@niroai/niro 0.6.0 → 0.7.0

package/CHANGELOG.md

@@ -2,6 +2,105 @@
 
 Notable changes to `@niroai/niro`. Dates are release dates.
 
+## 0.7.0 — 2026-08-17
+
+A data-loss release. If you use `niro watch`, upgrade.
+
+### Upgrading
+
+```bash
+npm install -g @niroai/niro@latest
+```
+
+Nothing extra is needed from 0.6.0. **From 0.4.x or earlier, upgrade urgently** — every fix
+below is client-side, so a server update alone does not protect you.
+
+### Why this release exists
+
+On 31 July a repository lost 494 source files. The client reported them deleted, the server
+removed the working copy and the durable backup, and the client's own record then said
+"deleted", so nothing ever re-sent them. Eleven days passed before anyone noticed.
+
+The cause was a `git checkout`. Git removed a directory of test files and wrote it straight
+back a moment later. In that gap the watcher looked, saw nothing, and reported 249 files
+deleted. Everything below follows from that one sentence: **the watcher believed a file was
+gone because it could not see it at one instant.**
+
+### Fixed — the client no longer infers a deletion from a failure to look
+
+- **Deletes now wait for the folder to go quiet.** A file that disappears is queued, not
+  reported. One timer per folder resets on every new disappearance, so a three-file checkout
+  holds for a few seconds and a ninety-second rebase holds for ninety seconds. When the folder
+  settles, whatever is still missing is deleted and whatever came back is dropped.
+
+  This covers `git checkout`, `git stash`, rebases, `npm ci`, `make clean`, a Docker remount and
+  editors that save by deleting and rewriting — without needing to know which of them is
+  happening. A real deletion now reaches the server about five seconds later than before.
+  Set `NIRO_DELETE_SETTLE_MS` to change that.
+
+- **A file that cannot be READ is no longer treated as deleted.** A permission error, a
+  transient lock, a file being rewritten or simply too many open files all made the hash return
+  nothing, and the file was then reported gone. It now keeps its previous state.
+
+- **A DIRECTORY that cannot be read is no longer treated as "everything under it was deleted".**
+  The same mistake one level up, and worse: an unreadable folder lists as empty, which is
+  indistinguishable from one whose files were all removed. Renaming a watched folder and
+  restarting reported the entire project as deleted, in a pass that reported itself successful.
+  An unreadable root now aborts the pass; an unreadable subdirectory keeps its files while the
+  rest of the tree syncs.
+
+- **A delete the server refuses is retried instead of forgotten.** It was marked done regardless
+  of the outcome, and once out of the local record it could never be re-attempted — so a
+  transient error became permanent.
+
+- **`niro discard-temp-project` no longer loses the work done in the temporary project.** The
+  file record followed the folder back to the source repository, so the source appeared to
+  already hold edits it had never received, and the next sync uploaded nothing. Discarding now
+  clears that record and re-uploads once.
+
+- **Excluding a path removes it again.** A guard added in the same work stopped an excluded file
+  ever being removed from the index, which mattered most for a path excluded *because* it holds
+  secrets.
+
+- **No delete calls for files that were never uploaded.** Editor scratch files are rejected on
+  the way in, but a delete was still sent when the editor renamed them away — 21% of all file
+  events on one real repository, every one of them pointless traffic.
+
+### Fixed — the retry flood
+
+- **The 60-second re-scan now backs off.** It retried at full rate forever, so a two-day server
+  problem became roughly 1,400 failed requests a day per folder and buried the real error. The
+  delay now doubles to a 30-minute ceiling and resets on success. It never gives up entirely, so
+  a recovered server is picked up within half an hour on its own.
+
+- **A pass whose file operations failed is no longer counted as a recovery**, which previously
+  reset the backoff mid-incident and printed a green "Sync recovered" while the outage continued.
+
+### Changed — worktrees and temporary projects
+
+You get one temporary project per project, and creating another moves it rather than adding one.
+With several worktrees open that meant they silently took it from each other.
+
+- A second worktree is no longer told to create one. It is told which branch currently holds it
+  and to use its own tools for that folder.
+- `niro discard-temp-project` asks before moving the slot away from another folder.
+- A folder that has lost the slot stops uploading, instead of blending two branches into one copy.
+- A branch switch is now told apart from another folder taking the slot.
+- `niro info` shows which local folder and branch syncs each project, and marks the one you are
+  standing in.
+
+### Also fixed
+
+- **A sync finishing after the folder was re-pointed no longer writes its stale record.** A pass takes
+  minutes on a large tree; if `niro new-temp-project` or `niro discard-temp-project` re-pointed the
+  folder while it ran, its results were written anyway, against a repository they did not describe.
+  For discard that undid the clean slate above and the re-upload was skipped. The record now belongs
+  to one repository and a pass that no longer matches is dropped, the same way a folder release has
+  always been handled.
+
+- **A folder whose root cannot be read now says so once**, and says when it can be read again. It used
+  to repeat the same error every sixty seconds for as long as the folder stayed away.
+
 ## 0.6.0 — 2026-08-11
 
 ### Upgrading

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@niroai/niro",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "Niro — one package: the niro CLI plus the Niro MCP server (code intelligence for AI coding assistants).",
   "keywords": [
     "niro",

package/src/commands/release.js

@@ -151,6 +151,22 @@ async function release(pathArg, opts = {}) {
         ...e,
         gitId: backup.previousGitId || null,
         projectId: sourceProjectId,
+        // The baseline describes what the TEMPORARY project holds, so it MUST NOT survive the move
+        // back to the source repo. Carrying it across told the daemon the source already had every
+        // file at its sandbox-era fingerprint — which it did not, because those edits only ever went
+        // to the temporary copy. The next pass then compared disk against that baseline, found no
+        // difference, and uploaded nothing. Every edit made during the temporary project was silently
+        // lost to the source project, with no error and nothing to prompt a re-sync.
+        //
+        // Clearing it makes the next pass treat every file as new and upload it. That is a full
+        // re-upload once, which is the cost of being sure: the client cannot know which files the
+        // source repo is missing, so the only safe assumption is all of them.
+        //
+        // The opposite direction already gets this right — takeover.js seeds fileHashes with what it
+        // actually uploaded to the new gitId. A baseline belongs to ONE gitId; when that changes, so
+        // must it.
+        fileHashes: {},
+        lastSyncedAt: null,
         takeover: undefined,
       }, e.apiUrl || baseUrl);
       repinned.push(e.folderPath);

package/src/commands/watch.js

@@ -38,6 +38,47 @@ const syncInFlight = new Set();
 // honoured by the live file handler, so one check per sync pass covers both paths rather than asking
 // the server on every save.
 const notHolding = new Set();
+
+/**
+ * How long the deletes for a folder must stay quiet before any of them is believed.
+ *
+ * Not a guess at how long a git checkout takes — the timer RESETS on every new delete, so a 90-second
+ * rebase holds the queue for 90 seconds and a three-file checkout holds it for five. This only has to
+ * outlast the gap between one file vanishing and the next.
+ */
+const DELETE_SETTLE_MS = Number(process.env.NIRO_DELETE_SETTLE_MS) || 5_000;
+
+/**
+ * Deletes waiting to be believed: resolved folder -> { paths:Set, timer }.
+ *
+ * A file disappearing is not evidence it was deleted. On 2026-07-31 a customer lost 494 files because
+ * a `git checkout` removed a tree, this handler saw the gap and reported every file gone, and git then
+ * wrote them all back — by which time the server had destroyed its copies. The client's own log shows
+ * the burst (249 consecutive deletes) followed immediately by re-uploads of the very same paths.
+ *
+ * So deletes are queued rather than sent, and ONE timer per folder is reset by every new delete. When
+ * the folder finally goes quiet, whatever is still missing is really gone and is sent; whatever came
+ * back was never deleted and is dropped.
+ *
+ * Deliberately NOT volume-based, and deliberately not "detect a git operation":
+ *  - a threshold misses a small checkout that touches three files, which is just as wrong;
+ *  - lock-file detection is git-only, and the same damage comes from `npm ci`, `make clean`, a Docker
+ *    remount, Perforce (no local lock at all) or any other VCS.
+ * Waiting for quiet needs to know none of that. It is the same rule the server already applies before
+ * it rebuilds a graph.
+ *
+ * Holding a delete costs nothing: the graph only updates after its own quiet period, so a few seconds
+ * is invisible. A wrong delete costs the file AND its durable backup, at the moment the call lands.
+ */
+const pendingDeletes = new Map();
+
+/**
+ * Folders whose root we could not read, so the "cannot read" error is said ONCE rather than every
+ * 60 seconds for as long as the folder stays away. A watched folder that is renamed or unmounted is
+ * often left that way for days; repeating a red error every minute trains people to ignore the log,
+ * which is how the errors that DO matter get missed.
+ */
+const unreadableRoots = new Set();
 // The state file is rewritten several times during a `niro takeover` (per-file hashes), so debounce
 // before reconciling the watch set. Also the interval for the mtime backstop re-scan below.
 const STATE_RELOAD_DEBOUNCE_MS = 1_500;
@@ -233,46 +274,7 @@ async function startWatch(targetDir, opts = {}) {
   // that drifted — the reliable, content-checked form of "also pick up changes we didn't get a live
   // event for". Re-reads fresh state, so a folder re-pointed by `niro takeover` or removed by `niro
   // release` mid-session is handled (or skipped) rather than synced to a stale gitId.
-  const rescanTimer = setInterval(() => {
-    const fresh = watchState.get(targetDir, api.currentBaseUrl());
-    if (!fresh || !fresh.gitId) return; // folder released — nothing to sync
-    // Back off after failures instead of retrying every 60s forever. Retrying at full rate against a
-    // server that is failing does not fix anything and buries the real error in its own noise.
-    const backoffKey = path.resolve(targetDir);
-    if (!shouldAttemptBackstop(backoffKey)) return;
-    deltaSyncOnResume(fresh.gitId, targetDir, fresh, { quiet: true })
-      .then(result => {
-        // A run that never reached the server proves nothing about the server. The in-flight guard
-        // returns at once when another sync for this folder is already going, and during an outage a
-        // large delta holds that flag for minutes — so a skipped tick was clearing the failure count
-        // and printing a green "Sync recovered" in the middle of the incident, while the real run was
-        // still heading for its own failure. The count then never grew past one, so the backoff never
-        // climbed towards its ceiling and kept hammering every two minutes: both things this backoff
-        // was added to stop.
-        // Only a pass that actually reached the server and had nothing fail counts as a recovery.
-        // A skipped run (another sync in flight) and a no-change run both contact nothing, and a pass
-        // whose per-file deletes were all refused resolves cleanly — so all three used to clear the
-        // failure count and print a green "Sync recovered" during an outage, which is how the retry rate
-        // never decayed and the real error stayed buried.
-        if (!result || result.skipped || result.noContact || result.notHolder) return;
-        if (result.failures > 0) {
-          const delayMs = recordBackstopFailure(backoffKey, Date.now());
-          console.error(color.red(
-            `  ${result.failures} file operation(s) failed for ${targetDir} — retrying in ` +
-            `${Math.round(delayMs / 60_000)} min.`));
-          return;
-        }
-        if (recordBackstopSuccess(backoffKey)) {
-          console.log(color.green(`  Sync recovered for ${targetDir}.`));
-        }
-      })
-      .catch(err => {
-        const delayMs = recordBackstopFailure(backoffKey, Date.now());
-        console.error(color.red(
-          `  Backstop re-scan failed for ${targetDir}: ${err.message} — retrying in ` +
-          `${Math.round(delayMs / 60_000)} min.`));
-      });
-  }, RESCAN_INTERVAL_MS);
+  const rescanTimer = setInterval(() => { backstopTick(targetDir); }, RESCAN_INTERVAL_MS);
 
   // Start file watcher
   const debounceTimers = new Map();
@@ -373,7 +375,27 @@ async function deltaSyncOnResume(gitId, targetDir, state, opts = {}) {
   const deleted = [];
 
   // Walk all currently included files
-  const manifest = buildMinimalManifest(targetDir, state.includePatterns, state.excludePatterns);
+  const { files: manifest, failedDirs } = buildMinimalManifest(targetDir, state.includePatterns,
+      state.excludePatterns);
+
+  // The repo root itself could not be read — the folder was moved, unmounted, or its permissions
+  // changed. EVERY file looks missing, so a delete pass here would wipe the whole project. Abort the
+  // pass entirely; a later one recovers by itself once the folder is back.
+  if (failedDirs.includes("")) {
+    // Said once per folder, then silence until it reads again. Repeating this every 60s for a folder
+    // that has simply been moved is noise, and noise is how a real error gets missed.
+    if (!unreadableRoots.has(path.resolve(targetDir))) {
+      unreadableRoots.add(path.resolve(targetDir));
+      console.error(color.red(
+        `  Cannot read ${targetDir} — skipping this sync entirely rather than reporting every file ` +
+        `deleted. Check the folder still exists and is readable. ` +
+        `This will not be repeated until it can be read again.`));
+    }
+    return;
+  }
+  if (unreadableRoots.delete(path.resolve(targetDir))) {
+    console.log(color.green(`  ${targetDir} is readable again — syncing resumed.`));
+  }
 
   const unreadable = [];
   for (const relativePath of manifest) {
@@ -406,15 +428,32 @@ async function deltaSyncOnResume(gitId, targetDir, state, opts = {}) {
   }
 
   // Files that were in stored hashes but are no longer present in the walk at all.
+  //
+  // "Not in the walk" only means "deleted" for parts of the tree the walk could actually READ. A
+  // directory that failed to list (permissions, a build holding it, too many open files, an NFS or
+  // Docker mount blip) yields no entries, which is indistinguishable from one whose files were all
+  // removed. Judging those would delete a subtree because we could not look at it.
+  const unreadableDirs = [];
   for (const rp of Object.keys(storedHashes)) {
-    if (!Object.prototype.hasOwnProperty.call(currentHashes, rp)) {
-      deleted.push(rp);
+    if (Object.prototype.hasOwnProperty.call(currentHashes, rp)) continue;
+    if (failedDirs.some(d => d && (rp === d || rp.startsWith(d + "/")))) {
+      unreadableDirs.push(rp);
+      currentHashes[rp] = storedHashes[rp]; // keep it tracked; we learned nothing about it
+      continue;
     }
+    deleted.push(rp);
+  }
+
+  if (unreadableDirs.length > 0) {
+    console.warn(color.yellow(
+      `  ${failedDirs.length} directory(ies) could not be read this pass, so ${unreadableDirs.length} ` +
+      `file(s) under them are being left alone rather than reported deleted. ` +
+      `Sample: ${failedDirs.slice(0, 3).join(", ")}`));
   }
 
   if (changed.length === 0 && deleted.length === 0) {
     if (!quiet) console.log(`  No changes since last sync.`);
-    watchState.mergeFileHashes(targetDir, { set: currentHashes });
+    watchState.mergeFileHashes(targetDir, { set: currentHashes, expectedGitId: gitId });
     // Nothing to send, so the server was never contacted and this pass is not evidence it is healthy.
     // This is the MAJORITY of backstop ticks: treated as a success it cleared the failure count on the
     // very next tick after one, so the backoff could never grow past its first step.
@@ -503,11 +542,16 @@ async function deltaSyncOnResume(gitId, targetDir, state, opts = {}) {
 
   // Merge rather than replace. Removals are explicit: the files we actually deleted, plus any the
   // gitignore policy dropped (those were never uploaded, so they must not stay recorded as synced).
-  watchState.mergeFileHashes(targetDir, {
+  // expectedGitId: this whole pass computed hashes for `gitId`. If a takeover or discard re-pointed the
+  // folder while it ran, these describe a repo it is no longer registered against and must be dropped.
+  if (!watchState.mergeFileHashes(targetDir, {
     set: currentHashes,
     remove: [...actuallyDeleted, ...gitignoreDropped],
     patch: { lastSyncedAt: new Date().toISOString() },
-  });
+    expectedGitId: gitId,
+  })) {
+    console.log(color.dim("  Folder was re-pointed during this sync — its results were not recorded."));
+  }
   console.log(`  ${color.green("✓")} Delta sync complete.`);
   return { failures };
   } finally {
@@ -515,6 +559,124 @@ async function deltaSyncOnResume(gitId, targetDir, state, opts = {}) {
   }
 }
 
+/** Queue one vanished path and (re)start this folder's settle timer. */
+function queueDelete(targetDir, relativePath, settleMs = DELETE_SETTLE_MS) {
+  const key = path.resolve(targetDir);
+  let entry = pendingDeletes.get(key);
+  if (!entry) {
+    entry = { paths: new Set(), timer: null };
+    pendingDeletes.set(key, entry);
+  }
+  entry.paths.add(relativePath);
+  // Reset, never extend-if-absent: while files keep vanishing the operation is still running, and
+  // nothing in the queue should be believed until it stops.
+  if (entry.timer) clearTimeout(entry.timer);
+  entry.timer = setTimeout(() => {
+    flushPendingDeletes(targetDir).catch(err =>
+      console.error(color.red(`  Delete flush failed for ${targetDir}: ${err.message}`)));
+  }, settleMs);
+  if (entry.timer.unref) entry.timer.unref(); // must never hold the daemon open
+}
+
+/**
+ * The folder has gone quiet. Look again at everything queued: send the deletes that are still real,
+ * and forget the ones that came back.
+ *
+ * A file that returned is left ALONE rather than re-uploaded here. Its baseline entry was never
+ * removed (we never sent the delete), so if the bytes changed, git's own write fires a change event
+ * that takes the normal upload path, and the 60-second backstop re-scan covers a coalesced event.
+ * Duplicating the upload path here would mean duplicating its gitignore and secret checks too.
+ */
+async function flushPendingDeletes(targetDir) {
+  const key = path.resolve(targetDir);
+  const entry = pendingDeletes.get(key);
+  if (!entry) return;
+  pendingDeletes.delete(key);
+  if (entry.timer) clearTimeout(entry.timer);
+
+  // Re-read state at flush time: a `niro takeover` or `niro release` during the settle window changes
+  // (or removes) the gitId these deletes were queued against.
+  const fresh = watchState.get(targetDir, api.currentBaseUrl());
+  if (!fresh || !fresh.gitId) return;
+  if (notHolding.has(key)) return;
+
+  const stillGone = [];
+  const returned = [];
+  for (const rp of entry.paths) {
+    if (fs.existsSync(path.join(targetDir, rp))) returned.push(rp);
+    else stillGone.push(rp);
+  }
+
+  if (returned.length > 0) {
+    console.log(color.dim(
+      `  ${returned.length} file(s) reappeared while settling — not deleted` +
+      (returned.length <= 3 ? `: ${returned.join(", ")}` : "")));
+  }
+
+  for (const rp of stillGone) {
+    try {
+      await agentApi.deleteFile(fresh.gitId, rp);
+      watchState.mergeFileHashes(targetDir, {
+        remove: [rp],
+        patch: { lastSyncedAt: new Date().toISOString() },
+        expectedGitId: fresh.gitId,
+      });
+      console.log(`  ${color.yellow("−")} ${rp}`);
+    } catch (err) {
+      // Keep the baseline entry so a later pass retries. Dropping it here is how a refused delete
+      // became permanent (see fb3ff0a).
+      console.error(color.red(`  Failed to delete ${rp}: ${err.message}`));
+    }
+  }
+}
+
+
+/**
+ * One backstop pass for a folder. Extracted from the interval so the backoff gate at the top can
+ * actually be exercised — adversarial review found the gate could be deleted with the whole suite
+ * still green, because the only thing that called it was a timer no test drives.
+ */
+function backstopTick(targetDir) {
+    const fresh = watchState.get(targetDir, api.currentBaseUrl());
+    if (!fresh || !fresh.gitId) return; // folder released — nothing to sync
+    // Back off after failures instead of retrying every 60s forever. Retrying at full rate against a
+    // server that is failing does not fix anything and buries the real error in its own noise.
+    const backoffKey = path.resolve(targetDir);
+    if (!shouldAttemptBackstop(backoffKey)) return;
+    deltaSyncOnResume(fresh.gitId, targetDir, fresh, { quiet: true })
+      .then(result => {
+        // A run that never reached the server proves nothing about the server. The in-flight guard
+        // returns at once when another sync for this folder is already going, and during an outage a
+        // large delta holds that flag for minutes — so a skipped tick was clearing the failure count
+        // and printing a green "Sync recovered" in the middle of the incident, while the real run was
+        // still heading for its own failure. The count then never grew past one, so the backoff never
+        // climbed towards its ceiling and kept hammering every two minutes: both things this backoff
+        // was added to stop.
+        // Only a pass that actually reached the server and had nothing fail counts as a recovery.
+        // A skipped run (another sync in flight) and a no-change run both contact nothing, and a pass
+        // whose per-file deletes were all refused resolves cleanly — so all three used to clear the
+        // failure count and print a green "Sync recovered" during an outage, which is how the retry rate
+        // never decayed and the real error stayed buried.
+        if (!result || result.skipped || result.noContact || result.notHolder) return;
+        if (result.failures > 0) {
+          const delayMs = recordBackstopFailure(backoffKey, Date.now());
+          console.error(color.red(
+            `  ${result.failures} file operation(s) failed for ${targetDir} — retrying in ` +
+            `${Math.round(delayMs / 60_000)} min.`));
+          return;
+        }
+        if (recordBackstopSuccess(backoffKey)) {
+          console.log(color.green(`  Sync recovered for ${targetDir}.`));
+        }
+      })
+      .catch(err => {
+        const delayMs = recordBackstopFailure(backoffKey, Date.now());
+        console.error(color.red(
+          `  Backstop re-scan failed for ${targetDir}: ${err.message} — retrying in ` +
+          `${Math.round(delayMs / 60_000)} min.`));
+      });
+}
+
 async function handleFileEvent(gitId, targetDir, relativePath, state) {
   // Re-read this folder's current state on every event instead of trusting the value
   // captured when the daemon started. A mid-session `niro takeover` re-points the folder
@@ -577,26 +739,29 @@ async function handleFileEvent(gitId, targetDir, relativePath, state) {
 
   const absPath = path.join(targetDir, relativePath);
 
+  // Symmetry: if we would never UPLOAD this path, we must never ask the server to DELETE it. The
+  // accept-set check used to sit below the delete branch, so an editor's scratch file — never sent
+  // to us in the first place — still produced a delete call for a path the server had never heard
+  // of. That is 21% of all file events in the customer's log (3,226 of 15,223), every one of them a
+  // wasted round trip, a wasted journal record, and a count against the server's delete-burst budget
+  // that could trip the guard on churn alone.
+  //
+  // Safe because uploadability is decided by the filename, which does not change for a given path:
+  // if it is not uploadable now it was never uploaded. A file the accept set USED to include is
+  // still reachable by the backstop re-scan, which works from the stored baseline rather than from
+  // live events.
+  if (!folderSync.isUploadableName(relativePath)) return;
+
   if (!fs.existsSync(absPath)) {
-    // File deleted
-    try {
-      await agentApi.deleteFile(gitId, relativePath);
-      watchState.mergeFileHashes(targetDir, {
-        remove: [relativePath],
-        patch: { lastSyncedAt: new Date().toISOString() },
-      });
-      console.log(`  ${color.yellow("−")} ${relativePath}`);
-    } catch (err) {
-      console.error(color.red(`  Failed to delete ${relativePath}: ${err.message}`));
-    }
+    // Gone RIGHT NOW is not the same as deleted. Queue it and look again once the folder is quiet.
+    queueDelete(targetDir, relativePath);
     return;
   }
 
-  // Only upload files in the accept set (source / structural / committed config).
-  // matchesPatterns can pass anything when the server-supplied includePatterns are
-  // empty; this keeps the per-file event from uploading stray files (e.g. a *.txt
-  // that could carry secrets), matching what the manifest walk would offer.
-  if (!folderSync.isUploadableName(relativePath)) return;
+  // It exists, so any queued delete for it was a transient gap (a rewrite, not a removal). Drop it
+  // immediately rather than waiting for the settle timer to work it out.
+  const pending = pendingDeletes.get(path.resolve(targetDir));
+  if (pending) pending.paths.delete(relativePath);
 
   // File changed or created
   const newHash = watchState.hashFile(absPath);
@@ -617,6 +782,7 @@ async function handleFileEvent(gitId, targetDir, relativePath, state) {
     watchState.mergeFileHashes(targetDir, {
       set: { [relativePath]: newHash },
       patch: { lastSyncedAt: new Date().toISOString() },
+      expectedGitId: gitId,
     });
     console.log(`  ${color.green("+")} ${relativePath}`);
   } catch (err) {
@@ -655,12 +821,27 @@ function minimatch(filePath, pattern) {
 }
 
 /** Walk the directory respecting stored patterns to find all currently included files. */
+/**
+ * @returns {{files: string[], failedDirs: string[]}} — `failedDirs` holds the repo-relative directories
+ * the walk could NOT read ("" means the repo root itself). A caller must treat those as UNKNOWN, never
+ * as empty: a directory that cannot be listed looks exactly like a directory whose files were all
+ * deleted, and acting on that difference is how a whole project gets wiped.
+ */
 function buildMinimalManifest(rootDir, includePatterns, excludePatterns) {
   const results = [];
+  const failedDirs = [];
 
   function walk(dir) {
     let entries;
-    try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch { return; }
+    try {
+      entries = fs.readdirSync(dir, { withFileTypes: true });
+    } catch {
+      // Swallowing this was the defect. The walk returned a SHORT list with no signal, the caller read
+      // "absent from the walk" as "deleted", and every file under here was reported gone. Renaming a
+      // watched folder emptied the whole manifest and deleted the entire project server-side.
+      failedDirs.push(path.relative(rootDir, dir).replace(/\\/g, "/"));
+      return;
+    }
     for (const entry of entries) {
       const fullPath = path.join(dir, entry.name);
       const relativePath = path.relative(rootDir, fullPath).replace(/\\/g, "/");
@@ -691,10 +872,12 @@ function buildMinimalManifest(rootDir, includePatterns, excludePatterns) {
     }
   }
   walk(rootDir);
-  return results;
+  return { files: results, failedDirs };
 }
 
 // handleFileEvent + deltaSyncOnResume are exported for unit testing the
 // gitignore/fail-closed guards without a live server or fs.watch loop.
 module.exports = { watch, startWatch, handleFileEvent, deltaSyncOnResume, handleEntryFailure,
+  queueDelete, flushPendingDeletes, pendingDeletes, DELETE_SETTLE_MS, backstopTick, notHolding,
+  unreadableRoots,
   nextBackoffMs, shouldAttemptBackstop, recordBackstopFailure, recordBackstopSuccess };

package/src/lib/watchState.js

@@ -143,16 +143,28 @@ function update(folderPath, patch) {
  * THIS process. The watch daemon is a separate process, so a cross-process interleave is still
  * possible; this shrinks the window from minutes to microseconds rather than closing it entirely.
  */
-function mergeFileHashes(folderPath, { set = {}, remove = [], patch = {} } = {}) {
+function mergeFileHashes(folderPath, { set = {}, remove = [], patch = {}, expectedGitId } = {}) {
   const state = load();
   const key = path.resolve(folderPath);
-  if (!state[key]) return;
+  if (!state[key]) return false;
+  // Compare-and-merge, exactly as `remove` above does its compare-and-delete, and for the same reason.
+  // A sync pass can take minutes on a large tree. If a `niro new-temp-project` or
+  // `niro discard-temp-project` re-points the folder DURING that pass, the hashes it computed describe
+  // a repo the folder is no longer registered against — and writing them lands a stale baseline on the
+  // new gitId. Discard was the case that bit: it clears the baseline so the source repo gets a full
+  // re-upload, and an in-flight pass finishing afterwards restored the old map, so the next pass said
+  // "No changes since last sync" and the sandbox edits were never uploaded. Exactly the silent loss
+  // clearing the baseline was meant to prevent.
+  if (expectedGitId !== undefined && state[key].gitId !== expectedGitId) {
+    return false;
+  }
   const merged = { ...(state[key].fileHashes || {}) };
   for (const rp of remove) delete merged[rp];
   // Applied after the removals, so a file deleted and re-created within one run keeps its new hash.
   Object.assign(merged, set);
   state[key] = { ...state[key], ...patch, fileHashes: merged };
   save(state);
+  return true;
 }
 
 /**