Plan the fabric-sync process boundary

[myobie]

Result

This plan extracts file sync into a separately supervised fabric-sync process while keeping one network identity, peer policy, config directory, and operator report.

The plan answers transport cost, state ownership, lifecycle, loud absence, mixed-fleet operation, format discipline, rollback, and staged delivery.

The blocking-walk fix is step one. Its property test is written and observed red first. The same five-second test and 150 ms pipe-delivery bound remain unchanged through extraction.

Each of eight implementation steps is one useful, green, independently reversible pull request. This pull request contains only the plan. It starts no implementation.

Important decisions

• fabric-sync never parses peers.toml or opens an endpoint.
• The daemon resolves peers, enforces sync permissions, and relays raw fabric/sync/1 bytes.
• syncs.toml stays beside peers.toml; no new config file or root appears.
• Existing durable state paths and formats stay unchanged.
• Independent systemd and launchd services supervise the two processes.
• A companion failure never stops the main daemon and never starts an embedded fallback.
• The remote wire stays compatible, so old and new machines sync in both directions during rollout.
• Before activation, a 10-minute two-host comparison reports the added Unix relay throughput and CPU cost.