[callumalpass]

Problem

The plugin requires desktop to sync even when desktop does not own the vault folder.

Changes

• Port the existing SDK mirror alongside the desktop thin client, selected by the folder ownership marker.
• Keep one Sync destination and support drain/stop before desktop handover.
• Persist per-path baselines, conflict preservation journals, stable vault ports and retry-safe upload identities.
• Stream attachment downloads through bounded pull RPCs into private staging, publishing atomically only after verified EOF and digest validation.
• Use a native loopback manifest and vault-specific SDK storage.

Validation

• 193 unit tests pass (124 existing, 69 native/reconcile tests).
• Lint and TypeScript checks pass.
• LAB-targeted bundle and mobile-safety budget check pass.
• The 50 MiB synthetic test uses actual MessagePort transfers, one outstanding pull and a 4 MiB maximum reply. Verification failure and digest mismatch leave existing vault bytes untouched.

Why draft

The pinned production SDK predates complete vault isolation. Production builds deliberately refuse until an authenticated production SDK containing the required changes is vendored; no LAB trust bundle is substituted.

Live LAB acceptance is blocked by the guarded environment tooling invoking a removed CLI subcommand. No environment configuration or deployment was changed. Production native-loopback CP support is already deployed; current production log preflight permits loopback origins.

Production SDK intake and LAB end-to-end acceptance must complete before this is ready to merge or publish. Mobile remains out of scope.

[callumalpass]

Weekly train investigation (2026-11-01): Build run 40676292007 fails deliberately in scripts/native-assets.mjs:17 because the pinned beta.141 production SDK lacks dist/application/storage-scope.js. Its native-platform/vault-isolation guard is valid; bypassing it or using LAB assets would be unsafe. This is a separate SDK-owned sync feature, not superseded by the weekly release tooling. Keep this draft blocked pending authenticated production npm SDK intake (first supported version 0.1.0-beta.149), rebasing onto the new repin tooling, and the outstanding LAB acceptance described above. Current main builds successfully with the unchanged vendor SDK; the new release automation does not claim to fix or qualify native sync.

[callumalpass]

Beta.149 follow-up dry run (2026-11-02): verified @mdbase-dev/sdk@0.1.0-beta.149 against ops production identity / annotated Connect tag at 4443fd15c4a591e46538eae24cf8425708e6a7f0, cryptographic npm Sigstore provenance, and tarball + lock integrity. The genuine production package now includes dist/application/storage-scope.js and bundle-storage: isolation, clearing the October 28 guard. However, building unchanged PR head 958863a with that SDK fails next at scripts/native-assets.mjs:31: dist/native/sqlite3-opfs-async-proxy.js is absent although asset-pins.json declares sqlite.asyncProxy (32505 bytes, sha256 9f1970e05ee07a79332498858740b705eeb1dcee03bc150f6f690bc0fb5f0a06). All 124 existing and 69 native unit tests pass in the isolated source copy. No production guard was bypassed and no PR 31 code changed. This feature PR is not superseded by dependency repinning: it contains the native sync implementation and still needs the missing asset resolved and LAB acceptance. The ordinary main plugin with the real SDK passes lint, 124 tests and mobile build in the isolated repin dry run. No PR/tag/release was created by that dry run.