@indigoai-us/hq-cloud 6.18.94 → 6.18.96

package/dist/cli/sync.js

@@ -27,7 +27,7 @@ import { readPendingConflictNotices, recordConflictParked } from "../conflict-no
 import { canonicalVaultKeySpelling, localPathForVaultKey, vaultKeyForLocalPath, } from "../local-path-codec.js";
 import { SKILLS_KEY_PREFIX } from "./doctor.js";
 import { downloadFile, createDownloadStagingPath, replaceStagedPath, streamRemoteFiles, streamRemoteFilePages, headRemoteFile, FILE_CONTENT_SHA256_META_KEY, primeObjectTransport, toPosixKey, classifyVaultKey, DanglingSymlinkParentError, WindowsSymlinkPrivilegeError, WINDOWS_SYMLINK_PRIVILEGE_REMEDY, WindowsRenameBlockedError, WINDOWS_RENAME_BLOCKED_REMEDY, renameOrRaiseWindowsBlocked, } from "../s3.js";
-import { readJournalForPass, readQuarantinedJournalPaths, writeJournal, setJournalSnapshotQuarantineListener, getStateDir, openJournalStoreSession, buildJournalBaseline, journalDeltaFromBaseline, hashFile, hashSymlinkTarget, journalRows, journalEntryMatchesStat, dropJournalDecodeWindow, updateEntry, removeEntry, getEntry, normalizeEtag, migrateToV2, gcTombstones, isTombstone, tombstoneEntry, lastPullRecord, appendPullRecord, generatePullId, PERSONAL_VAULT_JOURNAL_SLUG, migratePersonalVaultJournal, } from "../journal.js";
+import { readJournalForPass, bindPersonalVaultJournalToIdentity, readQuarantinedJournalPaths, writeJournal, setJournalSnapshotQuarantineListener, getStateDir, openJournalStoreSession, buildJournalBaseline, journalDeltaFromBaseline, hashFile, hashSymlinkTarget, journalRows, journalEntryMatchesStat, dropJournalDecodeWindow, updateEntry, removeEntry, getEntry, normalizeEtag, migrateToV2, gcTombstones, isTombstone, tombstoneEntry, lastPullRecord, appendPullRecord, generatePullId, PERSONAL_VAULT_JOURNAL_SLUG, configureRejectedDeltaRecovery, getJournalRecoveryMarker, clearJournalRecoveryMarker, migratePersonalVaultJournal, } from "../journal.js";
 import { isGeneratedCoreMirrorKey, PERSONAL_VAULT_MANIFEST_KEY, } from "../personal-vault.js";
 import { isPersonalVaultExcluded, isSafePersonalMcpConfigFile } from "../personal-vault-exclusions.js";
 import { resolvePersonalConnectorSettingsSync } from "../lib/personal-connector-settings-sync.js";
@@ -41,7 +41,7 @@ import { resolveSymlinkTargetRefusalFlag } from "../sync/symlink-target-refusal-
 import { coalesceDenseTargetedPullPaths } from "../sync/targeted-pull-prefixes.js";
 import { listRemoteForScope, POST_FILTER_THRESHOLD } from "../remote-pull.js";
 import { createIgnoreFilter, isPathExcludedFromSync, SYNC_MAX_FILE_BYTES, } from "../ignore.js";
-import { claimNeverSyncedLocalNotice, formatSecretsNotSyncedLine, isNeverSyncedVaultPath, isSecretBearingVaultPath, isSkipSecretPathsEnabled, } from "../sync/secret-path-policy.js";
+import { claimNeverSyncedLocalNotices, formatSecretsNotSyncedLine, isNeverSyncedVaultPath, isSecretBearingVaultPath, isSkipSecretPathsEnabled, isWalRejectedDeltaRecoveryEnabled, } from "../sync/secret-path-policy.js";
 import { hasRemoteChanged, isAccessDenied, isNotFound, resolveActiveCompany, resolveTransferConcurrency, readHostLoad, } from "../sync-core.js";
 import { formatIgnoreExcludedWarningLines, isEphemeralPath, isMalformedVaultKey } from "./share.js";
 import { createHumanSkipLineLog, formatReconcileSkipLine, } from "./reconcile-skip-reason.js";
@@ -51,7 +51,7 @@ import { isBoardJsonPath, mergeBoardJson, replaceIfUnchanged } from "../lib/boar
 import { createHash } from "node:crypto";
 import { buildConflictBackupPath, buildConflictId, buildConflictProbePath, readShortMachineId, } from "../lib/conflict-file.js";
 import { appendConflictEntry, findReusableConflictBackup } from "../lib/conflict-index.js";
-import { isCloudAuthoritative } from "../lib/cloud-authoritative.js";
+import { isCloudAuthoritative, isPullReconciledServerOwned, } from "../lib/cloud-authoritative.js";
 import { isMassDeleteGuardOverrideEnabled, MASS_DELETE_ABSOLUTE_CEILING, MASS_DELETE_SAMPLE_CAP, massDeleteGuardReason, resolveMassDeleteGuards, } from "../sync/mass-delete-guards.js";
 import { reindex } from "./reindex.js";
 import { withOperationLock } from "../operation-lock.js";
@@ -515,6 +515,7 @@ function snapshotCooperativeRowVisits() {
  * Do NOT import from `_testing` outside of tests in this package.
  */
 export const _testing = {
+    clearRecoveryMarkerAfterPass,
     enableCooperativeRowVisits,
     disableCooperativeRowVisits,
     cooperativeRowVisits: snapshotCooperativeRowVisits,
@@ -635,9 +636,13 @@ function safeErrorName(err) {
  * runner's all-complete summary carries a stable machine tag alongside the
  * paginated path list.
  */
-function extractAccessDeniedReason(err) {
+function extractAccessDeniedReason(err, key) {
     if (err instanceof Error) {
-        const msg = err.message ?? "";
+        // object-io messages embed the key ("Access denied for START-HERE.md:
+        // ..."), and an upper-case key segment would otherwise be read as the
+        // machine tag. Remove the key before matching.
+        const raw = err.message ?? "";
+        const msg = key ? raw.split(key).join("") : raw;
         // Prefer a bounded SCREAMING_SNAKE_CASE token like FILES_PRESIGN_FORBIDDEN
         // — object-io embeds these inside a parenthesized fragment such as
         // "(server get denied: FILES_PRESIGN_FORBIDDEN)". The prior stricter
@@ -751,6 +756,7 @@ async function syncWithOperationLockHeld(options) {
         // they begin, so their failure cannot turn a successful bulk transfer into
         // a full replay on the next pass.
         flushDownloadedJournalTail(run);
+        reportAccessDeniedSkipsToConsole(run);
         if (run.options.cooperativeCheckpoint?.shouldAbort?.() === true) {
             const newFiles = reportableNewFiles(run, plan);
             return {
@@ -767,6 +773,7 @@ async function syncWithOperationLockHeld(options) {
                 filesExcludedByPolicy: plan.filesExcludedByPolicy,
                 filesTombstoned: counters.filesTombstoned,
                 filesOutOfScope: counters.filesOutOfScope,
+                filesAccessDenied: run.accessDeniedSkips.size,
                 scopeOrphansRemoved: scopeRun.scopeOrphansRemoved,
                 scopeOrphansBlocked: scopeRun.shrinkResult.dirtyTombstoned,
                 changedPaths: [...counters.changedPaths, ...scopeRun.changedPaths],
@@ -823,6 +830,7 @@ async function buildPullContext(options) {
             },
         });
     const skipSecretPaths = await isSkipSecretPathsEnabled(vaultConfig, ctx.uid);
+    configureRejectedDeltaRecovery(await isWalRejectedDeltaRecoveryEnabled(vaultConfig, ctx.uid));
     const ignoreFilter = createIgnoreFilter(hqRoot, {
         allowRootMcpConfig: personalConnectorSettingsSync,
     });
@@ -839,6 +847,19 @@ async function buildPullContext(options) {
         return ignoreFilter(filePath, isDir);
     };
     const journalSlug = options.journalSlug ?? ctx.slug;
+    // hq-cloud#1028: bind the personal journal to this identity before any
+    // journal handle (quarantine, targeted session, scoped or full read) opens.
+    // Migrate the legacy slug first so the copied journal is fenced too.
+    if (journalSlug === PERSONAL_VAULT_JOURNAL_SLUG)
+        migratePersonalVaultJournal();
+    const personalBind = journalSlug === PERSONAL_VAULT_JOURNAL_SLUG
+        ? bindPersonalVaultJournalToIdentity({
+            uid: ctx.uid,
+            bucket: ctx.bucketName,
+            region: ctx.region,
+            endpoint: vaultConfig?.apiUrl,
+        })
+        : undefined;
     const quarantinedPaths = readQuarantinedJournalPaths(journalSlug);
     const startedAt = new Date().toISOString();
     // Mirror every progress event into the shared cross-process snapshot so the
@@ -855,15 +876,15 @@ async function buildPullContext(options) {
         baseEmit(event);
         recordProgress(event);
     };
+    if (personalBind?.fenced) {
+        emit({ type: "personal-journal-identity-fenced", reason: personalBind.fenced });
+    }
     if (quarantinedPaths.size > 0) {
         emit({ type: "journal-quarantine-unresolved", count: quarantinedPaths.size });
     }
-    const neverSyncedLocalPath = claimNeverSyncedLocalNotice(hqRoot, companyRoot);
-    if (neverSyncedLocalPath) {
+    for (const neverSyncedLocalPath of claimNeverSyncedLocalNotices(hqRoot, companyRoot)) {
         emit({ type: "secrets-not-synced", path: neverSyncedLocalPath });
     }
-    if (journalSlug === PERSONAL_VAULT_JOURNAL_SLUG)
-        migratePersonalVaultJournal();
     const syncMode = options.syncMode ?? "all";
     const currentPrefixSet = syncMode === "all" ? [""] : coalescePrefixes(options.prefixSet ?? []);
     // Push-only exclusions (US-006). Coalesced independently of `currentPrefixSet`
@@ -964,6 +985,7 @@ async function buildPullContext(options) {
             hqRoot,
             emit,
             humanSkipLines,
+            accessDeniedSkips: new Map(),
             ctx,
             companyRoot,
             personalConnectorSettingsSync,
@@ -1101,7 +1123,7 @@ async function planPull(run) {
             if (!rememberLinkWarning(run.linkWarnings, warning))
                 return;
             run.emit(brokenLinkSkipEvent(warning));
-        });
+        }, getJournalRecoveryMarker(run.journalSlug) !== undefined);
         const localDeleteKeys = Array.from(new Set([
             ...plan.tombstones.map((tombstone) => tombstone.key),
             ...plan.items.flatMap((item) => item.action === "tombstone-delete" ? [item.remoteFile.key] : []),
@@ -1260,8 +1282,15 @@ function createPullCounters() {
         hasRetryableOutcome: false,
     };
 }
-function reportableNewFiles(_run, plan) {
-    return plan.newFiles;
+function reportableNewFiles(run, plan) {
+    // A file whose GET was refused never reached this device, so it is not a
+    // "new file" here. Reporting it would also send the created-by enrichment
+    // back to HEAD a key the caller cannot read, one failing request and one
+    // stderr line per denied key (feedback_18ecc0b1: a burst of
+    // "HeadObject failed ...: UnknownError" on a pull that downloaded nothing).
+    if (run.accessDeniedSkips.size === 0)
+        return plan.newFiles;
+    return plan.newFiles.filter((nf) => !run.accessDeniedSkips.has(nf.path));
 }
 /** Sidecar listing the moves an in-flight scope shrink has not finished. */
 function scopeShrinkPendingMovesFile(run) {
@@ -2336,6 +2365,7 @@ async function executeConflictItem(run, plan, scopeRun, counters, downloadItems,
                         remoteBytes: fs.readFileSync(probeAbs),
                         localMtime,
                         remoteMtime: remoteFile.lastModified,
+                        noJournalBaseline: journalEntryAtConflict === undefined,
                     });
                 }
                 catch (readErr) {
@@ -2794,6 +2824,9 @@ async function downloadOne(run, downloadItem, counters, deferJournalCheckpoint =
                     ? { bypassBandwidthGovernor: true }
                     : {}),
                 refuseUnsafeSymlinkTargets: run.symlinkTargetRefusal,
+                // feedback_63da614f: never replay another machine's absolute link
+                // target into the live tree; skip that key, keep the pass going.
+                skipForeignAbsoluteSymlinkTargets: true,
                 symlinkTargetScope: run.options.personalMode === true
                     ? { kind: "personal" }
                     : { kind: "company", companySlug: run.ctx.slug },
@@ -2942,10 +2975,12 @@ async function downloadOne(run, downloadItem, counters, deferJournalCheckpoint =
             // `filesDone` (parity with the other `skip-*` paths) and the
             // runner produce a compact denied-summary on all-complete.
             counters.filesSkipped++;
+            const reason = extractAccessDeniedReason(err, remoteFile.key);
+            run.accessDeniedSkips.set(remoteFile.key, reason);
             run.emit({
                 type: "skip-access-denied",
                 path: remoteFile.key,
-                reason: extractAccessDeniedReason(err),
+                reason,
                 message: describeError(err),
             });
         }
@@ -3100,6 +3135,34 @@ function persistPullJournal(run) {
         release();
     }
 }
+const ACCESS_DENIED_SAMPLE_CAP = 10;
+/**
+ * Human-mode summary of the files this pull could not read. Each refused GET
+ * already emits `skip-access-denied`, which `--json` callers and the runner
+ * consume; the plain console renderer ignored it, so a pull whose every file
+ * was refused printed "N skipped, 0 error(s)" with no reason
+ * (feedback_18ecc0b1). One summary block, not a line per key, because a
+ * fresh member can be refused thousands of keys.
+ */
+function reportAccessDeniedSkipsToConsole(run) {
+    if (run.options.onEvent)
+        return;
+    const denied = run.accessDeniedSkips;
+    if (denied.size === 0)
+        return;
+    const reasons = [...new Set(denied.values())].sort().join(", ");
+    console.warn(`  ! ${denied.size} file${denied.size === 1 ? " was" : "s were"} not downloaded — access denied (${reasons}). Ask a company owner or admin to grant you read access, then pull again:`);
+    let shown = 0;
+    for (const key of denied.keys()) {
+        if (shown >= ACCESS_DENIED_SAMPLE_CAP)
+            break;
+        console.warn(`    · ${key}`);
+        shown++;
+    }
+    if (denied.size > shown) {
+        console.warn(`    ... and ${denied.size - shown} more`);
+    }
+}
 async function emitAndReportNewFiles(run, plan) {
     const enrichedNewFiles = [];
     const newFiles = reportableNewFiles(run, plan);
@@ -3152,6 +3215,11 @@ async function emitAndReportNewFiles(run, plan) {
                     isRetryableIdentityRefusal(headErr)) {
                     throw headErr;
                 }
+                // Author enrichment is best-effort. A read refusal is already
+                // reported by the access-denied summary, so do not log it per key.
+                if (isAccessDenied(headErr)) {
+                    return { path: nf.path, bytes: nf.bytes, addedBy };
+                }
                 try {
                     console.error(`[hq-sync] HeadObject failed for ${nf.path}: ${headErr instanceof Error ? headErr.message : String(headErr)}`);
                 }
@@ -3249,6 +3317,16 @@ async function executeJournalTombstoneDeletes(run, plan, counters) {
             await new Promise((resolve) => setImmediate(resolve));
         }
         const { key, localPath, localSnapshot } = tombstone;
+        if (tombstone.recoveryHold) {
+            removeEntry(run.journal, key);
+            run.emit({
+                type: "error",
+                diagnostic: true,
+                path: key,
+                message: "journal recovery hold: kept the local file the cloud no longer lists; dropped its journal row instead of deleting it",
+            });
+            continue;
+        }
         if (tombstone.journalOnly || plan.caseAliasedKeys?.has(toPosixKey(key))) {
             retireCaseAliasJournalRow(run, key);
             continue;
@@ -3315,6 +3393,43 @@ function scopePlanPreviousMode(run) {
 function scopePlanPreviousPrefixSet(run) {
     return [...(lastPullRecord(run.journal, run.ctx.uid)?.prefixSet ?? [])];
 }
+function clearRecoveryMarkerAfterPass(input) {
+    const authoritativeFullListing = input.syncMode === "all" &&
+        input.currentPrefixSet.length === 1 && input.currentPrefixSet[0] === "" &&
+        input.listedPrefixSet.length === 1 && input.listedPrefixSet[0] === "" &&
+        input.pullPrefixes.length === 0;
+    if (!getJournalRecoveryMarker(input.journalSlug) || !authoritativeFullListing || input.hasRetryableOutcome || input.aborted) {
+        return false;
+    }
+    clearJournalRecoveryMarker(input.journalSlug);
+    return true;
+}
+/** Most paths the human pull-delete summary names before "... and N more". */
+export const PULL_DELETE_SUMMARY_SAMPLE_CAP = 10;
+/**
+ * Human console summary of the local files this pull removed because they
+ * were deleted in the cloud (feedback_97906212). Only printed for the human
+ * CLI (no `onEvent`); machine callers already receive one `progress` event
+ * with `deleted: true` per key and `SyncResult.appliedDeletes`.
+ */
+export function formatPullLocalDeleteSummary(appliedDeletes) {
+    if (appliedDeletes.length === 0)
+        return [];
+    const n = appliedDeletes.length;
+    const lines = [
+        `Deleted ${n} local file${n === 1 ? "" : "s"} because ${n === 1 ? "it was" : "they were"} deleted in the cloud:`,
+    ];
+    for (const key of appliedDeletes.slice(0, PULL_DELETE_SUMMARY_SAMPLE_CAP))
+        lines.push(`    · ${key}`);
+    if (n > PULL_DELETE_SUMMARY_SAMPLE_CAP)
+        lines.push(`    ... and ${n - PULL_DELETE_SUMMARY_SAMPLE_CAP} more`);
+    lines.push("  To bring a file back, run hq files versions <path>, then hq files restore <path> --version-id <id>.");
+    return lines;
+}
+function printPullLocalDeleteSummary(appliedDeletes) {
+    for (const line of formatPullLocalDeleteSummary(appliedDeletes))
+        console.log(line);
+}
 function finalizePullRun(run, plan, scopeRun, counters) {
     appendPullRecord(run.journal, {
         pullId: generatePullId(),
@@ -3340,6 +3455,15 @@ function finalizePullRun(run, plan, scopeRun, counters) {
     });
     run.journal.lastSync = new Date().toISOString();
     persistPullJournal(run);
+    clearRecoveryMarkerAfterPass({
+        journalSlug: run.journalSlug,
+        syncMode: run.syncMode,
+        currentPrefixSet: run.currentPrefixSet,
+        listedPrefixSet: run.listedPrefixSet,
+        pullPrefixes: run.options.pullPrefixes ?? [],
+        hasRetryableOutcome: counters.hasRetryableOutcome,
+        aborted: run.options.cooperativeCheckpoint?.shouldAbort?.() === true,
+    });
     const changedOnDisk = counters.filesDownloaded > 0 ||
         counters.filesTombstoned > 0 ||
         scopeRun.scopeOrphansRemoved > 0;
@@ -3363,6 +3487,8 @@ function finalizePullRun(run, plan, scopeRun, counters) {
             // best-effort: a post-sync refresh failure never fails the sync
         }
     }
+    if (run.humanSkipLines)
+        printPullLocalDeleteSummary(counters.appliedDeletes);
     const newFiles = reportableNewFiles(run, plan);
     const result = {
         filesDownloaded: counters.filesDownloaded,
@@ -3378,6 +3504,7 @@ function finalizePullRun(run, plan, scopeRun, counters) {
         filesExcludedByPolicy: plan.filesExcludedByPolicy,
         filesTombstoned: counters.filesTombstoned,
         filesOutOfScope: counters.filesOutOfScope,
+        filesAccessDenied: run.accessDeniedSkips.size,
         scopeOrphansRemoved: scopeRun.scopeOrphansRemoved,
         scopeOrphansBlocked: scopeRun.shrinkResult.dirtyTombstoned,
         changedPaths: [...counters.changedPaths, ...scopeRun.changedPaths],
@@ -3709,7 +3836,13 @@ fileTombstones = new Map(),
 excludePrefixes = [], 
 // The runner resolves this once and shares it with the push leg. Direct
 // callers preserve the pre-policy, watcher-intent-only behavior.
-propagateDeletePolicy = "owned-only", onHeartbeat, journalRowCount = journalRows(journal).size, cooperativeCheckpoint, onCooperativeHandoff, deleteDenominatorKeys, pullContentHashes = {}, ctx, caseFoldingVolume = false, allowRootMcpConfig = false, quarantinedPaths = new Set(), onAuditRemoteFile, onLinkWarning) {
+propagateDeletePolicy = "owned-only", onHeartbeat, journalRowCount = journalRows(journal).size, cooperativeCheckpoint, onCooperativeHandoff, deleteDenominatorKeys, pullContentHashes = {}, ctx, caseFoldingVolume = false, allowRootMcpConfig = false, quarantinedPaths = new Set(), onAuditRemoteFile, onLinkWarning, 
+// A journal recovery marker exists (rebuilt from a valid prefix or reset
+// from an unreadable state store). The journal rows may be stale or missing,
+// so they are not evidence that a local file is a clean synced copy. While
+// set, pull never deletes a local file and never replaces an existing local
+// file without the conflict executor's byte comparison (feedback_b088e391).
+recoveryHold = false) {
     const prefixMatcher = compileScopeMatcher(prefixSet);
     const excludeMatcher = compileScopeMatcher(excludePrefixes);
     const items = [];
@@ -4086,6 +4219,11 @@ propagateDeletePolicy = "owned-only", onHeartbeat, journalRowCount = journalRows
                 continue;
             }
             const journalEntry = getEntry(journal, remoteFile.key);
+            // A server-owned key (sources/, signals/, ontology/ outside entities,
+            // company-brief.md) can never be pushed or deleted from this machine, so
+            // its local state never wins: a divergent local copy is replaced from
+            // the cloud and a missing one is re-downloaded (feedback_5a2609f2).
+            const serverOwnedPullReconciles = isPullReconciledServerOwned(remoteFile.key);
             // Reindex and package wiring own symlinks under these `core/<type>`
             // surfaces; their canonical sources are elsewhere. A prior pull records
             // the remote object as a symlink, then reindex removes the generated link.
@@ -4161,7 +4299,10 @@ propagateDeletePolicy = "owned-only", onHeartbeat, journalRowCount = journalRows
             // The currency-gated producer also stamps local-delete without a watcher
             // intent. Preserve that decision while the remote ETag is still current;
             // otherwise a second pull undoes the first before push can propagate it.
-            const localTombstoneSuppresses = journalEntry !== undefined &&
+            // A server-owned key is exempt: push never propagates its delete, so a
+            // local-delete tombstone would hide the cloud copy from this machine forever.
+            const localTombstoneSuppresses = !serverOwnedPullReconciles &&
+                journalEntry !== undefined &&
                 isTombstone(journalEntry) &&
                 (hasCurrentLocalDeleteIntent(journalEntry) ||
                     (propagateDeletePolicy === "currency-gated" &&
@@ -4428,7 +4569,7 @@ propagateDeletePolicy = "owned-only", onHeartbeat, journalRowCount = journalRows
                 // is the stale version → delete it + drop the journal entry so it stays
                 // gone on this machine.
                 if (tombstoneSuppresses) {
-                    if (localChanged || !journalEntry) {
+                    if (localChanged || !journalEntry || recoveryHold) {
                         items.push({
                             action: "conflict",
                             remoteFile,
@@ -4590,6 +4731,22 @@ propagateDeletePolicy = "owned-only", onHeartbeat, journalRowCount = journalRows
                     continue;
                 }
                 if (journalEntry && localChanged && !remoteChanged) {
+                    // Push refuses a server-owned key, so "local only" would never
+                    // converge. Route it through the conflict executor, which parks the
+                    // local body under `.hq/conflict-backups/` and adopts the cloud copy
+                    // (cloud-authoritative PULL-WINS).
+                    if (serverOwnedPullReconciles) {
+                        items.push({
+                            action: "conflict",
+                            remoteFile,
+                            localPath,
+                            localHash,
+                            localMtime: localLstat.mtime,
+                            localSize: isLocalSymlink ? 0 : localLstat.size,
+                            localSnapshot: plannedLocalSnapshot,
+                        });
+                        continue;
+                    }
                     items.push({ action: "skip-local-only", remoteFile, localPath });
                     continue;
                 }
@@ -4615,6 +4772,22 @@ propagateDeletePolicy = "owned-only", onHeartbeat, journalRowCount = journalRows
                     continue;
                 }
                 if (journalEntry && !localChanged && remoteChanged) {
+                    // Recovery hold: the journal baseline this file "matches" may be a
+                    // stale generation, so a clean-looking local copy can hold edits the
+                    // journal never saw. Compare bytes in the conflict executor instead
+                    // of downloading over it; matching bytes still converge silently.
+                    if (recoveryHold && !isLocalSymlink) {
+                        items.push({
+                            action: "conflict",
+                            remoteFile,
+                            localPath,
+                            localHash,
+                            localMtime: localLstat.mtime,
+                            localSize: localLstat.size,
+                            localSnapshot: plannedLocalSnapshot,
+                        });
+                        continue;
+                    }
                     // ── Anti-rollback guard (silent newer→older overwrite) ───────────
                     // Remote etag moved but local still matches the journal baseline, so
                     // the classic 3-way merge calls this a clean `download` and overwrites
@@ -4726,7 +4899,8 @@ propagateDeletePolicy = "owned-only", onHeartbeat, journalRowCount = journalRows
             // remains the whole-set guard for BOTH candidate classes. A stale-etag,
             // divergent, tombstoned, or never-journaled missing file falls through to
             // the normal download below.
-            if (!localExists &&
+            if (!serverOwnedPullReconciles &&
+                !localExists &&
                 journalEntry !== undefined &&
                 !isTombstone(journalEntry) &&
                 !journalEntry.localDiverges &&
@@ -4765,7 +4939,10 @@ propagateDeletePolicy = "owned-only", onHeartbeat, journalRowCount = journalRows
         intentionalDeleteCandidates.length / totalJournalEntries >=
             PULL_INTENTIONAL_DELETE_RATIO;
     for (const cand of intentionalDeleteCandidates) {
-        if (intentionalDeleteIsBulk) {
+        // Recovery hold: a missing local file is not proof of a user delete when
+        // the journal row may be stale, and a local-delete tombstone would let
+        // the push leg delete the vault copy once the marker clears. Restore it.
+        if (intentionalDeleteIsBulk || recoveryHold) {
             items.push({
                 action: "download",
                 remoteFile: cand.remoteFile,
@@ -4977,6 +5154,13 @@ propagateDeletePolicy = "owned-only", onHeartbeat, journalRowCount = journalRows
         const localSnapshot = snapshotLocalState(localPath);
         if (localSnapshot === null)
             continue;
+        if (recoveryHold && localSnapshot.kind !== "absent") {
+            // Recovery hold: the journal row that says this file was synced may be
+            // stale. Keep the local file and drop only the row, so the file is
+            // treated as untracked local work from here on.
+            tombstones.push({ key, localPath, localSnapshot, journalOnly: true, recoveryHold: true });
+            continue;
+        }
         tombstones.push({ key, localPath, localSnapshot });
     }
     return {
@@ -5003,7 +5187,10 @@ propagateDeletePolicy = "owned-only", onHeartbeat, journalRowCount = journalRows
  * without an `onEvent` see no behavioral change.
  */
 function defaultConsoleLogger(event, humanSkipLines) {
-    if (event.type === "journal-quarantine-unresolved") {
+    if (event.type === "personal-journal-identity-fenced") {
+        console.warn(`  ! personal sync record of unproven ownership set aside (${event.reason}); no local files were deleted`);
+    }
+    else if (event.type === "journal-quarantine-unresolved") {
         console.warn(`  ! ${event.count} journal path${event.count === 1 ? " is" : "s are"} unresolved and held for manual review`);
     }
     else if (event.type === "journal-quarantine") {
@@ -5033,7 +5220,11 @@ function defaultConsoleLogger(event, humanSkipLines) {
         console.warn(formatPlanLimitNotice(event));
     }
     else if (event.type === "progress") {
-        if (event.message) {
+        if (event.deleted === true) {
+            // A local delete must never read like a download (feedback_97906212).
+            console.log(`  − ${event.path} deleted locally${event.message ? ` — "${event.message}"` : ""}`);
+        }
+        else if (event.message) {
             console.log(`  ✓ ${event.path} — "${event.message}"`);
         }
         else {