pg: address review of --from-now

Fixes from the review of the previous commit.

The flag was silently dropped on daemon-delegated pushes: when the local daemon
owns the archive, `pg push` posts to /api/v1/push/pg, and neither the request
nor the handler carried it, so the whole archive was backfilled anyway. It now
travels in the request and maps into SyncOptions.

Whether --full was requested cannot be decided inside Push: callers pass
`cfg.Full || didResync`, so any automatic resync looked like explicit intent and
disabled the flag. The precedence is resolved at the CLI instead, where the
user's own flag is known.

The boundary scoped session selection only, while other phases stayed
archive-wide, so pre-boundary content was uploaded regardless. A bounded push
now refuses when a vector source is attached, because embeddings carry raw text
and cannot be bounded, and skips cursor usage events for the same reason a
filtered push already skips them: the rows are global and unattributed.

Freshness is now proven rather than inferred. The reset paths clear the
watermark, so an empty watermark alone could not distinguish a genuinely new
target from an established one whose marker was lost or whose first push failed
part-way, and re-seeding there would permanently skip the history those resets
exist to restore. Boundary state, marker presence, and whether a reset ran on
this pass are all required.

Also documents the flag and its interactions in the command reference.

Author: Technophobe01

cmd/agentsview/archive_write_backend.go

@@ -333,6 +333,7 @@ func (b daemonArchiveWriteBackend) PGPush(
 			SyncStateTarget:        target.SyncStateTarget,
 			MigrateLegacySyncState: target.MigrateLegacySyncState,
 			NoVectors:              cfg.NoVectors,
+			FromNow:                cfg.FromNow,
 			ScopeVectorsToChangedSessions: cfg.
 				ScopeVectorsToChangedSessions,
 			LastReconciledVectorGeneration: cfg.
@@ -623,7 +624,7 @@ func (b *localArchiveWriteBackend) PGPush(
 	ps, err := postgres.New(
 		target.PG.URL, target.PG.Schema, b.database,
 		target.PG.MachineName, target.PG.AllowInsecure,
-		target.syncOptions(projects, excludeProjects, vectorSource, cfg.FromNow),
+		target.syncOptions(projects, excludeProjects, vectorSource, cfg.FromNow && !cfg.Full),
 	)
 	if err != nil {
 		return postgres.PushResult{}, err
@@ -870,7 +871,7 @@ func (b *localArchiveWriteBackend) PGPushWatch(
 				s, cErr := postgres.New(
 					target.PG.URL, target.PG.Schema, b.database,
 					target.PG.MachineName, target.PG.AllowInsecure,
-					target.syncOptions(projects, exclude, vectorSource, cfg.FromNow),
+					target.syncOptions(projects, exclude, vectorSource, cfg.FromNow && !cfg.Full),
 				)
 				if cErr != nil {
 					return nil, cErr

cmd/agentsview/daemon_push.go

@@ -25,6 +25,10 @@ type daemonPushRequest struct {
 	// NoVectors mirrors the CLI --no-vectors flag into the daemon: it has no
 	// per-invocation flag of its own, so the gate must travel in the request.
 	NoVectors bool `json:"no_vectors,omitempty"`
+	// FromNow carries the CLI --from-now flag. Without it a delegated push
+	// silently backfills the whole archive, which is the opposite of what the
+	// flag was asked to do.
+	FromNow bool `json:"from_now,omitempty"`
 	// ScopeVectorsToChangedSessions is set by change-triggered watch
 	// pushes so the daemon's vector phase reads state only for the
 	// changed relational sessions (see postgres.PushOptions).

docs/commands.md

@@ -563,6 +563,7 @@ agentsview pg push [target] [flags]
 | -------------------- | ------- | -------------------------------------------------------------- |
 | `--full`             | `false` | Force full local resync and re-push                            |
 | `--no-vectors`       | `false` | Skip the semantic-search vector phase for this run             |
+| `--from-now`         | `false` | On a target's FIRST push, start at now instead of backfilling  |
 | `--projects`         |         | Comma-separated projects to push (inclusive)                   |
 | `--exclude-projects` |         | Comma-separated projects to exclude from push                  |
 | `--all-projects`     | `false` | Ignore configured project filters for this run                 |
@@ -571,8 +572,14 @@ agentsview pg push [target] [flags]
 | `--debounce`         | `30s`   | Coalesce window after a change before pushing (`--watch` only) |
 | `--interval`         | `15m`   | Periodic floor push interval (`--watch` only)                  |
 
-See [PostgreSQL Sync — Project Filtering](/pg-sync/#project-filtering) for
-details on how filtering interacts with the push watermark.
+`--from-now` bounds a target's very first push to sessions from that point on,
+for pushing into a database shared with other people where uploading the whole
+local archive would disclose unrelated work. It applies only when the target is
+provably new (no watermark, no boundary state, no push marker, and no reset on
+this run), is ignored with `--full`, and requires `--no-vectors` because the
+vector phase cannot be bounded. See
+[PostgreSQL Sync — Project Filtering](/pg-sync/#project-filtering) for details
+on how filtering interacts with the push watermark.
 
 ______________________________________________________________________
 

internal/postgres/push.go

@@ -134,10 +134,6 @@ func (s *Sync) PushWithOptions(
 ) (PushResult, error) {
 	full := opts.Full
 	start := time.Now()
-	// The caller's own --full intent, kept because `full` is reassigned below
-	// when reset detection forces a rebuild; PushFromNow must never override an
-	// explicitly requested full push.
-	requestedFull := full
 	var result PushResult
 	state := s.effectiveSyncState()
 	aliasBackfillState := s.aliasBackfillSyncStateOrDefault()
@@ -296,6 +292,31 @@ func (s *Sync) PushWithOptions(
 			}
 		}
 	}
+	// Decide the from-now boundary here, after every reset check and before the
+	// setup phases below. Freshness has to be proven, not assumed: a reset path
+	// clears lastPush, so lastPush alone cannot distinguish a genuinely new
+	// target from an established one whose marker was lost or whose first push
+	// failed part-way. Re-seeding the boundary in those cases would permanently
+	// skip history that should be restored, so require that nothing local
+	// (watermark, boundary state) and nothing remote (this marker) has ever
+	// recorded a push, and that no reset cleared state on this run.
+	applyFromNow := pushFromNowApplies(
+		s.pushFromNow, lastPush, boundaryState, markerExists, pushStateCleared,
+	)
+	// The boundary scopes SESSION selection only. Phases that are archive-wide
+	// would still upload pre-boundary content, defeating the point, so a bounded
+	// first push refuses or skips them rather than leaking quietly.
+	// Scoped to this push, so a later unbounded push still syncs these phases.
+	s.skipUnboundedPhases = applyFromNow
+	defer func() { s.skipUnboundedPhases = false }()
+	if applyFromNow && s.vectorSource != nil {
+		return result, fmt.Errorf(
+			"--from-now cannot bound the vector phase: it would upload " +
+				"embeddings and raw text for sessions before the boundary; " +
+				"re-run with --no-vectors",
+		)
+	}
+
 	if err := timedPushSetupStep("model pricing sync",
 		func() error { return s.syncModelPricing(ctx) }); err != nil {
 		return result, err
@@ -306,22 +327,18 @@ func (s *Sync) PushWithOptions(
 	}
 	cutoff := time.Now().UTC().Format(LocalSyncTimestampLayout)
 
-	// Start a brand-new target at "now" instead of backfilling the archive.
-	// Applied HERE, after every reset check above has run: those checks key on
-	// lastPush being non-empty and treat a watermark with no matching target
-	// fingerprint or PG-side marker as corrupt local state, so a watermark
-	// seeded any earlier (or from outside this process) would be wiped and the
-	// push would fall back to a full backfill. finalizePushState records cutoff
-	// at the end, so every later push for the target is normally incremental.
-	if boundary, applied := pushFromNowBoundary(
-		s.pushFromNow, requestedFull, lastPush, cutoff,
-	); applied {
+	// Seed the watermark so this target's history starts at the join point. The
+	// decision was made above; it cannot be pre-seeded from outside the process
+	// because the reset checks treat a watermark with no matching fingerprint or
+	// PG-side marker as corrupt local state and clear it. finalizePushState
+	// records cutoff at the end, so every later push is normally incremental.
+	if applyFromNow {
 		log.Printf(
 			"pgsync: first push for this target starts at %s "+
 				"(from-now); local history before it is not uploaded",
 			cutoff,
 		)
-		lastPush = boundary
+		lastPush = cutoff
 	}
 
 	// Candidate selection shares ListSessionsForMirrorWindow with the
@@ -1375,18 +1392,23 @@ func persistPushTargetFingerprint(
 	return nil
 }
 
-// pushFromNowBoundary decides the lower bound of a from-now push. It applies
-// only to a target with NO watermark yet, and never overrides an explicitly
-// requested full push: narrowing an established target would silently create a
-// gap in what the hub has, whereas bounding a target's very first push just
-// means its history starts at the join point.
-func pushFromNowBoundary(
-	enabled, requestedFull bool, lastPush, cutoff string,
-) (string, bool) {
-	if !enabled || requestedFull || lastPush != "" {
-		return lastPush, false
-	}
-	return cutoff, true
+// pushFromNowApplies reports whether a from-now boundary may be seeded.
+//
+// It requires PROOF that the target has never been pushed to, not merely an
+// empty watermark: the reset paths above clear lastPush, so an established
+// target whose PG marker was lost, whose fingerprint changed, or whose first
+// push failed part-way would otherwise look brand new. Seeding a boundary there
+// would permanently skip the history those resets exist to restore. Boundary
+// state counts because a partial first push leaves fingerprints behind with no
+// watermark, and stateCleared because a reset on this very run means state that
+// did exist was just discarded.
+func pushFromNowApplies(
+	enabled bool, lastPush, boundaryState string,
+	markerExists, stateCleared bool,
+) bool {
+	return enabled &&
+		lastPush == "" && boundaryState == "" &&
+		!markerExists && !stateCleared
 }
 
 func pushTargetState(
@@ -3441,7 +3463,7 @@ func nilIfZero(n int) any {
 func (s *Sync) syncCursorUsageEvents(ctx context.Context) error {
 	// Cursor admin rows are global and unattributed, so project-filtered pushes
 	// cannot sync them honestly.
-	if s.isFiltered() {
+	if s.isFiltered() || s.skipUnboundedPhases {
 		return nil
 	}
 

internal/postgres/push_test.go

@@ -1823,33 +1823,34 @@ func TestShouldSkipSessionMessagesInBatchedPush(t *testing.T) {
 	), "full mode should not skip by fingerprint check")
 }
 
-// A from-now push must bound only a target's FIRST push, and must never
-// silently narrow an established target or override an explicit full push.
-func TestPushFromNowBoundary(t *testing.T) {
-	const cutoff = "2026-07-24 12:00:00"
-	const established = "2026-07-01 00:00:00"
+// A from-now boundary may only be seeded when the target is PROVABLY new.
+// The reset paths clear lastPush, so an empty watermark alone does not
+// distinguish a fresh target from an established one whose marker was lost or
+// whose first push failed part-way; seeding there would permanently skip the
+// history those resets exist to restore.
+func TestPushFromNowApplies(t *testing.T) {
 	cases := []struct {
 		name          string
 		enabled       bool
-		requestedFull bool
 		lastPush      string
-		want          string
-		wantApplied   bool
+		boundaryState string
+		markerExists  bool
+		stateCleared  bool
+		want          bool
 	}{
-		{"fresh target starts at now", true, false, "", cutoff, true},
-		{"disabled backfills as before", false, false, "", "", false},
-		{"explicit full push wins", true, true, "", "", false},
-		{"established target is untouched", true, false, established, established, false},
-		{"established target with full push is untouched", true, true, established, established, false},
-		{"disabled and established is untouched", false, false, established, established, false},
+		{name: "provably fresh target", enabled: true, want: true},
+		{name: "disabled", enabled: false, want: false},
+		{name: "established target has a watermark", enabled: true, lastPush: "2026-07-01 00:00:00", want: false},
+		{name: "partial first push left boundary state", enabled: true, boundaryState: "{}", want: false},
+		{name: "target already carries this push marker", enabled: true, markerExists: true, want: false},
+		{name: "a reset cleared state on this run", enabled: true, stateCleared: true, want: false},
 	}
 	for _, tc := range cases {
 		t.Run(tc.name, func(t *testing.T) {
-			got, applied := pushFromNowBoundary(
-				tc.enabled, tc.requestedFull, tc.lastPush, cutoff,
-			)
-			assert.Equal(t, tc.want, got)
-			assert.Equal(t, tc.wantApplied, applied)
+			assert.Equal(t, tc.want, pushFromNowApplies(
+				tc.enabled, tc.lastPush, tc.boundaryState,
+				tc.markerExists, tc.stateCleared,
+			))
 		})
 	}
 }

internal/postgres/sync.go

@@ -177,6 +177,11 @@ type Sync struct {
 	// pushFromNow starts a fresh target at the current time rather than
 	// backfilling the local archive. See SyncOptions.PushFromNow.
 	pushFromNow bool
+
+	// skipUnboundedPhases is set for the duration of a push whose from-now
+	// boundary applied, so archive-wide phases that the boundary cannot scope
+	// are skipped instead of uploading pre-boundary content.
+	skipUnboundedPhases bool
 	// afterVectorApply is a full/scoped post-apply test hook.
 	afterVectorApply func()
 	// beforeVectorWitnessRecord is a generation-wide pre-witness test hook.

internal/server/huma_routes_push.go

@@ -159,6 +159,10 @@ type daemonPushRequest struct {
 	// NoVectors carries the CLI --no-vectors flag, which has no daemon-side
 	// flag of its own, into the push handler's vector-source gate.
 	NoVectors bool `json:"no_vectors,omitempty"`
+	// FromNow carries the CLI --from-now flag. Without it a delegated push
+	// silently backfills the whole archive, which is the opposite of what the
+	// flag was asked to do.
+	FromNow bool `json:"from_now,omitempty"`
 	// ScopeVectorsToChangedSessions is set by change-triggered watch
 	// pushes so the vector phase reads state only for the changed
 	// relational sessions (see postgres.PushOptions).
@@ -365,6 +369,7 @@ func (s *Server) humaPGPush(
 							SyncStateTarget:        body.SyncStateTarget,
 							MigrateLegacySyncState: body.MigrateLegacySyncState,
 							VectorSource:           vectorSource,
+							PushFromNow:            body.FromNow,
 						},
 					)
 					if err != nil {