fix(git-sync): red-team hardening — 12 confirmed sync-breaking bugs + regression tests

A 10-agent red-team pass on the two-way Docmost<->git sync surfaced 16 ranked
findings (9 others triaged out as already-defended). Wrote a reproduction test
per finding (each asserts the CORRECT behavior, so it fails on the bug), then
fixed the production code so every repro goes green. All confirmed bugs:

Round-trip data loss (markdown-converter.ts + docmost-schema.ts mirror):
- #1 editor-ext node types silently dropped on export — ported the 8 missing
  canon nodes (footnoteReference/footnotesList/footnoteDefinition, htmlEmbed,
  status, pageEmbed, transclusionSource/Reference) into the git-sync schema
  mirror and added converter cases that emit their schema-matching HTML instead
  of flattening unknown nodes to '' (this was the critical data-loss flagged in
  review #1679: footnotes/htmlEmbed lost on sync). Snapshot surface updated.
- #2 top-level image lost width/height/align/attachmentId — now emits an HTML
  <img> (like video/diagrams) when it carries layout attrs; bare images stay
  ![](src). Image node parses width/height as strings so they re-import.
- #3 code block containing a ``` fence corrupted on round-trip — outer fence is
  now widened to (longest-inner-backtick-run + 1).
- #16 deep nesting threw RangeError (page never synced) — added a depth guard
  (MAX_NODE_DEPTH=400) so the converter never overflows the stack.

Push/layout/cycle (engine):
- #4 disambiguation ' ~slugId' suffix corrupted Docmost titles + order-dependent
  layout — deterministic, order-independent sibling disambiguation; suffix is
  stripped from a path-derived title ONLY when the new name is exactly the old
  title plus the suffix (never a genuine retitle ending in ' ~token').
- #6 retry-adopt by (parent,title) clobbered the wrong duplicate-title sibling —
  ambiguous (parent,title) is no longer adopted (falls back to fresh create).
- #12 a new child under a new parent was created at ROOT — creates are ordered
  parent-before-child with an in-memory created-id map for parent resolution.
- #13 git conflict markers could reach Docmost — bodies are scanned and the
  marker lines stripped (a '=======' line is only treated as a conflict
  separator inside a <<<<<<< ... >>>>>>> block, so setext headings are safe).
- #15 a divergent `docmost` mirror was escalated by runPush but dropped by
  runCycle — RunCycleResult now forwards divergentDocmost to the orchestrator.

Server (merge / lock / provenance):
- #9 3-way merge lost a human's block edit when git inserted an adjacent block —
  finer-grained diff3 region merge (via lcs) preserves non-overlapping human
  edits; genuine same-block conflicts still resolve git-wins.
- #10 single-writer race — module-static liveLocks closes the same-process TOCTOU
  window, and a heartbeat refresh that cannot confirm the lock now aborts the
  cycle at its next write checkpoint (cooperative AbortSignal threaded through
  runCycle). Cross-process fencing tokens remain a follow-up.
- #14 sticky-agent provenance overrode an explicit actor='git-sync' write,
  blinding the listener loop-guard — resolveSource now lets an explicit actor
  win over the sticky-agent fallback (explicit agent still wins).

Verified: git-sync vitest 617 pass (+1 expected-fail), server unit jest 1541
pass, server tsc clean. A review pass over the fixes caught and corrected a
title-suffix over-strip, an inert abort signal, a document-wide conflict-marker
strip, and two leaf-atom content-holes.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

apps/server/src/integrations/git-sync/services/space-lock.service.ts

@@ -22,6 +22,16 @@ export class SpaceLockService {
   private readonly instanceId = randomUUID();
   /** In-process per-space mutex: spaceIds with a cycle currently running. */
   private readonly running = new Set<string>();
+  /**
+   * Process-wide single-writer guard: spaceId -> instanceId of the live holder.
+   * Unlike `running` (scoped to ONE service instance), this is shared by every
+   * SpaceLockService in the process, so even if the Redis lock key lapses
+   * (swallowed heartbeat / TTL expiry) a SECOND holder in the same process
+   * cannot start a concurrent cycle for the same space — it is rejected
+   * 'lock-held'. The cross-PROCESS race is handled by the Redis lock plus
+   * abort-on-refresh-failure (and, as a follow-up, fencing tokens).
+   */
+  private static readonly liveLocks = new Map<string, string>();
 
   constructor(redisService: RedisService) {
     this.redis = redisService.getOrThrow();
@@ -70,26 +80,42 @@ export class SpaceLockService {
    * lock that took over after our TTL expired. Used by the heartbeat in
    * `withSpaceLock` so a long-running push (client-controlled receive-pack + the
    * Docmost cycle) cannot outlive the lock and let a concurrent cycle race the
-   * working tree. Logs (warn) but never throws — a failed refresh must not break
-   * the cycle it is protecting.
+   * working tree. Never throws (a thrown timer callback would crash the process),
+   * but a refresh it cannot CONFIRM is treated as a LOST lock: it aborts the
+   * supplied controller so the in-flight protected fn stops instead of writing
+   * blind while another replica may already have taken over the lock.
    */
-  private async refreshLock(spaceId: string): Promise<void> {
+  private async refreshLock(
+    spaceId: string,
+    controller?: AbortController,
+  ): Promise<void> {
     const lua =
       'if redis.call("get", KEYS[1]) == ARGV[1] then return redis.call("pexpire", KEYS[1], ARGV[2]) else return 0 end';
     try {
-      await this.redis.eval(
+      const res = await this.redis.eval(
         lua,
         1,
         GIT_SYNC_LOCK_PREFIX + spaceId,
         this.instanceId,
         String(GIT_SYNC_LOCK_TTL_MS),
       );
+      // CAS miss (res !== 1): we no longer own the key — our TTL lapsed and
+      // another replica may hold it now. Abort the in-flight cycle rather than
+      // swallowing the loss and racing the working tree.
+      if (res !== 1) {
+        this.logger.warn(
+          `git-sync: lock for space ${spaceId} lost during refresh — aborting in-flight cycle`,
+        );
+        controller?.abort();
+      }
     } catch (err) {
       this.logger.warn(
         `git-sync: failed to refresh lock for space ${spaceId}: ${
           err instanceof Error ? err.message : String(err)
         }`,
       );
+      // A refresh we cannot confirm means we may no longer hold the lock; abort.
+      controller?.abort();
     }
   }
 
@@ -106,38 +132,50 @@ export class SpaceLockService {
    */
   async withSpaceLock<T>(
     spaceId: string,
-    fn: () => Promise<T>,
+    fn: (signal: AbortSignal) => Promise<T>,
   ): Promise<T | { skipped: 'lock-held' | 'in-progress' }> {
     if (this.running.has(spaceId)) {
       return { skipped: 'in-progress' };
     }
+    // Cross-instance, same-process single-writer guard: another live holder (a
+    // different SpaceLockService in this process) is mid-cycle for this space.
+    // This survives a swallowed heartbeat / Redis TTL lapse, so a second writer
+    // in the process cannot race the working tree — it is rejected 'lock-held'.
+    if (SpaceLockService.liveLocks.has(spaceId)) {
+      return { skipped: 'lock-held' };
+    }
     // Reserve the in-process slot synchronously (before any await) so two
     // concurrent same-space calls on THIS instance cannot both pass the guard and
     // race acquire(). Redis NX is already authoritative across replicas; this just
     // closes the in-process TOCTOU window. Released in the outer finally on every
     // path (acquire-failure, fn-throw, normal completion).
     this.running.add(spaceId);
+    SpaceLockService.liveLocks.set(spaceId, this.instanceId);
     try {
       if (!(await this.acquire(spaceId))) {
         return { skipped: 'lock-held' };
       }
+      // Lost-lock signal: a failed/CAS-missed heartbeat refresh aborts this so the
+      // protected fn can stop instead of writing blind after our lock lapsed.
+      const controller = new AbortController();
       // Heartbeat: periodically (≈ TTL/3) extend the lock's TTL while `fn` runs so
       // a long push (client-controlled receive-pack + the Docmost cycle) cannot
       // outlive the fixed TTL and let a concurrent cycle race the working tree. The
       // refresh is CAS-guarded (only extends while WE own it). `.unref()` keeps the
       // timer from holding the event loop open; it is ALWAYS cleared in `finally`.
       const heartbeat = setInterval(() => {
-        void this.refreshLock(spaceId);
+        void this.refreshLock(spaceId, controller);
       }, Math.max(1, Math.floor(GIT_SYNC_LOCK_TTL_MS / 3)));
       heartbeat.unref?.();
       try {
-        return await fn();
+        return await fn(controller.signal);
       } finally {
         clearInterval(heartbeat);
         await this.release(spaceId);
       }
     } finally {
       this.running.delete(spaceId);
+      SpaceLockService.liveLocks.delete(spaceId);
     }
   }
 }