Module state 

Durable emptyDir bookkeeping (plan §2.1 “restart matrix”).

Everything the barrier needs to survive a CONTAINER restart lives here as small JSON files under <root>/.flint-sync/, each written temp+rename. A POD replacement gets a fresh emptyDir and therefore a fresh identity — that asymmetry is deliberate (the plan’s P4: the incarnation id is emptyDir-scoped, so only the same pod’s restarted container may self-supersede the lease).

Structs

Baseline

The persisted baseline snapshot: what this syncer believes the bucket holds AND has integrated locally. Distinct from inst_base (the manifest view at our last install — the three-way merge base): consuming a HITL entry advances the baseline for that path but not the merge base. The formal model carries the same split (baseline vs instBase in LeanSubtree.tla) — collapsing them made a syncer mistake its own consumed adoption for a foreign entry.

BaselineEntry

One published path as this syncer last knew it: the recognized ETag is the If-Match guard for the next publish and the HEAD-guard for GC.

ConflictRecord

One surfaced conflict: both versions stay recoverable (local bytes in the tree, foreign bytes preserved at preserved_key or still current under the data key). Never a silent winner.

Incarnation

The pod-incarnation identity + lease bookkeeping ({last_token, quiet_polls} persist so container restarts RESUME the takeover observation instead of resetting it — plan §2.1).

IntentJournal

The intent journal written BEFORE uploads: which keys this barrier will touch and under which flush_uuid, so a restarted container can recognize its own crashed/torn PUT at the 412 (AdoptOwn) instead of mistaking it for a foreign write. recent_uuids keeps the last few barriers’ uuids for the same reason.

ScopeIntent

A rescope in flight (scoped-read design §4.3). target is the scope the workspace is moving TO; None means the whole tree.

SyncerState

Constants

DRAINED

Written by the SIGTERM drain only after it published: the node plugin’s evidence that a worker that is now gone actually drained (audit 2026-09-03, finding 3). Absent ⇒ the tree is preserved.