@indigoai-us/hq-cloud 6.14.9 → 6.14.11

package/dist/cli/sync.d.ts

@@ -146,7 +146,7 @@ export type SyncProgressEvent = {
     path: string;
     journalEtag: string;
     remoteEtag: string;
-    reason: "stale-etag" | "legacy-no-etag" | "bulk-asymmetry" | "divergent-local";
+    reason: "stale-etag" | "legacy-no-etag" | "bulk-asymmetry" | "divergent-local" | "missing-delete-intent" | "intent-changed";
 } | {
     /**
      * Emitted at most ONCE per `share()` call when the bulk-asymmetry

package/dist/cli/sync.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sync.d.ts","sourceRoot":"","sources":["../../src/cli/sync.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAEV,kBAAkB,EAEnB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAe,KAAK,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAEL,KAAK,eAAe,EACrB,MAAM,wBAAwB,CAAC;AAwChC,OAAO,EAGL,KAAK,gBAAgB,EACtB,MAAM,uBAAuB,CAAC;AAU/B,OAAO,KAAK,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAe1E;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,iBAAiB,GACzB;IACE,IAAI,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,iEAAiE;IACjE,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,0EAA0E;IAC1E,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB;;;;;;;OAOG;IACH,aAAa,EAAE,MAAM,CAAC;CACvB,GACD;IACE,IAAI,EAAE,UAAU,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sEAAsE;IACtE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;;;;OAQG;IACH,SAAS,CAAC,EAAE,IAAI,GAAG,MAAM,CAAC;IAC1B;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB,GACD;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAChD;IACE,IAAI,EAAE,UAAU,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC;IAC3B,UAAU,EAAE,kBAAkB,CAAC;CAChC,GACD;IACE;;;;;;;;;;;;;;;;OAgBG;IACH,IAAI,EAAE,YAAY,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC;CAC5B,GACD;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;CACvE,GACD;IACE;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,IAAI,EAAE,2BAA2B,CAAC;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,YAAY,GAAG,gBAAgB,GAAG,gBAAgB,GAAG,iBAAiB,CAAC;CAChF,GACD;IACE;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,IAAI,EAAE,+BAA+B,CAAC;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB,GACD;IACE;;;;;;;;;;;;;;;OAeG;IACH,IAAI,EAAE,8BAA8B,CAAC;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B,GACD;IACE;;;;;;;;;;;;;;;;OAgBG;IACH,IAAI,EAAE,gBAAgB,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB,GACD;IACE;;;;;;;;;OASG;IACH,IAAI,EAAE,iBAAiB,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB,GACD;IACE;;;;;;;;;;;OAWG;IACH,IAAI,EAAE,6BAA6B,CAAC;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;CACnB,GACD;IACE;;;;;;;;;;;;OAYG;IACH,IAAI,EAAE,iBAAiB,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf,GACD;IACE;;;;;;;;;;;OAWG;IACH,IAAI,EAAE,yBAAyB,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,6EAA6E;IAC7E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEN,MAAM,WAAW,WAAW;IAC1B,mEAAmE;IACnE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wCAAwC;IACxC,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B,2BAA2B;IAC3B,WAAW,EAAE,kBAAkB,CAAC;IAChC,wBAAwB;IACxB,MAAM,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,IAAI,CAAC;IAC7C;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;;;;;OAQG;IACH,eAAe,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACtC;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB;;;;;;;;;;;;OAYG;IACH,SAAS,CAAC,EAAE,gBAAgB,EAAE,CAAC;IAC/B;;;;;;;;;;;;;;;OAeG;IACH,eAAe,CAAC,EAAE,gBAAgB,EAAE,CAAC;IACrC;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;;;;;;;;;;;;;;;OAiBG;IACH,iBAAiB,CAAC,EAAE,OAAO,GAAG,cAAc,CAAC;IAC7C;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,eAAe,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC;IACzC;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;OAGG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;CACpC;AAED,MAAM,WAAW,UAAU;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,OAAO,EAAE,OAAO,CAAC;IACjB;;;;OAIG;IACH,QAAQ,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjD,4CAA4C;IAC5C,aAAa,EAAE,MAAM,CAAC;IACtB;;;;;;;OAOG;IACH,qBAAqB,EAAE,MAAM,CAAC;IAC9B;;;;;;;;;OASG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB;;;;;;;OAOG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,mBAAmB,EAAE,MAAM,CAAC;IAC5B;;;;;OAKG;IACH,mBAAmB,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AA4DD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,CAM5C;AAiBD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,sBAAsB,CAC1C,WAAW,EAAE,kBAAkB,EAC/B,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC,EACrE,eAAe,CAAC,EAAE,eAAe,GAAG,IAAI,GACvC,OAAO,CAAC,IAAI,CAAC,CA6Ef;AAoCD;;GAEG;AACH,wBAAsB,IAAI,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAOpE"}
+{"version":3,"file":"sync.d.ts","sourceRoot":"","sources":["../../src/cli/sync.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAEV,kBAAkB,EAEnB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAe,KAAK,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAEL,KAAK,eAAe,EACrB,MAAM,wBAAwB,CAAC;AAyChC,OAAO,EAGL,KAAK,gBAAgB,EACtB,MAAM,uBAAuB,CAAC;AAU/B,OAAO,KAAK,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAe1E;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,iBAAiB,GACzB;IACE,IAAI,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,iEAAiE;IACjE,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,0EAA0E;IAC1E,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB;;;;;;;OAOG;IACH,aAAa,EAAE,MAAM,CAAC;CACvB,GACD;IACE,IAAI,EAAE,UAAU,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sEAAsE;IACtE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;;;;OAQG;IACH,SAAS,CAAC,EAAE,IAAI,GAAG,MAAM,CAAC;IAC1B;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB,GACD;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAChD;IACE,IAAI,EAAE,UAAU,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC;IAC3B,UAAU,EAAE,kBAAkB,CAAC;CAChC,GACD;IACE;;;;;;;;;;;;;;;;OAgBG;IACH,IAAI,EAAE,YAAY,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC;CAC5B,GACD;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;CACvE,GACD;IACE;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,IAAI,EAAE,2BAA2B,CAAC;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EACF,YAAY,GACZ,gBAAgB,GAChB,gBAAgB,GAChB,iBAAiB,GACjB,uBAAuB,GACvB,gBAAgB,CAAC;CACtB,GACD;IACE;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,IAAI,EAAE,+BAA+B,CAAC;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB,GACD;IACE;;;;;;;;;;;;;;;OAeG;IACH,IAAI,EAAE,8BAA8B,CAAC;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B,GACD;IACE;;;;;;;;;;;;;;;;OAgBG;IACH,IAAI,EAAE,gBAAgB,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB,GACD;IACE;;;;;;;;;OASG;IACH,IAAI,EAAE,iBAAiB,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB,GACD;IACE;;;;;;;;;;;OAWG;IACH,IAAI,EAAE,6BAA6B,CAAC;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;CACnB,GACD;IACE;;;;;;;;;;;;OAYG;IACH,IAAI,EAAE,iBAAiB,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf,GACD;IACE;;;;;;;;;;;OAWG;IACH,IAAI,EAAE,yBAAyB,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,6EAA6E;IAC7E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEN,MAAM,WAAW,WAAW;IAC1B,mEAAmE;IACnE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wCAAwC;IACxC,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B,2BAA2B;IAC3B,WAAW,EAAE,kBAAkB,CAAC;IAChC,wBAAwB;IACxB,MAAM,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,IAAI,CAAC;IAC7C;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;;;;;OAQG;IACH,eAAe,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACtC;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB;;;;;;;;;;;;OAYG;IACH,SAAS,CAAC,EAAE,gBAAgB,EAAE,CAAC;IAC/B;;;;;;;;;;;;;;;OAeG;IACH,eAAe,CAAC,EAAE,gBAAgB,EAAE,CAAC;IACrC;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;;;;;;;;;;;;;;;OAiBG;IACH,iBAAiB,CAAC,EAAE,OAAO,GAAG,cAAc,CAAC;IAC7C;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,eAAe,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC;IACzC;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;OAGG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;CACpC;AAED,MAAM,WAAW,UAAU;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,OAAO,EAAE,OAAO,CAAC;IACjB;;;;OAIG;IACH,QAAQ,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjD,4CAA4C;IAC5C,aAAa,EAAE,MAAM,CAAC;IACtB;;;;;;;OAOG;IACH,qBAAqB,EAAE,MAAM,CAAC;IAC9B;;;;;;;;;OASG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB;;;;;;;OAOG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,mBAAmB,EAAE,MAAM,CAAC;IAC5B;;;;;OAKG;IACH,mBAAmB,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AA4DD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,CAM5C;AAiBD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,sBAAsB,CAC1C,WAAW,EAAE,kBAAkB,EAC/B,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC,EACrE,eAAe,CAAC,EAAE,eAAe,GAAG,IAAI,GACvC,OAAO,CAAC,IAAI,CAAC,CA6Ef;AAoCD;;GAEG;AACH,wBAAsB,IAAI,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAOpE"}

package/dist/cli/sync.js

@@ -14,6 +14,7 @@ import { localPathForVaultKey, vaultKeyForLocalPath } from "../local-path-codec.
 import { downloadFile, listRemoteFiles, headRemoteFile, primeObjectTransport, toPosixKey, classifyVaultKey, } from "../s3.js";
 import { readJournal, writeJournal, hashFile, hashSymlinkTarget, updateEntry, removeEntry, getEntry, normalizeEtag, migrateToV2, gcTombstones, isTombstone, tombstoneEntry, lastPullRecord, appendPullRecord, generatePullId, PERSONAL_VAULT_JOURNAL_SLUG, migratePersonalVaultJournal, } from "../journal.js";
 import { PERSONAL_VAULT_MANIFEST_KEY } from "../personal-vault.js";
+import { isPersonalVaultExcluded } from "../personal-vault-exclusions.js";
 import { buildScopeShrinkPlan, applyScopeShrink, ScopeShrinkBlockedError, ScopeShrinkLargePruneError, } from "../scope-shrink.js";
 import { coalescePrefixes, isCoveredByAny, } from "../prefix-coalesce.js";
 import { createIgnoreFilter } from "../ignore.js";
@@ -461,12 +462,19 @@ async function executeConflictExecutor(run, plan, scopeRun, counters) {
 }
 function executeFileTombstoneDelete(run, item, counters) {
     const tombstoneKey = item.remoteFile.key;
-    const tombstonePath = resolveContainedVaultPath(run.companyRoot, tombstoneKey);
-    if (tombstonePath === null)
+    const tombstonePath = item.localPath;
+    if (!isDownloadWritePathStillContained(run.companyRoot, tombstoneKey, tombstonePath)) {
+        run.emit({
+            type: "error",
+            path: tombstoneKey,
+            message: "tombstone-suppress unlink skipped: local parent escaped the sync root",
+        });
         return;
+    }
     try {
         const lstat = fs.lstatSync(tombstonePath);
-        if (tombstoneTargetDiverged(run.journal, tombstoneKey, tombstonePath, lstat)) {
+        if (!matchesLocalSnapshot(tombstonePath, item.localSnapshot)) {
+            reportLocalSnapshotConflict(run, counters, tombstoneKey);
             return;
         }
         if (lstat.isSymbolicLink() || lstat.isFile()) {
@@ -501,7 +509,13 @@ async function executeConflictItem(run, plan, scopeRun, counters, downloadItems,
     // the `.conflict-` mirror loop AND the journal false-stamp (remote etag over
     // divergent local content) that the keep path produced for these files.
     if (isCloudAuthoritative(vaultKeyForLocalPath(run.hqRoot, localPath))) {
-        downloadItems.push({ action: "download", remoteFile, localPath, isNew: false });
+        downloadItems.push({
+            action: "download",
+            remoteFile,
+            localPath,
+            isNew: false,
+            localSnapshot: item.localSnapshot,
+        });
         run.emit({ type: "reconciled", path: remoteFile.key, direction: "pull" });
         return null;
     }
@@ -547,7 +561,7 @@ async function executeConflictItem(run, plan, scopeRun, counters, downloadItems,
                 /* best-effort cleanup; a stray identical mirror is harmless */
             }
         }
-        updateEntry(run.journal, remoteFile.key, item.localHash, item.localSize, "down", remoteFile.etag, item.localMtime.getTime());
+        updateEntry(run.journal, remoteFile.key, item.localHash, item.localSize, "down", remoteFile.etag, item.localMtime.getTime(), item.localSnapshot.kind === "symlink" ? "symlink" : "file");
         run.emit({ type: "reconciled", path: remoteFile.key, direction: "pull" });
         counters.filesSkipped++;
         return null;
@@ -620,7 +634,7 @@ async function executeConflictItem(run, plan, scopeRun, counters, downloadItems,
     }
     if (resolution === "keep" || resolution === "skip") {
         counters.filesSkipped++;
-        updateEntry(run.journal, remoteFile.key, item.localHash, item.localSize, "down", remoteFile.etag, item.localMtime.getTime());
+        updateEntry(run.journal, remoteFile.key, item.localHash, item.localSize, "down", remoteFile.etag, item.localMtime.getTime(), item.localSnapshot.kind === "symlink" ? "symlink" : "file");
         // Journal-honesty: we recorded the remote etag so this conflict can't
         // re-fire (#137), but the KEPT local copy diverges from that remote — it
         // never matched it. Flag the entry so the currency-gated delete planner
@@ -637,6 +651,7 @@ async function executeConflictItem(run, plan, scopeRun, counters, downloadItems,
         remoteFile,
         localPath,
         isNew: false,
+        localSnapshot: item.localSnapshot,
     });
     return null;
 }
@@ -685,7 +700,13 @@ async function downloadOne(run, downloadItem, counters) {
         return;
     }
     try {
-        const { metadata, contentHash, contentSize, modeWarnings } = await downloadFile(run.ctx, remoteFile.key, localPath);
+        const { metadata, contentHash, contentSize, modeWarnings } = await downloadFile(run.ctx, remoteFile.key, localPath, {
+            beforeReplace: () => {
+                if (!matchesLocalSnapshot(localPath, downloadItem.localSnapshot)) {
+                    throw new LocalSnapshotChangedError(remoteFile.key);
+                }
+            },
+        });
         reportModeWarnings(run, modeWarnings);
         const author = metadata?.["created-by"] ?? null;
         const createdBySub = metadata?.["created-by-sub"];
@@ -695,7 +716,7 @@ async function downloadOne(run, downloadItem, counters) {
             ? hashSymlinkTarget(fs.readlinkSync(localPath))
             : (contentHash ?? hashFile(localPath));
         const size = isLocalSymlink ? 0 : (contentSize ?? fs.statSync(localPath).size);
-        updateEntry(run.journal, remoteFile.key, hash, size, "down", remoteFile.etag, localLstat.mtimeMs, createdBySub);
+        updateEntry(run.journal, remoteFile.key, hash, size, "down", remoteFile.etag, localLstat.mtimeMs, createdBySub, isLocalSymlink ? "symlink" : "file");
         const priorEntry = getEntry(run.journal, remoteFile.key);
         const remoteJournalMessage = priorEntry?.message;
         run.emit({
@@ -710,7 +731,10 @@ async function downloadOne(run, downloadItem, counters) {
         counters.changedPaths.push(remoteFile.key);
     }
     catch (err) {
-        if (isAccessDenied(err)) {
+        if (err instanceof LocalSnapshotChangedError) {
+            reportLocalSnapshotConflict(run, counters, remoteFile.key);
+        }
+        else if (isAccessDenied(err)) {
             counters.filesSkipped++;
         }
         else {
@@ -779,12 +803,12 @@ async function verifyPlannedJournalTombstones(run, plan) {
     // the push leg ever re-uploading it (tombstone-not-reupload).
     const autoVerified = [];
     const toHeadVerify = [];
-    for (const key of plan.tombstones) {
-        if (run.options.personalMode !== true && key.startsWith("companies/")) {
-            autoVerified.push(key);
+    for (const tombstone of plan.tombstones) {
+        if (run.options.personalMode !== true && tombstone.key.startsWith("companies/")) {
+            autoVerified.push(tombstone);
         }
         else {
-            toHeadVerify.push(key);
+            toHeadVerify.push(tombstone);
         }
     }
     plan.tombstones = toHeadVerify;
@@ -792,43 +816,50 @@ async function verifyPlannedJournalTombstones(run, plan) {
         plan.tombstones = autoVerified;
         return;
     }
-    await primeObjectTransport(run.ctx, "get", plan.tombstones);
+    await primeObjectTransport(run.ctx, "get", plan.tombstones.map((t) => t.key));
     const HEAD_VERIFY_CONCURRENCY = 5;
     const verified = [];
     for (let i = 0; i < plan.tombstones.length; i += HEAD_VERIFY_CONCURRENCY) {
         const batch = plan.tombstones.slice(i, i + HEAD_VERIFY_CONCURRENCY);
-        const results = await Promise.all(batch.map(async (key) => {
+        const results = await Promise.all(batch.map(async (tombstone) => {
             try {
-                const head = await headRemoteFile(run.ctx, key);
-                return head === null ? key : null;
+                const head = await headRemoteFile(run.ctx, tombstone.key);
+                return head === null ? tombstone : null;
             }
             catch (err) {
                 if (isAccessDenied(err))
                     return null;
                 run.emit({
                     type: "error",
-                    path: key,
+                    path: tombstone.key,
                     message: `tombstone HEAD verify failed (deferring): ${err instanceof Error ? err.message : String(err)}`,
                 });
                 return null;
             }
         }));
-        for (const k of results) {
-            if (k !== null)
-                verified.push(k);
+        for (const tombstone of results) {
+            if (tombstone !== null)
+                verified.push(tombstone);
         }
     }
     plan.tombstones = [...autoVerified, ...verified];
 }
 function executeJournalTombstoneDeletes(run, plan, counters) {
-    for (const key of plan.tombstones) {
-        const localPath = resolveContainedVaultPath(run.companyRoot, key);
-        if (localPath === null)
+    for (const tombstone of plan.tombstones) {
+        const { key, localPath, localSnapshot } = tombstone;
+        if (!isDownloadWritePathStillContained(run.companyRoot, key, localPath)) {
+            run.emit({
+                type: "error",
+                path: key,
+                message: "tombstone unlink skipped: local parent escaped the sync root",
+            });
             continue;
+        }
         let removedSomething = false;
         try {
             const lstat = fs.lstatSync(localPath);
-            if (tombstoneTargetDiverged(run.journal, key, localPath, lstat)) {
+            if (!matchesLocalSnapshot(localPath, localSnapshot)) {
+                reportLocalSnapshotConflict(run, counters, key);
                 continue;
             }
             if (lstat.isSymbolicLink() || lstat.isFile()) {
@@ -1007,23 +1038,52 @@ function isDownloadWritePathStillContained(root, key, localPath) {
     const resolved = resolveContainedVaultPath(root, key);
     return resolved !== null && path.resolve(resolved) === path.resolve(localPath);
 }
-function tombstoneTargetDiverged(journal, key, localPath, lstat) {
-    const journalEntry = journal.files[key];
-    if (!journalEntry?.hash) {
-        return lstat.isSymbolicLink() || lstat.isFile();
-    }
+function snapshotLocalState(localPath) {
     try {
+        const lstat = fs.lstatSync(localPath);
         if (lstat.isSymbolicLink()) {
-            return hashSymlinkTarget(fs.readlinkSync(localPath)) !== journalEntry.hash;
+            return { kind: "symlink", hash: hashSymlinkTarget(fs.readlinkSync(localPath)) };
         }
         if (lstat.isFile()) {
-            return hashFile(localPath) !== journalEntry.hash;
+            return { kind: "file", hash: hashFile(localPath) };
         }
+        if (lstat.isDirectory())
+            return { kind: "directory" };
+        return { kind: "other" };
     }
-    catch {
-        return true;
+    catch (err) {
+        const code = err && typeof err === "object" && "code" in err
+            ? err.code
+            : undefined;
+        return code === "ENOENT" ? { kind: "absent" } : null;
+    }
+}
+function matchesLocalSnapshot(localPath, expected) {
+    const actual = snapshotLocalState(localPath);
+    if (actual === null || actual.kind !== expected.kind)
+        return false;
+    return ((actual.kind !== "file" && actual.kind !== "symlink") ||
+        actual.hash === expected.hash);
+}
+function hasCurrentLocalDeleteIntent(entry) {
+    const intent = entry?.localDeleteIntent;
+    return !!(intent &&
+        intent.version === 1 &&
+        entry.remoteEtag &&
+        entry.kind &&
+        intent.remoteEtag === entry.remoteEtag &&
+        intent.localHash === entry.hash &&
+        intent.localKind === entry.kind);
+}
+function reportLocalSnapshotConflict(run, counters, key) {
+    counters.conflicts++;
+    counters.conflictPaths.push(key);
+    run.emit({ type: "conflict", path: key, direction: "pull", resolution: "skip" });
+}
+class LocalSnapshotChangedError extends Error {
+    constructor(key) {
+        super(`local state changed while downloading ${key}; replanning required`);
     }
-    return false;
 }
 /**
  * Stage-1 planning pass: classify every remote file into download / skip /
@@ -1122,6 +1182,15 @@ excludePrefixes = []) {
             items.push({ action: "skip-excluded-policy", remoteFile, localPath });
             continue;
         }
+        // Personal-vault policy must be symmetric across both transfer legs.
+        // The push walker refuses derived/machine-local/sensitive paths, but old
+        // objects can remain in the bucket from clients that predate an exclusion.
+        // Refuse those objects here too so a pull cannot rematerialize them (or,
+        // for generated skill wrappers, fight reindex over a directory link).
+        if (personalMode && isPersonalVaultExcluded(remoteFile.key)) {
+            items.push({ action: "skip-excluded-policy", remoteFile, localPath });
+            continue;
+        }
         if (personalMode &&
             remoteFile.key.startsWith("companies/") &&
             // EXEMPTION: companies/manifest.yaml is the routing source-of-truth
@@ -1213,6 +1282,7 @@ excludePrefixes = []) {
         // path below — never to delete a file that is present locally.
         const localTombstoneSuppresses = journalEntry !== undefined &&
             isTombstone(journalEntry) &&
+            hasCurrentLocalDeleteIntent(journalEntry) &&
             journalEntry.removedAt !== undefined &&
             !isRemoteRecreateAfterTombstone(remoteFile, {
                 deletedAt: journalEntry.removedAt,
@@ -1230,6 +1300,7 @@ excludePrefixes = []) {
         //      dangling link on every run.
         //   3. A regular file: indistinguishable from current behaviour.
         let localLstat = null;
+        let plannedLocalSnapshot = { kind: "absent" };
         let localPathBlockedByFileAncestor = false;
         try {
             localLstat = fs.lstatSync(localPath);
@@ -1327,6 +1398,10 @@ excludePrefixes = []) {
                     : hashFile(localPath);
             }
             const localChanged = !!journalEntry && journalEntry.hash !== localHash;
+            plannedLocalSnapshot = {
+                kind: isLocalSymlink ? "symlink" : "file",
+                hash: localHash,
+            };
             const remoteChanged = !!journalEntry && hasRemoteChanged(remoteFile, journalEntry);
             // ── Authoritative delete reaches a machine that still holds the file ──
             // A FILE_TOMBSTONE marks this key deleted and the remote object is not a
@@ -1347,10 +1422,16 @@ excludePrefixes = []) {
                         localHash,
                         localMtime: localLstat.mtime,
                         localSize: isLocalSymlink ? 0 : localLstat.size,
+                        localSnapshot: plannedLocalSnapshot,
                     });
                 }
                 else {
-                    items.push({ action: "tombstone-delete", remoteFile, localPath });
+                    items.push({
+                        action: "tombstone-delete",
+                        remoteFile,
+                        localPath,
+                        localSnapshot: plannedLocalSnapshot,
+                    });
                 }
                 continue;
             }
@@ -1375,6 +1456,7 @@ excludePrefixes = []) {
                     // every sync.
                     localMtime: localLstat.mtime,
                     localSize: isLocalSymlink ? 0 : localLstat.size,
+                    localSnapshot: plannedLocalSnapshot,
                 });
                 continue;
             }
@@ -1432,6 +1514,7 @@ excludePrefixes = []) {
                         localHash,
                         localMtime: localLstat.mtime,
                         localSize: localLstat.size,
+                        localSnapshot: plannedLocalSnapshot,
                     });
                     continue;
                 }
@@ -1460,7 +1543,12 @@ excludePrefixes = []) {
             if (journalEntry?.removedReason === "local-delete") {
                 continue;
             }
-            items.push({ action: "tombstone-delete", remoteFile, localPath });
+            items.push({
+                action: "tombstone-delete",
+                remoteFile,
+                localPath,
+                localSnapshot: plannedLocalSnapshot,
+            });
             continue;
         }
         // Intentional-delete producer: a clean, CURRENT (etag matches), non-divergent
@@ -1471,13 +1559,18 @@ excludePrefixes = []) {
         if (!localExists &&
             journalEntry !== undefined &&
             !isTombstone(journalEntry) &&
-            !journalEntry.localDiverges &&
-            journalEntry.remoteEtag !== undefined &&
+            hasCurrentLocalDeleteIntent(journalEntry) &&
             normalizeEtag(remoteFile.etag) === journalEntry.remoteEtag) {
             intentionalDeleteCandidates.push({ remoteFile, localPath });
             continue;
         }
-        items.push({ action: "download", remoteFile, localPath, isNew: !localExists });
+        items.push({
+            action: "download",
+            remoteFile,
+            localPath,
+            isNew: !localExists,
+            localSnapshot: plannedLocalSnapshot,
+        });
     }
     // ── Intentional-delete bulk-asymmetry decision (pull-leg producer) ─────────
     // Below the breaker → stamp a persisting `local-delete` tombstone (the
@@ -1497,6 +1590,7 @@ excludePrefixes = []) {
                 remoteFile: cand.remoteFile,
                 localPath: cand.localPath,
                 isNew: true,
+                localSnapshot: { kind: "absent" },
             });
         }
         else {
@@ -1648,7 +1742,10 @@ excludePrefixes = []) {
             if (code !== "ENOENT")
                 continue;
         }
-        tombstones.push(key);
+        const localSnapshot = snapshotLocalState(localPath);
+        if (localSnapshot === null)
+            continue;
+        tombstones.push({ key, localPath, localSnapshot });
     }
     return {
         items,