fix(sync): stop receive-side mutation before conflict loss (#150)

.github/workflows/ci.yml

@@ -73,6 +73,62 @@ jobs:
         # separate runner needed.
         run: go test -tags noassets ./bridge -count=1
 
+      - name: Run patched Syncthing conflict-safety tests
+        working-directory: go
+        run: |
+          expected="$(cat <<'EOF'
+          TestIssue150ConcurrentCapabilityReuseAllowsExactlyOneQueuedUse
+          TestIssue150ConfigStartupPreflightRunsBeforeUpgradeSave
+          TestIssue150ExactProtectedCapabilitiesAuthorizeOnlyTheirBoundDiffs
+          TestIssue150FolderDatabaseNameValidationPreservesHistoricalCanonicalASCII
+          TestIssue150GenericDeviceRemovalCannotDeriveProtectedMembershipDiff
+          TestIssue150GenericProtectedConfigurationDiffsStopBeforeSubscribers
+          TestIssue150GenericProtectedRemovalStopsInEitherFolderOrder
+          TestIssue150NoOpCapabilityUseIsConsumed
+          TestIssue150ProtectedAppStartupSkipsGlobalMutationServices
+          TestIssue150ProtectedCapabilitiesAreOneShotAndNonTransferable
+          TestIssue150ProtectedCapabilitiesRejectAdditionalOrReorderedDiffs
+          TestIssue150ProtectedDatabaseOpenDoesNotCleanOrphanDatabaseArtifacts
+          TestIssue150ProtectedFullAndDeltaPersistAuthenticatedNeed
+          TestIssue150ProtectedIntroducerDiffDoesNotLogLabelBeforeConfigGuard
+          TestIssue150ProtectedRequestKeepsReadsButDoesNotRecheckOrLeak
+          TestIssue150ProtectedRunnerIgnoresAtomicReplaceDuringRemoteIndex
+          TestIssue150ProtectedRunnerStartsWithoutMarkerOrLocalIndex
+          TestIssue150ProtectedSendReceiveRemoteIndexPreservesLocalStateForEveryMaxConflictsValue
+          TestIssue150ProtectedShareCapabilityRejectsPrepareDerivedAdditionalDiff
+          TestIssue150ProtectedVersionerIsPrivateAndInspectionOnly
+          TestIssue150ProtectionIsOptInAndCapabilityRequiresEnabledWrapper
+          TestIssue150PureSendOnlyAppKeepsStandardStartupServices
+          TestIssue150PureSendOnlyDatabaseOpenKeepsExistingWriteSemantics
+          TestIssue150ReceiveSideDatabaseOptionStopsBeforePathCreation
+          TestIssue150ReceiveSideDatabasePreflightNormalizesLateMutatingMainOpenFailure
+          TestIssue150ReceiveSideDatabasePreflightRejectsExistingPhysicalAliasesBeforeMutation
+          TestIssue150ReceiveSideDatabasePreflightRejectsFutureCaseFoldAliasesBeforeMutation
+          TestIssue150ReceiveSideDatabasePreflightRejectsNoncanonicalRegisteredNamesBeforeMutation
+          TestIssue150ReceiveSideDatabasePreflightRejectsRecognizableDatabaseDeviationsBeforeMutation
+          TestIssue150ReceiveSideDatabasePreflightRejectsUncheckpointedAppOwnedWALWithoutMutation
+          TestIssue150ReceiveSideDatabaseSafetyStopReusesCanonicalConfigError
+          TestIssue150ReceiveSideReadOnlyDisablesAutoAcceptBeforeConfigOrFilesystem
+          TestIssue150SendOnlyGenericConfigurationRetainsExistingSemantics
+          TestIssue150ZeroValueCapabilityFailsClosed
+          EOF
+          )"
+          discovered="$(go test -mod=readonly \
+            github.com/syncthing/syncthing/internal/db/sqlite \
+            github.com/syncthing/syncthing/lib/config \
+            github.com/syncthing/syncthing/lib/model \
+            github.com/syncthing/syncthing/lib/syncthing \
+            github.com/syncthing/syncthing/lib/versioner \
+            -list '^TestIssue150[A-Z]' | grep '^TestIssue150[A-Z]' | LC_ALL=C sort -u)"
+          diff -u <(printf '%s\n' "$expected") <(printf '%s\n' "$discovered")
+          go test -mod=readonly \
+            github.com/syncthing/syncthing/internal/db/sqlite \
+            github.com/syncthing/syncthing/lib/config \
+            github.com/syncthing/syncthing/lib/model \
+            github.com/syncthing/syncthing/lib/syncthing \
+            github.com/syncthing/syncthing/lib/versioner \
+            -run '^TestIssue150[A-Z]' -count=1 -timeout=15m
+
   notify-tests:
     name: Notify Tests
     runs-on: ubuntu-latest

CHANGELOG.md

@@ -12,13 +12,16 @@ All notable changes to VaultSync are documented here.
 
 ### Fixed
 
+- **Receive-capable vaults now stop before automatic local changes** ([#150](https://github.com/psimaker/vaultsync/issues/150), [#167](https://github.com/psimaker/vaultsync/issues/167), [#169](https://github.com/psimaker/vaultsync/issues/169)) — In 2.0.2, Send & Receive, Receive Only, and Receive Encrypted vaults retain remote change information for inspection but do not scan, watch, download, clean versions, or change local vault/index data. VaultSync 1.8.2, 2.0.0, and 2.0.1 created and accepted regular vaults as Send & Receive, so those existing vaults are frozen after upgrade: they neither download server changes nor index and upload new iPhone edits. Cloud Relay subscription recognition, provisioning, status, and wake-ups remain available, but a wake-up cannot pull changes into a frozen vault. Existing Send Only keeps its scan, upload, filter, and rescan behavior. Explicit pause, sharing, unsharing, and removal remain available, while path, filter, and rescan changes stay stopped for receive-capable vaults. If internal database validation cannot prove a clean recognized state, VaultSync stops instead of repairing it automatically. VaultSync lets you inspect whichever conflict copies are still available, but Keep This, Keep Other, Keep Both, and Always Skip cannot rename, replace, delete, ignore, or rescan conflict files. Creating a new vault or accepting a new shared vault is unavailable in 2.0.2. Reopening an existing vault performs no delayed default-filter write or rescan.
+- **Conflict inspection remains honest and bounded in large vaults** ([#150](https://github.com/psimaker/vaultsync/issues/150)) — VaultSync keeps a hard limit on visited filesystem entries plus a separate limit on collected conflicts. A bounded partial result remains visibly incomplete and is combined with previously visible conflict copies; only a verified complete empty inspection may clear them. The new versioned inspection bridge is additive, while the historical bridge entry points retain their earlier response formats for upgrade compatibility.
+- **Sync Filter scans no longer apply stale results after a safety-state change** ([#150](https://github.com/psimaker/vaultsync/issues/150)) — Every scan now has its own generation and must still match the current folder and a fresh clear Send Only safety state before its results or automatic selections appear. The Go bridge independently rejects every non-SendOnly folder before filesystem inspection.
 - **Cloud Relay no longer continues from malformed saved Relay device IDs** ([#161](https://github.com/psimaker/vaultsync/issues/161)) — VaultSync reports that Cloud Relay provisioning did not complete and sends no provisioning request, without rewriting or deleting the stored value. Valid existing JSON and legacy records remain unchanged.
 - **Push and Cloud Relay registration details now survive failed secure-storage updates** ([#148](https://github.com/psimaker/vaultsync/issues/148)) — VaultSync keeps the last valid value when a replacement cannot be saved and reports the failure instead of continuing as if registration succeeded.
 - **Folder access now stays intact when reconnecting or syncing in the background** ([#147](https://github.com/psimaker/vaultsync/issues/147)) — reselecting the same Obsidian folder no longer accumulates access claims. Switching folders takes effect only after the new location is readable, scanned, and its permission is saved; any failure keeps the previous folder connected. Background runs release only their own access on completion, restart, or cancellation.
 - **Background sync no longer reports unfinished work as completed** ([#146](https://github.com/psimaker/vaultsync/issues/146)) — continued processing now reports success only after every expected vault is confirmed fully idle. If the sync engine stops, vault status cannot be read, a vault reports an error, the run expires or is cancelled, or the app returns to the foreground, the background run reports failure instead; conflict checks happen only after idle is proven.
-- **Conflicting Obsidian settings now wait for your decision** ([#145](https://github.com/psimaker/vaultsync/issues/145)) — VaultSync no longer automatically deletes, replaces, or promotes `.obsidian` conflict copies by modification time. The legacy preference stays stored but cannot re-enable the retired behavior, and detected conflicts remain visible for manual review. Syncthing's separate conflict-copy retention is not guaranteed.
-- **Keep Both no longer overwrites an existing conflict copy** ([#144](https://github.com/psimaker/vaultsync/issues/144)) — when the intended copy name is already occupied, VaultSync leaves all existing files untouched instead of replacing previously saved bytes.
-- **Manual conflict resolution preserves unrelated temporary files** ([#143](https://github.com/psimaker/vaultsync/issues/143)) — choosing the conflicting version no longer reuses or overwrites a pre-existing temporary file next to the note.
+- **Conflicting Obsidian settings now wait for your decision** ([#145](https://github.com/psimaker/vaultsync/issues/145)) — VaultSync no longer automatically deletes, replaces, or promotes `.obsidian` conflict copies by modification time. The legacy preference stays stored but cannot re-enable the retired behavior, and detected conflicts remain visible for inspection without an executable recovery action in 2.0.2.
+- **Keep Both cannot overwrite an existing conflict copy** ([#144](https://github.com/psimaker/vaultsync/issues/144)) — the earlier no-replace safeguard remains a minimum for any future recovery, but 2.0.2 disables Keep Both before it inspects or creates a destination.
+- **Conflict review does not touch unrelated temporary files** ([#143](https://github.com/psimaker/vaultsync/issues/143)) — choosing a version is unavailable in 2.0.2 and stops before any temporary-file access.
 
 ### Security
 

README.md

@@ -25,6 +25,18 @@ Your notes sync peer-to-peer over Syncthing, straight into Obsidian's iOS sandbo
 
 ---
 
+> [!IMPORTANT]
+> **VaultSync 2.0.2 is a temporary data-safety containment release.** Vaults
+> created or accepted by VaultSync 1.8.2, 2.0.0, and 2.0.1 are normally
+> Send & Receive. After upgrading, those vaults are frozen: they neither
+> download server changes nor scan and upload new iPhone edits. Existing Send
+> Only folders continue to upload. New vault creation, share acceptance, and
+> conflict recovery are unavailable. Cloud Relay can still wake the app and
+> report status, but cannot download changes into a frozen vault. A previous
+> unclean engine shutdown can also make 2.0.2 refuse to start rather than alter
+> uncertain stored state. VaultSync does not automatically repair or convert a
+> live folder, and does not weaken this safety boundary.
+
 ## 🔭 Why VaultSync
 
 - **Peer-to-peer & private** — syncs directly between your own devices over [Syncthing](https://syncthing.net/). No note cloud, no account, no tracking.

docs/architecture.md

@@ -17,11 +17,23 @@ VaultSync embeds Syncthing's Go reference implementation as an iOS library via g
 └─────────────────────────────────┘
 ```
 
+> [!IMPORTANT]
+> VaultSync 2.0.2 is a temporary data-safety containment release. Existing
+> Send Only folders keep their scan, index, filter, rescan, and upload behavior.
+> Send & Receive, Receive Only, and Receive Encrypted folders do not pull, scan,
+> watch, clean versions, or index new local edits. Because VaultSync 1.8.2,
+> 2.0.0, and 2.0.1 created and accepted regular vaults as Send & Receive, those
+> vaults are frozen after upgrade: they neither download server changes nor
+> upload new iPhone edits. New vault creation and share acceptance are also
+> unavailable. Cloud Relay can still deliver and report a wake-up, but cannot
+> pull changes into a frozen folder. VaultSync never converts a live folder to
+> Send Only automatically and does not weaken this boundary to restore service.
+
 ## 🔄 Sync strategy
 
-- **Foreground** — Syncthing runs unrestricted: immediate, continuous sync.
-- **Background** — `BGAppRefreshTask` (requested ~15 min out; iOS decides the actual timing) + `BGProcessingTask` (overnight catch-up: multi-minute budget while charging with network) + `BGContinuedProcessingTask` (iOS 26+, longer runtime for user-initiated tasks). A ~30s grace window after backgrounding lets in-flight work finish.
-- **Push (Cloud Relay)** — optional. Near-realtime `server → iPhone` wake-ups via APNs silent push. See [relay-spec.md](relay-spec.md).
+- **Foreground** — in 2.0.2, existing Send Only folders run normally; receive-capable folders remain stopped before local or receive-side mutation.
+- **Background** — `BGAppRefreshTask` (requested ~15 min out; iOS decides the actual timing) + `BGProcessingTask` (overnight catch-up: multi-minute budget while charging with network) + `BGContinuedProcessingTask` (iOS 26+, longer runtime for user-initiated tasks). A ~30s grace window after backgrounding lets eligible Send Only work finish; a protected receive-capable folder reports failure rather than a false success.
+- **Push (Cloud Relay)** — optional. APNs can still request a background wake-up in 2.0.2, but a wake-up cannot pull into a protected receive-capable folder. See [relay-spec.md](relay-spec.md).
 
 VaultSync is intentionally **asymmetric**:
 
@@ -32,6 +44,29 @@ VaultSync is intentionally **asymmetric**:
 
 Cloud Relay is a `server → iPhone` *acceleration* path, not a guarantee of symmetric real-time background sync.
 
+### Versioned bridge inspection contracts
+
+Bridge ABI compatibility and inspection truth are separate requirements:
+
+- `GetConflictFilesJSON` remains the historical JSON-array entry point. It
+  returns an array for every outcome so an older app/bridge pair keeps its wire
+  shape; it cannot distinguish unavailable from verified empty.
+- `ReadFileContent` remains the historical raw-text or `error:` entry point.
+  Its fixed error contains no path, filename, folder, or driver detail.
+- Current Swift uses the additive `GetConflictFilesInspectionJSONV2` and
+  `ReadFileContentJSONV2` entry points. Their envelopes carry `version: 2` and
+  distinguish complete empty, complete results, bounded partial results, and
+  unavailable inspection. Unknown, legacy, malformed, or contradictory
+  envelopes fail closed.
+- Conflict inspection retains a hard visited-entry bound and a separate
+  collected-conflict bound. A partial result keeps every conflict found so far,
+  is unioned with previously visible copies, and always surfaces an incomplete
+  warning; only a complete empty result may clear cached conflicts.
+- `ScanFolderForKnownPatterns` returns explicit `complete` evidence and checks
+  the live configured folder type before any filesystem inspection. Only an
+  exact Send Only folder is authorized; stopped, unknown, or receive-capable
+  states return a fixed path-free unavailable result.
+
 ### Relay and sync proof hierarchy
 
 VaultSync models proof as independent fields, never as one derived “sync
@@ -277,7 +312,7 @@ Minimal API exported via gomobile. Only primitives + `string` + `[]byte` cross t
 - **Folders:** `AddFolder`, `RemoveFolder`, `RescanFolder`, `GetFoldersJSON`, `ShareFolderWithDevice`, `UnshareFolderFromDevice`
 - **Status & config:** `GetFolderStatusJSON`, `GetConnectionsJSON`, `GetConfigJSON`, `SetDiscoveryEnabled`
 - **Pending shares:** `GetPendingFoldersJSON`, `AcceptPendingFolder`
-- **Conflicts:** `GetConflictFilesJSON`, `ResolveConflict`, `KeepBothConflict`, `ReadFileContent`, `RemoveConflictFilesForOriginal`
+- **Conflicts:** `GetConflictFilesJSON`, `GetConflictFilesInspectionJSONV2`, `ResolveConflict`, `KeepBothConflict`, `ReadFileContent`, `ReadFileContentJSONV2`, `RemoveConflictFilesForOriginal`
 - **Filters:** `GetFolderIgnores`, `SetFolderIgnores`, `ScanFolderForKnownPatterns`
 - **Events:** `GetEventsSince`, `EventStreamGeneration`
 </details>

docs/decisions/027-keep-both-never-replaces-existing-files.md

@@ -2,6 +2,7 @@
 
 - Context: `KeepBothConflict` derived one destination name and could replace an existing regular file at that destination (#144), losing a previously preserved conflict copy.
 - Decision: Keep Both uses atomic no-replace semantics. Existing destination bytes are never replaced; a collision either produces an actually unique destination or returns an error, and success means every involved content remains present.
+- Current boundary: In 2.0.2 decision 033 supersedes executable Keep Both with a non-mutating compatibility stub; this no-replace rule remains a minimum requirement if recovery is ever reintroduced.
 - Why: “Keep Both” is a preservation promise. A crash or I/O failure between steps must prefer an extra copy over lost bytes, and cleanup never deletes user files automatically.
 - Rejected alternative: Checking with `Stat`/`fileExists` before a normal rename, because another operation can occupy the destination between check and rename; also rejected overwrite-then-repair, because overwritten bytes cannot be reconstructed safely.
 - Links: issue #144; `go/bridge/conflicts.go`, `go/bridge/conflicts_test.go`.

docs/decisions/028-conflicts-require-manual-choice.md

@@ -5,5 +5,5 @@
 - Compatibility: The legacy preference remains stored but is ignored, and the exported `AutoResolveStateConflicts` bridge entry point remains as a non-mutating compatibility no-op.
 - Why: Modification time cannot establish user intent, especially with clock skew, and a silent choice can propagate an unwanted result to every peer.
 - Rejected alternative: Keep opt-out last-writer-wins, because a missing or persisted `true` value would continue authorizing mutation without a decision at the time of conflict.
-- Boundary: Manual conflict actions remain available after explicit confirmation; Syncthing's separate conflict-copy retention is unchanged and not guaranteed indefinitely.
+- Boundary: All automatic conflict handling follows decision 032; in 2.0.2 all explicit recovery entry points follow the inspection-only boundary in decision 033.
 - Links: issue [#145](https://github.com/psimaker/vaultsync/issues/145); `go/bridge/conflicts.go`; `ios/VaultSync/Services/SyncthingManager.swift`; `ios/VaultSync/Services/BackgroundSyncService.swift`.