fix(git-sync): red-team hardening — 12 confirmed sync-breaking bugs + regression tests

A 10-agent red-team pass on the two-way Docmost<->git sync surfaced 16 ranked
findings (9 others triaged out as already-defended). Wrote a reproduction test
per finding (each asserts the CORRECT behavior, so it fails on the bug), then
fixed the production code so every repro goes green. All confirmed bugs:

Round-trip data loss (markdown-converter.ts + docmost-schema.ts mirror):
- #1 editor-ext node types silently dropped on export — ported the 8 missing
  canon nodes (footnoteReference/footnotesList/footnoteDefinition, htmlEmbed,
  status, pageEmbed, transclusionSource/Reference) into the git-sync schema
  mirror and added converter cases that emit their schema-matching HTML instead
  of flattening unknown nodes to '' (this was the critical data-loss flagged in
  review #1679: footnotes/htmlEmbed lost on sync). Snapshot surface updated.
- #2 top-level image lost width/height/align/attachmentId — now emits an HTML
  <img> (like video/diagrams) when it carries layout attrs; bare images stay
  ![](src). Image node parses width/height as strings so they re-import.
- #3 code block containing a ``` fence corrupted on round-trip — outer fence is
  now widened to (longest-inner-backtick-run + 1).
- #16 deep nesting threw RangeError (page never synced) — added a depth guard
  (MAX_NODE_DEPTH=400) so the converter never overflows the stack.

Push/layout/cycle (engine):
- #4 disambiguation ' ~slugId' suffix corrupted Docmost titles + order-dependent
  layout — deterministic, order-independent sibling disambiguation; suffix is
  stripped from a path-derived title ONLY when the new name is exactly the old
  title plus the suffix (never a genuine retitle ending in ' ~token').
- #6 retry-adopt by (parent,title) clobbered the wrong duplicate-title sibling —
  ambiguous (parent,title) is no longer adopted (falls back to fresh create).
- #12 a new child under a new parent was created at ROOT — creates are ordered
  parent-before-child with an in-memory created-id map for parent resolution.
- #13 git conflict markers could reach Docmost — bodies are scanned and the
  marker lines stripped (a '=======' line is only treated as a conflict
  separator inside a <<<<<<< ... >>>>>>> block, so setext headings are safe).
- #15 a divergent `docmost` mirror was escalated by runPush but dropped by
  runCycle — RunCycleResult now forwards divergentDocmost to the orchestrator.

Server (merge / lock / provenance):
- #9 3-way merge lost a human's block edit when git inserted an adjacent block —
  finer-grained diff3 region merge (via lcs) preserves non-overlapping human
  edits; genuine same-block conflicts still resolve git-wins.
- #10 single-writer race — module-static liveLocks closes the same-process TOCTOU
  window, and a heartbeat refresh that cannot confirm the lock now aborts the
  cycle at its next write checkpoint (cooperative AbortSignal threaded through
  runCycle). Cross-process fencing tokens remain a follow-up.
- #14 sticky-agent provenance overrode an explicit actor='git-sync' write,
  blinding the listener loop-guard — resolveSource now lets an explicit actor
  win over the sticky-agent fallback (explicit agent still wins).

Verified: git-sync vitest 617 pass (+1 expected-fail), server unit jest 1541
pass, server tsc clean. A review pass over the fixes caught and corrected a
title-suffix over-strip, an inert abort signal, a document-wide conflict-marker
strip, and two leaf-atom content-holes.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packages/git-sync/src/engine/cycle.ts

@@ -26,6 +26,16 @@ export interface RunCycleDeps {
   settings: Settings;
   fs: CycleFs;
   log: (line: string) => void;
+  /**
+   * Optional cooperative-abort signal. The caller (orchestrator) wires this to
+   * the per-space lock: if a heartbeat refresh cannot CONFIRM the lock is still
+   * held (CAS-miss / Redis error), the signal is aborted and the cycle bails at
+   * its next checkpoint (before the pull-apply and before the push-apply — the
+   * two destructive write phases) instead of writing blind after a possible
+   * lock loss. This is a COARSE best-effort guard; a fully fenced cross-process
+   * single-writer still needs the fencing-token redesign (follow-up).
+   */
+  signal?: AbortSignal;
   /**
    * Delete-cap hook (the ONLY caller-specific policy). Called with the push
    * dry-run's planned delete count (`Number.POSITIVE_INFINITY` when the dry-run
@@ -47,6 +57,13 @@ export interface RunCycleResult {
   skipped?: "merge-in-progress";
   pull?: { written: number; deleted: number; conflict: boolean };
   push?: { mode: string; failures: number };
+  /**
+   * Forwarded from the push result: `true` when the push REFUSED to fast-forward
+   * a divergent `docmost` mirror (the §5 invariant — `docmost` mirrors what
+   * Docmost contains — is broken). Surfaced here so a caller driving `runCycle`
+   * can detect the breach without scraping logs (red-team #15).
+   */
+  divergentDocmost?: boolean;
 }
 
 /**
@@ -70,7 +87,7 @@ export interface RunCycleResult {
  * Lock + cap POLICY live in the caller; this owns only the mechanics.
  */
 export async function runCycle(deps: RunCycleDeps): Promise<RunCycleResult> {
-  const { spaceId, client, vault, settings, fs, log, resolveApplyClient } =
+  const { spaceId, client, vault, settings, fs, log, resolveApplyClient, signal } =
     deps;
   const vaultRoot = settings.vaultPath;
   const abs = (relPath: string) => `${vaultRoot}/${relPath}`;
@@ -107,6 +124,9 @@ export async function runCycle(deps: RunCycleDeps): Promise<RunCycleResult> {
     existing,
   });
 
+  // Bail before the first destructive write phase if the lock was lost.
+  signal?.throwIfAborted();
+
   const pullResult = await applyPullActions(
     {
       client,
@@ -150,6 +170,9 @@ export async function runCycle(deps: RunCycleDeps): Promise<RunCycleResult> {
     applyClient = resolveApplyClient(plannedDeletes, client);
   }
 
+  // Bail before pushing to Docmost if the lock was lost during pull.
+  signal?.throwIfAborted();
+
   const pushResult = await runPush(
     { ...pushDeps, makeClient: () => applyClient },
     { dryRun: false },
@@ -166,5 +189,8 @@ export async function runCycle(deps: RunCycleDeps): Promise<RunCycleResult> {
       mode: pushResult.mode,
       failures: pushResult.failures?.length ?? 0,
     },
+    // Forward a divergent-`docmost` escalation so the caller can act on the §5
+    // invariant breach without scraping logs (red-team #15).
+    divergentDocmost: pushResult.divergentDocmost ?? false,
   };
 }