Files
beardrive/internal
Snow LeeandClaude Opus 5 46cfeb7898 feat(cli): bdrive verify proves this folder matches the hub (BEA-161)
"Your folder is the same everywhere" was a belief with no receipt. `bdrive
status` counts pending ops and unscanned changes but never reads a byte of
content, so a file whose bytes changed while its size and mtime stayed put was
invisible to every check we shipped.

`bdrive verify` hashes every synced file and compares it against
journal.Replay(AllOps), reporting drifted / never-pushed / missing-locally /
not-yet-scanned, and with --remote also missing-on-hub. Exit 0 when every
category is empty, 1 otherwise, so it composes as a pre-flight check.

The logic lives in internal/syncer/verify.go next to Drift and Explain — the
two read-only siblings it completes — because neverSync, chunkThreshold and
loadFilter are unexported there, and because a multi-device test cannot drive
a func main package. cmd/bdrive/verify.go is the thin cobra shell.

Two things that would have made it silently wrong:

- --remote must probe BOTH blobs/<sha> and manifests/<sha>. Files over 4 MiB
  are pushed as chunks plus a manifest keyed by the file's own sha, so a check
  asking only blobs/ would call every large file missing from the hub. Size
  only orders the probe — it can never be a filter, because browser uploads
  always write blobs/<sha> at any size, pushChunked falls back to a whole blob
  when the manifest key is refused, and pre-delta-sync history is whole blobs
  regardless.
- missing-locally applies filter.Skip + neverSync, the same guard materialize
  uses. The rules are symmetric in scan and materialize, so a path the local
  filter excludes is legitimately absent — without this, every project narrowed
  by `bdrive scope --only` would report its whole out-of-scope set as missing.

Pure read throughout: no Session, no volume flock, no ops, no journal writes,
no materialize, and no network without --remote. LoadProject rather than
ResolveMount and remote.Open rather than openSession, so a read never enrolls
the device. An unreachable hub degrades to a printed warning and the local
verdict still decides.

The command says its own caveat out loud: the journals it replays are this
device's local copies, so it proves "this folder matches what I last pulled".

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-21 09:24:23 -07:00
..