Module sync 

The sync verb (v1, HITL — decided §9 Q4), plus the scoped form the .flint/sync sentinel invokes (boundary-verbs plan §2.2, D4). Harness- or sentinel-invoked, never background.

Sync BEGINS with a full scan: “locally dirty” means dirty per THAT scan against the baseline — never per the last barrier’s snapshot (otherwise sync honors a remote delete over the agent’s un-scanned latest work: the review’s steady-state destruction finding). Policy: locally-dirty wins; remote deletions apply only to locally-clean paths; adds/changes fetch through the store; every skipped apply is a surfaced conflict, never silent.

The scope rule (D4) is a correctness rule, not an optimization. A scoped sync advances inst_base only for the paths it actually applied or verified in scope, and leaves baseline.seq / baseline.manifest_etag UNTOUCHED. inst_base is the three-way merge base; if a scoped sync advanced the whole merge base to bucket-current, every out-of-scope foreign change would look already-integrated to the next merge and would be silently lost from the inbox flow forever. With D4 those changes remain “foreign” and flow through the normal merge → inbox → consume path at the next barrier, untouched from today.

Structs

Scope

A normalized scope: path prefixes and exact paths, matched on COMPONENT boundaries ("in" never matches internal/).

SyncReport