feat(git-sync): remove the per-cycle delete cap; deletes apply + are logged every cycle

The delete cap (GIT_SYNC_MAX_DELETES_PER_CYCLE, default 5) was a defense-in-depth
guard that SUPPRESSED a cycle's deletions when the planned count exceeded the
limit. In practice it was a crutch over engine correctness that also blocked
legitimate deletes: deleting a folder with many child pages is a normal action,
and git-sync deletes are SOFT (Trash, reversible), so a blocking limit has little
upside and real downside. There is also no user-facing surface to "confirm" a
large delete from a background sync — the only channel is the operator log.

So: drop the cap entirely. Deletes apply unconditionally; every cycle already
logs its full push plan, per-action `delete: <pageId>` lines, and completion
counts through the engine `log`, so what was deleted (and what was skipped) is
always recorded. Engine correctness (the reconcile/layout/round-trip tests) is
what prevents phantom deletions — not a blocking cap.

Removed: orchestrator `resolveApplyClient` cap hook + `maxDeletes`,
`getGitSyncMaxDeletesPerCycle`, the `GIT_SYNC_MAX_DELETES_PER_CYCLE` env/validation/.env.example,
and the cap tests. (The engine's generic optional `resolveApplyClient` hook is
left as an unused extension point.)

server tsc clean, git-sync + environment jest 174.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
claude code agent 227
2026-06-26 03:59:12 +03:00
parent f4651f554d
commit 032df2cf31
6 changed files with 9 additions and 141 deletions

View File

@@ -209,12 +209,6 @@ export class EnvironmentVariables {
@IsString()
GIT_SYNC_BACKEND_TIMEOUT_MS: string;
// Defense-in-depth absolute cap on soft-deletes per push cycle (default 5): a
// non-convergent / phantom-absence cycle can never trash more than this many
// pages without an explicit override. Optional int (validated as a string env).
@IsOptional()
@IsString()
GIT_SYNC_MAX_DELETES_PER_CYCLE: string;
// Required when git-sync is enabled: the service user create/move/rename/delete
// are attributed to (issue #194 §7.2). Optional otherwise.