fix(sync): bound agent-scoped reconciliation to its requested roots

[rodboev]

Part of the prep work for #1208, along with #1307 and #1318. The branch was squashed and includes #1291's changes; if #1291 merges on its own, this needs a rebase.

The bug

Asking reconciliation to check one directory could delete sessions in other directories. The requested path got widened to the whole configured root, and that widened claim was treated as proof when deciding what to tombstone.

The fix

Each provider now says exactly what a request covers:

• Discovery may walk a wider directory, but the pass can only touch what was actually asked for.
• Deleting anything requires proof the pass really looked there.
• A pass that covered one whole container (a SQLite file, a Hermes archive) can clean up its members — after checking the session didn't just move somewhere else.
• Blank or unrelated paths now do nothing instead of matching everything.

Hermes, OpenCode, Zed, Shelley, Trae, Aider, VS Copilot, and Omnigent each get topology rules for their own layouts (shared databases, archives, profile folders).

Also in here (from #1291)

Watcher performance for shared SQLite databases: one session's write used to re-parse the whole database. Now each session has its own change signal, and a file event does work proportional to what changed, not to the archive size.

Where to look

• internal/parser/provider.go — the scope plan
• internal/sync/engine.go — how the engine uses it
• internal/parser/hermes_provider.go, opencode_provider.go, multi_session_container.go — per-provider rules

[roborev-ci]

roborev: Combined Review (b14c50e)

Code review found two medium-severity reconciliation issues in OpenCode SQLite container handling.

Medium

• internal/parser/provider.go:521 — OpenCode inherits the generic descendant scope, so requesting opencode.db proves only that exact path without IncludeVirtualMembers. Discovered opencode.db#<session> sources are filtered out, allowing reconciliation to succeed without syncing or tombstoning them. Override OpenCode-family scope resolution so database, WAL, and virtual-member paths share the container’s virtual-member proof, and add an exact-container reconciliation test.

• internal/sync/engine.go:3430 — Reconciliation narrowed to one OpenCode virtual member records only that member as discovered, but finishSQLiteContainerPass can still promote the captured container state as trusted. Other changed sessions may then be skipped indefinitely during later full passes. Promote trust only when the scope enumerated the container’s complete membership, or disable promotion for narrowed scopes; add a multi-session scoped-reconciliation regression test.

---

Reviewers: 2 done | Synthesis: codex, 9s | Total: 15m45s

[roborev-ci]

roborev: Combined Review (e717dfd)

No issues found.

---

Reviewers: 2 done | Synthesis: codex | Total: 15m58s

[wesm]

working on this

[roborev-ci]

roborev: Combined Review (0838610)

Changes need revision: two medium-severity synchronization issues could leave sessions stale or incorrectly active.

Medium

• internal/sync/opencode_container_gate.go:223 — Watermark-only sources are filtered before the pre-discovery container state is revalidated. A concurrent commit between the watermark query and filtering can remove the changed session from files; if all entries are filtered, SyncPathsContext returns before beginSQLiteContainerPass, bypassing the later capture-validity guard. Thread the pre-discovery capture into classification and filter only when a post-listing capture still matches; otherwise retain all sources for full fingerprinting. Add a regression test for mutation between watermark listing and filtering.

• internal/parser/hermes_provider.go:871 — Plain transcript-directory Hermes roots do not resolve descendant requests. Because their reconciliation unit has an empty stateDB, deleting root/session.jsonl can produce an empty plan, leaving the session active. For non-archive, non-profile units, use generic descendant-scope behavior: traverse the configured root while validating the requested descendant using the configured path spelling. Add coverage for transcript deletion from a custom flat Hermes directory.

---

Reviewers: 2 done | Synthesis: codex, 10s | Total: 13m56s

[roborev-ci]

roborev: Combined Review (ad7ae9e)

The change needs revision to prevent archive-sized memory allocation in the watcher fast path.

Medium

• internal/parser/opencode_provider.go:1028, internal/sync/opencode_container_gate.go:228 — The watcher fast path materializes all session metadata as SourceRefs and all stored members as a map before filtering. Each database event therefore allocates O(total sessions), violating the bounded daemon-memory invariant. The performance test only measures post-filter processing and child lookups, so it does not catch this scaling issue. Stream or page live watermarks and stored freshness in ordered passes, emit only changed sources, and add a cardinality test covering peak retained rows or allocations.

---

Reviewers: 2 done | Synthesis: codex, 8s | Total: 15m59s

[roborev-ci]

roborev: Combined Review (49ad79d)

Medium-severity issues remain in reconciliation scoping and freshness pagination.

Medium

• internal/parser/provider.go:473 — Multi-session providers using SourceSetProvider inherit the generic directory scope resolver. Reconciling a physical container path (such as Aider history, Zed/Shelley SQLite, or Omnigent chat.db) proves only that path, while discovery emits container#member paths. The engine discards those members as outside the proof and reports a successful no-op, regressing the prior widening to the configured root.

  Fix: Add container-aware reconciliation topology for multiSessionContainerSourceSet, mapping physical containers and sidecars to proof scopes with IncludeVirtualMembers: true, while retaining exact scopes for individual members. Add coverage for non-OpenCode container providers.

• internal/sync/opencode_container_gate.go:199 — The freshness adapter filters stale-data-version rows after fetching a database page. If a full raw page contains only stale rows, it returns an empty page with done=false; storedMemberFreshnessCursor treats that as exhaustion. Later current-version members are unnecessarily emitted and materialized, causing one event’s work to scale with the remainder of the archive.

  Fix: Advance internally across raw pages using the last raw path until a vouchable row is found or the source is exhausted. Add a test where an all-stale first page is followed by covered current-version rows.

---

Reviewers: 2 done | Synthesis: codex, 11s | Total: 15m12s

[roborev-ci]

roborev: Combined Review (f70b0fd)

Medium-severity issue found in Hermes scope deduplication; no security issues were identified.

Medium

• internal/parser/hermes_provider.go:805 — Deduplicating Hermes scopes preserves only the first scope’s authority. With overlapping configuration ordered as [profile, container], the individual profile creates a non-covering scope first; the later covering scope shares its identity but loses CoverageIdentities. Reconciliation can therefore appear incomplete and fail to reclaim removed aggregate-owned state.db sessions even though all configured roots were requested.
  • Fix: On key collisions, merge or upgrade traversal, proof, and coverage fields—not only RetryRoots—and add a reversed-order overlapping-root test.

---

Reviewers: 2 done | Synthesis: codex, 9s | Total: 17m47s

[roborev-ci]

roborev: Combined Review (9d1b897)

Medium-severity reconciliation issues remain; no security vulnerabilities were identified.

Medium

• internal/sync/engine.go:4455 — Aggregate-member deletion still requires full provider-root coverage. Reconciliation scoped to one complete Hermes archive can prove that a state.db member was removed, but aggregateOwnedMemberGone exits early if another configured archive/profile is uncovered, leaving the deleted session active.

  Fix: Permit aggregate-member checks when all provider roots are covered or the current scope proves complete membership of the aggregate container. Pass this authority into aggregateOwnedMemberGone and add a targeted Hermes member-deletion test.

• internal/sync/engine.go:5932 — Incremental cutoff filtering trusts watermark-only metadata even when post-discovery container recapture invalidates the pass. A child-only commit during discovery can retain an old session/project watermark, fall below the cutoff, and be removed before full fingerprinting detects the update.

  Fix: Use the carried watermark only while sqliteContainerPassCaptureValid is true; otherwise fall through to providerSourceMtime so the composite fingerprint and digest are resolved.

---

Reviewers: 2 done | Synthesis: codex, 10s | Total: 19m57s

[roborev-ci]

roborev: Combined Review (183133c)

Code review found one medium-severity reconciliation issue.

Medium

• internal/sync/engine.go:4797 — Scoped container reconciliation does not check whether PersistentArchive members were relocated. If a persistent-archive session moves from container A to configured container B, reconciling only A can incorrectly tombstone it even though FindSource resolves it under B. Call reconciliationMemberRelocated before setting persistentMemberContainerExists and tombstoning, and add a cross-container move regression test for a persistent-archive provider.

---

Reviewers: 2 done | Synthesis: codex, 8s | Total: 16m44s

[roborev-ci]

roborev: Combined Review (5ba5f35)

Code changes are generally sound, but one medium-severity reconciliation bug can incorrectly tombstone relocated sessions.

Medium

• internal/sync/engine.go:4873 — Scoped container reconciliation checks relocation only when the stale virtual path still resolves. If a non-persistent container is deleted after its member moves elsewhere—for example, a Visual Studio Copilot conversation moving to another trace—SourceForReconciliation returns not found and the code tombstones the session even though FindSource could locate it under another configured container.

  Fix: Before tombstoning any scoped, container-authorized virtual member, call reconciliationMemberRelocated regardless of whether the stale path resolves. Add coverage for moving a member while deleting its original container.

---

Reviewers: 2 done | Synthesis: codex, 11s | Total: 20m54s

[roborev-ci]

roborev: Combined Review (86c1cdd)

No issues found.

---

Reviewers: 2 done | Synthesis: codex | Total: 15m6s