Module sync 

The sync verb (v1, HITL — decided §9 Q4), plus the scoped form the .flint/sync sentinel invokes (boundary-verbs plan §2.2, D4). Harness- or sentinel-invoked, never background.

Sync BEGINS with a full scan: “locally dirty” means dirty per THAT scan against the baseline — never per the last barrier’s snapshot (otherwise sync honors a remote delete over the agent’s un-scanned latest work: the review’s steady-state destruction finding). Policy: locally-dirty wins; remote deletions apply only to locally-clean paths; adds/changes fetch through the store; every skipped apply is a surfaced conflict, never silent.

The scope rule (D4) is a correctness rule, not an optimization. A scoped sync moves the baseline — which is also the merge base since P1-lite — only for the paths it applied or verified in scope, and leaves baseline.seq / baseline.manifest_etag UNTOUCHED. What it leaves out stays OWED: the next barrier’s consume derives it and takes it, untouched from today. And a path the WORKSPACE’S scope declined (a scoped checkout) is never fetched here either: the baseline does not hold it, and only the held set and the scope’s cover are owed.

Structs

Scope

A normalized scope: path prefixes and exact paths, matched on COMPONENT boundaries ("in" never matches internal/).

SyncReport