livesync-bridge: stop restart-time vault deletion + make bulk replay resilient

[AlienWalker1995]

What broke

A livesync-bridge restart wiped the materialized notes/ mirror. Root cause: the storage peer's scanOfflineChanges ran its offline diff against the notes/ 9p bind mount before Docker Desktop finished populating it — it read the not-yet-mounted (empty) tree as thousands of deletions and propagated them toward CouchDB and disk. Every bridge restart was a coin-flip that could mass-delete the vault.

CouchDB is the authoritative store (every Obsidian device syncs to it); notes/ is a materialized mirror the 24/7 AI stack reads. Recovery from this incident surfaced a second bug: the bridge's bulk fetch-from-first replay (rebuilding the whole vault from CouchDB on a fresh index) would silently stall partway on a single bad document, leaving the mirror short.

Fixes

1. Stop the restart-time deletion (20d8b15)

• scanOfflineChanges: false — the offline reconciliation is the destructive path and is unnecessary for a 24/7 bridge: useChokidar (with CHOKIDAR_USEPOLLING) carries host/AI edits → CouchDB, and device → CouchDB → file is network-driven. Only changes made while the bridge was down are missed, and they re-sync on next touch — a benign staleness, never a deletion. CouchDB→disk full materialization still happens via the couchdb peer's fetch-from-first.
• Stable-populated mount gate in entrypoint.sh: when CouchDB is populated, refuse to start the sync daemon until the on-disk file count has been unchanged across 3×5s (i.e. the 9p mount finished enumerating), so no startup scan ever sees a partial tree.

2. Make the bulk replay resilient (5452b9a)

• patch-watch-resilience.ts (applied at build time, self-verifying — the build fails if the upstream pattern is gone) patches the vendored LiveSync core's beginWatch/followUpdates:
  • skips documents over 25 MiB before the expensive getByMeta() (a 451 MB corrupted .rtb and a 34 MB PDF were stalling the feed) — such files can't reliably materialize to the disk mirror anyway and stay safe in CouchDB;
  • moves getByMeta() inside the try/catch, so a corrupted doc ("Corrupted document") or oversized one (RangeError: string too long) is logged and skipped instead of halting every document sequenced after it.
• LSB_ALLOW_EMPTY_STORAGE=1 escape hatch to skip the mount-readiness gate for a deliberate fresh-device re-materialization (intentionally-emptied notes/).

Validation

• Fixed image boots with the gate waiting for the mount to stabilize, then zero Unlink/delete events; doc_del_count held throughout.
• With polling contention removed for the one-shot rebuild, a full CouchDB→disk materialization completes to the full ~5,260 files; the 451 MB / 34 MB monsters are cleanly skipped (kept in CouchDB).
• Steady state (polling on) holds the complete mirror with no regression.

Notes / follow-ups (not in this PR)

• The bridge's since checkpoint lives in ephemeral in-container Deno localStorage, so every recreate re-runs the full replay. Persisting /deno-dir/location_data on a named volume would make restarts resume instead of rebuild — a candidate follow-up.
• Operational lesson recorded separately: LiveSync soft-deletes (deleted:true field) are invisible to doc_del_count — audit deletions via _find {"selector":{"deleted":true}}, and un-delete via _bulk_docs (content chunks are retained).

🤖 Generated with Claude Code