@indigoai-us/hq-cloud 6.18.12-alpha.1 → 6.18.12

package/dist/cli/rescue-core.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rescue-core.d.ts","sourceRoot":"","sources":["../../src/cli/rescue-core.ts"],"names":[],"mappings":"AAiCA,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAO7B,OAAO,EAOL,KAAK,gBAAgB,EAEtB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAuB,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAEnF,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;CAChB;AA0CD,UAAU,MAAM;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,OAAO,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,OAAO,CAAC;IACrB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,OAAO,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,OAAO,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,gBAAgB,EAAE,OAAO,CAAC;IAC1B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,eAAe,EAAE,MAAM,CAAC;CACzB;AAkDD,oFAAoF;AACpF,wBAAgB,QAAQ,CACtB,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,IAAI,EAAE,MAAM,GACX,MAAM,GAAG,SAAS,CASpB;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAS3D;AA6MD,UAAU,kBAAkB;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,UAAU,aAAa;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AA8BD;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,EAAE,EACjB,GAAG,EAAE,MAAM,CAAC,UAAU,GACrB,kBAAkB,GAAG,SAAS,CAyChC;AAmCD,sFAAsF;AACtF,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,GACvB,aAAa,CA+Cf;AAmED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CAwMtD;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CACvB,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,GAAE;IACJ,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,iFAAiF;IACjF,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,iFAAiF;IACjF,6BAA6B,CAAC,EAAE,MAAM,CAAC;IACvC,mEAAmE;IACnE,qBAAqB,CAAC,EAAE,OAAO,oBAAoB,CAAC;CAChD,GACL,eAAe,CA4CjB;AA0kBD;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,gBAAgB,GACzB,IAAI,CAEN;AA2OD;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,EACZ,YAAY,GAAE,IAAI,CAAC,YAAmB,GACrC,OAAO,CAGT;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,GAAG,MAAM,CAwB1E;AAugDD,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC7B;IAAE,IAAI,EAAE,wBAAwB,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC/C;IAAE,IAAI,EAAE,qBAAqB,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC5C;IAAE,IAAI,EAAE,sBAAsB,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC7D;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,0BAA0B,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACjD;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACzC;IAAE,IAAI,EAAE,uBAAuB,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC9C;IAAE,IAAI,EAAE,0BAA0B,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACjD;IAAE,IAAI,EAAE,sBAAsB,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC7C;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC3C;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACzD;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC3C;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACzC;IAAE,IAAI,EAAE,4BAA4B,CAAC;IAAC,GAAG,EAAE,qBAAqB,CAAA;CAAE,CAAC;AAuevE,KAAK,SAAS,GACZ,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,GAAG,SAAS,EAAE,GAAG;IAAE,CAAC,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAAC;AAM9E,sFAAsF;AACtF,wBAAgB,aAAa,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,GAAG,OAAO,CAajE;AAWD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,SAAS,EACf,IAAI,EAAE,SAAS,GAAG,SAAS,EAC3B,WAAW,GAAE,MAAM,EAAiB,EACpC,UAAU,SAAK,GACd,SAAS,GAAG,SAAS,CAkDvB;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE;IAAE,CAAC,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,EAClC,KAAK,EAAE;IAAE,CAAC,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,GAChC;IAAE,CAAC,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAkB5B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE;IAAE,CAAC,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,EAClC,IAAI,EAAE;IAAE,CAAC,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,EAChC,IAAI,EAAE;IAAE,CAAC,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,GAC/B,IAAI,CAcN;AA8BD,UAAU,YAAY;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,eAAe,GAAG,cAAc,CAAC;IAC/C;uDACmD;IACnD,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC5B;AAeD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,YAAY,EACjB,qBAAqB,EAAE,MAAM,GAAG,IAAI,EACpC,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,EACxB,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,GACvB,IAAI,CA8LN;AAq1BD,uEAAuE;AACvE,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,sBAAsB,CAAC,EAAE,MAAM,GAC9B,MAAM,CAmBR;AAED,8EAA8E;AAC9E,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,GACnB,MAAM,CAcR;AAsCD;;;;GAIG;AACH,wBAAgB,oCAAoC,CAClD,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,aAAa,CAAC;IACrB,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC,CAAC,GACD,MAAM,EAAE,CAwBV"}
+{"version":3,"file":"rescue-core.d.ts","sourceRoot":"","sources":["../../src/cli/rescue-core.ts"],"names":[],"mappings":"AAiCA,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAO7B,OAAO,EAOL,KAAK,gBAAgB,EAEtB,MAAM,oBAAoB,CAAC;AAK5B,OAAO,EAAuB,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAEnF,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;CAChB;AA0CD,UAAU,MAAM;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,OAAO,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,OAAO,CAAC;IACrB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,OAAO,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,OAAO,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,gBAAgB,EAAE,OAAO,CAAC;IAC1B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,eAAe,EAAE,MAAM,CAAC;CACzB;AAkDD,oFAAoF;AACpF,wBAAgB,QAAQ,CACtB,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,IAAI,EAAE,MAAM,GACX,MAAM,GAAG,SAAS,CASpB;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAS3D;AA6MD,UAAU,kBAAkB;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,UAAU,aAAa;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AA8BD;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,EAAE,EACjB,GAAG,EAAE,MAAM,CAAC,UAAU,GACrB,kBAAkB,GAAG,SAAS,CAyChC;AAmCD,sFAAsF;AACtF,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,GACvB,aAAa,CA+Cf;AAmED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CAwMtD;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CACvB,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,GAAE;IACJ,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,iFAAiF;IACjF,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,iFAAiF;IACjF,6BAA6B,CAAC,EAAE,MAAM,CAAC;IACvC,mEAAmE;IACnE,qBAAqB,CAAC,EAAE,OAAO,oBAAoB,CAAC;CAChD,GACL,eAAe,CA4CjB;AA0kBD;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,gBAAgB,GACzB,IAAI,CAEN;AA2OD;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,EACZ,YAAY,GAAE,IAAI,CAAC,YAAmB,GACrC,OAAO,CAGT;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,GAAG,MAAM,CAwB1E;AAohDD,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC7B;IAAE,IAAI,EAAE,wBAAwB,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC/C;IAAE,IAAI,EAAE,qBAAqB,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC5C;IAAE,IAAI,EAAE,sBAAsB,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC7D;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,0BAA0B,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACjD;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACzC;IAAE,IAAI,EAAE,uBAAuB,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC9C;IAAE,IAAI,EAAE,0BAA0B,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACjD;IAAE,IAAI,EAAE,sBAAsB,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC7C;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC3C;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACzD;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC3C;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACzC;IAAE,IAAI,EAAE,4BAA4B,CAAC;IAAC,GAAG,EAAE,qBAAqB,CAAA;CAAE,CAAC;AAuevE,KAAK,SAAS,GACZ,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,GAAG,SAAS,EAAE,GAAG;IAAE,CAAC,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAAC;AAM9E,sFAAsF;AACtF,wBAAgB,aAAa,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,GAAG,OAAO,CAajE;AAWD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,SAAS,EACf,IAAI,EAAE,SAAS,GAAG,SAAS,EAC3B,WAAW,GAAE,MAAM,EAAiB,EACpC,UAAU,SAAK,GACd,SAAS,GAAG,SAAS,CAkDvB;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE;IAAE,CAAC,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,EAClC,KAAK,EAAE;IAAE,CAAC,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,GAChC;IAAE,CAAC,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAkB5B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE;IAAE,CAAC,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,EAClC,IAAI,EAAE;IAAE,CAAC,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,EAChC,IAAI,EAAE;IAAE,CAAC,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,GAC/B,IAAI,CAcN;AA8BD,UAAU,YAAY;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,eAAe,GAAG,cAAc,CAAC;IAC/C;uDACmD;IACnD,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC5B;AAeD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,YAAY,EACjB,qBAAqB,EAAE,MAAM,GAAG,IAAI,EACpC,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,EACxB,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,GACvB,IAAI,CA8LN;AAs3BD,uEAAuE;AACvE,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,sBAAsB,CAAC,EAAE,MAAM,GAC9B,MAAM,CAmBR;AAED,8EAA8E;AAC9E,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,GACnB,MAAM,CAcR;AAsCD;;;;GAIG;AACH,wBAAgB,oCAAoC,CAClD,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,aAAa,CAAC;IACrB,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC,CAAC,GACD,MAAM,EAAE,CAwBV"}

package/dist/cli/rescue-core.js

@@ -35,6 +35,7 @@ import * as path from "path";
 import yaml from "js-yaml";
 import { assertRescuePathTypeUnchanged, isRescueTransientDirectory, } from "./rescue-snapshot.js";
 import { applyBackupPrune, canonicalRootHash, inventoryManagedSnapshots, isManagedSnapshotManifest, } from "../backup-prune.js";
+import { makeRestoreProbePath, makeRestoreStagePath, } from "../restore-staging.js";
 import { readCoreSourceStamp, writeCoreSourceStamp } from "./core-source-stamp.js";
 // Paths always preserved across wipe+overlay (shuttled out, restored after).
 const CARVE_OUT_PATHS = [
@@ -1290,7 +1291,7 @@ function recreateSnapshotSymlink(hqRoot, rel, target, destination = snapshotRela
 function snapshotSymlinkRepresentation(hqRoot, source, destination, rel, target) {
     if (process.platform !== "win32")
         return undefined;
-    const probe = `${destination}.hq-restore-probe-${process.pid}-${Date.now().toString(36)}`;
+    const probe = makeRestoreProbePath(destination, process.pid, Date.now());
     try {
         recreateSnapshotSymlink(hqRoot, rel, target, probe);
         fs.rmSync(probe, { recursive: true, force: true });
@@ -1967,6 +1968,7 @@ function doRescue(cfg, env, out, err, setTmp, gitReachabilityProbeTimeoutMs = GI
         throw new ExitError(overlayPreflight.status || 1);
     }
     ctx.actions = buildRescueActions(ctx);
+    protectPreservedPathsFromClassifiedActions(ctx);
     // Permission preflight is deliberately before snapshot allocation. A
     // root-owned release tree (EACCES on rename/delete) used to allocate a
     // snapshot, fail apply twice, and then freeze rescue behind the
@@ -2115,22 +2117,30 @@ function doRescue(cfg, env, out, err, setTmp, gitReachabilityProbeTimeoutMs = GI
             fs.mkdirSync(shuttle, { recursive: true });
             let shuttleId = 0;
             for (const sp of cfg.preserveSubpaths) {
-                if (snapshotSkippedEntries.some((entry) => rescuePathsOverlap(sp, entry.relativePath))) {
-                    out(`==> Left ${sp} in place because it contains a skipped snapshot path\n`);
+                const normalizedSp = sp
+                    .replace(/\\/g, "/")
+                    .replace(/^\.\//, "")
+                    .replace(/\/+$/, "");
+                if (snapshotSkippedEntries.some((entry) => rescuePathsOverlap(normalizedSp, entry.relativePath))) {
+                    out(`==> Left ${normalizedSp} in place because it contains a skipped snapshot path\n`);
                     continue;
                 }
-                const src = path.join(hqRoot, sp);
+                const src = path.join(hqRoot, normalizedSp);
                 if (lexists(src)) {
                     shuttleId += 1;
                     try {
                         cpA(src, shuttle, String(shuttleId));
                     }
                     catch (error) {
-                        reportPreserveBackupFailure(sp, error, err);
+                        reportPreserveBackupFailure(normalizedSp, error, err);
                         throw error;
                     }
-                    preserveMap.push({ id: shuttleId, rel: sp });
-                    out(`==> Backed up ${sp} -> shuttle/${shuttleId}\n`);
+                    preserveMap.push({ id: shuttleId, rel: normalizedSp });
+                    // A preserved subtree stays local through the overlay. This avoids
+                    // transient rsync writes that would otherwise look like sync changes
+                    // before the shuttle is reconciled.
+                    appendLiteralRsyncExclude(unchangedList, normalizedSp, lstatOrNull(src)?.isDirectory() ?? false);
+                    out(`==> Backed up ${normalizedSp} -> shuttle/${shuttleId}\n`);
                 }
             }
         }
@@ -2200,7 +2210,7 @@ function doRescue(cfg, env, out, err, setTmp, gitReachabilityProbeTimeoutMs = GI
                 const dest = path.join(hqRoot, rel);
                 const shuttleItem = path.join(shuttle, String(id));
                 try {
-                    restorePreservedPath(shuttleItem, dest);
+                    reconcilePreservedPath(shuttleItem, dest);
                     out(`    restored ${rel}\n`);
                 }
                 catch (error) {
@@ -3643,6 +3653,29 @@ function renderDryRunDecision(ctx, decision) {
             break;
     }
 }
+function protectPreservedPathsFromClassifiedActions(ctx) {
+    const preserved = ctx.cfg.preserveSubpaths.map((rel) => rel.replace(/\\/g, "/").replace(/^\.\//, "").replace(/\/$/, ""));
+    const isInsidePreservedPath = (rel) => {
+        const normalized = rel.replace(/\\/g, "/").replace(/^\.\//, "").replace(/\/$/, "");
+        return preserved.some((preservedRel) => normalized === preservedRel ||
+            normalized.startsWith(`${preservedRel}/`));
+    };
+    ctx.actions = ctx.actions.filter((action) => {
+        const protectedRels = action.affectedRels.filter(isInsidePreservedPath);
+        if (protectedRels.length === 0)
+            return true;
+        // Keep mixed actions intact. A rescue can move a file out of a preserved
+        // subtree into personal/ or .hq-conflicts; the shuttle restores the source
+        // after the overlay while the action's destination remains useful.
+        const actionStaysInsidePreservedPaths = action.affectedRels.length > 0 &&
+            action.affectedRels.every(isInsidePreservedPath) &&
+            action.destParentRels.every(isInsidePreservedPath);
+        if (!actionStaysInsidePreservedPaths)
+            return true;
+        ctx.out(`    left in place by --preserve-subpath: ${protectedRels.join(", ")}\n`);
+        return false;
+    });
+}
 function buildRescueActions(ctx) {
     const actions = [];
     const add = (label, affectedRels, runAction, destParentRels = []) => {
@@ -4493,28 +4526,121 @@ function confirmedAbsent(p) {
         throw error;
     }
 }
-function restoreStagePath(dest) {
+function restoreStagePath(dest, stageBase = dest) {
     for (let attempt = 0; attempt < 1000; attempt += 1) {
-        const suffix = attempt === 0 ? "" : `-${attempt}`;
-        const staged = `${dest}.hq-restore-${process.pid}${suffix}`;
+        const staged = makeRestoreStagePath(stageBase, process.pid, attempt);
         if (confirmedAbsent(staged))
             return staged;
     }
     throw new Error(`could not allocate a restore staging sibling for ${dest}`);
 }
-/** Copy into a sibling before touching the live preserved path. */
-function restorePreservedPath(shuttleItem, dest) {
-    const staged = restoreStagePath(dest);
+function lstatForRestore(p) {
+    try {
+        return fs.lstatSync(p);
+    }
+    catch (error) {
+        const code = error.code;
+        if (code === "ENOENT" || code === "ENOTDIR")
+            return null;
+        throw error;
+    }
+}
+const PRESERVED_FILE_COMPARE_CHUNK_BYTES = 64 * 1024;
+function readRestoreChunk(fd, buffer, length, position) {
+    let read = 0;
+    while (read < length) {
+        const bytesRead = fs.readSync(fd, buffer, read, length - read, position + read);
+        if (bytesRead === 0)
+            return false;
+        read += bytesRead;
+    }
+    return true;
+}
+function regularFileContentsMatch(source, destination, size) {
+    const sourceFd = fs.openSync(source, "r");
+    let destinationFd;
+    try {
+        destinationFd = fs.openSync(destination, "r");
+        const sourceBuffer = Buffer.allocUnsafe(PRESERVED_FILE_COMPARE_CHUNK_BYTES);
+        const destinationBuffer = Buffer.allocUnsafe(PRESERVED_FILE_COMPARE_CHUNK_BYTES);
+        for (let position = 0; position < size;) {
+            const length = Math.min(PRESERVED_FILE_COMPARE_CHUNK_BYTES, size - position);
+            if (!readRestoreChunk(sourceFd, sourceBuffer, length, position) ||
+                !readRestoreChunk(destinationFd, destinationBuffer, length, position) ||
+                !sourceBuffer.subarray(0, length).equals(destinationBuffer.subarray(0, length))) {
+                return false;
+            }
+            position += length;
+        }
+        return true;
+    }
+    finally {
+        if (destinationFd !== undefined)
+            fs.closeSync(destinationFd);
+        fs.closeSync(sourceFd);
+    }
+}
+function preservedEntriesMatch(source, destination) {
+    const sourceStats = lstatForRestore(source);
+    const destinationStats = lstatForRestore(destination);
+    if (!sourceStats || !destinationStats)
+        return false;
+    if (sourceStats.isSymbolicLink()) {
+        return (destinationStats.isSymbolicLink() &&
+            fs.readlinkSync(source) === fs.readlinkSync(destination));
+    }
+    if (sourceStats.isDirectory()) {
+        if (!destinationStats.isDirectory() || destinationStats.isSymbolicLink()) {
+            return false;
+        }
+        const sourceNames = fs.readdirSync(source).sort();
+        const destinationNames = fs.readdirSync(destination).sort();
+        if (sourceNames.length !== destinationNames.length ||
+            sourceNames.some((name, index) => name !== destinationNames[index])) {
+            return false;
+        }
+        return sourceNames.every((name) => preservedEntriesMatch(path.join(source, name), path.join(destination, name)));
+    }
+    if (!sourceStats.isFile() || !destinationStats.isFile())
+        return false;
+    return (sourceStats.size === destinationStats.size &&
+        (sourceStats.mode & 0o7777) === (destinationStats.mode & 0o7777) &&
+        regularFileContentsMatch(source, destination, sourceStats.size));
+}
+function restorePreservedDirectoryMode(destination, stats) {
+    try {
+        if ((lstatForRestore(destination)?.mode ?? stats.mode) !== stats.mode) {
+            fs.chmodSync(destination, stats.mode);
+        }
+    }
+    catch {
+        // Match cpATo's existing best-effort metadata handling on Windows.
+    }
+}
+function replacePreservedEntry(source, destination) {
+    fs.mkdirSync(path.dirname(destination), { recursive: true });
+    const sourceDevice = fs.statSync(path.dirname(source)).dev;
+    const destinationDevice = fs.statSync(path.dirname(destination)).dev;
+    // Prefer a shuttle-side stage when both roots share a filesystem. If they do
+    // not, stage beside the destination so the final rename remains atomic.
+    // Symlinks stay destination-side because Windows junction targets are
+    // resolved while copying and must be anchored at their final parent.
+    const sourceStats = lstatForRestore(source);
+    const stageBase = sourceStats?.isFile() && sourceDevice === destinationDevice
+        ? source
+        : destination;
+    const staged = restoreStagePath(destination, stageBase);
     let completed = false;
     try {
-        fs.mkdirSync(path.dirname(dest), { recursive: true });
-        cpATo(shuttleItem, staged);
-        fs.rmSync(dest, { recursive: true, force: true });
+        cpATo(source, staged);
+        if (lstatForRestore(destination)) {
+            fs.rmSync(destination, { recursive: true, force: true });
+        }
         try {
-            fs.renameSync(staged, dest);
+            fs.renameSync(staged, destination);
         }
         catch {
-            cpATo(staged, dest);
+            cpATo(staged, destination);
             fs.rmSync(staged, { recursive: true, force: true });
         }
         completed = true;
@@ -4530,6 +4656,49 @@ function restorePreservedPath(shuttleItem, dest) {
         }
     }
 }
+function reconcilePreservedEntry(source, destination) {
+    const sourceStats = lstatForRestore(source);
+    if (!sourceStats) {
+        if (lstatForRestore(destination)) {
+            fs.rmSync(destination, { recursive: true, force: true });
+        }
+        return;
+    }
+    const destinationStats = lstatForRestore(destination);
+    if (sourceStats.isDirectory()) {
+        if (destinationStats &&
+            (!destinationStats.isDirectory() || destinationStats.isSymbolicLink())) {
+            fs.rmSync(destination, { recursive: true, force: true });
+        }
+        fs.mkdirSync(destination, { recursive: true });
+        const sourceNames = fs.readdirSync(source);
+        const sourceNameSet = new Set(sourceNames);
+        for (const name of sourceNames) {
+            reconcilePreservedEntry(path.join(source, name), path.join(destination, name));
+        }
+        for (const name of fs.readdirSync(destination)) {
+            if (!sourceNameSet.has(name)) {
+                fs.rmSync(path.join(destination, name), { recursive: true, force: true });
+            }
+        }
+        // Preserve directory permissions, but let its mtime reflect changed
+        // children. Reapplying an old directory timestamp is itself watcher-visible.
+        restorePreservedDirectoryMode(destination, sourceStats);
+        return;
+    }
+    if (preservedEntriesMatch(source, destination))
+        return;
+    replacePreservedEntry(source, destination);
+}
+/** Reconcile at file granularity; unchanged entries stay in place. */
+function reconcilePreservedPath(shuttleItem, dest) {
+    if (!lstatForRestore(shuttleItem)) {
+        throw new Error(`preserved shuttle item is missing: ${shuttleItem}`);
+    }
+    if (preservedEntriesMatch(shuttleItem, dest))
+        return;
+    reconcilePreservedEntry(shuttleItem, dest);
+}
 function preservePathFailureCode(error) {
     return error?.code ?? "UNKNOWN";
 }
@@ -4682,14 +4851,14 @@ function rescuePathsOverlap(first, second) {
 function isSkippedSnapshotPath(ctx, rel) {
     return ctx.skippedSnapshotRels.some((skippedRel) => rescuePathsOverlap(rel, skippedRel));
 }
-function appendLiteralRsyncExclude(excludeList, rel) {
+function appendLiteralRsyncExclude(excludeList, rel, recursive = false) {
     let pattern = rel;
     if (/[\\*?[]/.test(pattern)) {
         pattern = pattern
             .replace(/\\/g, "\\\\")
             .replace(/([*?[])/g, "\\$1");
     }
-    fs.appendFileSync(excludeList, `/${pattern}\0`);
+    fs.appendFileSync(excludeList, `/${pattern}${recursive ? "/***" : ""}\0`);
 }
 /**
  * A skipped snapshot path cannot enter the preserve shuttle because copying it