@plinth-music/cli 0.23.1 → 0.23.3

package/dist/cli.js

@@ -4671,7 +4671,7 @@ var require_omap = __commonJS((exports, module) => {
   function resolveYamlOmap(data) {
     if (data === null)
       return true;
-    var objectKeys = [], index, length, pair, pairKey, pairHasKey, object = data;
+    var objectKeys = {}, index, length, pair, pairKey, pairHasKey, object = data;
     for (index = 0, length = object.length;index < length; index += 1) {
       pair = object[index];
       pairHasKey = false;
@@ -4687,10 +4687,9 @@ var require_omap = __commonJS((exports, module) => {
       }
       if (!pairHasKey)
         return false;
-      if (objectKeys.indexOf(pairKey) === -1)
-        objectKeys.push(pairKey);
-      else
+      if (_hasOwnProperty.call(objectKeys, pairKey))
         return false;
+      Object.defineProperty(objectKeys, pairKey, { value: true });
     }
     return true;
   }
@@ -5033,6 +5032,7 @@ var require_loader = __commonJS((exports, module) => {
     this.legacy = options2["legacy"] || false;
     this.json = options2["json"] || false;
     this.listener = options2["listener"] || null;
+    this.maxTotalMergeKeys = typeof options2["maxTotalMergeKeys"] === "number" ? options2["maxTotalMergeKeys"] : 1e4;
     this.implicitTypes = this.schema.compiledImplicit;
     this.typeMap = this.schema.compiledTypeMap;
     this.length = input.length;
@@ -5040,6 +5040,7 @@ var require_loader = __commonJS((exports, module) => {
     this.line = 0;
     this.lineStart = 0;
     this.lineIndent = 0;
+    this.totalMergeKeys = 0;
     this.documents = [];
   }
   function generateError(state, message) {
@@ -5113,14 +5114,22 @@ var require_loader = __commonJS((exports, module) => {
       state.result += _result;
     }
   }
+  function chargeMergeWork(state) {
+    state.totalMergeKeys += 1;
+    if (state.maxTotalMergeKeys !== -1 && state.totalMergeKeys > state.maxTotalMergeKeys) {
+      throwError(state, "merge keys exceeded maxTotalMergeKeys (" + state.maxTotalMergeKeys + ")");
+    }
+  }
   function mergeMappings(state, destination, source, overridableKeys) {
     var sourceKeys, key, index, quantity;
     if (!common.isObject(source)) {
       throwError(state, "cannot merge mappings; the provided source object is unacceptable");
     }
+    chargeMergeWork(state);
     sourceKeys = Object.keys(source);
     for (index = 0, quantity = sourceKeys.length;index < quantity; index += 1) {
       key = sourceKeys[index];
+      chargeMergeWork(state);
       if (!_hasOwnProperty.call(destination, key)) {
         setProperty(destination, key, source[key]);
         overridableKeys[key] = true;
@@ -5149,6 +5158,9 @@ var require_loader = __commonJS((exports, module) => {
     }
     if (keyTag === "tag:yaml.org,2002:merge") {
       if (Array.isArray(valueNode)) {
+        if (valueNode.length > 100) {
+          throwError(state, "abnormal merge sequence size");
+        }
         for (index = 0, quantity = valueNode.length;index < quantity; index += 1) {
           mergeMappings(state, _result, valueNode[index], overridableKeys);
         }
@@ -7584,7 +7596,7 @@ function _getBuiltinFlags(long, short, userNames, userAliases) {
 // package.json
 var package_default = {
   name: "@plinth-music/cli",
-  version: "0.23.1",
+  version: "0.23.3",
   description: "Plinth capstone sync daemon and CLI",
   type: "module",
   private: false,
@@ -7628,6 +7640,9 @@ var package_default = {
     "gray-matter": "^4.0.3",
     ora: "^9.4.0",
     zod: "^4.4.3"
+  },
+  overrides: {
+    "js-yaml": "3.15.2"
   }
 };
 
@@ -7843,8 +7858,48 @@ function emptyCorpusCounts() {
   return { nonMarkdown: 0, unreadable: 0 };
 }
 
+// src/lib/matter.ts
+var import_gray_matter = __toESM(require_gray_matter(), 1);
+var FRONTMATTER_IS_CODE = "it is marked as code, which Plinth never runs";
+var PATCHED = Symbol.for("plinth.matter.engines-before-patch");
+var marked = (table) => table[PATCHED];
+var refuse = {
+  parse() {
+    throw new Error(FRONTMATTER_IS_CODE);
+  },
+  stringify() {
+    throw new Error(FRONTMATTER_IS_CODE);
+  }
+};
+var engines = import_gray_matter.default.engines;
+if (marked(engines) === undefined) {
+  const before = Object.keys(engines).sort();
+  const safeLoad = engines.yaml.parse;
+  Object.assign(engines, {
+    javascript: refuse,
+    coffee: refuse,
+    yaml: { parse: (input) => safeLoad(input), stringify: engines.yaml.stringify }
+  });
+  Object.defineProperty(engines, PATCHED, { value: before });
+}
+var ENGINES_BEFORE_PATCH = marked(engines);
+function matter(input, read) {
+  return read === undefined ? import_gray_matter.default(input) : import_gray_matter.default(input, { cache: false });
+}
+function stringifyFrontmatter(body, data) {
+  const out = import_gray_matter.default.stringify({ content: body }, data);
+  const bodyOnly = body.endsWith(`
+`) ? body : `${body}
+`;
+  if (out === bodyOnly && import_gray_matter.default.test(body.replace(/^/, ""))) {
+    return `---
+---
+${bodyOnly}`;
+  }
+  return out;
+}
+
 // src/lib/backlinks/scan.ts
-var import_gray_matter4 = __toESM(require_gray_matter(), 1);
 import { readFileSync as readFileSync2 } from "node:fs";
 import { relative, sep as sep2 } from "node:path";
 
@@ -7860,9 +7915,6 @@ import {
 } from "node:fs";
 import { dirname, join as join2, resolve, sep } from "node:path";
 
-// src/lib/entities/_helpers.ts
-var import_gray_matter = __toESM(require_gray_matter(), 1);
-
 // node_modules/zod/v4/classic/external.js
 var exports_external = {};
 __export(exports_external, {
@@ -22189,7 +22241,7 @@ function buildFrontmatter(doc2, projectionKeys) {
   return { ...doc2.frontmatter, ...projection };
 }
 function serialiseRow(doc2, projectionKeys, bodyAccessor) {
-  const out = import_gray_matter.default.stringify(bodyAccessor(doc2), buildFrontmatter(doc2, projectionKeys));
+  const out = stringifyFrontmatter(bodyAccessor(doc2), buildFrontmatter(doc2, projectionKeys));
   return out.endsWith(`
 `) ? out : out + `
 `;
@@ -22829,7 +22881,6 @@ var documentsStrategy = {
 };
 
 // src/lib/entities/meetings.ts
-var import_gray_matter2 = __toESM(require_gray_matter(), 1);
 var MeetingLiveSchema = exports_external.object({
   ...BASE_ROW,
   deleted_at: exports_external.null(),
@@ -22984,7 +23035,7 @@ function serialise(doc2) {
     decisions: doc2.decisions,
     follow_up_summary: doc2.follow_up_summary
   });
-  const out = import_gray_matter2.default.stringify(body, fm);
+  const out = stringifyFrontmatter(body, fm);
   return out.endsWith(`
 `) ? out : out + `
 `;
@@ -24475,7 +24526,6 @@ function readContextFile(workspaceSlug, relativePath) {
 }
 
 // src/lib/backlinks/parse.ts
-var import_gray_matter3 = __toESM(require_gray_matter(), 1);
 var RENDERED_BLOCKS = [
   { name: "tasks", begin: TASKS_BLOCK_BEGIN, end: TASKS_BLOCK_END },
   { name: "comments", begin: COMMENTS_BLOCK_BEGIN, end: COMMENTS_BLOCK_END },
@@ -24557,7 +24607,7 @@ function frontmatterLinks(body) {
     return null;
   let data;
   try {
-    data = import_gray_matter3.default(body).data;
+    data = matter(body).data;
   } catch {
     return null;
   }
@@ -24825,7 +24875,7 @@ function buildArtistIndex(relPaths, root, readFile) {
     const slug = m[1];
     let name = null;
     try {
-      const raw = import_gray_matter4.default(readFile(`${root}${sep2}${rel}`)).data;
+      const raw = matter(readFile(`${root}${sep2}${rel}`)).data;
       if (typeof raw.name === "string" && raw.name.trim().length > 0) {
         name = raw.name.trim();
       }
@@ -25634,7 +25684,8 @@ var TripReasonSchema = exports_external.object({
   entityType: exports_external.string().optional(),
   typeCount: exports_external.number().int().nonnegative().optional(),
   typePopulation: exports_external.number().int().nonnegative().optional(),
-  pct: exports_external.number().optional()
+  pct: exports_external.number().optional(),
+  loneRemoved: exports_external.number().int().nonnegative().optional()
 });
 var PendingBatchFileSchema = exports_external.object({
   version: exports_external.literal(1),
@@ -25743,6 +25794,9 @@ function describeTrip(reason) {
     const pct = reason.pct !== undefined ? ` (${Math.round(reason.pct * 100)}%)` : "";
     return `${reason.typeCount}/${reason.typePopulation} ${reason.entityType}${pct} — proportion threshold`;
   }
+  if (reason.loneRemoved !== undefined) {
+    return reason.count === 1 ? "1 large overwrite — size threshold" : `${reason.count} destructive ops, including a large overwrite — size threshold`;
+  }
   return `${reason.count} destructive ops — count threshold`;
 }
 function formatBytes(n) {
@@ -26365,6 +26419,23 @@ var RejectedWriteSchema = exports_external.object({
   max_bytes: exports_external.number().int().nonnegative().optional(),
   reported_at: exports_external.string().datetime({ offset: true }).optional()
 });
+var FilePullHoldSchema = exports_external.object({
+  target: exports_external.string().min(1),
+  path: exports_external.string().min(1),
+  kind: exports_external.string().min(1),
+  row_id: exports_external.string().min(1),
+  row_updated_at: exports_external.string().min(1),
+  row_hash: exports_external.string().min(1),
+  reason: exports_external.string().optional(),
+  code: exports_external.string().optional(),
+  local: exports_external.object({
+    size: exports_external.number().int().nonnegative(),
+    mtime_ms: exports_external.number(),
+    ino: exports_external.number().int().nonnegative()
+  }).nullable().optional(),
+  attempts: exports_external.number().int().positive(),
+  next_retry_at: exports_external.string().optional()
+});
 var TeamFileRejectionSchema = exports_external.object({
   path: exports_external.string().min(1),
   reason: exports_external.string().min(1),
@@ -26392,6 +26463,7 @@ var WorkspaceStateV2Schema = exports_external.object({
   files: FileEntriesSchema.optional(),
   unsynced: exports_external.array(UnsyncedOpSchema).optional(),
   rejected: exports_external.array(RejectedWriteSchema).optional(),
+  file_pull_holds: exports_external.array(FilePullHoldSchema).optional(),
   workspace_rules: WorkspaceRulesStateSchema.optional(),
   workspace_memory: WorkspaceMemoryStateSchema.optional(),
   user_memory: UserMemoryStateSchema.optional(),
@@ -26487,25 +26559,50 @@ function isLaterVersion(a, b) {
   return ta > tb;
 }
 function committedEntryIfNewer(workspaceSlug, entityType, entry) {
+  const committed = readCommittedEntry(workspaceSlug, entityType, entry.id);
+  return isLaterVersion(committed, entry) ? committed : undefined;
+}
+function readCommittedEntry(workspaceSlug, entityType, id) {
+  const parsed = readCommittedJson(workspaceSlug);
+  const entries = parsed?.entries;
+  const committed = entries?.[entityType]?.[id];
+  if (committed === undefined)
+    return;
+  const valid = StateEntrySchema.safeParse(committed);
+  return valid.success ? valid.data : undefined;
+}
+function readCommittedFileEntry(workspaceSlug, relPath) {
+  const read = readCommittedFileAck(workspaceSlug, relPath);
+  return read.kind === "entry" ? read.entry : undefined;
+}
+function readCommittedFileAck(workspaceSlug, relPath) {
+  const json2 = readCommittedJson(workspaceSlug);
+  if (!json2)
+    return { kind: "unknown" };
+  const files = json2.files;
+  if (files === undefined)
+    return { kind: "absent" };
+  if (files === null || typeof files !== "object")
+    return { kind: "unknown" };
+  const committed = files[relPath];
+  if (committed === undefined)
+    return { kind: "absent" };
+  const valid = FileStateEntrySchema.safeParse(committed);
+  return valid.success ? { kind: "entry", entry: valid.data } : { kind: "unknown" };
+}
+function readCommittedJson(workspaceSlug) {
   let raw;
   try {
     raw = readFileSync7(stateFilePath(workspaceSlug), "utf8");
   } catch {
     return;
   }
-  let committed;
   try {
     const parsed = JSON.parse(raw);
-    committed = parsed.entries?.[entityType]?.[entry.id];
+    return parsed !== null && typeof parsed === "object" ? parsed : undefined;
   } catch {
     return;
   }
-  if (committed === undefined)
-    return;
-  const valid = StateEntrySchema.safeParse(committed);
-  if (!valid.success)
-    return;
-  return isLaterVersion(valid.data, entry) ? valid.data : undefined;
 }
 function mergeKey(fresh, before, after) {
   if (before === after)
@@ -26612,6 +26709,7 @@ function mergeWorkspaceState(fresh, before, after, wantCorrected = true) {
     files: mergedFiles,
     unsynced: mergedList(fresh.unsynced, before.unsynced, after.unsynced),
     rejected: mergedList(fresh.rejected, before.rejected, after.rejected),
+    file_pull_holds: mergedList(fresh.file_pull_holds, before.file_pull_holds, after.file_pull_holds),
     workspace_rules: rules.value,
     workspace_memory: memory.value,
     user_memory: userMemory.value,
@@ -26749,6 +26847,27 @@ function removeFileEntry(state, path) {
   delete nextFiles[path];
   return { state: { ...state, files: nextFiles }, changed: true };
 }
+function listFilePullHolds(state) {
+  return (state.file_pull_holds ?? []).filter((h) => h.target === "file");
+}
+function getFilePullHold(state, path) {
+  return state.file_pull_holds?.find((h) => h.target === "file" && h.path === path);
+}
+function upsertFilePullHold(state, hold) {
+  const list = state.file_pull_holds ?? [];
+  const at = list.findIndex((h) => h.target === hold.target && h.path === hold.path);
+  if (at !== -1 && stableHash(list[at]) === stableHash(hold))
+    return state;
+  const next = at === -1 ? [...list, hold] : list.map((h, i) => i === at ? hold : h);
+  return { ...state, file_pull_holds: next };
+}
+function removeFilePullHold(state, path, kind) {
+  const list = state.file_pull_holds;
+  const hit = (h) => h.target === "file" && h.path === path && (kind === undefined || h.kind === kind);
+  if (!list?.some(hit))
+    return state;
+  return { ...state, file_pull_holds: list.filter((h) => !hit(h)) };
+}
 function fileEntryCount(state) {
   return Object.keys(state.files ?? {}).length;
 }
@@ -27630,7 +27749,6 @@ function decideRegen(input) {
 }
 
 // src/lib/context/roster.ts
-var import_gray_matter5 = __toESM(require_gray_matter(), 1);
 import { readdirSync as readdirSync3, readFileSync as readFileSync8 } from "node:fs";
 import { join as join7 } from "node:path";
 function readRoster(workspaceSlug) {
@@ -27655,7 +27773,7 @@ function readRoster(workspaceSlug) {
       continue;
     }
     try {
-      const fm = import_gray_matter5.default(raw).data;
+      const fm = matter(raw).data;
       const name = typeof fm.name === "string" && fm.name.length > 0 ? fm.name : slug;
       const status = typeof fm.status === "string" ? fm.status : null;
       roster.push({ slug, name, status });
@@ -29045,7 +29163,6 @@ var SKILL_LOCATIONS = [
 var SECURITY_NOTE = "Scoped to a single Plinth workspace: do not read or write across " + "workspace folders; each has its own token and isolation boundary.";
 
 // src/lib/context/artist-data.ts
-var import_gray_matter6 = __toESM(require_gray_matter(), 1);
 import { readFileSync as readFileSync10 } from "node:fs";
 function artistUuidBySlug(state) {
   const map2 = new Map;
@@ -29172,7 +29289,7 @@ function readEntityFrontmatter(workspaceSlug, entityType, slug) {
     return null;
   }
   try {
-    return import_gray_matter6.default(raw).data;
+    return matter(raw).data;
   } catch {
     return null;
   }
@@ -30545,9 +30662,15 @@ function fileDeleteSuppressedLine(f) {
 function entityDeleteSuppressedLine(f) {
   return `[ENTITY_DELETE_SUPPRESSED entityType=${f.entityType} slug=${f.slug} reason=${f.reason}]`;
 }
+function entityPushHeldLine(f) {
+  return `[PUSH_HELD entityType=${f.entityType} slug=${f.slug} reason=${f.reason}]`;
+}
 function entityRestoreDeferredLine(f) {
   return `[ENTITY_RESTORE_DEFERRED entityType=${f.entityType} slug=${f.slug} wait_s=${f.waitSeconds}]`;
 }
+function entityPullDeferredLine(f) {
+  return `[PULL_DEFERRED entityType=${f.entityType} slug=${f.slug} id=${f.id} reason=${f.reason}]`;
+}
 function fileRestoreDeferredLine(f) {
   return `[FILE_RESTORE_DEFERRED path=${f.path} wait_s=${f.waitSeconds}]`;
 }
@@ -30566,6 +30689,16 @@ function fileStashFailedLine(f) {
   const codePart = f.code ? ` code=${f.code}` : "";
   return `[FILE_STASH_FAILED path=${f.path} reason=${f.reason}${codePart}]`;
 }
+function fileRestoreSkippedLine(f) {
+  return `[FILE_RESTORE_SKIPPED path=${f.path} row_id=${f.rowId} reason=${f.reason}]`;
+}
+function filePullSkippedLine(f) {
+  return `[FILE_PULL_SKIPPED path=${f.path} row_id=${f.rowId} reason=${f.reason}]`;
+}
+function filePullHeldLine(f) {
+  const retryPart = f.retryInSeconds !== undefined ? ` retry_s=${f.retryInSeconds}` : "";
+  return `[FILE_PULL_HELD path=${f.path} kind=${f.kind}${retryPart}]`;
+}
 function fileRejectionSyncFailedLine(f) {
   const parts = [`[FILE_REJECTION_SYNC_FAILED verb=${f.verb}`];
   if (f.path !== undefined)
@@ -30739,6 +30872,34 @@ function recordEntityRejected(args) {
     rejected_at: args.now().toISOString()
   }));
 }
+var FRONTMATTER_UNREADABLE_REASON = "frontmatter_unreadable";
+function frontmatterUnreadableSentence(why) {
+  const reason = why.replace(/[\u0000-\u001f\u007f-\u009f]/g, " ").replace(/\s+/g, " ").trim().slice(0, 120);
+  return `not synced, because its frontmatter could not be read (${reason}). ` + `Fix the frontmatter and it syncs.`;
+}
+function recordEntityFrontmatterUnreadable(args) {
+  let path;
+  try {
+    path = relative4(workspaceMirrorPath(args.workspaceSlug), args.absolutePath);
+  } catch {
+    path = args.absolutePath;
+  }
+  const message = frontmatterUnreadableSentence(args.why);
+  const withoutStale = removeUnsynced(args.state, "entity", path);
+  const existing = listRejected(args.state).find((o) => o.target === "entity" && o.path === path);
+  if (!withoutStale.changed && existing?.reason === FRONTMATTER_UNREADABLE_REASON && existing.message === message) {
+    return args.state;
+  }
+  return commitState(args.state, upsertRejected(withoutStale.state, {
+    target: "entity",
+    op: "upsert",
+    path,
+    status: 0,
+    reason: FRONTMATTER_UNREADABLE_REASON,
+    message,
+    rejected_at: args.now().toISOString()
+  }).state);
+}
 function recordFileRejected(args) {
   const cat = categorizeError(args.err);
   const withoutStale = removeUnsynced(args.state, "file", args.relPath).state;
@@ -34319,8 +34480,7 @@ var sessionCommand = defineCommand({
 });
 
 // src/commands/start.ts
-var import_gray_matter14 = __toESM(require_gray_matter(), 1);
-import { existsSync as existsSync10, readFileSync as readFileSync30, statSync as statSync18 } from "node:fs";
+import { existsSync as existsSync10, readFileSync as readFileSync33, statSync as statSync18 } from "node:fs";
 
 // src/lib/daemon-log.ts
 import { appendFileSync as appendFileSync2, mkdirSync as mkdirSync9, renameSync as renameSync7, statSync as statSync4 } from "node:fs";
@@ -34386,188 +34546,27 @@ class DaemonLog {
 }
 
 // src/lib/destructive-gate.ts
-var import_gray_matter7 = __toESM(require_gray_matter(), 1);
-import { readFileSync as readFileSync14, statSync as statSync5 } from "node:fs";
+import { readFileSync as readFileSync16, statSync as statSync6 } from "node:fs";
 import { basename as basename4 } from "node:path";
-var GUTTING_RATIO_DEFAULT = 0.5;
-var GUTTING_MIN_PRIOR_BYTES = 200;
-function envFloat(name, def) {
-  const v = process.env[name];
-  if (v === undefined || v === "")
-    return def;
-  const n = Number.parseFloat(v);
-  return Number.isFinite(n) && n > 0 ? n : def;
-}
-function envInt(name, def) {
-  const v = process.env[name];
-  if (v === undefined || v === "")
-    return def;
-  const n = Number.parseInt(v, 10);
-  return Number.isFinite(n) && n > 0 ? n : def;
-}
-function guttingRatio() {
-  return envFloat("PLINTH_GATE_GUTTING_RATIO", GUTTING_RATIO_DEFAULT);
-}
-function isGutting(priorLen, newLen) {
-  if (priorLen === undefined)
-    return false;
-  if (priorLen < GUTTING_MIN_PRIOR_BYTES)
-    return false;
-  return newLen <= guttingRatio() * priorLen;
-}
-function classifyDestructive(event, entityType, state, deps = {}) {
-  if (event.kind === "renamed")
-    return null;
-  if (event.kind === "unlink") {
-    const entry3 = event.stateEntry;
-    if (!entry3)
-      return null;
-    return {
-      kind: "delete",
-      entityType,
-      slug: entry3.slug,
-      id: entry3.id,
-      updatedAt: entry3.updated_at,
-      absolutePath: event.absolutePath
-    };
-  }
-  const readFile = deps.readFile ?? ((p) => readFileSync14(p, "utf8"));
-  const statInode = deps.statInode ?? ((p) => {
-    try {
-      return statSync5(p).ino;
-    } catch {
-      return;
-    }
-  });
-  let raw;
-  try {
-    raw = readFile(event.absolutePath);
-  } catch {
-    return null;
-  }
-  let newLen;
-  try {
-    const body = import_gray_matter7.default(raw).content;
-    newLen = (getStrategy(entityType)?.stripLocalBlocks?.(body) ?? body).length;
-  } catch {
-    return null;
-  }
-  const liveInode = statInode(event.absolutePath);
-  const slug = basename4(event.absolutePath, ".md");
-  const entry2 = (liveInode !== undefined ? getEntryByInode(state, entityType, liveInode) : undefined) ?? getEntryBySlug(state, entityType, slug);
-  if (!entry2)
-    return null;
-  if (!isGutting(entry2.body_len, newLen))
-    return null;
-  return {
-    kind: "overwrite",
-    entityType,
-    slug: entry2.slug,
-    id: entry2.id,
-    updatedAt: entry2.updated_at,
-    absolutePath: event.absolutePath,
-    priorLen: entry2.body_len ?? 0,
-    newLen
-  };
-}
-function defaultThresholds() {
-  return {
-    absCount: envInt("PLINTH_GATE_ABS_COUNT", 3),
-    propMinOps: envInt("PLINTH_GATE_PROP_MIN_OPS", 2),
-    propPct: envFloat("PLINTH_GATE_PROP_PCT", 0.5)
-  };
-}
-function evaluateBatch(ops, typePopulations, thresholds = defaultThresholds()) {
-  const count = ops.length;
-  if (count === 0)
-    return { tripped: false };
-  if (count >= thresholds.absCount) {
-    return { tripped: true, reason: { kind: "count", count } };
-  }
-  const byType = new Map;
-  for (const op of ops) {
-    byType.set(op.entityType, (byType.get(op.entityType) ?? 0) + 1);
-  }
-  for (const [entityType, typeCount] of byType) {
-    const typePopulation = typePopulations[entityType] ?? typeCount;
-    if (typeCount >= thresholds.propMinOps && typePopulation > 0 && typeCount >= thresholds.propPct * typePopulation) {
-      return {
-        tripped: true,
-        reason: {
-          kind: "proportion",
-          count,
-          entityType,
-          typeCount,
-          typePopulation,
-          pct: typeCount / typePopulation
-        }
-      };
-    }
-  }
-  return { tripped: false };
-}
-function dedupeOps(ops) {
-  const byKey = new Map;
-  for (const op of ops)
-    byKey.set(`${op.entityType}:${op.id}`, op);
-  return Array.from(byKey.values());
-}
-var DEFAULT_SETTLE_MS = 600;
-var DEFAULT_MAX_BATCH = 500;
-
-class DestructiveGate {
-  pending = [];
-  timer = null;
-  settleMs;
-  maxBatch;
-  onSettle;
-  onError;
-  constructor(opts) {
-    this.settleMs = opts.settleMs ?? DEFAULT_SETTLE_MS;
-    this.maxBatch = opts.maxBatch ?? DEFAULT_MAX_BATCH;
-    this.onSettle = opts.onSettle;
-    this.onError = opts.onError;
-  }
-  consider(op) {
-    this.pending.push(op);
-    if (this.pending.length >= this.maxBatch) {
-      this.flush();
-      return;
-    }
-    if (this.timer)
-      clearTimeout(this.timer);
-    this.timer = setTimeout(() => {
-      this.flush();
-    }, this.settleMs);
-  }
-  async drain() {
-    await this.flush();
-  }
-  size() {
-    return this.pending.length;
-  }
-  async flush() {
-    if (this.timer) {
-      clearTimeout(this.timer);
-      this.timer = null;
-    }
-    if (this.pending.length === 0)
-      return;
-    const batch = this.pending;
-    this.pending = [];
-    try {
-      await this.onSettle(batch);
-    } catch (err) {
-      this.onError?.(err);
-    }
-  }
-}
 
-// src/lib/resolve-pending.ts
-import { readFileSync as readFileSync20 } from "node:fs";
+// src/lib/pull-write.ts
+import { readFileSync as readFileSync15 } from "node:fs";
 
 // src/lib/conflicts.ts
-import { mkdirSync as mkdirSync10, readFileSync as readFileSync15, readdirSync as readdirSync6, statSync as statSync6, writeFileSync as writeFileSync7 } from "node:fs";
+import { createHash as createHash3, randomBytes } from "node:crypto";
+import {
+  closeSync as closeSync4,
+  constants as fsConstants2,
+  fstatSync as fstatSync2,
+  mkdirSync as mkdirSync10,
+  openSync as openSync4,
+  readFileSync as readFileSync14,
+  readdirSync as readdirSync6,
+  renameSync as renameSync8,
+  statSync as statSync5,
+  unlinkSync as unlinkSync8,
+  writeFileSync as writeFileSync7
+} from "node:fs";
 import { dirname as dirname9, join as join12 } from "node:path";
 function conflictsRoot(workspaceSlug) {
   return join12(plinthHome(), "_conflicts", workspaceSlug);
@@ -34597,7 +34596,7 @@ function stashEntityConflictOnce(args) {
   if (newest !== undefined) {
     const path5 = join12(dir, newest);
     try {
-      if (readFileSync15(path5, "utf8") === args.contents)
+      if (readFileSync14(path5, "utf8") === args.contents)
         return { path: path5, reused: true };
     } catch {}
   }
@@ -34609,13 +34608,95 @@ function fileConflictPath(args) {
   return join12(conflictsRoot(workspaceSlug), `${fileConflictStem(relPath)}.${iso}.${side}`);
 }
 function fileConflictStem(relPath) {
-  return `files.${relPath.replace(/[/\\]/g, "__")}`;
+  const flat = `files.${relPath.replace(/[/\\]/g, "__")}`;
+  if (Buffer.byteLength(flat) + STAMP_AND_SIDE_BYTES <= NAME_MAX_BYTES && !LONG_STEM_RE.test(flat)) {
+    return flat;
+  }
+  return `${truncateUtf8(flat, LONG_PREFIX_BYTES)}~${pathHash(relPath)}`;
+}
+var NAME_MAX_BYTES = 255;
+var STAMP_AND_SIDE_BYTES = 1 + 24 + 1 + 5;
+var PATH_HASH_HEX = 16;
+var LONG_PREFIX_BYTES = NAME_MAX_BYTES - STAMP_AND_SIDE_BYTES - 1 - PATH_HASH_HEX;
+var LONG_STEM_RE = /^(files\..*)~([0-9a-f]{16})$/;
+function pathHash(relPath) {
+  return createHash3("sha256").update(relPath, "utf8").digest("hex").slice(0, PATH_HASH_HEX);
+}
+function truncateUtf8(s, maxBytes) {
+  let bytes = 0;
+  let out = "";
+  for (const ch of s) {
+    const n = Buffer.byteLength(ch);
+    if (bytes + n > maxBytes)
+      break;
+    bytes += n;
+    out += ch;
+  }
+  return out;
+}
+function pathRecordFile(workspaceSlug, hash2) {
+  return join12(conflictsRoot(workspaceSlug), `.${hash2}.path`);
+}
+function ensurePathRecord(workspaceSlug, relPath) {
+  const target = pathRecordFile(workspaceSlug, pathHash(relPath));
+  if (readPathRecord(target) === relPath)
+    return;
+  const tmp = `${target}.${process.pid}.${randomBytes(4).toString("hex")}.tmp`;
+  writeFileSync7(tmp, relPath, { mode: 384 });
+  try {
+    renameSync8(tmp, target);
+  } catch (err) {
+    try {
+      unlinkSync8(tmp);
+    } catch {}
+    throw err;
+  }
+}
+function readStashFolderFile(target) {
+  let fd;
+  try {
+    fd = openSync4(target, fsConstants2.O_RDONLY | fsConstants2.O_NONBLOCK | fsConstants2.O_NOFOLLOW);
+  } catch {
+    return null;
+  }
+  try {
+    return fstatSync2(fd).isFile() ? readFileSync14(fd) : null;
+  } catch {
+    return null;
+  } finally {
+    closeSync4(fd);
+  }
+}
+function readPathRecord(target) {
+  return readStashFolderFile(target)?.toString("utf8") ?? null;
+}
+function prepareFileStash(workspaceSlug, relPath) {
+  mkdirSync10(conflictsRoot(workspaceSlug), { recursive: true, mode: 448 });
+  if (LONG_STEM_RE.test(fileConflictStem(relPath)))
+    ensurePathRecord(workspaceSlug, relPath);
+}
+function resolveLongStem(workspaceSlug, head) {
+  const m = LONG_STEM_RE.exec(head);
+  if (!m)
+    return null;
+  const recorded = readPathRecord(pathRecordFile(workspaceSlug, m[2]));
+  return recorded !== null && fileConflictStem(recorded) === head ? recorded : null;
 }
 function stashFileConflict(args) {
-  const target = fileConflictPath(args);
-  mkdirSync10(dirname9(target), { recursive: true, mode: 448 });
-  writeFileSync7(target, args.bytes, { mode: 384 });
-  return target;
+  prepareFileStash(args.workspaceSlug, args.relPath);
+  let stamp = args.timestamp;
+  for (let attempt = 0;attempt < 1000; attempt++) {
+    const target = fileConflictPath({ ...args, timestamp: stamp });
+    try {
+      writeFileSync7(target, args.bytes, { mode: 384, flag: "wx" });
+      return target;
+    } catch (err) {
+      if (err?.code !== "EEXIST")
+        throw err;
+      stamp = new Date(stamp.getTime() + 1);
+    }
+  }
+  throw new Error(`no free recovery-copy name for files/${args.relPath} near ${args.timestamp.toISOString()}`);
 }
 function stashFileConflictOnce(args) {
   const dir = conflictsRoot(args.workspaceSlug);
@@ -34630,10 +34711,13 @@ function stashFileConflictOnce(args) {
   const newest = names.filter((n) => n.startsWith(head) && tail.test(n.slice(head.length))).sort().pop();
   if (newest !== undefined) {
     const path5 = join12(dir, newest);
-    try {
-      if (Buffer.compare(args.bytes, readFileSync15(path5)) === 0)
-        return { path: path5, reused: true };
-    } catch {}
+    const existing = readStashFolderFile(path5);
+    if (existing !== null && Buffer.compare(args.bytes, existing) === 0) {
+      try {
+        prepareFileStash(args.workspaceSlug, args.relPath);
+      } catch {}
+      return { path: path5, reused: true };
+    }
   }
   return { path: stashFileConflict(args), reused: false };
 }
@@ -34643,18 +34727,28 @@ function parseStamp(stamp) {
   const d = new Date(iso);
   return Number.isNaN(d.getTime()) ? null : d;
 }
-function labelFor(file2) {
+function labelFor(file2, workspaceSlug) {
   const m = STAMP_RE2.exec(file2);
   if (!m)
-    return file2;
+    return { label: file2 };
   const head = file2.slice(0, m.index);
+  const exact = LONG_STEM_RE.test(head) ? resolveLongStem(workspaceSlug, head) : null;
+  if (exact !== null)
+    return { label: `files/${exact}`, pathRecorded: true };
+  if (LONG_STEM_RE.test(head)) {
+    const cut = LONG_STEM_RE.exec(head)[1];
+    return {
+      label: `files/${cut.slice("files.".length).replace(/__/g, "/")}…`,
+      pathUnrecorded: true
+    };
+  }
   if (head.startsWith("files.")) {
-    return `files/${head.slice("files.".length).replace(/__/g, "/")}`;
+    return { label: `files/${head.slice("files.".length).replace(/__/g, "/")}` };
   }
   const dot = head.indexOf(".");
   if (dot === -1)
-    return head;
-  return `${head.slice(0, dot)}/${head.slice(dot + 1)}`;
+    return { label: head };
+  return { label: `${head.slice(0, dot)}/${head.slice(dot + 1)}` };
 }
 function listConflictStashes(workspaceSlug) {
   const dir = conflictsRoot(workspaceSlug);
@@ -34669,7 +34763,7 @@ function listConflictStashes(workspaceSlug) {
     const absPath = join12(dir, file2);
     let st;
     try {
-      st = statSync6(absPath);
+      st = statSync5(absPath);
     } catch {
       continue;
     }
@@ -34679,10 +34773,13 @@ function listConflictStashes(workspaceSlug) {
       continue;
     const m = STAMP_RE2.exec(file2);
     const side = m?.[2];
+    const labelled = labelFor(file2, workspaceSlug);
     out.push({
       file: file2,
       absPath,
-      label: labelFor(file2),
+      label: labelled.label,
+      ...labelled.pathUnrecorded ? { pathUnrecorded: true } : {},
+      ...labelled.pathRecorded ? { pathRecorded: true } : {},
       stashedAt: m ? parseStamp(m[1]) : null,
       side: side === "local" || side === "cloud" ? side : null,
       mtimeMs: st.mtimeMs
@@ -34691,24 +34788,386 @@ function listConflictStashes(workspaceSlug) {
   return out.sort((a, b) => (b.stashedAt?.getTime() ?? b.mtimeMs) - (a.stashedAt?.getTime() ?? a.mtimeMs));
 }
 
+// src/lib/pull-write.ts
+var UNCACHED = { cache: false };
+function parseUncached(raw) {
+  return matter(raw, UNCACHED);
+}
+var NOT_A_MAPPING = "it is not a list of `key: value` lines";
+var SELF_REFERENCE = "an alias in it refers to itself";
+function readFrontmatter(raw) {
+  let parsed;
+  try {
+    parsed = parseUncached(raw);
+  } catch (err) {
+    return { ok: false, why: yamlReason(err) };
+  }
+  if (Object.prototype.toString.call(parsed.data) !== "[object Object]") {
+    return { ok: false, why: NOT_A_MAPPING };
+  }
+  try {
+    JSON.stringify(parsed.data);
+  } catch {
+    return { ok: false, why: SELF_REFERENCE };
+  }
+  return { ok: true, parsed };
+}
+function yamlReason(err) {
+  const message = err instanceof Error ? err.message : String(err);
+  return (message.split(`
+`)[0] ?? "").replace(/:\s*$/, "").trim();
+}
+function frontmatterParseError(raw) {
+  const read = readFrontmatter(raw);
+  return read.ok ? null : read.why;
+}
+function computeMirrorHashes(strategy, content) {
+  const parsed = matter(content);
+  const fm = parsed.data ?? {};
+  const lifted = splitUserFrontmatter(strategy, fm);
+  const userFm = userFrontmatter(strategy, lifted.frontmatter);
+  const hashBody = hashableBody(strategy, parsed.content);
+  return {
+    bodyHash: stableHash(hashBody),
+    frontmatterHash: stableHash({ ...userFm, ...lifted.topLevel }),
+    bodyLen: hashBody.length,
+    frontmatterId: fm["id"]
+  };
+}
+function hashableBody(strategy, body) {
+  return strategy.stripLocalBlocks?.(body) ?? body;
+}
+function relocateForSlugChange(args) {
+  const { workspaceSlug, strategy, fromSlug, toSlug, acked, echo, now } = args;
+  if (fromSlug === toSlug)
+    return { kind: "not_needed", writeSlug: toSlug };
+  if (!echo) {
+    return { kind: "skipped", writeSlug: toSlug, fromSlug, reason: "unguarded" };
+  }
+  if (strategy.mirrorRelativePath(fromSlug).split("/").length !== 2) {
+    return { kind: "skipped", writeSlug: toSlug, fromSlug, reason: "foldered" };
+  }
+  let fromPath;
+  try {
+    fromPath = entityFilePath(workspaceSlug, strategy.type, fromSlug);
+    entityFilePath(workspaceSlug, strategy.type, toSlug);
+  } catch (err) {
+    if (err instanceof MirrorPathError) {
+      return {
+        kind: "skipped",
+        writeSlug: toSlug,
+        fromSlug,
+        reason: "unresolvable"
+      };
+    }
+    throw err;
+  }
+  let raw = null;
+  try {
+    raw = readFileSync15(fromPath, "utf8");
+  } catch (err) {
+    const code = err?.code;
+    if (code === "ENOENT") {
+      return { kind: "absent", writeSlug: toSlug, fromSlug };
+    }
+    return {
+      kind: "refused",
+      writeSlug: fromSlug,
+      fromSlug,
+      reason: "source_unreadable"
+    };
+  }
+  let diverged = true;
+  try {
+    const hashes = computeMirrorHashes(strategy, raw);
+    diverged = hashes.bodyHash !== acked.bodyHash || hashes.frontmatterHash !== acked.frontmatterHash;
+  } catch {
+    diverged = true;
+  }
+  const stashPath = diverged ? stashConflict({
+    workspaceSlug,
+    entityType: strategy.type,
+    entitySlug: fromSlug,
+    timestamp: now(),
+    contents: raw,
+    side: "local"
+  }) : undefined;
+  try {
+    let registered = false;
+    const result = moveEntityFile(workspaceSlug, strategy.type, fromSlug, toSlug, () => {
+      if (echo.watcher === "live") {
+        echo.suppressor.registerDelete(fromPath);
+        registered = true;
+      }
+    });
+    if (result === "moved") {
+      return { kind: "moved", writeSlug: toSlug, fromSlug, stashPath };
+    }
+    if (registered && echo.watcher === "live") {
+      echo.suppressor.cancelDelete(fromPath);
+    }
+    return { kind: "absent", writeSlug: toSlug, fromSlug };
+  } catch (err) {
+    if (err instanceof MirrorDestinationOccupiedError) {
+      return {
+        kind: "refused",
+        writeSlug: fromSlug,
+        fromSlug,
+        reason: "destination_occupied",
+        stashPath
+      };
+    }
+    if (err instanceof MirrorPathError) {
+      return {
+        kind: "skipped",
+        writeSlug: toSlug,
+        fromSlug,
+        reason: "unresolvable"
+      };
+    }
+    throw err;
+  }
+}
+function writeMirrorWithBodyPreserve(workspaceSlug, strategy, doc2, suppressor, pathSlug) {
+  const targetSlug = pathSlug ?? doc2.slug;
+  const content = renderMirrorWithBodyPreserve(workspaceSlug, strategy, doc2, targetSlug);
+  if (suppressor) {
+    const target = entityFilePath(workspaceSlug, strategy.type, targetSlug);
+    suppressor.registerWrite(target, computeMirrorHashes(strategy, content));
+  }
+  writeMirrorFile(workspaceSlug, strategy.type, targetSlug, content);
+  return content;
+}
+function renderMirrorWithBodyPreserve(workspaceSlug, strategy, doc2, targetSlug) {
+  let content = strategy.serialise(doc2);
+  if (strategy.preserveLocalBodyOnPull) {
+    const target = entityFilePath(workspaceSlug, strategy.type, targetSlug);
+    let existing = null;
+    try {
+      existing = readFileSync15(target, "utf8");
+    } catch (err) {
+      if (err?.code !== "ENOENT")
+        throw err;
+    }
+    if (existing !== null) {
+      const existingParsed = matter(existing);
+      const cloudParsed = matter(content);
+      const stitched = stringifyFrontmatter(existingParsed.content, cloudParsed.data);
+      content = stitched.endsWith(`
+`) ? stitched : stitched + `
+`;
+    }
+  }
+  return content;
+}
+
+// src/lib/destructive-gate.ts
+var GUTTING_RATIO_DEFAULT = 0.5;
+var GUTTING_MIN_PRIOR_BYTES = 200;
+function envFloat(name, def) {
+  const v = process.env[name];
+  if (v === undefined || v === "")
+    return def;
+  const n = Number.parseFloat(v);
+  return Number.isFinite(n) && n > 0 ? n : def;
+}
+function envInt(name, def) {
+  const v = process.env[name];
+  if (v === undefined || v === "")
+    return def;
+  const n = Number.parseInt(v, 10);
+  return Number.isFinite(n) && n > 0 ? n : def;
+}
+function guttingRatio() {
+  return envFloat("PLINTH_GATE_GUTTING_RATIO", GUTTING_RATIO_DEFAULT);
+}
+function isGutting(priorLen, newLen) {
+  if (priorLen === undefined)
+    return false;
+  if (priorLen < GUTTING_MIN_PRIOR_BYTES)
+    return false;
+  return newLen <= guttingRatio() * priorLen;
+}
+function classifyDestructive(event, entityType, state, deps = {}) {
+  if (event.kind === "renamed")
+    return null;
+  if (event.kind === "unlink") {
+    const entry3 = event.stateEntry;
+    if (!entry3)
+      return null;
+    return {
+      kind: "delete",
+      entityType,
+      slug: entry3.slug,
+      id: entry3.id,
+      updatedAt: entry3.updated_at,
+      absolutePath: event.absolutePath
+    };
+  }
+  const readFile = deps.readFile ?? ((p) => readFileSync16(p, "utf8"));
+  const statInode = deps.statInode ?? ((p) => {
+    try {
+      return statSync6(p).ino;
+    } catch {
+      return;
+    }
+  });
+  let raw;
+  try {
+    raw = readFile(event.absolutePath);
+  } catch {
+    return null;
+  }
+  const read = readFrontmatter(raw);
+  if (!read.ok)
+    return null;
+  const body = read.parsed.content;
+  const newLen = (getStrategy(entityType)?.stripLocalBlocks?.(body) ?? body).length;
+  const liveInode = statInode(event.absolutePath);
+  const slug = basename4(event.absolutePath, ".md");
+  const entry2 = (liveInode !== undefined ? getEntryByInode(state, entityType, liveInode) : undefined) ?? getEntryBySlug(state, entityType, slug);
+  if (!entry2)
+    return null;
+  if (!isGutting(entry2.body_len, newLen))
+    return null;
+  return {
+    kind: "overwrite",
+    entityType,
+    slug: entry2.slug,
+    id: entry2.id,
+    updatedAt: entry2.updated_at,
+    absolutePath: event.absolutePath,
+    priorLen: entry2.body_len ?? 0,
+    newLen
+  };
+}
+var LONE_MIN_REMOVED_DEFAULT = 5000;
+var LONE_MIN_REMOVED_BYTES_DEFAULT = 100 * 1024;
+function defaultThresholds() {
+  return {
+    absCount: envInt("PLINTH_GATE_ABS_COUNT", 3),
+    propMinOps: envInt("PLINTH_GATE_PROP_MIN_OPS", 2),
+    propPct: envFloat("PLINTH_GATE_PROP_PCT", 0.5),
+    loneMinRemoved: envInt("PLINTH_GATE_LONE_MIN_REMOVED", LONE_MIN_REMOVED_DEFAULT),
+    loneMinRemovedBytes: envInt("PLINTH_GATE_LONE_MIN_REMOVED_BYTES", LONE_MIN_REMOVED_BYTES_DEFAULT)
+  };
+}
+function tripReasonToken(reason) {
+  return reason.loneRemoved !== undefined ? "size" : reason.kind;
+}
+function evaluateLoneOverwrite(count, removed, floor) {
+  const loneRemoved = Math.max(0, ...removed);
+  if (loneRemoved < floor)
+    return { tripped: false };
+  return { tripped: true, reason: { kind: "count", count, loneRemoved } };
+}
+function evaluateBatch(ops, typePopulations, thresholds = defaultThresholds()) {
+  const count = ops.length;
+  if (count === 0)
+    return { tripped: false };
+  if (count >= thresholds.absCount) {
+    return { tripped: true, reason: { kind: "count", count } };
+  }
+  const byType = new Map;
+  for (const op of ops) {
+    byType.set(op.entityType, (byType.get(op.entityType) ?? 0) + 1);
+  }
+  for (const [entityType, typeCount] of byType) {
+    const typePopulation = typePopulations[entityType] ?? typeCount;
+    if (typeCount >= thresholds.propMinOps && typePopulation > 0 && typeCount >= thresholds.propPct * typePopulation) {
+      return {
+        tripped: true,
+        reason: {
+          kind: "proportion",
+          count,
+          entityType,
+          typeCount,
+          typePopulation,
+          pct: typeCount / typePopulation
+        }
+      };
+    }
+  }
+  return evaluateLoneOverwrite(count, ops.map((op) => op.kind === "overwrite" ? op.priorLen - op.newLen : 0), thresholds.loneMinRemoved);
+}
+function dedupeOps(ops) {
+  const byKey = new Map;
+  for (const op of ops)
+    byKey.set(`${op.entityType}:${op.id}`, op);
+  return Array.from(byKey.values());
+}
+var DEFAULT_SETTLE_MS = 600;
+var DEFAULT_MAX_BATCH = 500;
+
+class DestructiveGate {
+  pending = [];
+  timer = null;
+  settleMs;
+  maxBatch;
+  onSettle;
+  onError;
+  constructor(opts) {
+    this.settleMs = opts.settleMs ?? DEFAULT_SETTLE_MS;
+    this.maxBatch = opts.maxBatch ?? DEFAULT_MAX_BATCH;
+    this.onSettle = opts.onSettle;
+    this.onError = opts.onError;
+  }
+  consider(op) {
+    this.pending.push(op);
+    if (this.pending.length >= this.maxBatch) {
+      this.flush();
+      return;
+    }
+    if (this.timer)
+      clearTimeout(this.timer);
+    this.timer = setTimeout(() => {
+      this.flush();
+    }, this.settleMs);
+  }
+  async drain() {
+    await this.flush();
+  }
+  size() {
+    return this.pending.length;
+  }
+  async flush() {
+    if (this.timer) {
+      clearTimeout(this.timer);
+      this.timer = null;
+    }
+    if (this.pending.length === 0)
+      return;
+    const batch = this.pending;
+    this.pending = [];
+    try {
+      await this.onSettle(batch);
+    } catch (err) {
+      this.onError?.(err);
+    }
+  }
+}
+
+// src/lib/resolve-pending.ts
+import { readFileSync as readFileSync22 } from "node:fs";
+
 // src/lib/files/push.ts
-import { readFileSync as readFileSync17, statSync as statSync7 } from "node:fs";
+import { readFileSync as readFileSync19, statSync as statSync7 } from "node:fs";
 
 // src/lib/permanent-deletions.ts
-import { createHash as createHash3, randomUUID } from "node:crypto";
+import { createHash as createHash4, randomUUID } from "node:crypto";
 import {
   chmodSync,
-  closeSync as closeSync4,
+  closeSync as closeSync5,
   constants as constants2,
   existsSync as existsSync4,
   fsyncSync as fsyncSync2,
-  fstatSync as fstatSync2,
+  fstatSync as fstatSync3,
   lstatSync as lstatSync4,
   mkdirSync as mkdirSync11,
-  openSync as openSync4,
-  readFileSync as readFileSync16,
-  renameSync as renameSync8,
-  unlinkSync as unlinkSync8,
+  openSync as openSync5,
+  readFileSync as readFileSync17,
+  renameSync as renameSync9,
+  unlinkSync as unlinkSync9,
   writeSync as writeSync2
 } from "node:fs";
 import { dirname as dirname10, join as join13 } from "node:path";
@@ -34806,13 +35265,13 @@ function canonical(value) {
   return `{${Object.keys(obj).sort().map((key) => `${JSON.stringify(key)}:${canonical(obj[key])}`).join(",")}}`;
 }
 function canonicalPayloadDigest(value) {
-  return createHash3("sha256").update(canonical(value), "utf8").digest("hex");
+  return createHash4("sha256").update(canonical(value), "utf8").digest("hex");
 }
 function fileCreatePayloadDigest(contentHash, mimeType) {
   return canonicalPayloadDigest({ content_hash: contentHash, mime_type: mimeType });
 }
 function checksum(body) {
-  return createHash3("sha256").update(canonical(body), "utf8").digest("hex");
+  return createHash4("sha256").update(canonical(body), "utf8").digest("hex");
 }
 function emptyJournal(workspaceSlug) {
   return { version: 1, revision: 0, workspace_slug: workspaceSlug, records: [], refresh: [] };
@@ -34884,11 +35343,11 @@ function parseJournal(workspaceSlug, raw) {
   return body;
 }
 function fsyncDirectory(path5) {
-  const fd = openSync4(path5, constants2.O_RDONLY);
+  const fd = openSync5(path5, constants2.O_RDONLY);
   try {
     fsyncSync2(fd);
   } finally {
-    closeSync4(fd);
+    closeSync5(fd);
   }
 }
 function loadPermanentDeletionJournal(workspaceSlug) {
@@ -34897,7 +35356,7 @@ function loadPermanentDeletionJournal(workspaceSlug) {
     return emptyJournal(workspaceSlug);
   assertPrivateDirectory(dirname10(target));
   assertOwnerOnlyFile(target);
-  const journal = parseJournal(workspaceSlug, readFileSync16(target, "utf8"));
+  const journal = parseJournal(workspaceSlug, readFileSync17(target, "utf8"));
   try {
     fsyncDirectory(dirname10(target));
   } catch (error52) {
@@ -34932,8 +35391,8 @@ function writePermanentDeletionJournal(prior, next) {
 `;
   let fd;
   try {
-    fd = openSync4(tmp, constants2.O_WRONLY | constants2.O_CREAT | constants2.O_EXCL | (constants2.O_NOFOLLOW ?? 0), 384);
-    const stat = fstatSync2(fd);
+    fd = openSync5(tmp, constants2.O_WRONLY | constants2.O_CREAT | constants2.O_EXCL | (constants2.O_NOFOLLOW ?? 0), 384);
+    const stat = fstatSync3(fd);
     if (!stat.isFile() || (stat.mode & 511) !== 384) {
       throw new PermanentDeletionJournalError("journal temporary file is not owner-only", "prepare");
     }
@@ -34942,16 +35401,16 @@ function writePermanentDeletionJournal(prior, next) {
     while (offset < bytes.length)
       offset += writeSync2(fd, bytes, offset, bytes.length - offset);
     fsyncSync2(fd);
-    closeSync4(fd);
+    closeSync5(fd);
     fd = undefined;
   } catch (error52) {
     if (fd !== undefined) {
       try {
-        closeSync4(fd);
+        closeSync5(fd);
       } catch {}
     }
     try {
-      unlinkSync8(tmp);
+      unlinkSync9(tmp);
     } catch {}
     if (error52 instanceof PermanentDeletionJournalError)
       throw error52;
@@ -34959,18 +35418,18 @@ function writePermanentDeletionJournal(prior, next) {
     throw new PermanentDeletionJournalError(`could not prepare journal write: ${detail}`, "write");
   }
   try {
-    renameSync8(tmp, target);
+    renameSync9(tmp, target);
   } catch (error52) {
     let installed2 = false;
     try {
       assertOwnerOnlyFile(target);
-      const candidate = parseJournal(body.workspace_slug, readFileSync16(target, "utf8"));
+      const candidate = parseJournal(body.workspace_slug, readFileSync17(target, "utf8"));
       installed2 = candidate.revision === body.revision && checksum(candidate) === checksum(body);
     } catch {
       installed2 = false;
     }
     try {
-      unlinkSync8(tmp);
+      unlinkSync9(tmp);
     } catch {}
     if (!installed2) {
       const detail = error52 instanceof Error ? error52.message : String(error52);
@@ -34978,7 +35437,7 @@ function writePermanentDeletionJournal(prior, next) {
     }
   }
   assertOwnerOnlyFile(target);
-  const installed = parseJournal(body.workspace_slug, readFileSync16(target, "utf8"));
+  const installed = parseJournal(body.workspace_slug, readFileSync17(target, "utf8"));
   if (installed.revision !== body.revision || checksum(installed) !== checksum(body)) {
     throw new PermanentDeletionJournalError("renamed journal revision did not validate", "durability_indeterminate");
   }
@@ -34986,7 +35445,7 @@ function writePermanentDeletionJournal(prior, next) {
     fsyncDirectory(parent);
   } catch (firstError) {
     assertOwnerOnlyFile(target);
-    const reopened = parseJournal(body.workspace_slug, readFileSync16(target, "utf8"));
+    const reopened = parseJournal(body.workspace_slug, readFileSync17(target, "utf8"));
     if (reopened.revision !== body.revision || checksum(reopened) !== checksum(body)) {
       throw new PermanentDeletionJournalError("journal changed after rename", "durability_indeterminate");
     }
@@ -35329,9 +35788,109 @@ async function prepareOrResolveGenerationCreateLocked(args) {
 }
 
 // src/lib/files/content-hash.ts
-import { createHash as createHash4 } from "node:crypto";
+import { createHash as createHash5 } from "node:crypto";
 function sha256Bytes(bytes) {
-  return createHash4("sha256").update(bytes).digest("hex");
+  return createHash5("sha256").update(bytes).digest("hex");
+}
+
+// src/lib/files/keep-local.ts
+import { randomBytes as randomBytes2 } from "node:crypto";
+import { lstatSync as lstatSync5, readFileSync as readFileSync18, unlinkSync as unlinkSync10, writeFileSync as writeFileSync8 } from "node:fs";
+import { dirname as dirname11, join as join14 } from "node:path";
+function keepUnsentLocalCopy(args) {
+  const read = readKeepable(args.workspaceSlug, args.abs);
+  if (read.kind === "failed")
+    return read.failure;
+  if (read.kind === "absent")
+    return null;
+  const localHash = sha256Bytes(read.bytes);
+  if (args.safeHashes.includes(localHash))
+    return null;
+  let stashed;
+  try {
+    stashed = stashFileConflictOnce({
+      workspaceSlug: args.workspaceSlug,
+      relPath: args.relPath,
+      timestamp: args.now(),
+      bytes: read.bytes,
+      side: "local"
+    });
+  } catch (err) {
+    return { reason: "stash_io", code: errCode(err) };
+  }
+  const key = `reused:${stashed.path}:${args.versionKey}`;
+  if (stashed.reused && args.loggedStashNotices?.has(key))
+    return null;
+  if (stashed.reused)
+    args.loggedStashNotices?.add(key);
+  args.output?.log(fileConflictLine({ path: args.relPath, stash: stashed.path, via: args.via, reused: stashed.reused }));
+  args.output?.warn(stashed.reused ? `Conflict on files/${args.relPath} → your local edit is already kept at ${stashed.path}.` : `Conflict on files/${args.relPath} → stashed local edit to ${stashed.path} (cloud-wins${args.onBoot ? " on boot" : ""}).`);
+  return null;
+}
+function probeKeep(args) {
+  const read = readKeepable(args.workspaceSlug, args.abs);
+  if (read.kind === "failed")
+    return read.failure;
+  if (read.kind === "absent")
+    return null;
+  if (args.safeHashes.includes(sha256Bytes(read.bytes)))
+    return null;
+  const dir = conflictsRoot(args.workspaceSlug);
+  const probe2 = join14(dir, `.keep-probe-${process.pid}-${randomBytes2(6).toString("hex")}`);
+  try {
+    prepareFileStash(args.workspaceSlug, args.relPath);
+    writeFileSync8(probe2, read.bytes, { mode: 384 });
+  } catch (err) {
+    return { reason: "stash_io", code: errCode(err) };
+  } finally {
+    try {
+      unlinkSync10(probe2);
+    } catch {}
+  }
+  return null;
+}
+function unsentBytesAt(args) {
+  const read = readKeepable(args.workspaceSlug, args.abs);
+  if (read.kind === "failed")
+    return read;
+  if (read.kind === "absent")
+    return { kind: "none" };
+  return args.safeHashes.includes(sha256Bytes(read.bytes)) ? { kind: "none" } : { kind: "unsent" };
+}
+function readLocalForKeep(workspaceSlug, abs) {
+  return readKeepable(workspaceSlug, abs);
+}
+function localFingerprint(abs) {
+  try {
+    const st = lstatSync5(abs);
+    return { size: st.size, mtime_ms: st.mtimeMs, ino: st.ino };
+  } catch (err) {
+    return err?.code === "ENOENT" ? null : undefined;
+  }
+}
+function readKeepable(workspaceSlug, abs) {
+  if (hasSymlinkedComponent(workspaceSlug, dirname11(abs))) {
+    return { kind: "failed", failure: { reason: "symlink" } };
+  }
+  let st;
+  try {
+    st = lstatSync5(abs);
+  } catch (err) {
+    if (err?.code === "ENOENT")
+      return { kind: "absent" };
+    return { kind: "failed", failure: { reason: "unreadable", code: errCode(err) } };
+  }
+  if (!st.isFile())
+    return { kind: "failed", failure: { reason: "not_a_file" } };
+  try {
+    return { kind: "read", bytes: readFileSync18(abs) };
+  } catch (err) {
+    return { kind: "failed", failure: { reason: "unreadable", code: errCode(err) } };
+  }
+}
+function errCode(err) {
+  const code = err?.code;
+  return typeof code === "string" ? code : undefined;
 }
 
 // src/lib/files/mime.ts
@@ -35403,23 +35962,63 @@ async function restoreFileFromCloud(args) {
   const { workspaceSlug, baseUrl, pat, id, relPath, state, fetchImpl, suppressor, output } = args;
   const got = args.prefetched ?? await getFile({ baseUrl, pat, id, fetchImpl });
   const abs = filesSubtreePath(workspaceSlug, relPath);
+  const ack = getFileEntry(state, relPath);
+  const keptHash = args.kept ? sha256Bytes(args.kept) : undefined;
+  const blocked = (cloud) => {
+    const read = readCommittedFileAck(workspaceSlug, relPath);
+    if (read.kind === "unknown")
+      return null;
+    if (read.kind === "absent")
+      return ack ? "removed" : null;
+    const committed = read.entry;
+    if (committed.id !== id)
+      return "replaced";
+    const against = cloud ?? ack;
+    return against && isLaterVersion(committed, against) ? "newer_ack" : null;
+  };
+  const unsent = (cloudHash) => {
+    const committed = readCommittedFileEntry(workspaceSlug, relPath);
+    const disk = unsentBytesAt({
+      workspaceSlug,
+      abs,
+      safeHashes: [
+        cloudHash,
+        ack?.content_hash,
+        keptHash,
+        committed?.id === id ? committed.content_hash : undefined
+      ]
+    });
+    if (disk.kind === "failed")
+      return disk.failure.reason;
+    return disk.kind === "unsent" ? "newer_save" : null;
+  };
+  const skipped = (reason2) => {
+    output?.log(fileRestoreSkippedLine({ path: relPath, rowId: id, reason: reason2 }));
+    return { state, outcome: "skipped", reason: reason2 };
+  };
   if (!got.ok) {
+    const reason2 = blocked(null) ?? unsent(undefined);
+    if (reason2)
+      return skipped(reason2);
     suppressor?.registerDelete(abs);
     deleteFilesFile(workspaceSlug, relPath);
-    return dropFiles(state, relPath);
+    return { state: dropFiles(state, relPath), outcome: "removed" };
   }
   if (got.row.download_url === null) {
     output?.warn(`files/${relPath}: Plinth holds no bytes for this file, so there is nothing to restore from cloud — the local copy and its state were left exactly as they are.`);
-    return state;
+    return { state, outcome: "no_bytes" };
   }
   const bytes = await downloadBytes(got.row.download_url, fetchImpl);
+  const reason = blocked(got.row) ?? unsent(got.row.content_hash);
+  if (reason)
+    return skipped(reason);
   suppressor?.registerWrite(abs, {
     bodyHash: got.row.content_hash,
     frontmatterHash: ""
   });
   writeFilesBytes(workspaceSlug, relPath, bytes);
   deleteExtractedText(workspaceSlug, relPath);
-  return persistFiles(state, {
+  const restored = persistFiles(state, {
     id: got.row.id,
     path: relPath,
     content_hash: got.row.content_hash,
@@ -35428,6 +36027,7 @@ async function restoreFileFromCloud(args) {
     updated_at: got.row.updated_at,
     inode: safeInode(abs)
   });
+  return { state: restored, outcome: "restored" };
 }
 async function pushFilesUpsert(args) {
   return withPermanentDeletionLock("workspace_file", args.relPath, () => pushFilesUpsertLocked(args));
@@ -35485,7 +36085,7 @@ async function pushFilesUpsertLocked(args) {
         state: next
       };
     }
-    bytes = readFileSync17(absolutePath);
+    bytes = readFileSync19(absolutePath);
     hash2 = sha256Bytes(bytes);
     inode = st.ino;
   }
@@ -35692,8 +36292,9 @@ async function pushFilesUpsertLocked(args) {
     side: "local"
   });
   output?.log(fileConflictLine({ path: relPath, stash: stashPath, reused }));
+  let restore;
   if (existing) {
-    nextState = await restoreFileFromCloud({
+    const restored = await restoreFileFromCloud({
       workspaceSlug,
       baseUrl,
       pat,
@@ -35703,10 +36304,16 @@ async function pushFilesUpsertLocked(args) {
       fetchImpl,
       suppressor,
       output,
-      prefetched: cloudRow
+      prefetched: cloudRow,
+      kept: bytes
     });
+    nextState = restored.state;
+    restore = restored.outcome;
   }
-  return { outcome: { kind: "conflict", relPath, stashPath }, state: nextState };
+  return {
+    outcome: { kind: "conflict", relPath, stashPath, ...restore ? { restore } : {} },
+    state: nextState
+  };
 }
 async function pushFilesDelete(args) {
   const { workspaceSlug, baseUrl, pat, relPath, state, deps } = args;
@@ -35732,7 +36339,7 @@ async function pushFilesDelete(args) {
     output?.log(fileDeleteLine({ path: relPath, id: existing.id, note: "already_absent" }));
     return { outcome: { kind: "deleted", relPath, id: existing.id }, state: dropFiles(state, relPath) };
   }
-  const nextState = await restoreFileFromCloud({
+  const restore = await restoreFileFromCloud({
     workspaceSlug,
     baseUrl,
     pat,
@@ -35743,16 +36350,71 @@ async function pushFilesDelete(args) {
     suppressor,
     output
   });
-  return { outcome: { kind: "conflict", relPath, stashPath: "" }, state: nextState };
+  return {
+    outcome: { kind: "conflict", relPath, stashPath: "", restore: restore.outcome },
+    state: restore.state
+  };
 }
 
 // src/lib/push.ts
-var import_gray_matter10 = __toESM(require_gray_matter(), 1);
-import { existsSync as existsSync5, readFileSync as readFileSync19, statSync as statSync8 } from "node:fs";
+import { existsSync as existsSync5, readFileSync as readFileSync21, statSync as statSync8 } from "node:fs";
 import { basename as basename5, relative as relative5 } from "node:path";
 
+// src/lib/frontmatter-held.ts
+import { lstatSync as lstatSync6, readFileSync as readFileSync20 } from "node:fs";
+import { resolve as resolve4, sep as sep5 } from "node:path";
+function holdUnreadableFrontmatter(args) {
+  const next = recordEntityFrontmatterUnreadable(args);
+  args.output?.log(entityPushHeldLine({
+    entityType: args.entityType,
+    slug: args.slug,
+    reason: FRONTMATTER_UNREADABLE_REASON
+  }));
+  if (next !== args.state) {
+    args.output?.warn(`${args.entityType}/${args.slug}: ${frontmatterUnreadableSentence(args.why)}`);
+  }
+  return next;
+}
+function settleFrontmatterHolds(state, workspaceSlug) {
+  const held = listRejected(state).filter(isFrontmatterHold);
+  if (held.length === 0)
+    return state;
+  let root;
+  try {
+    root = workspaceMirrorPath(workspaceSlug);
+  } catch {
+    return state;
+  }
+  const settled = new Set(held.map((record2) => record2.path).filter((path5) => !stillHeld(workspaceSlug, root, path5)));
+  if (settled.size === 0)
+    return state;
+  return commitState(state, {
+    ...state,
+    rejected: listRejected(state).filter((o) => !(isFrontmatterHold(o) && settled.has(o.path)))
+  });
+}
+function isFrontmatterHold(record2) {
+  return record2.target === "entity" && record2.reason === FRONTMATTER_UNREADABLE_REASON;
+}
+function stillHeld(workspaceSlug, root, recordPath) {
+  const absolutePath = resolve4(root, recordPath);
+  if (!absolutePath.startsWith(root + sep5))
+    return true;
+  if (hasSymlinkedComponent(workspaceSlug, absolutePath))
+    return true;
+  let raw;
+  try {
+    if (!lstatSync6(absolutePath).isFile())
+      return true;
+    raw = readFileSync20(absolutePath, "utf8");
+  } catch (err) {
+    const code = err.code;
+    return code !== "ENOENT" && code !== "ENOTDIR";
+  }
+  return frontmatterParseError(raw) !== null;
+}
+
 // src/lib/frontmatter-id.ts
-var import_gray_matter8 = __toESM(require_gray_matter(), 1);
 function eolOf(content) {
   return /\r\n/.test(content) ? `\r
 ` : `
@@ -35789,158 +36451,16 @@ function withFrontmatterId(raw, parsed, id) {
 }
 function frontmatterIdWriteIsSound(next, id, expectedBody) {
   try {
-    const check2 = import_gray_matter8.default(next);
+    const check2 = matter(next);
     return check2.data?.["id"] === id && check2.content === expectedBody;
   } catch {
     return false;
   }
 }
 
-// src/lib/pull-write.ts
-var import_gray_matter9 = __toESM(require_gray_matter(), 1);
-import { readFileSync as readFileSync18 } from "node:fs";
-function computeMirrorHashes(strategy, content) {
-  const parsed = import_gray_matter9.default(content);
-  const fm = parsed.data ?? {};
-  const lifted = splitUserFrontmatter(strategy, fm);
-  const userFm = userFrontmatter(strategy, lifted.frontmatter);
-  const hashBody = hashableBody(strategy, parsed.content);
-  return {
-    bodyHash: stableHash(hashBody),
-    frontmatterHash: stableHash({ ...userFm, ...lifted.topLevel }),
-    bodyLen: hashBody.length,
-    frontmatterId: fm["id"]
-  };
-}
-function hashableBody(strategy, body) {
-  return strategy.stripLocalBlocks?.(body) ?? body;
-}
-function relocateForSlugChange(args) {
-  const { workspaceSlug, strategy, fromSlug, toSlug, acked, echo, now } = args;
-  if (fromSlug === toSlug)
-    return { kind: "not_needed", writeSlug: toSlug };
-  if (!echo) {
-    return { kind: "skipped", writeSlug: toSlug, fromSlug, reason: "unguarded" };
-  }
-  if (strategy.mirrorRelativePath(fromSlug).split("/").length !== 2) {
-    return { kind: "skipped", writeSlug: toSlug, fromSlug, reason: "foldered" };
-  }
-  let fromPath;
-  try {
-    fromPath = entityFilePath(workspaceSlug, strategy.type, fromSlug);
-    entityFilePath(workspaceSlug, strategy.type, toSlug);
-  } catch (err) {
-    if (err instanceof MirrorPathError) {
-      return {
-        kind: "skipped",
-        writeSlug: toSlug,
-        fromSlug,
-        reason: "unresolvable"
-      };
-    }
-    throw err;
-  }
-  let raw = null;
-  try {
-    raw = readFileSync18(fromPath, "utf8");
-  } catch (err) {
-    const code = err?.code;
-    if (code === "ENOENT") {
-      return { kind: "absent", writeSlug: toSlug, fromSlug };
-    }
-    return {
-      kind: "refused",
-      writeSlug: fromSlug,
-      fromSlug,
-      reason: "source_unreadable"
-    };
-  }
-  let diverged = true;
-  try {
-    const hashes = computeMirrorHashes(strategy, raw);
-    diverged = hashes.bodyHash !== acked.bodyHash || hashes.frontmatterHash !== acked.frontmatterHash;
-  } catch {
-    diverged = true;
-  }
-  const stashPath = diverged ? stashConflict({
-    workspaceSlug,
-    entityType: strategy.type,
-    entitySlug: fromSlug,
-    timestamp: now(),
-    contents: raw,
-    side: "local"
-  }) : undefined;
-  try {
-    let registered = false;
-    const result = moveEntityFile(workspaceSlug, strategy.type, fromSlug, toSlug, () => {
-      if (echo.watcher === "live") {
-        echo.suppressor.registerDelete(fromPath);
-        registered = true;
-      }
-    });
-    if (result === "moved") {
-      return { kind: "moved", writeSlug: toSlug, fromSlug, stashPath };
-    }
-    if (registered && echo.watcher === "live") {
-      echo.suppressor.cancelDelete(fromPath);
-    }
-    return { kind: "absent", writeSlug: toSlug, fromSlug };
-  } catch (err) {
-    if (err instanceof MirrorDestinationOccupiedError) {
-      return {
-        kind: "refused",
-        writeSlug: fromSlug,
-        fromSlug,
-        reason: "destination_occupied",
-        stashPath
-      };
-    }
-    if (err instanceof MirrorPathError) {
-      return {
-        kind: "skipped",
-        writeSlug: toSlug,
-        fromSlug,
-        reason: "unresolvable"
-      };
-    }
-    throw err;
-  }
-}
-function writeMirrorWithBodyPreserve(workspaceSlug, strategy, doc2, suppressor, pathSlug) {
-  const targetSlug = pathSlug ?? doc2.slug;
-  const content = renderMirrorWithBodyPreserve(workspaceSlug, strategy, doc2, targetSlug);
-  if (suppressor) {
-    const target = entityFilePath(workspaceSlug, strategy.type, targetSlug);
-    suppressor.registerWrite(target, computeMirrorHashes(strategy, content));
-  }
-  writeMirrorFile(workspaceSlug, strategy.type, targetSlug, content);
-  return content;
-}
-function renderMirrorWithBodyPreserve(workspaceSlug, strategy, doc2, targetSlug) {
-  let content = strategy.serialise(doc2);
-  if (strategy.preserveLocalBodyOnPull) {
-    const target = entityFilePath(workspaceSlug, strategy.type, targetSlug);
-    let existing = null;
-    try {
-      existing = readFileSync18(target, "utf8");
-    } catch (err) {
-      if (err?.code !== "ENOENT")
-        throw err;
-    }
-    if (existing !== null) {
-      const existingParsed = import_gray_matter9.default(existing);
-      const cloudParsed = import_gray_matter9.default(content);
-      const stitched = import_gray_matter9.default.stringify(existingParsed.content, cloudParsed.data);
-      content = stitched.endsWith(`
-`) ? stitched : stitched + `
-`;
-    }
-  }
-  return content;
-}
-
 // src/lib/push.ts
 var DELETE_DECLINED_PATH_EXISTS = "the file is on disk again — a newer write owns this row";
+var FRONTMATTER_PARSE_ERROR = "frontmatter parse error";
 function deleteDeclinedSentence(relPath) {
   return `Not deleted: ${relPath} is on disk again, so the row was left alone. If you meant to delete it, remove the file and it will be retried.`;
 }
@@ -36049,8 +36569,8 @@ function stampStateFromMirror(args) {
   const { strategy, workspaceSlug, doc: doc2, state, priorMemoryHash } = args;
   const targetSlug = args.pathSlug ?? doc2.slug;
   const mirrorPath = entityFilePath(workspaceSlug, strategy.type, targetSlug);
-  const mirrorRaw = readFileSync19(mirrorPath, "utf8");
-  const mirrorParsed = import_gray_matter10.default(mirrorRaw);
+  const mirrorRaw = readFileSync21(mirrorPath, "utf8");
+  const mirrorParsed = matter(mirrorRaw);
   const mirrorFm = mirrorParsed.data ?? {};
   const mirrorLifted = splitUserFrontmatter(strategy, mirrorFm);
   const mirrorUserFm = userFrontmatter(strategy, mirrorLifted.frontmatter);
@@ -36202,7 +36722,7 @@ async function pushFile(args) {
   }
   let raw;
   try {
-    raw = readFileSync19(absolutePath, "utf8");
+    raw = readFileSync21(absolutePath, "utf8");
   } catch (err) {
     if (err?.code === "ENOENT") {
       return runPushDelete({
@@ -36222,23 +36742,32 @@ async function pushFile(args) {
     }
     throw err;
   }
-  let parsed;
-  try {
-    parsed = import_gray_matter10.default(raw);
-  } catch {
-    return {
-      outcome: { kind: "ignored", absolutePath, reason: "frontmatter parse error" },
-      state
-    };
-  }
-  const fm = parsed.data ?? {};
-  const slugFromFm = typeof fm.slug === "string" && fm.slug.length > 0 ? fm.slug : null;
   let parsedSlug = null;
   try {
     const rel = relative5(workspaceMirrorPath(workspaceSlug), absolutePath);
     parsedSlug = strategy.parseMirrorPath(rel)?.slug ?? null;
   } catch {}
   const slugFromPath = parsedSlug ?? basename5(absolutePath, ".md");
+  const read = readFrontmatter(raw);
+  if (!read.ok) {
+    return {
+      outcome: { kind: "ignored", absolutePath, reason: FRONTMATTER_PARSE_ERROR },
+      state: holdUnreadableFrontmatter({
+        state,
+        workspaceSlug,
+        absolutePath,
+        entityType,
+        slug: slugFromPath,
+        why: read.why,
+        now,
+        output
+      }),
+      base: state
+    };
+  }
+  let parsed = read.parsed;
+  const fm = parsed.data ?? {};
+  const slugFromFm = typeof fm.slug === "string" && fm.slug.length > 0 ? fm.slug : null;
   const slug = identity === "path" ? slugFromPath : slugFromFm ?? slugFromPath;
   if (!slug) {
     return {
@@ -36252,14 +36781,14 @@ async function pushFile(args) {
   if (strategy.classifyFieldErrors) {
     const desiredBody = spliceSyncErrorBlock(parsed.content, fieldErrors);
     if (desiredBody.replace(/\s+$/, "") !== parsed.content.replace(/\s+$/, "")) {
-      let rewritten = import_gray_matter10.default.stringify(desiredBody, parsed.data ?? {});
+      let rewritten = stringifyFrontmatter(desiredBody, parsed.data ?? {});
       if (!rewritten.endsWith(`
 `))
         rewritten += `
 `;
       writeMirrorFile(workspaceSlug, entityType, slug, rewritten);
       raw = rewritten;
-      parsed = import_gray_matter10.default(rewritten);
+      parsed = parseUncached(rewritten);
     }
   }
   const liveInode = safeInode2(absolutePath);
@@ -36537,7 +37066,7 @@ async function runPushUpsert(args) {
     }
     const wireProjection = (md) => {
       try {
-        const p = import_gray_matter10.default(md);
+        const p = matter(md);
         const f = p.data ?? {};
         const l = splitUserFrontmatter(strategy, f);
         const u = userFrontmatter(strategy, l.frontmatter);
@@ -36552,7 +37081,7 @@ async function runPushUpsert(args) {
     if (liveEntry !== snapshotEntry) {
       let onDisk = null;
       try {
-        onDisk = readFileSync19(args.absolutePath, "utf8");
+        onDisk = readFileSync21(args.absolutePath, "utf8");
       } catch {
         onDisk = null;
       }
@@ -37014,7 +37543,7 @@ function writeCreatedIdBack(args) {
     if (entityFilePath(args.workspaceSlug, args.strategy.type, args.slug) !== args.absolutePath) {
       return;
     }
-    const readBack = args.readBack ?? ((p) => readFileSync19(p, "utf8"));
+    const readBack = args.readBack ?? ((p) => readFileSync21(p, "utf8"));
     if (readBack(args.absolutePath) !== args.raw)
       return;
     args.suppressor?.registerWrite(args.absolutePath, computeMirrorHashes(args.strategy, write.content));
@@ -37486,8 +38015,8 @@ async function pushRename(args) {
       };
       if (!updated.body_hash || !updated.frontmatter_hash) {
         try {
-          const mirrorRaw = readFileSync19(toPath, "utf8");
-          const mirrorParsed = import_gray_matter10.default(mirrorRaw);
+          const mirrorRaw = readFileSync21(toPath, "utf8");
+          const mirrorParsed = matter(mirrorRaw);
           const renameFm = mirrorParsed.data ?? {};
           const renameLifted = splitUserFrontmatter(strategy, renameFm);
           const renameUserFm = userFrontmatter(strategy, renameLifted.frontmatter);
@@ -37523,7 +38052,7 @@ async function pushRename(args) {
     if (patchResult.reason === "slug_conflict") {
       let contents2 = "";
       try {
-        contents2 = readFileSync19(toPath, "utf8");
+        contents2 = readFileSync21(toPath, "utf8");
       } catch {}
       const stashPath2 = stashConflict({
         workspaceSlug,
@@ -37571,7 +38100,7 @@ async function pushRename(args) {
     }
     let contents = "";
     try {
-      contents = readFileSync19(toPath, "utf8");
+      contents = readFileSync21(toPath, "utf8");
     } catch {}
     const stashPath = stashConflict({
       workspaceSlug,
@@ -37619,7 +38148,7 @@ async function drainResolvedBatches(deps) {
       deps.output?.log(`[DESTRUCTIVE_APPLIED batch=${batch.batch_id} ops=${batch.ops.length}]`);
       applied++;
     } else {
-      await discardBatchOps(batch, deps);
+      await discardBatchOps(batch, deps, mutex2);
       deps.output?.log(`[DESTRUCTIVE_DISCARDED batch=${batch.batch_id} ops=${batch.ops.length}]`);
       discarded++;
     }
@@ -37692,11 +38221,11 @@ async function applyFileOp(op, deps) {
   });
   deps.applyState(base2, result.state);
 }
-async function discardBatchOps(batch, deps) {
+async function discardBatchOps(batch, deps, mutex2) {
   for (const op of batch.ops) {
     try {
       if (op.target === "file") {
-        await discardFileOp(op, deps);
+        await discardFileOp(op, deps, mutex2);
         continue;
       }
       const strategy = requireStrategy(op.entityType);
@@ -37704,7 +38233,7 @@ async function discardBatchOps(batch, deps) {
         const path5 = opPath(deps.workspaceSlug, op);
         let local = null;
         try {
-          local = readFileSync20(path5, "utf8");
+          local = readFileSync22(path5, "utf8");
         } catch {
           local = null;
         }
@@ -37739,35 +38268,50 @@ async function discardBatchOps(batch, deps) {
     }
   }
 }
-async function discardFileOp(op, deps) {
-  const abs = filesSubtreePath(deps.workspaceSlug, op.path);
-  let local = null;
-  try {
-    local = readFileSync20(abs);
-  } catch {
-    local = null;
-  }
-  if (local !== null) {
-    stashFileConflict({
+async function discardFileOp(op, deps, mutex2) {
+  await mutex2.run(`files:${op.path}`, async () => {
+    const abs = filesSubtreePath(deps.workspaceSlug, op.path);
+    const skip = (reason, why) => {
+      deps.output?.log(fileRestoreSkippedLine({ path: op.path, rowId: op.id, reason }));
+      deps.output?.warn(`Discard of files/${op.path} left the file as it is: ${why}.`);
+    };
+    const committed = readCommittedFileEntry(deps.workspaceSlug, op.path);
+    if (committed && committed.id !== op.id) {
+      skip("replaced", "another file now has that path");
+      return;
+    }
+    const read = readLocalForKeep(deps.workspaceSlug, abs);
+    if (read.kind === "failed") {
+      skip(read.failure.reason, "the file there could not be read safely");
+      return;
+    }
+    const local = read.kind === "read" ? read.bytes : null;
+    if (local !== null) {
+      stashFileConflict({
+        workspaceSlug: deps.workspaceSlug,
+        relPath: op.path,
+        timestamp: (deps.now ?? (() => new Date))(),
+        bytes: local,
+        side: "local"
+      });
+    }
+    const base2 = deps.getState();
+    const restore = await restoreFileFromCloud({
       workspaceSlug: deps.workspaceSlug,
+      baseUrl: deps.baseUrl,
+      pat: deps.pat,
+      id: op.id,
       relPath: op.path,
-      timestamp: (deps.now ?? (() => new Date))(),
-      bytes: local,
-      side: "local"
+      state: base2,
+      fetchImpl: deps.fetchImpl,
+      output: deps.output,
+      kept: local
     });
-  }
-  const base2 = deps.getState();
-  const next = await restoreFileFromCloud({
-    workspaceSlug: deps.workspaceSlug,
-    baseUrl: deps.baseUrl,
-    pat: deps.pat,
-    id: op.id,
-    relPath: op.path,
-    state: base2,
-    fetchImpl: deps.fetchImpl,
-    output: deps.output
+    if (restore.outcome === "skipped") {
+      deps.output?.warn(`Discard of files/${op.path} left the file as it is (${restore.reason}); daemon.log has the line.`);
+    }
+    deps.applyState(base2, restore.state);
   });
-  deps.applyState(base2, next);
 }
 function opPath(workspaceSlug, op) {
   try {
@@ -37780,7 +38324,7 @@ function opPath(workspaceSlug, op) {
 }
 
 // src/lib/files/classify.ts
-import { relative as relative6, sep as sep5 } from "node:path";
+import { relative as relative6, sep as sep6 } from "node:path";
 var FILES_SUBTREE = "files";
 function classifyFilesPath(args) {
   let root;
@@ -37790,20 +38334,20 @@ function classifyFilesPath(args) {
     return null;
   }
   const rel = relative6(root, args.absolutePath);
-  if (rel.startsWith("..") || rel.startsWith(sep5))
+  if (rel.startsWith("..") || rel.startsWith(sep6))
     return null;
-  const prefix = FILES_SUBTREE + sep5;
+  const prefix = FILES_SUBTREE + sep6;
   if (!rel.startsWith(prefix))
     return null;
   const sub = rel.slice(prefix.length);
   if (sub.length === 0)
     return null;
-  const posix = sep5 === "/" ? sub : sub.split(sep5).join("/");
+  const posix = sep6 === "/" ? sub : sub.split(sep6).join("/");
   return validateFilesRelPath(posix) ? { relPath: posix } : null;
 }
 
 // src/lib/memory-facts/sync.ts
-import { isAbsolute as isAbsolute2, relative as relative7, sep as sep6 } from "node:path";
+import { isAbsolute as isAbsolute2, relative as relative7, sep as sep7 } from "node:path";
 
 // src/lib/memory-facts/api.ts
 var FactCommonSchema = exports_external.object({
@@ -38547,7 +39091,7 @@ function classifyMemoryFactPath(args) {
   const rel = relative7(root, args.absolutePath);
   if (rel === "" || rel.startsWith("..") || isAbsolute2(rel))
     return null;
-  const mirrorRel = `${MEMORY_FACTS_DIR}/${rel.split(sep6).join("/")}`;
+  const mirrorRel = `${MEMORY_FACTS_DIR}/${rel.split(sep7).join("/")}`;
   return { relPath: mirrorRel, fact: parseMemoryFactRelPath(mirrorRel) };
 }
 function classifyMemoryFactEvent(args) {
@@ -38644,7 +39188,7 @@ function evaluateFileBatch(ops, population, thresholds = defaultThresholds()) {
       }
     };
   }
-  return { tripped: false };
+  return evaluateLoneOverwrite(count, ops.map((op) => op.kind === "overwrite" ? op.priorSize - op.newSize : 0), thresholds.loneMinRemovedBytes);
 }
 function dedupeFileOps(ops) {
   const byKey = new Map;
@@ -38715,10 +39259,10 @@ class FileDestructiveGate {
 }
 
 // src/lib/files/reconcile.ts
-import { readFileSync as readFileSync21, statSync as statSync10 } from "node:fs";
+import { readFileSync as readFileSync23, statSync as statSync10 } from "node:fs";
 
 // src/lib/unsynced.ts
-import { join as join14, relative as relative8 } from "node:path";
+import { join as join15, relative as relative8 } from "node:path";
 var RECORDABLE_REASONS = new Set([
   "rate_limit",
   "server",
@@ -38780,7 +39324,7 @@ async function drainUnsyncedOps(args) {
     attempted += 1;
     try {
       if (op.target === "entity") {
-        const absolutePath = join14(workspaceMirrorPath(workspaceSlug), op.path);
+        const absolutePath = join15(workspaceMirrorPath(workspaceSlug), op.path);
         const classified = classifyMirrorPath({ workspaceSlug, absolutePath });
         if (!classified) {
           clear("entity", op.path);
@@ -39593,9 +40137,9 @@ class NodeFsHandler {
     if (this.fsw.closed) {
       return;
     }
-    const dirname12 = sp.dirname(file2);
+    const dirname13 = sp.dirname(file2);
     const basename7 = sp.basename(file2);
-    const parent = this.fsw._getWatchedDir(dirname12);
+    const parent = this.fsw._getWatchedDir(dirname13);
     let prevStats = stats;
     if (parent.has(basename7))
       return;
@@ -39622,7 +40166,7 @@ class NodeFsHandler {
             prevStats = newStats2;
           }
         } catch (error52) {
-          this.fsw._remove(dirname12, basename7);
+          this.fsw._remove(dirname13, basename7);
         }
       } else if (parent.has(basename7)) {
         const at = newStats.atimeMs;
@@ -39711,7 +40255,7 @@ class NodeFsHandler {
         this._addToNodeFs(path5, initialAdd, wh, depth + 1);
       }
     }).on(EV.ERROR, this._boundHandleError);
-    return new Promise((resolve5, reject) => {
+    return new Promise((resolve6, reject) => {
       if (!stream)
         return reject();
       stream.once(STR_END, () => {
@@ -39720,7 +40264,7 @@ class NodeFsHandler {
           return;
         }
         const wasThrottled = throttler ? throttler.clear() : false;
-        resolve5(undefined);
+        resolve6(undefined);
         previous.getChildren().filter((item) => {
           return item !== directory && !current.has(item);
         }).forEach((item) => {
@@ -40479,7 +41023,7 @@ var chokidar_default = { watch, FSWatcher };
 
 // src/lib/watcher.ts
 import { statSync as statSync9 } from "node:fs";
-import { sep as sep7 } from "node:path";
+import { sep as sep8 } from "node:path";
 
 // src/lib/rename-classifier.ts
 class RenameClassifier {
@@ -40610,7 +41154,7 @@ function watcherIgnoreMatcher(workspaceRoot) {
   return (absolutePath) => patterns.some((re) => re.test(absolutePath));
 }
 function escSep() {
-  return sep7 === "/" ? "/" : "\\\\";
+  return sep8 === "/" ? "/" : "\\\\";
 }
 
 class DebounceMap {
@@ -40660,6 +41204,12 @@ class DebounceMap {
     this.pending.delete(oldestKey);
     this.handler(entry2.event);
   }
+  nudge(absolutePath) {
+    if (this.pending.has(absolutePath))
+      return false;
+    this.schedule({ kind: "upsert", absolutePath });
+    return true;
+  }
   async drain() {
     const entries = Array.from(this.pending.entries());
     this.pending.clear();
@@ -40724,6 +41274,9 @@ function startWatcher(opts, handler) {
     drainPending() {
       return debounce.drain();
     },
+    nudge(absolutePath) {
+      return debounce.nudge(absolutePath);
+    },
     pendingCount() {
       return debounce.size();
     }
@@ -40754,7 +41307,7 @@ function readBlobForPush(args) {
   }
   let bytes;
   try {
-    bytes = readFileSync21(absolutePath);
+    bytes = readFileSync23(absolutePath);
   } catch (err) {
     if (err?.code === "ENOENT")
       return { kind: "gone" };
@@ -40897,7 +41450,7 @@ async function reconcileFilesSubtree(args) {
         ops: pendingOps
       });
       quarantined = ops.length;
-      output?.log(`[DESTRUCTIVE_HELD batch=${batchId} ops=${ops.length} reason=${result.reason.kind} source=files-reconcile]`);
+      output?.log(`[DESTRUCTIVE_HELD batch=${batchId} ops=${ops.length} reason=${tripReasonToken(result.reason)} source=files-reconcile]`);
     } else {
       for (const c of guttingCandidates) {
         await pushDivergedBlob(c.op.relPath, c.op.absolutePath, c.prepared);
@@ -41064,7 +41617,7 @@ function applyArtistMemoryOnPull(args) {
   const cloudMemory = live.memory;
   const generated = live.memory_generated === true;
   const local = readArtistMemoryFile(workspaceSlug, slug);
-  const refuse = (localContent, canonical2) => {
+  const refuse2 = (localContent, canonical2) => {
     const refused = refuseGeneratedMemoryEdit({
       state,
       workspaceSlug,
@@ -41093,7 +41646,7 @@ function applyArtistMemoryOnPull(args) {
   const cloudHash = stableHash(cloudMemory);
   if (cloudHash === ackedMemoryHash && local !== null) {
     if (generated && stableHash(local) !== ackedMemoryHash) {
-      refuse(local, cloudMemory);
+      refuse2(local, cloudMemory);
       return { memoryHash: cloudHash, state };
     }
     if (generated) {
@@ -41105,7 +41658,7 @@ function applyArtistMemoryOnPull(args) {
     const localHash = stableHash(local);
     if (localHash !== ackedMemoryHash && localHash !== cloudHash) {
       if (generated) {
-        refuse(local, cloudMemory);
+        refuse2(local, cloudMemory);
         return { memoryHash: cloudHash, state };
       }
       const stashPath = stashConflict({
@@ -41815,10 +42368,10 @@ function anyUnknown(state) {
 }
 
 // src/lib/memory/write.ts
-import { readFileSync as readFileSync22, statSync as statSync11 } from "node:fs";
+import { readFileSync as readFileSync24, statSync as statSync11 } from "node:fs";
 
 // src/lib/files/extracted-text.ts
-import { createHash as createHash5 } from "node:crypto";
+import { createHash as createHash6 } from "node:crypto";
 var DERIVED_TEXT_VERSION = 2;
 function yamlString3(value) {
   return JSON.stringify(value);
@@ -41892,11 +42445,10 @@ ${doc2.text}
 `;
 }
 function extractedTextHash(rendered) {
-  return createHash5("sha256").update(rendered, "utf8").digest("hex");
+  return createHash6("sha256").update(rendered, "utf8").digest("hex");
 }
 
 // src/lib/memory/splice.ts
-var import_gray_matter11 = __toESM(require_gray_matter(), 1);
 var OPEN_RE = /^---\r?\n/;
 function findFrontmatter(content) {
   const open2 = OPEN_RE.exec(content);
@@ -41982,7 +42534,7 @@ function spliceAnnotation(content, lines) {
 }
 function parsesAsFrontmatter(content) {
   try {
-    import_gray_matter11.default(content, { cache: false });
+    matter(content, { cache: false });
     return true;
   } catch {
     return false;
@@ -42010,7 +42562,7 @@ function writeDocumentAnnotation(args) {
   }
   let current;
   try {
-    current = readFileSync22(target, "utf8");
+    current = readFileSync24(target, "utf8");
   } catch {
     return { kind: "absent" };
   }
@@ -42048,18 +42600,32 @@ function writeFileTextAnnotation(args) {
   const current = readExtractedText(args.workspaceSlug, args.relPath);
   if (current === null)
     return { kind: "absent" };
-  if (args.textHash !== undefined && extractedTextHash(current) !== args.textHash) {
+  const onDisk = extractedTextHash(current);
+  const acked = args.textHash;
+  const offAck = acked !== undefined && onDisk !== acked;
+  if (acked !== undefined && offAck && !isOwnRender(current, acked, args.priorLines)) {
     return { kind: "diverged", relPath: extractedTextRelPath(args.relPath) };
   }
   const spliced = spliceAnnotation(current, args.lines);
-  if (!spliced.changed)
-    return { kind: "unchanged" };
+  if (!spliced.changed) {
+    return offAck ? { kind: "unchanged", textHash: onDisk } : { kind: "unchanged" };
+  }
   writeExtractedText(args.workspaceSlug, args.relPath, spliced.content);
   return { kind: "written", textHash: extractedTextHash(spliced.content) };
 }
+function isOwnRender(current, ackedHash, priorLines) {
+  if (extractedTextHash(spliceAnnotation(current, []).content) === ackedHash)
+    return true;
+  if (priorLines === undefined)
+    return false;
+  return extractedTextHash(spliceAnnotation(current, priorLines).content) === ackedHash;
+}
 function divergedNotice(relPath, state) {
   return `${relPath}: its memory context is now "${state}", but the file has local ` + `edits so the marker was not written into it. Your edits are untouched. ` + `Resolve the edit and the next sync writes the marker.`;
 }
+function generatedDivergedNotice(relPath) {
+  return `${relPath}: this generated file does not match Plinth's record of it, ` + `so its memory marker was not written. Plinth rewrites the file when its ` + `source next changes; changes made to it here are not synced.`;
+}
 function unreadableNotice(relPath, why) {
   const reason = why.replace(/\s+/g, " ").trim().slice(0, 120);
   return `${relPath}: its memory context could not be written because the file's ` + `frontmatter could not be read (${reason}). The file is untouched. Fix the ` + `frontmatter and the next sync writes the marker.`;
@@ -42089,6 +42655,10 @@ function heldFileTexts(state) {
     textHash: f.text_hash
   }));
 }
+function priorFileLines(state, id) {
+  return getMemorySourceEntries(state, "workspace_files")[id]?.rendered.split(`
+`);
+}
 async function writeChanged(args) {
   const docs = new Map(heldDocuments(args.state).map((d) => [d.id, d.slug]));
   const texts = new Map(heldFileTexts(args.state).map((f) => [f.id, f]));
@@ -42188,7 +42758,8 @@ async function writeChanged(args) {
           workspaceSlug: args.workspaceSlug,
           relPath: file2.relPath,
           textHash: args.freshTextHashes?.get(answer2.id) ?? file2.textHash,
-          lines: answer2.lines
+          lines: answer2.lines,
+          priorLines: priorFileLines(args.state, answer2.id)
         });
         if (res.kind !== "diverged" && res.kind !== "absent") {
           args.onWritten?.("workspace_files", answer2.id, res.textHash);
@@ -42215,7 +42786,7 @@ async function writeChanged(args) {
     }
     const textPath = extractedTextRelPath(file2.relPath);
     if (outcome.kind === "diverged") {
-      report.push({ path: textPath, record: divergedNotice(textPath, answer2.entry.state) });
+      report.push({ path: textPath, record: generatedDivergedNotice(textPath) });
     } else {
       clear.push(textPath);
     }
@@ -42224,9 +42795,11 @@ async function writeChanged(args) {
       if (outcome.textHash !== undefined) {
         textHashes.set(file2.relPath, { to: outcome.textHash });
       }
+    } else if (outcome.kind === "unchanged" && outcome.textHash !== undefined) {
+      textHashes.set(file2.relPath, { to: outcome.textHash });
     } else if (outcome.kind === "diverged") {
       diverged++;
-      notices.push(divergedNotice(outcome.relPath, answer2.entry.state));
+      notices.push(generatedDivergedNotice(outcome.relPath));
     }
   }
   if (args.abortIfStale?.() === true) {
@@ -43948,8 +44521,7 @@ class PullSuppressor {
 }
 
 // src/lib/discover-entities.ts
-var import_gray_matter12 = __toESM(require_gray_matter(), 1);
-import { readFileSync as readFileSync23, statSync as statSync12 } from "node:fs";
+import { readFileSync as readFileSync25, statSync as statSync12 } from "node:fs";
 var DISCOVERY_WRITE_CAP_DEFAULT = 10;
 function discoveryWriteCap() {
   const raw = process.env.PLINTH_DISCOVERY_WRITE_CAP;
@@ -43976,6 +44548,11 @@ function classifyUntrackedEntity(args) {
   }
   return { kind: "create" };
 }
+function holdsUnreadableUntracked(args) {
+  if (args.readable)
+    return false;
+  return classifyUntrackedEntity({ ...args, frontmatter: {} }).kind === "create";
+}
 function classifyRenameDestination(args) {
   const occupant = getEntryBySlug(args.state, args.entityType, args.entitySlug);
   if (occupant && occupant.id !== args.movedEntryId) {
@@ -44046,13 +44623,20 @@ function planDiscoveryWrites(args) {
     if (getEntryBySlug(state, entityType, entitySlug))
       continue;
     counts.discovered++;
-    let frontmatter;
+    let raw;
     try {
-      frontmatter = import_gray_matter12.default(readFileSync23(absolutePath, "utf8")).data ?? {};
+      raw = readFileSync25(absolutePath, "utf8");
     } catch {
       counts.discovered--;
       continue;
     }
+    const read = readFrontmatter(raw);
+    if (!read.ok && holdsUnreadableUntracked({ entityType, entitySlug, readable: false })) {
+      counts.discovered--;
+      planned.push({ kind: "unreadable", entityType, entitySlug, absolutePath, why: read.why });
+      continue;
+    }
+    const frontmatter = read.ok ? read.parsed.data : {};
     const verdict = classifyUntrackedEntity({ entityType, entitySlug, frontmatter });
     if (verdict.kind === "hold") {
       if (verdict.held === "artist")
@@ -44093,7 +44677,7 @@ async function discoverUntrackedEntities(args) {
   }
   const cap = discoveryWriteCap();
   const creates = planned.filter((w) => w.kind === "create");
-  const toRun = creates.length > cap ? planned.filter((w) => w.kind === "rename") : planned;
+  const toRun = creates.length > cap ? planned.filter((w) => w.kind !== "create") : planned;
   if (creates.length > cap) {
     counts.heldCap = creates.length;
     output?.log(`[DISCOVERY_HELD reason=cap creates=${creates.length} cap=${cap} source=entity-discovery]`);
@@ -44116,6 +44700,19 @@ async function runPlannedWrites(args) {
   let state = args.state;
   for (const write of planned) {
     try {
+      if (write.kind === "unreadable") {
+        state = holdUnreadableFrontmatter({
+          state,
+          workspaceSlug,
+          absolutePath: write.absolutePath,
+          entityType: write.entityType,
+          slug: write.entitySlug,
+          why: write.why,
+          now,
+          output
+        });
+        continue;
+      }
       if (write.kind === "rename") {
         state = await runDiscoveredRename({
           write,
@@ -44276,8 +44873,7 @@ function recordDiscoveryFailure(args) {
 }
 
 // src/lib/frontmatter-id-backfill.ts
-var import_gray_matter13 = __toESM(require_gray_matter(), 1);
-import { readFileSync as readFileSync24, statSync as statSync13 } from "node:fs";
+import { readFileSync as readFileSync26, statSync as statSync13 } from "node:fs";
 var FRONTMATTER_ID_BACKFILL_VERSION = 1;
 function backfillWorthReporting(r) {
   return r.written > 0 || r.failed > 0 || r.skipped.foreignId > 0 || r.skipped.unwritable > 0 || r.skipped.slugCollision > 0;
@@ -44320,7 +44916,7 @@ function safeInode3(path5) {
 function backfillFrontmatterIds(args) {
   const { workspaceSlug, state } = args;
   const compose = args.compose ?? withFrontmatterId;
-  const readRaw = args.readFile ?? ((p) => readFileSync24(p, "utf8"));
+  const readRaw = args.readFile ?? ((p) => readFileSync26(p, "utf8"));
   const result = emptyResult();
   if (state.frontmatter_id_backfill_version === FRONTMATTER_ID_BACKFILL_VERSION) {
     return result;
@@ -44369,7 +44965,7 @@ function backfillFrontmatterIds(args) {
       let rawBody;
       let parsedData;
       try {
-        const parsed = import_gray_matter13.default(raw);
+        const parsed = parseUncached(raw);
         parsedData = parsed.data ?? {};
         existing = parsedData["id"];
         rawBody = parsed.content;
@@ -44448,11 +45044,11 @@ function backfillFrontmatterIds(args) {
 }
 
 // src/lib/reconcile.ts
-import { readFileSync as readFileSync25, statSync as statSync14 } from "node:fs";
+import { readFileSync as readFileSync27, statSync as statSync14 } from "node:fs";
 async function reconcileDivergedRows(args) {
   const { workspaceSlug, baseUrl, pat, fetchImpl, output, isFrozen } = args;
   const now = args.now ?? (() => new Date);
-  let state = args.state;
+  let state = settleFrontmatterHolds(args.state, workspaceSlug);
   let scanned = 0;
   let diverged = 0;
   let pushed = 0;
@@ -44560,7 +45156,7 @@ async function reconcileDivergedRows(args) {
       }
       let content;
       try {
-        content = readFileSync25(absolutePath, "utf8");
+        content = readFileSync27(absolutePath, "utf8");
       } catch (err) {
         if (err?.code === "ENOENT") {
           state = clearEntityCloudRowDeleted(state, strategy.mirrorRelativePath(entry2.slug));
@@ -44568,6 +45164,20 @@ async function reconcileDivergedRows(args) {
         }
         throw err;
       }
+      const unreadable = frontmatterParseError(content);
+      if (unreadable !== null) {
+        state = holdUnreadableFrontmatter({
+          state,
+          workspaceSlug,
+          absolutePath,
+          entityType,
+          slug: entry2.slug,
+          why: unreadable,
+          now,
+          output
+        });
+        continue;
+      }
       const hashes = computeMirrorHashes(strategy, content);
       if (hashes.frontmatterId === undefined)
         sawTrackedFileWithoutId = true;
@@ -44618,7 +45228,7 @@ async function reconcileDivergedRows(args) {
         ops: pendingOps
       });
       quarantined = ops.length;
-      output?.log(`[DESTRUCTIVE_HELD batch=${batchId} ops=${ops.length} reason=${result.reason.kind} source=reconcile]`);
+      output?.log(`[DESTRUCTIVE_HELD batch=${batchId} ops=${ops.length} reason=${tripReasonToken(result.reason)} source=reconcile]`);
     } else {
       for (const c of guttingCandidates) {
         const op = c.op;
@@ -45849,7 +46459,7 @@ class Semaphore {
       this.active += 1;
       return;
     }
-    await new Promise((resolve6) => this.waiters.push(resolve6));
+    await new Promise((resolve7) => this.waiters.push(resolve7));
   }
   release() {
     const next = this.waiters.shift();
@@ -45911,17 +46521,17 @@ function createThrottledFetch(baseFetch, opts = {}) {
 // src/commands/sync.ts
 import {
   existsSync as existsSync9,
-  lstatSync as lstatSync6,
+  lstatSync as lstatSync8,
   readdirSync as readdirSync7,
-  readFileSync as readFileSync29,
+  readFileSync as readFileSync32,
   statSync as statSync17,
-  unlinkSync as unlinkSync9
+  unlinkSync as unlinkSync11
 } from "node:fs";
-import { join as join18 } from "node:path";
+import { join as join19 } from "node:path";
 
 // src/lib/conflicts-view.ts
 import { existsSync as existsSync7 } from "node:fs";
-import { join as join17 } from "node:path";
+import { join as join18 } from "node:path";
 var NO_GENERATED_MEMORY = {
   artistMemoryGenerated: () => false,
   workspaceMemoryGenerated: () => false,
@@ -45963,11 +46573,13 @@ function resolveConflictRows(workspaceSlug, stashes, generatedMemory = NO_GENERA
     if (root === null || !stash.label.startsWith("files/")) {
       return { kind: "entity", stash };
     }
+    if (stash.pathUnrecorded)
+      return { kind: "unsafe-path", stash };
     const rel = stash.label.slice("files/".length);
     if (validateFilesRelPath(rel) === null) {
       return { kind: "unsafe-path", stash };
     }
-    const abs = join17(root, "files", rel);
+    const abs = join18(root, "files", rel);
     if (hasSymlinkedComponent(workspaceSlug, abs)) {
       return { kind: "unsafe-path", stash };
     }
@@ -46034,7 +46646,9 @@ function renderRow(row) {
 `);
   }
   out.push("To put your version back, run this and then delete the stash:", "", "```sh", `cp ${shellQuote2(stash.absPath)} ${shellQuote2(row.mirrorPath)}`, "```");
-  if (!row.mirrorPathExists) {
+  if (!row.mirrorPathExists && stash.pathRecorded) {
+    out.push("", "**Nothing is at that path right now**, so the cloud copy was probably", "deleted. Open the stash and check before running it.");
+  } else if (!row.mirrorPathExists) {
     out.push("", "**Nothing is at that path right now.** It is derived from the stash", "filename, which cannot represent a `/` and a `__` differently, so either", "the cloud copy was deleted, or the original path contained `__` and the", "line above names the wrong file. Open the stash and check before running it.");
   }
   return out.join(`
@@ -46097,17 +46711,16 @@ function refreshConflictsView(workspaceSlug) {
 }
 
 // src/lib/files/pull.ts
-import { existsSync as existsSync8, lstatSync as lstatSync5, readFileSync as readFileSync27, statSync as statSync15 } from "node:fs";
-import { dirname as dirname13 } from "node:path";
+import { existsSync as existsSync8, readFileSync as readFileSync29, statSync as statSync15 } from "node:fs";
 
 // src/lib/permanent-disposition.ts
-import { createHash as createHash6 } from "node:crypto";
-import { readFileSync as readFileSync26 } from "node:fs";
+import { createHash as createHash7 } from "node:crypto";
+import { readFileSync as readFileSync28 } from "node:fs";
 function sha256(value) {
-  return createHash6("sha256").update(value).digest("hex");
+  return createHash7("sha256").update(value).digest("hex");
 }
 function verifyStash(path5, expectedHash) {
-  const actual = sha256(readFileSync26(path5));
+  const actual = sha256(readFileSync28(path5));
   if (actual !== expectedHash) {
     throw new Error(`permanent deletion stash verification failed for ${path5}`);
   }
@@ -46151,7 +46764,7 @@ function disposePermanentDocumentLocked(args) {
     const target = entityFilePath(args.workspaceSlug, args.strategy.type, retiredEntry?.slug ?? t.logicalKey);
     let raw;
     try {
-      raw = readFileSync26(target, "utf8");
+      raw = readFileSync28(target, "utf8");
     } catch (error52) {
       if (error52?.code !== "ENOENT")
         throw error52;
@@ -46249,7 +46862,7 @@ function disposePermanentFileLocked(args) {
     const target = filesSubtreePath(args.workspaceSlug, t.logicalKey);
     let bytes;
     try {
-      bytes = readFileSync26(target);
+      bytes = readFileSync28(target);
     } catch (error52) {
       if (error52?.code !== "ENOENT")
         throw error52;
@@ -46296,6 +46909,34 @@ function disposePermanentFileLocked(args) {
   return { state, deleted, textDeleted, ...stashPath ? { stashPath } : {} };
 }
 
+// src/lib/files/pull-ack.ts
+function currentFileAck(args) {
+  const read = readCommittedFileAck(args.workspaceSlug, args.relPath);
+  if (read.kind === "unknown")
+    return args.snapshot;
+  if (read.kind === "absent") {
+    const retired = args.committedBase !== undefined && sameFileVersion(args.snapshot, args.committedBase);
+    return retired ? undefined : args.snapshot;
+  }
+  const committed = read.entry;
+  const known = args.snapshot ?? args.committedBase;
+  if (!known)
+    return committed;
+  if (committed.id !== known.id) {
+    if (isLaterVersion(known, committed))
+      return args.snapshot;
+    if (isLaterVersion(committed, known))
+      return committed;
+    return args.snapshot !== undefined && !sameFileVersion(args.snapshot, args.committedBase) ? args.snapshot : committed;
+  }
+  return isLaterVersion(committed, known) ? committed : args.snapshot;
+}
+function sameFileVersion(a, b) {
+  if (!a || !b)
+    return a === b;
+  return a.id === b.id && a.updated_at === b.updated_at && a.content_hash === b.content_hash;
+}
+
 // src/lib/files/pull.ts
 function dueFileRefreshMarkers(workspaceSlug, now) {
   try {
@@ -46422,7 +47063,9 @@ async function replayPermanentFiles(args, markers) {
       loggedTombstoneSkips: args.loggedTombstoneSkips,
       forceTextRewalk: args.forceTextRewalk,
       loggedStashNotices: args.loggedStashNotices,
-      recentUnlinks: args.recentUnlinks
+      recentUnlinks: args.recentUnlinks,
+      committedBase: lastCommittedState,
+      commit: args.commit
     });
     state = outcome.state;
     if (outcome.action === "written")
@@ -46495,6 +47138,7 @@ async function pullFiles(args) {
   let finalHighWater = null;
   let markRefused = false;
   let cursorBlocked = permanentJournalBlocked;
+  const deliveredPaths = new Set;
   while (true) {
     let page;
     try {
@@ -46512,6 +47156,7 @@ async function pullFiles(args) {
     let pageTextFailed = false;
     for (const row of page.rows) {
       fetched++;
+      deliveredPaths.add(row.path);
       if (row.deleted_at !== null && row.permanent_delete === true && row.purge_generation !== undefined) {
         if (permanentJournalBlocked) {
           pageTextFailed = true;
@@ -46542,7 +47187,9 @@ async function pullFiles(args) {
         loggedTombstoneSkips: args.loggedTombstoneSkips,
         forceTextRewalk: args.forceTextRewalk,
         loggedStashNotices: args.loggedStashNotices,
-        recentUnlinks: args.recentUnlinks
+        recentUnlinks: args.recentUnlinks,
+        committedBase: pageBase,
+        commit: args.commit
       });
       state = outcome.state;
       if (!outcome.symlinkRefused) {
@@ -46596,6 +47243,14 @@ async function pullFiles(args) {
       return replayPermanentFiles({ ...args, state }, markers);
     }
   }
+  const pruned = pruneFilePullHolds({
+    state,
+    workspaceSlug,
+    deliveredPaths,
+    cursorPass: markRefused || args.cursor === baseCursor
+  });
+  if (pruned !== state)
+    state = args.commit ? args.commit(state, pruned) : pruned;
   if (textUnknown > 0) {
     args.output?.warn(`${textUnknown} file ${textUnknown === 1 ? "row" : "rows"} arrived without a readable \`has_extracted_text\` — this server predates the extracted-text contract, or the field was dropped from the payload. Derived text under views/extracted/ was left untouched rather than deleted, and is not being updated either.`);
   }
@@ -46668,6 +47323,9 @@ async function materialiseExtractedText(args) {
     });
   } else {
     const got = await getFileText({ baseUrl, pat, id: row.id, fetchImpl });
+    if (args.stillCurrent && !args.stillCurrent()) {
+      return { textHash: undefined, written: 0, deleted: 0, stale: true };
+    }
     if (!got.ok)
       return { textHash: undefined, written: 0, deleted: 0 };
     if (got.row.text === null) {
@@ -46729,7 +47387,10 @@ async function applyFileRow(args) {
       symlinkRefused: true
     };
   }
-  const existing = getFileEntry(state, relPath);
+  const snapshotEntry = getFileEntry(state, relPath);
+  const baseEntry = getFileEntry(args.committedBase, relPath);
+  const ackNow = () => currentFileAck({ workspaceSlug, relPath, snapshot: snapshotEntry, committedBase: baseEntry });
+  const existing = ackNow();
   if (row.deleted_at !== null) {
     if (existing && existing.id !== row.id) {
       const key = `${row.id}:${existing.id}:${relPath}`;
@@ -46737,40 +47398,63 @@ async function applyFileRow(args) {
         args.loggedTombstoneSkips?.add(key);
         output?.log(`[FILE_TOMBSTONE_SKIP path=${relPath} row_id=${row.id} tracked_id=${existing.id} reason=id_mismatch]`);
       }
-      return { state, action: "skipped" };
+      return { state: clearHoldsOfRow(state, relPath, row.id), action: "skipped" };
     }
     let localBytes;
     try {
-      localBytes = readFileSync27(abs);
+      localBytes = readFileSync29(abs);
     } catch {
       localBytes = undefined;
     }
     const isOurs = localBytes === undefined || existing !== undefined && sha256Bytes(localBytes) === existing.content_hash;
     if (!isOurs) {
       output?.log(`[FILE_TOMBSTONE_KEEP path=${relPath} row_id=${row.id} reason=${existing === undefined ? "untracked" : "diverged"}]`);
-      const next2 = existing ? removeFileEntry(state, relPath).state : state;
-      return { state: next2, action: "skipped" };
+      if (!existing)
+        return { state: clearHoldsOfRow(state, relPath, row.id), action: "skipped" };
+      const kept = upsertFilePullHold(clearRowHolds(dropAck(state, relPath, existing, snapshotEntry, args.commit), relPath), {
+        target: "file",
+        path: relPath,
+        kind: "kept_after_delete",
+        row_id: row.id,
+        row_updated_at: row.deleted_at,
+        row_hash: existing.content_hash,
+        local: localFingerprint(abs) ?? null,
+        attempts: 1
+      });
+      return { state: kept, action: "skipped" };
     }
     suppressor?.registerDelete(abs);
     const didUnlink = deleteFilesFile(workspaceSlug, relPath);
     const removedText = safeDeleteExtractedText(workspaceSlug, relPath, output);
     const textDeleted = removedText.removed ? 1 : 0;
     if (existing) {
-      const { state: next2 } = removeFileEntry(state, relPath);
       return {
-        state: next2,
+        state: clearRowHolds(dropAck(state, relPath, existing, snapshotEntry, args.commit), relPath),
         action: "deleted",
         textDeleted,
         textFailed: removedText.failed
       };
     }
     return {
-      state,
+      state: clearRowHolds(state, relPath),
       action: didUnlink ? "deleted" : "skipped",
       textDeleted,
       textFailed: removedText.failed
     };
   }
+  if (existing && isLaterVersion(existing, row)) {
+    const key = `skip:${relPath}:${row.id}:${row.updated_at}`;
+    if (!args.loggedStashNotices?.has(key)) {
+      args.loggedStashNotices?.add(key);
+      output?.log(filePullSkippedLine({
+        path: relPath,
+        rowId: row.id,
+        reason: existing.id === row.id ? "older" : "replaced"
+      }));
+    }
+    return { state: clearRowHolds(state, relPath), action: "skipped" };
+  }
+  const stillAt = (decided) => () => sameFileVersion(ackNow(), decided);
   const textSignal = extractedTextSignal(row);
   const textUnknown = textSignal === "unknown";
   if (storedBytesSignal(row) === "absent") {
@@ -46784,7 +47468,8 @@ async function applyFileRow(args) {
       existing,
       textSignal,
       fetchImpl,
-      output
+      output,
+      stillCurrent: stillAt(existing)
     });
   }
   if (existing && existing.content_hash === row.content_hash && !existsSync8(abs)) {
@@ -46798,9 +47483,9 @@ async function applyFileRow(args) {
   } else {
     presentAgain(args.recentUnlinks, abs);
   }
-  if (existing && existing.content_hash === row.content_hash && existsSync8(abs)) {
+  if (existing && existing.id === row.id && existing.content_hash === row.content_hash && existsSync8(abs)) {
     if (!args.forceTextRewalk && textIsCurrent(existing, row, workspaceSlug, relPath)) {
-      return { state, action: "noop", textUnknown };
+      return { state: clearRowHolds(state, relPath), action: "noop", textUnknown };
     }
     const text2 = await applyExtractedText({
       workspaceSlug,
@@ -46810,9 +47495,13 @@ async function applyFileRow(args) {
       relPath,
       bytesInMirror: true,
       fetchImpl,
-      output
+      output,
+      stillCurrent: stillAt(existing)
     });
-    const { state: next2 } = upsertFileEntry(state, {
+    if (text2.stale) {
+      return { state, action: "noop", textUnknown };
+    }
+    const { state: next2 } = upsertFileEntry(clearRowHolds(state, relPath), {
       ...existing,
       updated_at: row.updated_at,
       text_hash: textUnknown ? existing.text_hash : text2.textHash
@@ -46826,6 +47515,23 @@ async function applyFileRow(args) {
       textUnknown
     };
   }
+  const held = stillHeld2({
+    hold: getFilePullHold(state, relPath),
+    row,
+    abs,
+    relPath,
+    workspaceSlug,
+    ackHash: existing?.content_hash,
+    now
+  });
+  if (held) {
+    const key = `held:${relPath}:${row.updated_at}:${held.kind}`;
+    if (!args.loggedStashNotices?.has(key)) {
+      args.loggedStashNotices?.add(key);
+      output?.log(filePullHeldLine({ path: relPath, kind: held.kind, retryInSeconds: held.retryInSeconds }));
+    }
+    return held.kind === "stash_failed" ? { state, action: "skipped", stashFailed: true } : { state, action: "skipped", integrityFailed: true };
+  }
   const got = await getFile({ baseUrl, pat, id: row.id, fetchImpl });
   if (!got.ok) {
     return { state, action: "skipped" };
@@ -46844,22 +47550,51 @@ async function applyFileRow(args) {
       existing,
       textSignal,
       fetchImpl,
-      output
+      output,
+      stillCurrent: stillAt(existing)
     });
   }
   const bytes = await downloadBytes(got.row.download_url, fetchImpl);
   if (sha256Bytes(bytes) !== row.content_hash) {
     output?.warn(`Integrity check failed for files/${relPath} (hash mismatch) — skipped this pull.`);
-    return { state, action: "skipped", integrityFailed: true };
+    return {
+      state: holdRow(state, getFilePullHold(state, relPath), {
+        row,
+        relPath,
+        kind: "integrity_failed",
+        abs,
+        now
+      }),
+      action: "skipped",
+      integrityFailed: true
+    };
+  }
+  const ackAtWrite = ackNow();
+  if (ackAtWrite && isLaterVersion(ackAtWrite, row)) {
+    const key = `skip:${relPath}:${row.id}:${row.updated_at}`;
+    if (!args.loggedStashNotices?.has(key)) {
+      args.loggedStashNotices?.add(key);
+      output?.log(filePullSkippedLine({
+        path: relPath,
+        rowId: row.id,
+        reason: ackAtWrite.id === row.id ? "older" : "replaced"
+      }));
+    }
+    return { state: clearRowHolds(state, relPath), action: "skipped" };
+  }
+  const ackIsRow = ackAtWrite !== undefined && ackAtWrite.id === row.id && ackAtWrite.updated_at === row.updated_at && ackAtWrite.content_hash === row.content_hash;
+  if (ackIsRow && (!sameFileVersion(ackAtWrite, existing) || unsentBytesAt({ workspaceSlug, abs, safeHashes: [row.content_hash] }).kind === "unsent")) {
+    return { state: clearRowHolds(state, relPath), action: "noop", textUnknown };
   }
-  const stashFailure = stashUnpushedLocalEdit({
+  const stashFailure = keepUnsentLocalCopy({
     workspaceSlug,
     relPath,
     abs,
-    existing,
-    rowHash: row.content_hash,
-    ambient: suppressor !== undefined,
+    safeHashes: [row.content_hash, ackAtWrite?.content_hash],
     now,
+    via: "pull",
+    versionKey: row.content_hash,
+    onBoot: suppressor === undefined,
     output,
     loggedStashNotices: args.loggedStashNotices
   });
@@ -46869,7 +47604,18 @@ async function applyFileRow(args) {
       args.loggedStashNotices?.add(key);
       output?.log(fileStashFailedLine({ path: relPath, ...stashFailure }));
     }
-    return { state, action: "skipped", stashFailed: true };
+    return {
+      state: holdRow(state, getFilePullHold(state, relPath), {
+        row,
+        relPath,
+        kind: "stash_failed",
+        abs,
+        now,
+        failure: stashFailure
+      }),
+      action: "skipped",
+      stashFailed: true
+    };
   }
   suppressor?.registerWrite(abs, { bodyHash: row.content_hash, frontmatterHash: "" });
   writeFilesBytes(workspaceSlug, relPath, bytes);
@@ -46895,7 +47641,8 @@ async function applyFileRow(args) {
       relPath,
       bytesInMirror: true,
       fetchImpl,
-      output
+      output,
+      stillCurrent: stillAt(ackAtWrite)
     });
   }
   let inode;
@@ -46904,7 +47651,7 @@ async function applyFileRow(args) {
   } catch {
     inode = undefined;
   }
-  const { state: next } = upsertFileEntry(state, {
+  const { state: next } = upsertFileEntry(clearRowHolds(state, relPath), {
     id: row.id,
     path: relPath,
     content_hash: row.content_hash,
@@ -46940,7 +47687,8 @@ async function applyPointerRow(args) {
     relPath,
     bytesInMirror,
     fetchImpl: args.fetchImpl,
-    output: args.output
+    output: args.output,
+    stillCurrent: args.stillCurrent
   });
   return {
     state,
@@ -46952,53 +47700,87 @@ async function applyPointerRow(args) {
     pointer: true
   };
 }
-function stashUnpushedLocalEdit(args) {
-  const { workspaceSlug, relPath, abs, existing, output } = args;
-  if (hasSymlinkedComponent(workspaceSlug, dirname13(abs)))
-    return { reason: "symlink" };
-  let st;
-  try {
-    st = lstatSync5(abs);
-  } catch (err) {
-    if (err?.code === "ENOENT")
-      return null;
-    return { reason: "unreadable", code: errCode(err) };
-  }
-  if (!st.isFile())
-    return { reason: "not_a_file" };
-  let localBytes;
-  try {
-    localBytes = readFileSync27(abs);
-  } catch (err) {
-    return { reason: "unreadable", code: errCode(err) };
+function clearRowHolds(state, relPath) {
+  return removeFilePullHold(removeFilePullHold(state, relPath, "stash_failed"), relPath, "integrity_failed");
+}
+function clearHoldsOfRow(state, relPath, rowId) {
+  const hold = getFilePullHold(state, relPath);
+  return hold && hold.row_id === rowId ? clearRowHolds(state, relPath) : state;
+}
+function dropAck(state, relPath, ack, snapshotEntry, commit2) {
+  const next = removeFileEntry(state, relPath).state;
+  if (commit2 && !sameFileVersion(snapshotEntry, ack)) {
+    commit2(upsertFileEntry(state, ack).state, next);
   }
-  const localHash = sha256Bytes(localBytes);
-  if (localHash === args.rowHash || localHash === existing?.content_hash)
+  return next;
+}
+function holdRow(state, prior, args) {
+  const { row, relPath, kind, now } = args;
+  const sameVersion = prior?.kind === kind && prior.row_id === row.id && prior.row_updated_at === row.updated_at && prior.row_hash === row.content_hash;
+  const attempts = sameVersion ? prior.attempts + 1 : 1;
+  const at = now();
+  return upsertFilePullHold(clearRowHolds(state, relPath), {
+    target: "file",
+    path: relPath,
+    kind,
+    row_id: row.id,
+    row_updated_at: row.updated_at,
+    row_hash: row.content_hash,
+    ...args.failure ? { reason: args.failure.reason } : {},
+    ...args.failure?.code ? { code: args.failure.code } : {},
+    local: localFingerprint(args.abs) ?? null,
+    attempts,
+    ...kind === "integrity_failed" ? { next_retry_at: new Date(at.getTime() + integrityBackoffMs(attempts)).toISOString() } : {}
+  });
+}
+var INTEGRITY_BACKOFF_MS = 60000;
+var INTEGRITY_BACKOFF_CAP_MS = 3600000;
+function integrityBackoffMs(attempts) {
+  return Math.min(INTEGRITY_BACKOFF_MS * 2 ** Math.max(0, attempts - 1), INTEGRITY_BACKOFF_CAP_MS);
+}
+function stillHeld2(args) {
+  const { hold, row } = args;
+  if (!hold || hold.row_id !== row.id || hold.row_updated_at !== row.updated_at || hold.row_hash !== row.content_hash) {
     return null;
-  let stashed;
-  try {
-    stashed = stashFileConflictOnce({
-      workspaceSlug,
-      relPath,
-      timestamp: args.now(),
-      bytes: localBytes,
-      side: "local"
-    });
-  } catch (err) {
-    return { reason: "stash_io", code: errCode(err) };
   }
-  const key = `reused:${stashed.path}:${args.rowHash}`;
-  if (stashed.reused && args.loggedStashNotices?.has(key))
+  if (hold.kind === "integrity_failed") {
+    const due = hold.next_retry_at ? Date.parse(hold.next_retry_at) : Number.NaN;
+    const wait = due - args.now().getTime();
+    return Number.isFinite(wait) && wait > 0 ? { kind: "integrity_failed", retryInSeconds: Math.ceil(wait / 1000) } : null;
+  }
+  if (hold.kind !== "stash_failed")
     return null;
-  if (stashed.reused)
-    args.loggedStashNotices?.add(key);
-  output?.log(fileConflictLine({ path: relPath, stash: stashed.path, via: "pull", reused: stashed.reused }));
-  output?.warn(stashed.reused ? `Conflict on files/${relPath} → your local edit is already kept at ${stashed.path}.` : `Conflict on files/${relPath} → stashed local edit to ${stashed.path} (cloud-wins${args.ambient ? "" : " on boot"}).`);
-  return null;
+  const local = localFingerprint(args.abs);
+  const unchanged = local !== undefined && (local === null ? hold.local === null : hold.local != null && hold.local.size === local.size && hold.local.mtime_ms === local.mtime_ms && hold.local.ino === local.ino);
+  if (!unchanged)
+    return null;
+  const failure = probeKeep({
+    workspaceSlug: args.workspaceSlug,
+    relPath: args.relPath,
+    abs: args.abs,
+    safeHashes: [row.content_hash, args.ackHash]
+  });
+  return failure ? { kind: "stash_failed" } : null;
 }
-function errCode(err) {
-  const code = err?.code;
-  return typeof code === "string" ? code : undefined;
+function pruneFilePullHolds(args) {
+  let state = args.state;
+  for (const hold of listFilePullHolds(state)) {
+    if (hold.kind === "kept_after_delete") {
+      let gone = getFileEntry(state, hold.path) !== undefined;
+      if (!gone) {
+        try {
+          gone = localFingerprint(filesSubtreePath(args.workspaceSlug, hold.path)) === null;
+        } catch {
+          gone = false;
+        }
+      }
+      if (gone)
+        state = removeFilePullHold(state, hold.path, hold.kind);
+    } else if ((hold.kind === "stash_failed" || hold.kind === "integrity_failed") && args.cursorPass && !args.deliveredPaths.has(hold.path)) {
+      state = removeFilePullHold(state, hold.path, hold.kind);
+    }
+  }
+  return state;
 }
 function textIsCurrent(existing, row, workspaceSlug, relPath) {
   const signal = extractedTextSignal(row);
@@ -47018,7 +47800,7 @@ function textIsCurrent(existing, row, workspaceSlug, relPath) {
 }
 
 // src/lib/files/rejection-sync.ts
-import { readFileSync as readFileSync28, statSync as statSync16 } from "node:fs";
+import { readFileSync as readFileSync30, statSync as statSync16 } from "node:fs";
 
 // src/lib/files/rejections-api.ts
 var RejectionsFeedSchema = exports_external.object({
@@ -47151,7 +47933,7 @@ function settledDisposition(args) {
     return null;
   let bytes;
   try {
-    bytes = readFileSync28(absolute2);
+    bytes = readFileSync30(absolute2);
   } catch {
     return null;
   }
@@ -47216,6 +47998,49 @@ function rearmMissingReports(state) {
 
 // src/commands/sync.ts
 init_output();
+
+// src/lib/pull-live-gate.ts
+import { lstatSync as lstatSync7, readFileSync as readFileSync31 } from "node:fs";
+function decideLivePull(args) {
+  const { workspaceSlug, strategy, live, snapshotEntry, writeSlug } = args;
+  if (strategy.preserveLocalBodyOnPull)
+    return { kind: "write" };
+  if (strategy.type === "artists")
+    return { kind: "write" };
+  const absolutePath = entityFilePath(workspaceSlug, strategy.type, writeSlug);
+  const ack = snapshotEntry ? committedEntryIfNewer(workspaceSlug, strategy.type, snapshotEntry) ?? snapshotEntry : readCommittedEntry(workspaceSlug, strategy.type, live.id);
+  if (!ack)
+    return { kind: "write" };
+  const older = isLaterVersion(ack, live);
+  if (ack.slug !== writeSlug)
+    return older ? { kind: "skip" } : { kind: "write" };
+  const newer = !older && live.updated_at !== ack.updated_at;
+  let raw = null;
+  try {
+    raw = lstatSync7(absolutePath).isFile() ? readFileSync31(absolutePath, "utf8") : null;
+  } catch {
+    raw = null;
+  }
+  if (raw === null)
+    return older ? { kind: "skip" } : { kind: "write" };
+  if (frontmatterParseError(raw) !== null) {
+    return { kind: "defer", reason: "unreadable", absolutePath };
+  }
+  const disk = computeMirrorHashes(strategy, raw);
+  const matchesAck = disk.bodyHash === ack.body_hash && disk.frontmatterHash === ack.frontmatter_hash;
+  if (!newer) {
+    return matchesAck ? { kind: "skip" } : { kind: "defer", reason: "local_edit", absolutePath };
+  }
+  if (matchesAck)
+    return { kind: "write" };
+  const incoming = computeMirrorHashes(strategy, renderMirrorWithBodyPreserve(workspaceSlug, strategy, live, writeSlug));
+  if (disk.bodyHash === incoming.bodyHash && disk.frontmatterHash === incoming.frontmatterHash) {
+    return { kind: "adopt", raw };
+  }
+  return { kind: "defer", reason: "local_edit", absolutePath };
+}
+
+// src/commands/sync.ts
 var memberRefreshFailedAt = new Map;
 var MEMBER_REFRESH_RETRY_AFTER_MS = 60 * 60 * 1000;
 function classifyApiError(err) {
@@ -47237,7 +48062,7 @@ function hasExistingContent(workspacePath) {
       if (!e.isDirectory())
         return true;
       try {
-        return readdirSync7(join18(workspacePath, e.name)).length > 0;
+        return readdirSync7(join19(workspacePath, e.name)).length > 0;
       } catch {
         return true;
       }
@@ -47267,7 +48092,7 @@ function unlinkIfProvablyOurs(workspaceSlug, strategy, entry2, suppressor) {
   }
   let raw;
   try {
-    raw = readFileSync29(target, "utf8");
+    raw = readFileSync32(target, "utf8");
   } catch (err) {
     if (err?.code === "ENOENT") {
       return { didUnlink: false };
@@ -47285,7 +48110,7 @@ function unlinkIfProvablyOurs(workspaceSlug, strategy, entry2, suppressor) {
   }
   try {
     suppressor?.registerDelete(target);
-    unlinkSync9(target);
+    unlinkSync11(target);
     return { didUnlink: true };
   } catch (err) {
     if (err?.code === "ENOENT") {
@@ -47392,7 +48217,7 @@ async function replayPermanentDocuments(args) {
   for (const row of rows) {
     if (row.deleted_at !== null && row.permanent_delete === true)
       continue;
-    const outcome = applyRow(args.workspaceSlug, args.strategy, row, state, args.output, args.suppressor, args.now, args.isFrozen, args.loggedTombstoneSkips, args.recentUnlinks);
+    const outcome = applyRow(args.workspaceSlug, args.strategy, row, state, args.output, args.suppressor, args.now, args.isFrozen, args.loggedTombstoneSkips, args.recentUnlinks, args.deferral);
     state = outcome.state;
     if (outcome.action === "written")
       counters.written++;
@@ -47529,6 +48354,10 @@ async function runSync(workspaceSlug, deps = {}) {
     committed = state;
   };
   const counters = {};
+  const deferral = {
+    onPushDeferred: deps.onPushDeferred,
+    logged: deps.loggedPullDeferrals
+  };
   let restoresDeferred = 0;
   try {
     for (const entityType of allEntityTypes()) {
@@ -47552,6 +48381,7 @@ async function runSync(workspaceSlug, deps = {}) {
             isFrozen: deps.isFrozen,
             loggedTombstoneSkips: deps.loggedTombstoneSkips,
             recentUnlinks: deps.recentUnlinks,
+            deferral,
             commit: (before, after) => {
               const next = commitState(before, after);
               committed = next;
@@ -47637,7 +48467,7 @@ async function runSync(workspaceSlug, deps = {}) {
           }
           let outcome;
           try {
-            outcome = applyRow(slug, strategy, row, state, out, deps.suppressor, now, deps.isFrozen, deps.loggedTombstoneSkips, deps.recentUnlinks);
+            outcome = applyRow(slug, strategy, row, state, out, deps.suppressor, now, deps.isFrozen, deps.loggedTombstoneSkips, deps.recentUnlinks, deferral);
           } catch (err) {
             if (!(err instanceof MirrorSymlinkError))
               throw err;
@@ -47697,6 +48527,7 @@ async function runSync(workspaceSlug, deps = {}) {
           isFrozen: deps.isFrozen,
           loggedTombstoneSkips: deps.loggedTombstoneSkips,
           recentUnlinks: deps.recentUnlinks,
+          deferral,
           commit: (before, after) => {
             const next = commitState(before, after);
             committed = next;
@@ -47990,7 +48821,7 @@ async function runSync(workspaceSlug, deps = {}) {
   out.success(`Done in ${elapsed}s.`);
   return { exitCode: 0, applied: totalWritten + totalMoved + totalDeleted, restoresDeferred };
 }
-function applyRow(workspaceSlug, strategy, row, state, out, suppressor, now = () => new Date, isFrozen, loggedTombstoneSkips, recentUnlinks) {
+function applyRow(workspaceSlug, strategy, row, state, out, suppressor, now = () => new Date, isFrozen, loggedTombstoneSkips, recentUnlinks, deferral) {
   if (isFrozen?.(strategy.type, row.id)) {
     return { state, action: "skipped" };
   }
@@ -48141,16 +48972,47 @@ function applyRow(workspaceSlug, strategy, row, state, out, suppressor, now = ()
       return { state, action: "noop_overwrite" };
     }
   }
+  let adoptRaw;
+  if (suppressor && relocation.kind !== "moved") {
+    const gate = decideLivePull({
+      workspaceSlug,
+      strategy,
+      live,
+      snapshotEntry: existingEntry,
+      writeSlug
+    });
+    if (gate.kind === "skip")
+      return { state, action: "noop_overwrite" };
+    if (gate.kind === "defer") {
+      const key = `${strategy.type}:${live.id}:${live.updated_at}`;
+      if (!deferral?.logged?.has(key)) {
+        deferral?.logged?.add(key);
+        out.log(entityPullDeferredLine({
+          entityType: strategy.type,
+          slug: writeSlug,
+          id: live.id,
+          reason: gate.reason
+        }));
+        deferral?.onPushDeferred?.(gate.absolutePath);
+      }
+      return { state, action: "deferred" };
+    }
+    if (gate.kind === "adopt")
+      adoptRaw = gate.raw;
+  }
   if (!suppressor && existingEntry && existingEntry.updated_at !== live.updated_at && relocation.kind !== "moved") {
     let localRaw = null;
     try {
-      localRaw = readFileSync29(entityFilePath(workspaceSlug, strategy.type, writeSlug), "utf8");
+      localRaw = readFileSync32(entityFilePath(workspaceSlug, strategy.type, writeSlug), "utf8");
     } catch {
       localRaw = null;
     }
     if (localRaw !== null) {
-      const localHashes = computeMirrorHashes(strategy, localRaw);
-      const diverged = localHashes.bodyHash !== existingEntry.body_hash || localHashes.frontmatterHash !== existingEntry.frontmatter_hash;
+      let diverged = !strategy.preserveLocalBodyOnPull && frontmatterParseError(localRaw) !== null;
+      if (!diverged) {
+        const localHashes = computeMirrorHashes(strategy, localRaw);
+        diverged = localHashes.bodyHash !== existingEntry.body_hash || localHashes.frontmatterHash !== existingEntry.frontmatter_hash;
+      }
       if (diverged) {
         const stashPath = stashConflict({
           workspaceSlug,
@@ -48168,7 +49030,7 @@ function applyRow(workspaceSlug, strategy, row, state, out, suppressor, now = ()
     const target = entityFilePath(workspaceSlug, strategy.type, writeSlug);
     let localRaw = null;
     try {
-      localRaw = lstatSync6(target).isFile() ? readFileSync29(target, "utf8") : null;
+      localRaw = lstatSync8(target).isFile() ? readFileSync32(target, "utf8") : null;
     } catch {
       localRaw = null;
     }
@@ -48196,7 +49058,7 @@ function applyRow(workspaceSlug, strategy, row, state, out, suppressor, now = ()
       }
     }
   }
-  const content = writeMirrorWithBodyPreserve(workspaceSlug, strategy, live, suppressor, writeSlug);
+  const content = adoptRaw ?? writeMirrorWithBodyPreserve(workspaceSlug, strategy, live, suppressor, writeSlug);
   const hashes = computeMirrorHashes(strategy, content);
   let inode;
   try {
@@ -48233,7 +49095,7 @@ function applyRow(workspaceSlug, strategy, row, state, out, suppressor, now = ()
     memory_hash: memoryHash,
     memory_generated: memoryGenerated
   });
-  const action = relocation.kind === "moved" ? "moved" : "written";
+  const action = adoptRaw !== undefined ? "noop_overwrite" : relocation.kind === "moved" ? "moved" : "written";
   return { state: nextState, action };
 }
 var syncCommand = defineCommand({
@@ -48334,7 +49196,7 @@ function backfillStateInodes(workspaceSlug, state, statFn = (p) => statSync18(p)
     return { state, changed: false };
   return { state: { ...state, entries: nextEntries }, changed: true };
 }
-function backfillBodyLengths(workspaceSlug, state, readFn = (p) => readFileSync30(p, "utf8")) {
+function backfillBodyLengths(workspaceSlug, state, readFn = (p) => readFileSync33(p, "utf8")) {
   let changed = false;
   const nextEntries = {};
   for (const [entityType, bucket] of Object.entries(state.entries)) {
@@ -48346,7 +49208,7 @@ function backfillBodyLengths(workspaceSlug, state, readFn = (p) => readFileSync3
       }
       try {
         const path5 = entityFilePath(workspaceSlug, entityType, entry2.slug);
-        const bodyLen = import_gray_matter14.default(readFn(path5)).content.length;
+        const bodyLen = parseUncached(readFn(path5)).content.length;
         nextBucket[id] = { ...entry2, body_len: bodyLen };
         changed = true;
       } catch {
@@ -48359,6 +49221,18 @@ function backfillBodyLengths(workspaceSlug, state, readFn = (p) => readFileSync3
     return { state, changed: false };
   return { state: { ...state, entries: nextEntries }, changed: true };
 }
+function isOwnWriteEcho(suppressor, absolutePath, strategy, raw) {
+  if (frontmatterParseError(raw) !== null)
+    return false;
+  return suppressor.shouldSuppressUpsert(absolutePath, computeMirrorHashes(strategy, raw));
+}
+function destinationIsUnreadable(absolutePath) {
+  try {
+    return frontmatterParseError(readFileSync33(absolutePath, "utf8")) !== null;
+  } catch {
+    return false;
+  }
+}
 function makeWatchHandler(deps) {
   const {
     workspaceSlug,
@@ -48475,7 +49349,7 @@ function makeWatchHandler(deps) {
         spinner.update(`Watching ${workspaceSlug} · ${watchingSummary(getState())}`);
         return;
       }
-      const bytes = readFileSync30(absolutePath);
+      const bytes = readFileSync33(absolutePath);
       const hash2 = sha256Bytes(bytes);
       if (suppressor?.shouldSuppressUpsert(absolutePath, {
         bodyHash: hash2,
@@ -48539,7 +49413,7 @@ function makeWatchHandler(deps) {
     if (suppressor) {
       let raw = null;
       try {
-        raw = readFileSync30(absolutePath, "utf8");
+        raw = readFileSync33(absolutePath, "utf8");
       } catch {
         raw = null;
       }
@@ -48578,7 +49452,7 @@ function makeWatchHandler(deps) {
     if (suppressor) {
       let raw = null;
       try {
-        raw = readFileSync30(absolutePath, "utf8");
+        raw = readFileSync33(absolutePath, "utf8");
       } catch {
         raw = null;
       }
@@ -48617,7 +49491,7 @@ function makeWatchHandler(deps) {
     if (suppressor) {
       let raw = null;
       try {
-        raw = readFileSync30(absolutePath, "utf8");
+        raw = readFileSync33(absolutePath, "utf8");
       } catch {
         raw = null;
       }
@@ -48656,7 +49530,7 @@ function makeWatchHandler(deps) {
     if (suppressor) {
       let raw = null;
       try {
-        raw = readFileSync30(absolutePath, "utf8");
+        raw = readFileSync33(absolutePath, "utf8");
       } catch {
         raw = null;
       }
@@ -48695,7 +49569,7 @@ function makeWatchHandler(deps) {
     if (suppressor) {
       let raw = null;
       try {
-        raw = readFileSync30(absolutePath, "utf8");
+        raw = readFileSync33(absolutePath, "utf8");
       } catch {
         raw = null;
       }
@@ -48741,11 +49615,11 @@ function makeWatchHandler(deps) {
           const strategy = getStrategy(classifiedFrom.entityType);
           let toRaw = null;
           try {
-            toRaw = readFileSync30(event.toPath, "utf8");
+            toRaw = readFileSync33(event.toPath, "utf8");
           } catch {
             toRaw = null;
           }
-          const isEcho = strategy !== undefined && toRaw !== null && suppressor.shouldSuppressUpsert(event.toPath, computeMirrorHashes(strategy, toRaw));
+          const isEcho = strategy !== undefined && toRaw !== null && isOwnWriteEcho(suppressor, event.toPath, strategy, toRaw);
           if (isEcho) {
             output?.log(`[RENAME_SUPPRESSED entityType=${classifiedFrom.entityType} ` + `from=${event.fromSlug} id=${event.id} reason=pull_echo]`);
             return;
@@ -48753,6 +49627,9 @@ function makeWatchHandler(deps) {
           await handle({ kind: "upsert", absolutePath: event.toPath });
           return;
         }
+        if (destinationIsUnreadable(event.toPath)) {
+          await handle({ kind: "upsert", absolutePath: event.toPath });
+        }
         const base3 = getState();
         const result2 = await pushRename({
           workspaceSlug,
@@ -48810,7 +49687,7 @@ function makeWatchHandler(deps) {
         if (event.kind === "upsert") {
           try {
             ownEcho = suppressor?.shouldSuppressUpsert(absolutePath, {
-              bodyHash: stableHash(readFileSync30(absolutePath, "utf8")),
+              bodyHash: stableHash(readFileSync33(absolutePath, "utf8")),
               frontmatterHash: ""
             }) === true;
           } catch {
@@ -48865,11 +49742,11 @@ function makeWatchHandler(deps) {
           if (strategy) {
             let raw = null;
             try {
-              raw = readFileSync30(absolutePath, "utf8");
+              raw = readFileSync33(absolutePath, "utf8");
             } catch {
               raw = null;
             }
-            if (raw !== null && suppressor.shouldSuppressUpsert(absolutePath, computeMirrorHashes(strategy, raw))) {
+            if (raw !== null && isOwnWriteEcho(suppressor, absolutePath, strategy, raw)) {
               return;
             }
           }
@@ -48920,7 +49797,8 @@ function makeWatchHandler(deps) {
           echo: suppressor ? { watcher: "live", suppressor } : undefined
         }
       });
-      applyState(result.base ?? base2, clearEntityRejected(result.state, workspaceSlug, absolutePath));
+      const heldUnreadable = result.outcome.kind === "ignored" && result.outcome.reason === FRONTMATTER_PARSE_ERROR;
+      applyState(result.base ?? base2, heldUnreadable ? result.state : clearEntityRejected(result.state, workspaceSlug, absolutePath));
       reportOutcome(spinner, workspaceSlug, getState(), result.outcome);
     } catch (err) {
       const msg = err instanceof Error ? err.message : "unknown push error";
@@ -49311,6 +50189,7 @@ async function runStart(workspaceSlug, deps = {}) {
   }
   const loggedTombstoneSkips = new Set;
   const loggedStashNotices = new Set;
+  const loggedPullDeferrals = new Set;
   const initial = await runSync(workspaceSlug, {
     fetchImpl,
     keychain,
@@ -49468,7 +50347,7 @@ async function runStart(workspaceSlug, deps = {}) {
         return;
       }
       refreshFrozen();
-      out.log(`[DESTRUCTIVE_HELD batch=${batchId} ops=${batch.length} reason=${result.reason.kind}]`);
+      out.log(`[DESTRUCTIVE_HELD batch=${batchId} ops=${batch.length} reason=${tripReasonToken(result.reason)}]`);
       spinner.warn(`Held ${batch.length} destructive op${batch.length === 1 ? "" : "s"} pending confirm → ${stashPath}. Run \`plinth confirm\` to review.`);
       spinner.update(`Watching ${slug} · ${watchingSummary(state)}`);
     }
@@ -49524,7 +50403,7 @@ async function runStart(workspaceSlug, deps = {}) {
         return;
       }
       refreshFrozen();
-      out.log(`[DESTRUCTIVE_HELD batch=${batchId} ops=${batch.length} reason=${result.reason.kind} source=files-watch]`);
+      out.log(`[DESTRUCTIVE_HELD batch=${batchId} ops=${batch.length} reason=${tripReasonToken(result.reason)} source=files-watch]`);
       spinner.warn(`Held ${batch.length} destructive file op${batch.length === 1 ? "" : "s"} pending confirm → ${stashPath}. Run \`plinth confirm\` to review.`);
       spinner.update(`Watching ${slug} · ${watchingSummary(state)}`);
     }
@@ -49576,7 +50455,11 @@ async function runStart(workspaceSlug, deps = {}) {
         isFrozen,
         isFileFrozen,
         loggedTombstoneSkips,
-        loggedStashNotices
+        loggedStashNotices,
+        onPushDeferred: (absolutePath) => {
+          watcher.nudge(absolutePath);
+        },
+        loggedPullDeferrals
       }));
       if (result.exitCode === 0) {
         const applied = result.applied ?? 0;
@@ -49616,6 +50499,9 @@ async function runStart(workspaceSlug, deps = {}) {
     afterPoll: () => {
       (async () => {
         state = loadState(slug);
+        const unsettled = state;
+        const settled = settleFrontmatterHolds(unsettled, slug);
+        state = rebaseState(state, unsettled, settled);
         if (draining)
           return;
         draining = true;
@@ -49837,12 +50723,12 @@ async function runStart(workspaceSlug, deps = {}) {
       try {
         await Promise.race([
           watcher.drainPending().then(() => Promise.all([gate.drain(), fileGate.drain()])),
-          new Promise((resolve6) => setTimeout(() => resolve6(-1), SHUTDOWN_DRAIN_TIMEOUT_MS))
+          new Promise((resolve7) => setTimeout(() => resolve7(-1), SHUTDOWN_DRAIN_TIMEOUT_MS))
         ]);
       } finally {
         await Promise.race([
           watcher.stop(),
-          new Promise((resolve6) => setTimeout(resolve6, SHUTDOWN_DRAIN_TIMEOUT_MS))
+          new Promise((resolve7) => setTimeout(resolve7, SHUTDOWN_DRAIN_TIMEOUT_MS))
         ]);
         clearDaemonPid(slug);
         releaseDaemonLock(lockHandle);
@@ -49938,6 +50824,21 @@ function reportOutcome(spinner, slug, state, outcome) {
       return;
   }
 }
+function fileConflictMessage(outcome) {
+  const head = `Conflict on files/${outcome.relPath}${outcome.stashPath ? ` → ${outcome.stashPath}` : ""}`;
+  switch (outcome.restore) {
+    case "skipped":
+      return `${head} (Plinth's version was not applied here; daemon.log says why)`;
+    case "removed":
+      return outcome.stashPath ? `${head} (deleted in Plinth, so removed here; your copy is stashed)` : `${head} (deleted in Plinth too, and gone here)`;
+    case "no_bytes":
+      return `${head} (Plinth holds no bytes for it; the local file was left as it is)`;
+    case "restored":
+      return outcome.stashPath ? `${head} (cloud-wins; local copy stashed)` : `${head} (cloud-wins; cloud copy restored)`;
+    default:
+      return `${head} (already in Plinth; your copy is stashed)`;
+  }
+}
 function reportFileOutcome(spinner, slug, state, outcome) {
   const summary = watchingSummary(state);
   switch (outcome.kind) {
@@ -49954,7 +50855,7 @@ function reportFileOutcome(spinner, slug, state, outcome) {
       spinner.update(`Watching ${slug} · ${summary}`);
       return;
     case "conflict":
-      spinner.warn(outcome.stashPath ? `Conflict on files/${outcome.relPath} → ${outcome.stashPath} (cloud-wins; local copy stashed)` : `Conflict on files/${outcome.relPath} (cloud-wins; cloud copy restored)`);
+      spinner.warn(fileConflictMessage(outcome));
       spinner.update(`Watching ${slug} · ${summary}`);
       return;
     case "over_cap":
@@ -50094,7 +50995,7 @@ var startCommand = defineCommand({
 });
 
 // src/commands/status.ts
-import { statSync as statSync20 } from "node:fs";
+import { existsSync as existsSync12, statSync as statSync20 } from "node:fs";
 
 // src/lib/context/context-walls.ts
 function prepare(raw) {
@@ -50395,14 +51296,69 @@ function assessContextWalls(workspaceSlug, deps = {}) {
   return { walls, played, asOf, unreadable };
 }
 
+// src/commands/status-holds.ts
+function filePullHoldLines(args) {
+  const details = [];
+  for (const hold of args.holds) {
+    const line = holdLine(hold, args);
+    if (line !== null)
+      details.push(line);
+  }
+  const n = details.length;
+  if (n === 0)
+    return { headline: "No files held.", details };
+  return {
+    headline: `${n} file${n === 1 ? "" : "s"} held - this folder and Plinth differ. Each line says why and what clears it.`,
+    details
+  };
+}
+function holdLine(hold, args) {
+  const name = `files/${hold.path}`;
+  if (hold.kind === "kept_after_delete") {
+    if (!args.fileExists(hold.path) || args.isTracked(hold.path))
+      return null;
+    return `${name}: deleted in Plinth, but your copy here had changes that were never uploaded, so it was kept. ` + `It goes back into Plinth as a new file the next time the daemon starts; delete it here to accept the deletion.`;
+  }
+  if (hold.kind === "stash_failed") {
+    return `${name}: Plinth has a newer version, but your copy here could not be kept first, so it was not replaced. ` + `${keepRemedy(hold, args.conflictsDir)} It updates on the next sync after that.`;
+  }
+  if (hold.kind === "integrity_failed") {
+    return `${name}: Plinth's copy did not match its checksum when it was downloaded, so it was not written. ` + `${retryPhrase(hold, args.now)}`;
+  }
+  return `${name}: held by a newer version of Plinth (${hold.kind}); update Plinth on this Mac to see why.`;
+}
+function keepRemedy(hold, conflictsDir) {
+  const code = hold.code ? ` (${hold.code})` : "";
+  switch (hold.reason) {
+    case "symlink":
+      return "A folder on the way to it is a link; replace the link with a real folder.";
+    case "not_a_file":
+      return "Something other than a file is at that path; move it aside.";
+    case "unreadable":
+      return `Your copy could not be read${code}; check its permissions.`;
+    case "stash_io":
+      return `A recovery copy could not be written to ${conflictsDir}${code}; free some disk space or check that folder's permissions.`;
+    default:
+      return `Your copy could not be kept (${hold.reason ?? "no reason recorded"}${code}); update Plinth on this Mac to see why.`;
+  }
+}
+function retryPhrase(hold, now) {
+  const due = hold.next_retry_at ? Date.parse(hold.next_retry_at) : Number.NaN;
+  const wait = due - now.getTime();
+  if (!Number.isFinite(wait) || wait <= 0)
+    return "It is tried again on the next sync.";
+  const minutes = Math.max(1, Math.round(wait / 60000));
+  return `It is tried again in about ${minutes} minute${minutes === 1 ? "" : "s"}, or at once if the file changes in Plinth.`;
+}
+
 // src/lib/build-stamp.ts
 import { execFileSync as execFileSync4 } from "node:child_process";
-import { existsSync as existsSync11, mkdirSync as mkdirSync12, readFileSync as readFileSync31, writeFileSync as writeFileSync8 } from "node:fs";
-import { dirname as dirname14, join as join19 } from "node:path";
+import { existsSync as existsSync11, mkdirSync as mkdirSync12, readFileSync as readFileSync34, writeFileSync as writeFileSync9 } from "node:fs";
+import { dirname as dirname14, join as join20 } from "node:path";
 import { fileURLToPath } from "node:url";
 var BUILD_STAMP_FILENAME = "build-stamp.json";
 function stampPath(distDir) {
-  return join19(distDir, BUILD_STAMP_FILENAME);
+  return join20(distDir, BUILD_STAMP_FILENAME);
 }
 function readHead(repoDir) {
   try {
@@ -50421,7 +51377,7 @@ function readHead(repoDir) {
 }
 function readBuildStamp(distDir) {
   try {
-    const parsed = JSON.parse(readFileSync31(stampPath(distDir), "utf8"));
+    const parsed = JSON.parse(readFileSync34(stampPath(distDir), "utf8"));
     if (parsed && typeof parsed.sha === "string" && parsed.sha.length > 0 && typeof parsed.dirty === "boolean" && typeof parsed.built_at === "string") {
       return { sha: parsed.sha, dirty: parsed.dirty, built_at: parsed.built_at };
     }
@@ -50433,7 +51389,7 @@ function readBuildStamp(distDir) {
 function findRepoRoot(fromDir) {
   let dir = fromDir;
   for (;; ) {
-    if (existsSync11(join19(dir, ".git")))
+    if (existsSync11(join20(dir, ".git")))
       return dir;
     const parent = dirname14(dir);
     if (parent === dir)
@@ -50482,12 +51438,12 @@ function checkBuildStaleness(deps = {}) {
 }
 
 // src/lib/memory-links.ts
-import { readFileSync as readFileSync32 } from "node:fs";
-import { relative as relative15, sep as sep8 } from "node:path";
+import { readFileSync as readFileSync35 } from "node:fs";
+import { relative as relative15, sep as sep9 } from "node:path";
 var MEMORY_FILE_RE = /^(workspace-memory\.md|user-memory\.md|artists\/[^/]+\/memory\.md|memory\/[^/]+\.md|memory\/private\/[^/]+\.md)$/i;
 function scanMemoryLinks(deps) {
   const listFiles = deps.listFiles ?? ((r) => walkSubtreeFiles(r, isVcsInternal));
-  const readFile = deps.readFile ?? ((p) => readFileSync32(p, "utf8"));
+  const readFile = deps.readFile ?? ((p) => readFileSync35(p, "utf8"));
   let root;
   let absPaths;
   try {
@@ -50496,7 +51452,7 @@ function scanMemoryLinks(deps) {
   } catch {
     return { scanned: 0, unreadable: [], dead: [] };
   }
-  const relPaths = absPaths.map((p) => relative15(root, p).split(sep8).join("/"));
+  const relPaths = absPaths.map((p) => relative15(root, p).split(sep9).join("/"));
   const artists = buildArtistIndex(relPaths, root, (abs) => readFile(abs));
   const dead = [];
   const unreadable = [];
@@ -50531,9 +51487,8 @@ function scanMemoryLinks(deps) {
 init_output();
 
 // src/lib/pending-writes.ts
-import { readFileSync as readFileSync33, statSync as statSync19 } from "node:fs";
+import { readFileSync as readFileSync36, statSync as statSync19 } from "node:fs";
 import { relative as relative16 } from "node:path";
-var import_gray_matter15 = __toESM(require_gray_matter(), 1);
 var EMPTY3 = { writes: [], count: 0 };
 function reportedElsewhere(state) {
   const entities = new Set;
@@ -50579,7 +51534,7 @@ function scanPendingWrites(args) {
         continue;
       let hash2;
       try {
-        hash2 = sha256Bytes(readFileSync33(absolutePath));
+        hash2 = sha256Bytes(readFileSync36(absolutePath));
       } catch {
         continue;
       }
@@ -50610,17 +51565,15 @@ function scanPendingWrites(args) {
       continue;
     let content;
     try {
-      content = readFileSync33(absolutePath, "utf8");
+      content = readFileSync36(absolutePath, "utf8");
     } catch {
       continue;
     }
     if (!entry2) {
-      let frontmatter;
-      try {
-        frontmatter = import_gray_matter15.default(content).data ?? {};
-      } catch {
+      const read = readFrontmatter(content);
+      if (holdsUnreadableUntracked({ entityType, entitySlug, readable: read.ok }))
         continue;
-      }
+      const frontmatter = read.ok ? read.parsed.data : {};
       const verdict = classifyUntrackedEntity({
         entityType,
         entitySlug,
@@ -51055,6 +52008,23 @@ async function runStatus(args, deps = {}) {
     }
     out.info("");
   }
+  const pullHolds = filePullHoldLines({
+    holds: listFilePullHolds(localState),
+    conflictsDir: conflictsRoot(slug),
+    now,
+    fileExists: (rel) => {
+      try {
+        return existsSync12(filesSubtreePath(slug, rel));
+      } catch {
+        return true;
+      }
+    },
+    isTracked: (rel) => getFileEntry(localState, rel) !== undefined
+  });
+  out.info(row("Held", pullHolds.headline));
+  for (const line of pullHolds.details)
+    out.info(cont(line));
+  out.info("");
   const rejected = listRejected(localState);
   const freshness = Object.values(localState.memory_sources?.unwritten ?? {}).sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
   const localRejectedPaths = new Set(rejected.filter((r) => r.target === "file").map((r) => r.path));
@@ -51076,7 +52046,7 @@ async function runStatus(args, deps = {}) {
     }
   }
   if (freshness.length > 0) {
-    out.info(row("Memory context", `${freshness.length} file${freshness.length === 1 ? "" : "s"} could not be marked with ${freshness.length === 1 ? "its" : "their"} current memory state. Your edits are untouched.`));
+    out.info(row("Memory context", `${freshness.length} file${freshness.length === 1 ? "" : "s"} could not be marked with ${freshness.length === 1 ? "its" : "their"} current memory state.`));
     for (const r of freshness.slice(0, MAX_SHOWN)) {
       out.info(cont(r.message));
     }
@@ -51521,7 +52491,7 @@ var versionCommand = defineCommand({
 });
 
 // src/commands/voice-gate.ts
-import { readFileSync as readFileSync36 } from "node:fs";
+import { readFileSync as readFileSync39 } from "node:fs";
 
 // src/lib/voice-gate/api.ts
 var VoiceGateSurfaces = [
@@ -51623,15 +52593,15 @@ async function callVoiceGate(req) {
 }
 
 // src/lib/voice-gate/attempts.ts
-import { createHash as createHash7 } from "node:crypto";
+import { createHash as createHash8 } from "node:crypto";
 import {
   mkdirSync as mkdirSync13,
-  readFileSync as readFileSync34,
-  renameSync as renameSync9,
-  unlinkSync as unlinkSync10,
-  writeFileSync as writeFileSync9
+  readFileSync as readFileSync37,
+  renameSync as renameSync10,
+  unlinkSync as unlinkSync12,
+  writeFileSync as writeFileSync10
 } from "node:fs";
-import { join as join20 } from "node:path";
+import { join as join21 } from "node:path";
 var MAX_REGENS = 2;
 var ENTRY_TTL_MS = 24 * 60 * 60 * 1000;
 var AttemptEntrySchema = exports_external.object({
@@ -51644,20 +52614,20 @@ var AttemptsFileSchema = exports_external.object({
   entries: exports_external.record(exports_external.string(), AttemptEntrySchema)
 });
 function attemptsDir(workspaceSlug) {
-  return join20(plinthHome(), "_voice_gate", workspaceSlug);
+  return join21(plinthHome(), "_voice_gate", workspaceSlug);
 }
 function attemptsPath(workspaceSlug) {
-  return join20(attemptsDir(workspaceSlug), "attempts.json");
+  return join21(attemptsDir(workspaceSlug), "attempts.json");
 }
 function attemptKey(identity) {
-  return createHash7("sha256").update(identity, "utf8").digest("hex").slice(0, 32);
+  return createHash8("sha256").update(identity, "utf8").digest("hex").slice(0, 32);
 }
 function emptyFile() {
   return { version: 1, entries: {} };
 }
 function load2(workspaceSlug) {
   try {
-    const raw = readFileSync34(attemptsPath(workspaceSlug), "utf8");
+    const raw = readFileSync37(attemptsPath(workspaceSlug), "utf8");
     const parsed = AttemptsFileSchema.safeParse(JSON.parse(raw));
     return parsed.success ? parsed.data : emptyFile();
   } catch {
@@ -51678,13 +52648,13 @@ function save(workspaceSlug, file2) {
   const target = attemptsPath(workspaceSlug);
   const tmp = `${target}.${process.pid}.${tmpCounter2++}.tmp`;
   mkdirSync13(dir, { recursive: true, mode: 448 });
-  writeFileSync9(tmp, `${JSON.stringify(file2, null, 2)}
+  writeFileSync10(tmp, `${JSON.stringify(file2, null, 2)}
 `, { mode: 384 });
   try {
-    renameSync9(tmp, target);
+    renameSync10(tmp, target);
   } catch (err) {
     try {
-      unlinkSync10(tmp);
+      unlinkSync12(tmp);
     } catch {}
     throw err;
   }
@@ -51820,9 +52790,9 @@ function denyUngated(detail) {
 }
 
 // src/lib/voice-gate/payload.ts
-import { readFileSync as readFileSync35, statSync as statSync21 } from "node:fs";
+import { readFileSync as readFileSync38, statSync as statSync21 } from "node:fs";
 import { homedir as homedir2 } from "node:os";
-import { isAbsolute as isAbsolute4, resolve as resolve6 } from "node:path";
+import { isAbsolute as isAbsolute4, resolve as resolve7 } from "node:path";
 var MAX_BODY_BYTES = 256 * 1024;
 var HELPER_BASENAME = "push_gmail_draft.py";
 var DRAFT_FLAGS = ["--to", "--body-file", "--body-stdin"];
@@ -51981,7 +52951,7 @@ function defaultReadBodyFile(path5) {
   if (stat4.size > MAX_BODY_BYTES) {
     throw new Error(`draft body is ${stat4.size} bytes, over the ${MAX_BODY_BYTES}-byte gate limit`);
   }
-  return readFileSync35(path5, "utf8");
+  return readFileSync38(path5, "utf8");
 }
 function parseRecipients(...raw) {
   const all = raw.filter((v) => typeof v === "string").flatMap((v) => v.split(",")).map((v) => v.trim().toLowerCase()).filter((v) => v.length > 0);
@@ -52016,13 +52986,13 @@ function applyCd(tokens, state) {
     return { dir: expanded, known: true };
   if (!state.known)
     return state;
-  return { dir: resolve6(state.dir, expanded), known: true };
+  return { dir: resolve7(state.dir, expanded), known: true };
 }
 function expandHome(path5) {
   if (path5 === "~")
     return homedir2();
   if (path5.startsWith("~/"))
-    return resolve6(homedir2(), path5.slice(2));
+    return resolve7(homedir2(), path5.slice(2));
   return path5;
 }
 function classifyHelperSegment(tokens, dirState, readBodyFile) {
@@ -52048,7 +53018,7 @@ function classifyHelperSegment(tokens, dirState, readBodyFile) {
       unreadable: `the draft push uses a relative \`--body-file\` (${bodyFile}) after a \`cd\` ` + `the voice gate cannot resolve, so it cannot tell which file ships. Pass an ` + `absolute \`--body-file\` path.`
     };
   }
-  const resolved = isAbsolute4(expanded) ? expanded : resolve6(dirState.dir, expanded);
+  const resolved = isAbsolute4(expanded) ? expanded : resolve7(dirState.dir, expanded);
   let body;
   try {
     body = readBodyFile(resolved);
@@ -52341,7 +53311,7 @@ async function runVoiceGateDirect(args, deps = {}) {
   let text;
   if (args.file) {
     try {
-      text = readFileSync36(args.file, "utf8");
+      text = readFileSync39(args.file, "utf8");
     } catch (err) {
       const msg = err instanceof Error ? err.message : "unknown error";
       out.error(`Could not read ${args.file}: ${msg}`);