md", "hash", 10, "up");
+      const abs = path.join(stateDir, "foo.md");
+      fs.writeFileSync(abs, "x");
+      updateEntry(j, "foo.md", "hash", 10, "up", abs);
       expect(j.files["foo.md"]?.hash).toBe("hash");
       expect(j.files["foo.md"]?.direction).toBe("up");
       expect(j.lastSync).not.toBe("");
       expect(j.files["foo.md"]?.syncedAt).not.toBe("");
     });
+
+    // Load-bearing once delete propagation authorizes on ETag currency alone:
+    // an entry whose file was never written is indistinguishable from "the
+    // user deleted this", and the next push would issue a remote DeleteObject
+    // for what was only premature bookkeeping.
+    it("refuses to journal a path that is not on disk", () => {
+      const j: SyncJournal = { version: "1", lastSync: "", files: {} };
+      const missing = path.join(stateDir, "never-written.md");
+      expect(() => updateEntry(j, "never-written.md", "hash", 10, "down", missing)).toThrow(
+        PrematureJournalEntryError,
+      );
+      expect(j.files).not.toHaveProperty("never-written.md");
+      expect(j.lastSync).toBe("");
+    });
+
+    it("accepts a dangling symlink — the link itself is the synced object", () => {
+      const j: SyncJournal = { version: "1", lastSync: "", files: {} };
+      const link = path.join(stateDir, "dangling-link");
+      fs.symlinkSync(path.join(stateDir, "no-such-target"), link);
+      expect(() =>
+        updateEntry(j, "dangling-link", "hash", 0, "down", link, { kind: "symlink" }),
+      ).not.toThrow();
+      expect(j.files["dangling-link"]?.kind).toBe("symlink");
+    });
+
+    // Regression: `kind` and `createdBySub` were adjacent trailing optionals
+    // and two call sites passed kind into the createdBySub slot, leaving
+    // entry.kind unset. entry.kind gates delete-intent minting, so those
+    // entries could never be deleted. Named options make it unrepresentable.
+    it("records kind and createdBySub into their own fields", () => {
+      const j: SyncJournal = { version: "1", lastSync: "", files: {} };
+      const abs = path.join(stateDir, "typed.md");
+      fs.writeFileSync(abs, "x");
+      updateEntry(j, "typed.md", "hash", 1, "down", abs, {
+        kind: "file",
+        createdBySub: "sub-123",
+      });
+      expect(j.files["typed.md"]?.kind).toBe("file");
+      expect(j.files["typed.md"]?.createdBySub).toBe("sub-123");
+    });
   });
 
   // ── Journal v2 (US-005): pulls, tombstones, GC, migration ─────────────────

package/src/journal.ts

@@ -416,17 +416,82 @@ export function hashSymlinkTarget(target: string): string {
  * via `hq files get` are pulled — `direction:"down"` — but ride the pin union
  * in the caller's inclusion prefixSet, so they are likewise never pruned.)
  */
+/**
+ * Thrown when a caller tries to journal a path that is not on disk.
+ *
+ * Deliberately loud rather than a silent skip: a caller reaching this has a
+ * real ordering bug, and swallowing it would reintroduce exactly the silent
+ * drift this guard exists to prevent.
+ */
+export class PrematureJournalEntryError extends Error {
+  constructor(readonly relativePath: string, readonly absolutePath: string) {
+    super(
+      `refusing to journal '${relativePath}': no file at '${absolutePath}'. ` +
+        `A journal entry must be written only AFTER its file is on disk.`,
+    );
+    this.name = "PrematureJournalEntryError";
+  }
+}
+
+/**
+ * Optional fields of a journal entry.
+ *
+ * These are an OBJECT rather than trailing positional parameters because they
+ * were four adjacent optionals, two of them `string`, and callers drifted:
+ * two conflict-resolution sites in `cli/sync.ts` passed their `"file" |
+ * "symlink"` value into the `createdBySub` slot, so `entry.kind` was silently
+ * never set on any conflict-resolved entry. That is not cosmetic — `entry.kind`
+ * gates delete-intent minting (`markLocalDeleteIntent` requires it to match,
+ * and the watcher skips any entry without one), so a file that had ever been
+ * through conflict resolution could never be deleted, even with a live watcher.
+ * Named fields make that class of mistake unrepresentable.
+ */
+export interface UpdateEntryOptions {
+  remoteEtag?: string;
+  mtimeMs?: number;
+  /** Object's `created-by-sub` S3 metadata. Download path only. */
+  createdBySub?: string;
+  kind?: "file" | "symlink";
+}
+
+/**
+ * Record a journal entry for a file that is CONFIRMED present on disk.
+ *
+ * `verifyAbsolutePath` is required, and the entry is written only after an
+ * `lstat` proves the file exists. This is a load-bearing invariant, not a
+ * defensive nicety: a journal entry says "this key was synced and the local
+ * copy is at this hash". Once delete propagation authorizes on ETag currency
+ * alone (no watcher-minted intent), an entry whose file was never actually
+ * written becomes indistinguishable from "the user deleted this file" — and
+ * the next push issues a remote DeleteObject for a file that was only ever
+ * premature bookkeeping.
+ *
+ * Every existing caller already had a `fs.lstatSync` in hand and passed values
+ * derived from it, so this makes an existing convention structural. The point
+ * is that a FUTURE caller cannot get it wrong: with the check inside this
+ * function there is no longer a way to add a call site that records an entry
+ * for a file that is not there.
+ *
+ * `lstat` (not `stat`) so a dangling symlink still counts as present — the
+ * link itself is the synced object, and its target may legitimately be absent.
+ *
+ * @throws PrematureJournalEntryError when nothing exists at `verifyAbsolutePath`.
+ */
 export function updateEntry(
   journal: SyncJournal,
   relativePath: string,
   hash: string,
   size: number,
   direction: "up" | "down",
-  remoteEtag?: string,
-  mtimeMs?: number,
-  createdBySub?: string,
-  kind?: "file" | "symlink",
+  verifyAbsolutePath: string,
+  opts: UpdateEntryOptions = {},
 ): void {
+  try {
+    fs.lstatSync(verifyAbsolutePath);
+  } catch {
+    throw new PrematureJournalEntryError(relativePath, verifyAbsolutePath);
+  }
+  const { remoteEtag, mtimeMs, createdBySub, kind } = opts;
   const entry: JournalEntry = {
     hash,
     size,