Module state 

Durable emptyDir bookkeeping (plan §2.1 “restart matrix”).

Everything the barrier needs to survive a CONTAINER restart lives here as small JSON files under <root>/.flint-sync/, each written temp+rename. The baseline is the exception (lever D): a snapshot written temp+rename and a journal that each save appends to in place, held parsed in memory for the life of the process.

A POD replacement gets a fresh emptyDir and therefore a fresh identity — that asymmetry is deliberate (the plan’s P4: the incarnation id is emptyDir-scoped, so only the same pod’s restarted container may self-supersede the lease).

Structs

Baseline

The persisted baseline snapshot: what this syncer believes the bucket holds AND has integrated locally — and, since P1-lite (2026-09-25), the three-way MERGE BASE too. A separate merge base existed because a tree could adopt a UI write the document did not cite yet; under P2 every UI edit commits first, so no tree holds a version the document never cited, and the split had nothing left to keep apart (the sandbox pair LeanCoreP1/LeanCoreP2R).

BaselineEntry

One published path as this syncer last knew it: the handle it integrated (the citation repair re-cites it, the merge recognises it as this tree’s own) and the ETag that attests its bytes.

Carrier

See IntentJournal::carrier.

ConflictRecord

One surfaced conflict: both versions stay recoverable (local bytes in the tree, foreign bytes preserved at preserved_key or still current under the data key). Never a silent winner.

Incarnation

The pod-incarnation identity + lease bookkeeping ({last_token, quiet_polls} persist so container restarts RESUME the takeover observation instead of resetting it — plan §2.1).

IntentJournal

The intent journal: the flush id of the barrier in flight, and the H10 carrier. (Its keys, recent_uuids and declared_deletes served the slot’s AdoptOwn and the cell’s declared removals; nothing read them once both were gone — M6 of the 2026-09-24 simplification analysis.)

ScopeIntent

A rescope in flight (scoped-read design §4.3). target is the scope the workspace is moving TO; None means the whole tree.

StoreConformance

What the conditional-write probes saw this store do (conformance.rs). Cached because the probes cost ~10 requests and a store does not change its mind between two barriers — but keyed by identity, because a workspace re-pointed at a different endpoint or bucket is a different store and must be asked again.

SyncerState

Constants

DRAINED

Written by the SIGTERM drain only after it published: the node plugin’s evidence that a worker that is now gone actually drained (audit 2026-09-03, finding 3). Absent ⇒ the tree is preserved.

Functions

read_baseline_at

The baseline of a state directory this process does not hold: what its owner’s next load would read, never cutting anything. For status, which runs beside a live syncer.