Tested end-to-end with two throwaway homes against a scratch hub root:
deletion propagation, new-machine join safety, edit-wins-over-delete,
reaping, forget, alert timing. Fixes found by those tests:
- harvest deletions BEFORE the pull (pull used to undo every deletion)
- gate attribution on $STATE/seen (a new machine would have tombstoned
every hub file its peers had just uploaded)
- active_path probed '+ /dir***' instead of '+ /dir/***' -> every tombstone
looked out-of-scope, so deletions never applied
- tombstone excludes must precede includes in the filter (first match wins)
- rsync must get -e with the deploy key; harvest stderr must not be dropped
- guard hub sync root that already holds unrelated data (178 G here)
- scrub credentials out of repo remote URLs before publishing the manifest
DESIGN.md is the rationale; README.md the operations half.
Four data classes: files (mtime-arbitrated two-way), git repos (manifest +
clone, never byte-synced), the browser link bar (union merge), and everything
else denied by default.
druppy