@indigoai-us/hq-cloud 6.15.16 → 6.15.17

package/dist/cli/rescue-core.d.ts

@@ -80,6 +80,9 @@ export type RescueDecision = {
 } | {
     kind: "user-edit-overwrite-safe";
     rel: string;
+} | {
+    kind: "user-edit-keep-local";
+    rel: string;
 } | {
     kind: "user-edit-conflict";
     rel: string;

package/dist/cli/rescue-core.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rescue-core.d.ts","sourceRoot":"","sources":["../../src/cli/rescue-core.ts"],"names":[],"mappings":"AA6BA,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAa7B,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;CAChB;AA0CD,UAAU,MAAM;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,OAAO,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,OAAO,CAAC;IACrB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,OAAO,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,OAAO,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,oBAAoB,EAAE,MAAM,CAAC;CAC9B;AA2BD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAS3D;AA0FD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CAwJtD;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CACvB,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;CAAO,GACrC,eAAe,CAkCjB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,GAAE,IAAI,CAAC,YAAmB,GAAG,OAAO,CAGhG;AA24BD,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC7B;IAAE,IAAI,EAAE,wBAAwB,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC/C;IAAE,IAAI,EAAE,qBAAqB,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC5C;IAAE,IAAI,EAAE,sBAAsB,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC7D;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,0BAA0B,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACjD;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACzC;IAAE,IAAI,EAAE,uBAAuB,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC9C;IAAE,IAAI,EAAE,0BAA0B,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACjD;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC3C;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACzD;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC3C;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACzC;IAAE,IAAI,EAAE,4BAA4B,CAAC;IAAC,GAAG,EAAE,qBAAqB,CAAA;CAAE,CAAC;AAuYvE,KAAK,SAAS,GACV,MAAM,GACN,MAAM,GACN,OAAO,GACP,IAAI,GACJ,SAAS,EAAE,GACX;IAAE,CAAC,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAAC;AAM/B,sFAAsF;AACtF,wBAAgB,aAAa,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,GAAG,OAAO,CAajE;AAWD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,SAAS,EACf,IAAI,EAAE,SAAS,GAAG,SAAS,EAC3B,WAAW,GAAE,MAAM,EAAiB,EACpC,UAAU,SAAK,GACd,SAAS,GAAG,SAAS,CA6CvB;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE;IAAE,CAAC,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,EAClC,KAAK,EAAE;IAAE,CAAC,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,GAChC;IAAE,CAAC,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAkB5B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE;IAAE,CAAC,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,EAClC,IAAI,EAAE;IAAE,CAAC,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,EAChC,IAAI,EAAE;IAAE,CAAC,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,GAC/B,IAAI,CAcN;AA8BD,UAAU,YAAY;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,eAAe,GAAG,cAAc,CAAC;IAC/C;uDACmD;IACnD,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC5B;AAeD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,YAAY,EACjB,qBAAqB,EAAE,MAAM,GAAG,IAAI,EACpC,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,EACxB,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,GACvB,IAAI,CAqKN"}
+{"version":3,"file":"rescue-core.d.ts","sourceRoot":"","sources":["../../src/cli/rescue-core.ts"],"names":[],"mappings":"AA+BA,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAa7B,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;CAChB;AA0CD,UAAU,MAAM;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,OAAO,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,OAAO,CAAC;IACrB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,OAAO,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,OAAO,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,oBAAoB,EAAE,MAAM,CAAC;CAC9B;AA2BD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAS3D;AAiGD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CA2JtD;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CACvB,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;CAAO,GACrC,eAAe,CAkCjB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,EACZ,YAAY,GAAE,IAAI,CAAC,YAAmB,GACrC,OAAO,CAGT;AA2hCD,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC7B;IAAE,IAAI,EAAE,wBAAwB,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC/C;IAAE,IAAI,EAAE,qBAAqB,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC5C;IAAE,IAAI,EAAE,sBAAsB,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC7D;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,0BAA0B,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACjD;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACzC;IAAE,IAAI,EAAE,uBAAuB,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC9C;IAAE,IAAI,EAAE,0BAA0B,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACjD;IAAE,IAAI,EAAE,sBAAsB,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC7C;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC3C;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACzD;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC3C;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACzC;IAAE,IAAI,EAAE,4BAA4B,CAAC;IAAC,GAAG,EAAE,qBAAqB,CAAA;CAAE,CAAC;AA8bvE,KAAK,SAAS,GACZ,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,GAAG,SAAS,EAAE,GAAG;IAAE,CAAC,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAAC;AAM9E,sFAAsF;AACtF,wBAAgB,aAAa,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,GAAG,OAAO,CAajE;AAWD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,SAAS,EACf,IAAI,EAAE,SAAS,GAAG,SAAS,EAC3B,WAAW,GAAE,MAAM,EAAiB,EACpC,UAAU,SAAK,GACd,SAAS,GAAG,SAAS,CAkDvB;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE;IAAE,CAAC,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,EAClC,KAAK,EAAE;IAAE,CAAC,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,GAChC;IAAE,CAAC,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAkB5B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE;IAAE,CAAC,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,EAClC,IAAI,EAAE;IAAE,CAAC,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,EAChC,IAAI,EAAE;IAAE,CAAC,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,GAC/B,IAAI,CAcN;AA8BD,UAAU,YAAY;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,eAAe,GAAG,cAAc,CAAC;IAC/C;uDACmD;IACnD,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC5B;AAeD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,YAAY,EACjB,qBAAqB,EAAE,MAAM,GAAG,IAAI,EACpC,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,EACxB,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,GACvB,IAAI,CA8LN"}

package/dist/cli/rescue-core.js

@@ -21,8 +21,10 @@
  *                 upstream HEAD, leave in place + protect from the overlay so
  *                 its mtime survives (Layer 1).
  *   USER-EDIT  -> rescue into personal/ (or diff-append for .claude/CLAUDE.md),
- *                 quarantine into .hq-conflicts/ (conflict class), or silently
- *                 overwrite (overwrite-safe class).
+ *                 quarantine into .hq-conflicts/ (conflict class), silently
+ *                 overwrite (overwrite-safe class), or keep the local file and
+ *                 protect it from the overlay (keep-local class: root-level
+ *                 ignore files — see LOCAL_IGNORE_FILES).
  */
 import { spawnSync } from "child_process";
 import * as fs from "fs";
@@ -196,7 +198,9 @@ function utcStamp(d, sep) {
     const h = p(d.getUTCHours());
     const m = p(d.getUTCMinutes());
     const s = p(d.getUTCSeconds());
-    return sep === "colon" ? `${date}T${h}:${m}:${s}Z` : `${date}T${h}-${m}-${s}Z`;
+    return sep === "colon"
+        ? `${date}T${h}:${m}:${s}Z`
+        : `${date}T${h}-${m}-${s}Z`;
 }
 /**
  * Parse the rescue argv exactly as the bash `while case` loop did, including
@@ -494,10 +498,10 @@ function doRescue(cfg, env, out, err, setTmp) {
     const yqAvailable = hasCmd("yq", env);
     if (isFileFollow(coreYaml) && yqAvailable) {
         const yq = (expr) => run("yq", ["-r", expr, coreYaml], { env }).stdout.trim();
-        prevSyncSha = yq(".replaced_from_source.last_sync_sha // .replaced_from_staging.last_sync_sha // \"\"");
-        prevSyncSource = yq(".replaced_from_source.source // .replaced_from_staging.source // \"\"");
-        prevSyncRef = yq(".replaced_from_source.ref // .replaced_from_staging.ref // \"\"");
-        prevSyncAt = yq(".replaced_from_source.last_sync_at // .replaced_from_staging.last_sync_at // \"\"");
+        prevSyncSha = yq('.replaced_from_source.last_sync_sha // .replaced_from_staging.last_sync_sha // ""');
+        prevSyncSource = yq('.replaced_from_source.source // .replaced_from_staging.source // ""');
+        prevSyncRef = yq('.replaced_from_source.ref // .replaced_from_staging.ref // ""');
+        prevSyncAt = yq('.replaced_from_source.last_sync_at // .replaced_from_staging.last_sync_at // ""');
     }
     // Caller override (--floor-sha) wins only when the on-disk stamp is empty.
     if (!prevSyncSha && cfg.floorShaOverride) {
@@ -522,7 +526,9 @@ function doRescue(cfg, env, out, err, setTmp) {
     }
     else {
         out("==> Mode:       preserve-list (default)\n");
-        const extra = cfg.extraPreserve.length ? `, ${cfg.extraPreserve.join(" ")}` : "";
+        const extra = cfg.extraPreserve.length
+            ? `, ${cfg.extraPreserve.join(" ")}`
+            : "";
         out(`==> Preserved:  .git, companies (except companies/_template), personal, workspace, repos, worktrees, .worktrees, .sst-sandbox-home, .tmp-codex-asar, .github, .leak-scan, .hq-sync-journal.json, .hq, .hq-conflicts, .local${extra}\n`);
     }
     if (cfg.preserveSubpaths.length !== 0) {
@@ -615,7 +621,10 @@ function doRescue(cfg, env, out, err, setTmp) {
             err("error: clone failed\n");
             throw new ExitError(5);
         }
-        const checkoutResult = run("git", ["checkout", cfg.ref], { cwd: srcDir, env });
+        const checkoutResult = run("git", ["checkout", cfg.ref], {
+            cwd: srcDir,
+            env,
+        });
         if (checkoutResult.status !== 0) {
             reportGitFailure(checkoutResult);
             err(`error: could not check out ref '${cfg.ref}' from ${cfg.sourceRepo}\n`);
@@ -634,7 +643,10 @@ function doRescue(cfg, env, out, err, setTmp) {
                 err("error: clone failed\n");
                 throw new ExitError(5);
             }
-            const checkoutResult = run("git", ["checkout", cfg.ref], { cwd: srcDir, env });
+            const checkoutResult = run("git", ["checkout", cfg.ref], {
+                cwd: srcDir,
+                env,
+            });
             if (checkoutResult.status !== 0) {
                 reportGitFailure(checkoutResult);
                 err(`error: could not check out ref '${cfg.ref}' from ${cfg.sourceRepo}\n`);
@@ -642,7 +654,10 @@ function doRescue(cfg, env, out, err, setTmp) {
             }
         }
     }
-    const srcSha = run("git", ["rev-parse", "HEAD"], { cwd: srcDir, env }).stdout.trim();
+    const srcSha = run("git", ["rev-parse", "HEAD"], {
+        cwd: srcDir,
+        env,
+    }).stdout.trim();
     // Committer timestamp of the source SHA — the DETERMINISTIC stamp value for
     // core/core.yaml's `last_sync_at`. Stamping wall-clock "now" made every
     // rescue run on every machine produce a byte-different core.yaml for the
@@ -660,7 +675,8 @@ function doRescue(cfg, env, out, err, setTmp) {
     let historyFloor = "";
     let baselineMode = "head_compare";
     if (cfg.historyCheck && prevSyncSha && prevSyncSource === cfg.sourceRepo) {
-        if (run("git", ["cat-file", "-e", prevSyncSha], { cwd: srcDir, env }).status === 0) {
+        if (run("git", ["cat-file", "-e", prevSyncSha], { cwd: srcDir, env })
+            .status === 0) {
             historyFloor = prevSyncSha;
             baselineMode = "history_floor";
         }
@@ -744,6 +760,7 @@ function doRescue(cfg, env, out, err, setTmp) {
         userEdit: 0,
         userConflict: 0,
         userOverwrite: 0,
+        userKeptLocal: 0,
         claudeDiffAppend: 0,
         symlinkDropped: 0,
         cloudSymlinkReconciled: 0,
@@ -801,6 +818,7 @@ function doRescue(cfg, env, out, err, setTmp) {
         out(`  user-edit (rescue / diff-append): ${counts.userEdit} files\n`);
         out(`  user-edit (conflict quarantine):  ${counts.userConflict} files\n`);
         out(`  user-edit (overwrite-safe):       ${counts.userOverwrite} files\n`);
+        out(`  user-edit (kept local):           ${counts.userKeptLocal} files\n`);
         out(`  cloud-symlink reconciled:         ${counts.cloudSymlinkReconciled} files\n`);
         out(`  drift reconciled (== upstream):   ${counts.driftReconciled} files\n`);
         out(`  reindex symlinks dropped:     ${counts.symlinkDropped} entries\n`);
@@ -883,7 +901,10 @@ function doRescue(cfg, env, out, err, setTmp) {
     let backupDir = "";
     let mutationStarted = false;
     const hasDestructivePaths = ctx.actions.some((action) => action.affectedRels.length > 0);
-    if (cfg.doBackup && !cfg.dryRun && wipeToplevel.length !== 0 && hasDestructivePaths) {
+    if (cfg.doBackup &&
+        !cfg.dryRun &&
+        wipeToplevel.length !== 0 &&
+        hasDestructivePaths) {
         const prePlan = pruneManagedBackups(cfg, hqRoot, out, false);
         const unresolved = prePlan.protected.filter((x) => x.reason === "recovery-required-no-later-good");
         if (unresolved.length >= 2) {
@@ -936,7 +957,7 @@ function doRescue(cfg, env, out, err, setTmp) {
             }
         }
         out("\n");
-        out(`==> Walk complete (user-only: ${counts.userOnly}, unchanged: ${counts.unchanged}, user-edit-rescued: ${counts.userEdit}, conflict-quarantined: ${counts.userConflict}, overwrite-safe: ${counts.userOverwrite}, cloud-symlink-reconciled: ${counts.cloudSymlinkReconciled}, symlinks-dropped: ${counts.symlinkDropped})\n`);
+        out(`==> Walk complete (user-only: ${counts.userOnly}, unchanged: ${counts.unchanged}, user-edit-rescued: ${counts.userEdit}, conflict-quarantined: ${counts.userConflict}, overwrite-safe: ${counts.userOverwrite}, kept-local: ${counts.userKeptLocal}, cloud-symlink-reconciled: ${counts.cloudSymlinkReconciled}, symlinks-dropped: ${counts.symlinkDropped})\n`);
         // --- Overlay source onto HQ root ---
         out("==> Overlaying source onto HQ root ...\n");
         // `unchangedList` is only populated during applyClassifiedActions above, so
@@ -984,7 +1005,14 @@ function doRescue(cfg, env, out, err, setTmp) {
         // (vs the last-sync floor) into settings.local.json so the effective merged
         // settings are preserved. No-op in narrow mode that excludes .claude.
         if (claudeSettingsInScope) {
-            reconcileClaudeSettings({ hqRoot, srcDir, env, historyFloor, baselineMode, preserveSubpaths: cfg.preserveSubpaths }, preRescueSettingsJson, out, err);
+            reconcileClaudeSettings({
+                hqRoot,
+                srcDir,
+                env,
+                historyFloor,
+                baselineMode,
+                preserveSubpaths: cfg.preserveSubpaths,
+            }, preRescueSettingsJson, out, err);
         }
         // --- Restore executable bit on shipped shebang scripts (defense-in-depth) ---
         // rsync -a already propagated each file's upstream git tree mode; this guards
@@ -1002,7 +1030,9 @@ function doRescue(cfg, env, out, err, setTmp) {
         // unparseable commit timestamp skips the stamp entirely — a nondeterministic
         // stamp is worse than no stamp (it re-creates cross-machine conflict mirrors).
         const srcCommitDate = new Date(srcCommitIsoRaw);
-        if (cfg.narrowPaths.length === 0 && isFileFollow(coreYaml) && Number.isNaN(srcCommitDate.getTime())) {
+        if (cfg.narrowPaths.length === 0 &&
+            isFileFollow(coreYaml) &&
+            Number.isNaN(srcCommitDate.getTime())) {
             err(`    WARN: could not parse source commit timestamp (${JSON.stringify(srcCommitIsoRaw)}); skipping core/core.yaml stamp to keep it deterministic\n`);
         }
         if (cfg.narrowPaths.length === 0 &&
@@ -1090,6 +1120,7 @@ function doRescue(cfg, env, out, err, setTmp) {
         out(`    user-edits (rescued):             ${counts.userEdit} files\n`);
         out(`    user-edits (conflict quarantine): ${counts.userConflict} files\n`);
         out(`    user-edits (overwrite-safe):      ${counts.userOverwrite} files\n`);
+        out(`    user-edit  (kept local):          ${counts.userKeptLocal} files\n`);
         out(`    cloud-symlink reconciled:         ${counts.cloudSymlinkReconciled} files\n`);
         out(`    drift reconciled (== upstream):   ${counts.driftReconciled} files\n`);
         out(`    reindex symlinks dropped:     ${counts.symlinkDropped} entries\n`);
@@ -1124,6 +1155,7 @@ function doRescue(cfg, env, out, err, setTmp) {
             lines.push(`  user-edit  (rescued into personal/):     ${counts.userEdit}`);
             lines.push(`  user-edit  (conflict quarantine):        ${counts.userConflict}`);
             lines.push(`  user-edit  (overwrite-safe):             ${counts.userOverwrite}`);
+            lines.push(`  user-edit  (kept local, ignore file):     ${counts.userKeptLocal}`);
             lines.push(`  cloud-symlink reconciled:                ${counts.cloudSymlinkReconciled}`);
             lines.push(`  drift reconciled (== upstream HEAD):     ${counts.driftReconciled}`);
             lines.push(`  reindex symlinks dropped:            ${counts.symlinkDropped}`);
@@ -1284,7 +1316,9 @@ function writeApplyFailureManifest(ctx, backupDir, failedAction, completed, rest
     const completedLines = completed.length === 0
         ? ["  (none)"]
         : completed.map((action) => {
-            const paths = action.affectedRels.length > 0 ? action.affectedRels.join(", ") : "(no filesystem path)";
+            const paths = action.affectedRels.length > 0
+                ? action.affectedRels.join(", ")
+                : "(no filesystem path)";
             return `  - ${action.label}: ${paths}`;
         });
     const restoredSet = new Set(restored);
@@ -1369,6 +1403,28 @@ function isConflictClass(rel) {
         rel.startsWith(".obsidian/") ||
         rel === "MIGRATION.md");
 }
+/**
+ * Root-level exclusion lists an operator tunes for their own machine
+ * (`/workspace/`, large-media globs, local scratch dirs). They ship with a
+ * release, so the generic classifier used to treat an edited one as scaffold
+ * drift: archive it into `personal/` and lay the release copy down. On a real
+ * HQ root that silently reverted the operator's rules, and the git mirror and
+ * sync engine went straight back to walking tens of GB they had been told to
+ * skip. Once edited, the local file wins outright — see KEEP-LOCAL in
+ * classifyOne. Root-anchored on purpose: a nested `core/.gitignore` is
+ * scaffold, not machine-local tuning, and stays on the normal rescue path.
+ */
+const LOCAL_IGNORE_FILES = new Set([
+    ".gitignore",
+    ".hqignore",
+    ".hqsyncignore",
+    ".hqinclude",
+    ".claudeignore",
+    ".ignore",
+]);
+function isLocalIgnoreFile(rel) {
+    return LOCAL_IGNORE_FILES.has(rel);
+}
 function isOverwriteSafe(rel) {
     return (rel === "AGENTS.md" ||
         rel === "USER-GUIDE.md" ||
@@ -1453,12 +1509,20 @@ function isCloudFlattenedSymlinkEquiv(ctx, rel, localPath) {
     if (!localTarget)
         return false;
     const ref = ctx.baselineMode === "history_floor" ? ctx.historyFloor : "HEAD";
-    const lsTree = run("git", ["ls-tree", ref, "--", rel], { cwd: ctx.srcDir, env: ctx.env }).stdout;
+    const lsTree = run("git", ["ls-tree", ref, "--", rel], {
+        cwd: ctx.srcDir,
+        env: ctx.env,
+    }).stdout;
     const mode = lsTree.trim().split(/\s+/)[0] ?? "";
     if (mode !== "120000")
         return false;
-    const showRef = ctx.baselineMode === "history_floor" ? `${ctx.historyFloor}:${rel}` : `HEAD:${rel}`;
-    const upstreamTarget = run("git", ["show", showRef], { cwd: ctx.srcDir, env: ctx.env }).stdout;
+    const showRef = ctx.baselineMode === "history_floor"
+        ? `${ctx.historyFloor}:${rel}`
+        : `HEAD:${rel}`;
+    const upstreamTarget = run("git", ["show", showRef], {
+        cwd: ctx.srcDir,
+        env: ctx.env,
+    }).stdout;
     if (!upstreamTarget)
         return false;
     return localTarget === upstreamTarget;
@@ -1841,12 +1905,16 @@ export function reconcileClaudeSettings(ctx, preRescueSettingsJson, out, err) {
         }
         // Additions drift: base = realBase when available, else theirs (conservative
         // head_compare fallback — never loses a customization). See design note.
-        const additionsBase = isPlainObject(realBase) ? realBase : theirs;
+        const additionsBase = isPlainObject(realBase)
+            ? realBase
+            : theirs;
         const drift = settingsDrift(ours, additionsBase);
         if (isPlainObject(drift) && Object.keys(drift).length > 0) {
             const existingLocal = jsonParseOrNull((() => {
                 try {
-                    return isFileFollow(localPath) ? fs.readFileSync(localPath, "utf-8") : null;
+                    return isFileFollow(localPath)
+                        ? fs.readFileSync(localPath, "utf-8")
+                        : null;
                 }
                 catch {
                     return null;
@@ -2005,7 +2073,9 @@ function rescueOne(ctx, rel) {
         dest = `${dest}.drift-${Math.floor(Date.now() / 1000)}-${process.pid}`;
     }
     fs.renameSync(localPath, dest);
-    const destRel = dest.startsWith(ctx.hqRoot + "/") ? dest.slice(ctx.hqRoot.length + 1) : dest;
+    const destRel = dest.startsWith(ctx.hqRoot + "/")
+        ? dest.slice(ctx.hqRoot.length + 1)
+        : dest;
     ctx.out(`    rescued: ${rel}  ->  ${destRel}\n`);
     ctx.appendLog(`rescued\t${rel}\t-> ${destRel}\n`);
 }
@@ -2020,7 +2090,9 @@ function conflictOne(ctx, rel) {
         dest = `${dest}.drift-${Math.floor(Date.now() / 1000)}-${process.pid}`;
     }
     fs.renameSync(localPath, dest);
-    const destRel = dest.startsWith(ctx.hqRoot + "/") ? dest.slice(ctx.hqRoot.length + 1) : dest;
+    const destRel = dest.startsWith(ctx.hqRoot + "/")
+        ? dest.slice(ctx.hqRoot.length + 1)
+        : dest;
     ctx.out(`    conflicted: ${rel}  ->  ${destRel}\n`);
     ctx.appendLog(`conflicted\t${rel}\t-> ${destRel}\n`);
 }
@@ -2036,7 +2108,8 @@ function classifyOne(ctx, rel) {
     const srcPath = path.join(ctx.srcDir, rel);
     // Test-only fault seam: prove the classify-before-delete ordering invariant
     // by forcing a classifier throw at a chosen entry. Never set in production.
-    if (ctx.env.HQ_RESCUE_FAULT_AT_REL && rel === ctx.env.HQ_RESCUE_FAULT_AT_REL) {
+    if (ctx.env.HQ_RESCUE_FAULT_AT_REL &&
+        rel === ctx.env.HQ_RESCUE_FAULT_AT_REL) {
         throw new Error(`rescue classifier fault injected at ${rel} (HQ_RESCUE_FAULT_AT_REL)`);
     }
     if (isUnderPreserve(cfg, rel))
@@ -2053,6 +2126,14 @@ function classifyOne(ctx, rel) {
     // Symlinks (mid-tree).
     const lst = lstatOrNull(localPath);
     if (lst && lst.isSymbolicLink()) {
+        // A root ignore file pointed at a dotfiles repo or shared config is by
+        // construction the operator's own — the release ships regular files here,
+        // never symlinks. The generic arm below would `skip` it without recording
+        // an exclusion, and `rsync -a` replaces a receiver symlink with the
+        // source's regular file, so the local rules would still be lost.
+        if (isLocalIgnoreFile(rel)) {
+            return { kind: "user-edit-keep-local", rel };
+        }
         const target = masterSyncSymlinkTarget(localPath);
         if (target !== null) {
             return { kind: "drop-reindex-symlink", rel, target };
@@ -2088,6 +2169,12 @@ function classifyOne(ctx, rel) {
     }
     // Path is/was in upstream. Determine if user edited it.
     let userEdited = 0;
+    // Set only by the floor comparison below — the one arm that proves the local
+    // bytes diverged from the baseline the operator last synced, rather than
+    // merely differing from HEAD. KEEP-LOCAL requires this evidence: without it,
+    // an untouched file from an older release (head_compare mode) or one upstream
+    // deleted would be pinned locally forever instead of tracking the release.
+    let editProvenAgainstFloor = false;
     if (ctx.baselineMode === "history_floor" && inFloor === 1) {
         const localSha = ctx.localShas?.get(rel) ??
             run("git", ["hash-object", localPath], { env: ctx.env }).stdout.trim();
@@ -2096,8 +2183,10 @@ function classifyOne(ctx, rel) {
                 cwd: ctx.srcDir,
                 env: ctx.env,
             }).stdout.trim();
-        if (!localSha || !floorSha || localSha !== floorSha)
+        if (!localSha || !floorSha || localSha !== floorSha) {
             userEdited = 1;
+            editProvenAgainstFloor = true;
+        }
     }
     else if (inHead === 1) {
         if (!bytesEqual(localPath, srcPath))
@@ -2116,6 +2205,11 @@ function classifyOne(ctx, rel) {
         return { kind: "drift-reconciled", rel };
     }
     if (userEdited === 1) {
+        // KEEP-LOCAL: an edited root ignore file is machine-local tuning. Leave it
+        // untouched and keep the overlay off it; the release copy never wins.
+        if (editProvenAgainstFloor && isLocalIgnoreFile(rel)) {
+            return { kind: "user-edit-keep-local", rel };
+        }
         if (rel === ".claude/CLAUDE.md") {
             return { kind: "user-edit-diff-append", rel };
         }
@@ -2163,6 +2257,10 @@ function renderDryRunDecision(ctx, decision) {
             ctx.out(`    user-edit (overwrite-safe): ${decision.rel}  ->  upstream wins (no copy preserved)\n`);
             ctx.counts.userOverwrite += 1;
             break;
+        case "user-edit-keep-local":
+            ctx.out(`    user-edit (keep local): ${decision.rel}  ->  local wins (machine-local ignore file; overlay skipped)\n`);
+            ctx.counts.userKeptLocal += 1;
+            break;
         case "user-edit-conflict":
             ctx.out(`    user-edit (conflict): ${decision.rel}  ->  .hq-conflicts/rescue-${ctx.runTs}/${decision.rel}\n`);
             ctx.counts.userConflict += 1;
@@ -2235,6 +2333,17 @@ function buildRescueActions(ctx) {
                     ctx.appendLog(`overwritten\t${decision.rel}\t(overwrite-safe; upstream wins, no copy preserved)\n`);
                 });
                 break;
+            case "user-edit-keep-local":
+                // No affected paths: nothing is moved or deleted. Listing the rel in
+                // `unchangedList` makes it an `--exclude-from` entry for the overlay
+                // rsync, so the release copy is never laid over the local one.
+                add(`keep local: ${decision.rel}`, [], () => {
+                    fs.appendFileSync(ctx.unchangedList, `/${decision.rel}\n`);
+                    ctx.counts.userKeptLocal += 1;
+                    ctx.out(`    kept local: ${decision.rel}  (machine-local ignore file; your edits win, overlay skipped)\n`);
+                    ctx.appendLog(`kept-local\t${decision.rel}\t(machine-local ignore file; user edit wins, overlay excluded)\n`);
+                });
+                break;
             case "user-edit-conflict":
                 add(`conflict quarantine: ${decision.rel}`, [decision.rel], () => conflictOne(ctx, decision.rel));
                 break;
@@ -2375,15 +2484,31 @@ function walkAndProcess(ctx, rootRel) {
         return;
     // companies/_template — wholesale-replace.
     if (rootRel === "companies/_template") {
-        recordDecision(ctx, { kind: "wholesale-replace-template", rel: "companies/_template" });
+        recordDecision(ctx, {
+            kind: "wholesale-replace-template",
+            rel: "companies/_template",
+        });
         return;
     }
     const lst = lstatOrNull(rootAbs);
     // Top-level symlink.
     if (lst && lst.isSymbolicLink()) {
+        // A root ignore file pointed at a dotfiles repo or shared config is by
+        // construction the operator's own — the release ships regular files here,
+        // never symlinks. Falling through to the plain `return` below records no
+        // exclusion, and the overlay's `rsync -a` then replaces the receiver
+        // symlink with the source's regular file, losing the local rules.
+        if (isLocalIgnoreFile(rootRel)) {
+            recordDecision(ctx, { kind: "user-edit-keep-local", rel: rootRel });
+            return;
+        }
         const target = masterSyncSymlinkTarget(rootAbs);
         if (target !== null) {
-            recordDecision(ctx, { kind: "drop-reindex-symlink", rel: rootRel, target });
+            recordDecision(ctx, {
+                kind: "drop-reindex-symlink",
+                rel: rootRel,
+                target,
+            });
         }
         return;
     }
@@ -2445,17 +2570,28 @@ function findFilesAndSymlinks(rootAbs, hqRoot) {
 // --- restore file mtimes from git commit history ---
 function restoreMtimesFromGit(srcDir, env, out) {
     // Deepen a shallow clone so per-file commit times are real.
-    const isShallow = run("git", ["rev-parse", "--is-shallow-repository"], { cwd: srcDir, env }).stdout.trim() ===
-        "true";
+    const isShallow = run("git", ["rev-parse", "--is-shallow-repository"], {
+        cwd: srcDir,
+        env,
+    }).stdout.trim() === "true";
     if (isShallow) {
         out("==> Deepening clone for per-file mtime history (blob:none) ...\n");
-        const r = run("git", ["fetch", "--unshallow", "--filter=blob:none"], { cwd: srcDir, env });
+        const r = run("git", ["fetch", "--unshallow", "--filter=blob:none"], {
+            cwd: srcDir,
+            env,
+        });
         if (r.status !== 0) {
             out("    (unshallow failed; mtimes fall back to release tip-commit time)\n");
         }
     }
     out("==> Restoring file mtimes from git commit history ...\n");
-    const log = run("git", ["log", "--no-renames", "--pretty=format:C:%ct", "--name-only", "--diff-filter=ACMR"], { cwd: srcDir, env });
+    const log = run("git", [
+        "log",
+        "--no-renames",
+        "--pretty=format:C:%ct",
+        "--name-only",
+        "--diff-filter=ACMR",
+    ], { cwd: srcDir, env });
     if (log.status !== 0)
         return;
     let ts = "";
@@ -2490,9 +2626,22 @@ function allocateSnapshotDir(backupRoot, runTs, rootHash, runId) {
 }
 function snapshotManifest(status, hqRoot, runId, cfg, sourceSha, includedRoots) {
     const now = new Date().toISOString();
-    return { schemaVersion: 1, status, canonicalHqRoot: hqRoot, rootHash: canonicalRootHash(hqRoot), runId,
-        creatorPid: process.pid, creatorStartedAt: now, source: cfg.sourceRepo, ref: cfg.ref, sourceSha,
-        createdAt: now, includedRoots, fileCount: 0, byteCount: 0 };
+    return {
+        schemaVersion: 1,
+        status,
+        canonicalHqRoot: hqRoot,
+        rootHash: canonicalRootHash(hqRoot),
+        runId,
+        creatorPid: process.pid,
+        creatorStartedAt: now,
+        source: cfg.sourceRepo,
+        ref: cfg.ref,
+        sourceSha,
+        createdAt: now,
+        includedRoots,
+        fileCount: 0,
+        byteCount: 0,
+    };
 }
 function readSnapshotManifest(backupDir) {
     try {
@@ -2514,8 +2663,13 @@ function updateSnapshotStatus(backupDir, status, completedAt) {
     if (!manifest)
         return;
     const stats = estimateFiltered(backupDir, "");
-    writeSnapshotManifest(backupDir, { ...manifest, status, fileCount: stats.files, byteCount: stats.bytes,
-        ...(completedAt ? { completedAt: new Date().toISOString() } : {}) });
+    writeSnapshotManifest(backupDir, {
+        ...manifest,
+        status,
+        fileCount: stats.files,
+        byteCount: stats.bytes,
+        ...(completedAt ? { completedAt: new Date().toISOString() } : {}),
+    });
 }
 function pruneManagedBackups(cfg, hqRoot, out, apply) {
     const inventory = inventoryManagedSnapshots(cfg.backupRoot, hqRoot, (m) => {
@@ -2526,15 +2680,25 @@ function pruneManagedBackups(cfg, hqRoot, out, apply) {
         catch {
             return false;
         }
-    }, { keepGood: Number(cfg.backupRetentionCount), maxAgeDays: Number(cfg.backupRetentionDays) });
-    const plan = { candidates: inventory.candidates, protected: inventory.protected, unmanaged: inventory.unmanaged };
+    }, {
+        keepGood: Number(cfg.backupRetentionCount),
+        maxAgeDays: Number(cfg.backupRetentionDays),
+    });
+    const plan = {
+        candidates: inventory.candidates,
+        protected: inventory.protected,
+        unmanaged: inventory.unmanaged,
+    };
     out(`==> Backup retention dry-run: ${plan.candidates.length} candidate(s), ${plan.protected.length} protected, ${plan.unmanaged.length} unmanaged.\n`);
     for (const item of plan.candidates)
         out(`    candidate ${item.entry.name}: ${item.reason}\n`);
     for (const item of plan.protected)
         out(`    protected ${item.entry.name}: ${item.reason}\n`);
     if (apply && plan.candidates.length > 0) {
-        const result = applyBackupPrune(cfg.backupRoot, hqRoot, plan, { keepGood: Number(cfg.backupRetentionCount), maxAgeDays: Number(cfg.backupRetentionDays) });
+        const result = applyBackupPrune(cfg.backupRoot, hqRoot, plan, {
+            keepGood: Number(cfg.backupRetentionCount),
+            maxAgeDays: Number(cfg.backupRetentionDays),
+        });
         for (const name of result.deleted)
             out(`    deleted snapshot: ${name}\n`);
         for (const failure of result.failures)
@@ -2614,7 +2778,9 @@ function countFiles(dir) {
  * "$SHUTTLE/$id"`, an explicit destination name).
  */
 function cpA(src, destDir, asName) {
-    const dest = asName ? path.join(destDir, asName) : path.join(destDir, path.basename(src));
+    const dest = asName
+        ? path.join(destDir, asName)
+        : path.join(destDir, path.basename(src));
     cpATo(src, dest);
 }
 /** `cp -a <src> <dest>` with an explicit destination path. */