feat(cloud): cleo cloud sync - seal, push, pull and apply each attached stream (T12996)

[kryptobaseddev]

Task: T12996 (C-1 core; the two-device AC lands with the T12999 JOIN, as proposed to team-lead)

Stacked on #1959. sync.push and sync.pull stay unreleased: the CLI never opts in.

What

cloudSync(opts) (cloud/nexus-vault.ts) runs, for each attached stream (the project's and the account's global store, or the one --scope names), pushSyncStream then pullSyncStream, and returns one CloudSyncResult.

• Per stream:
  • a status: synced; disabled (both flags off); paused (clock ahead); not-attached (E_NEXUS_VAULT_NOT_LINKED / E_NEXUS_NOT_A_PROJECT); or refused, with the reason;
  • the counts: sealed, built, sent, duplicates, received, staged, redelivered, applied, held (pending + held-skew + refused-schema) and conflicts;
  • the staged position against the server's head.
• E_SYNC_DISABLED (a new code), with the fix cleo sync enable push, is returned when no attached stream did work and at least one is disabled.
• pullSyncStream now looks for a pull position only when sync.pull is on, so a store with pull off reports disabled instead of "no position".

CLI: cleo cloud sync [--scope project|global] [--api-url] gives one envelope and a one-line summary per stream.

Contracts: CloudSyncResult, CloudSyncStreamResult, and E_SYNC_DISABLED in NEXUS_ACCOUNT_ERROR_CODES.

T12996 ACs

• AC1 (seal, push, pull and apply per stream, counts and seq versus head in one envelope): this PR.
• AC2 (E_SYNC_DISABLED naming cleo sync enable): this PR.
• AC3 (an interrupted run resumes without duplicate or lost ops): this PR, through an injected upload failure. Crash points inside push and pull are covered by feat(sync): push a stream's journal - seal, persist, upload (T12343 S4-2) #1957 and feat(sync): pull a stream's journal - verify, stage once, apply (T12343 S5-1) #1959's resend and re-delivery tests.
• AC4 (the two-device test: edit on A, sync both, it appears on B, plus a status conflict): needs B to join A's journal stream, which needs the journal-restore JOIN (T12999), proposed to team-lead. It lands right after that.

Tests

nexus-vault.test.ts, "C-1", against the fake server:

1. One cloudSync seals, pushes, pulls and applies: synced, sent 1, received 1, applied 1, after equal to head. A rerun does nothing.
2. Interrupted: a segment upload is refused, so the call rejects; the rerun sends the same segment (built 0, sent 1), receives and applies it once. One inbox row, one task.
3. Flags off: E_SYNC_DISABLED, with cleo sync enable push in the fix.

CLI (nexus-vault-cli.test.ts): the API URL passes through, and a scope is passed only when one is given.

Mutations (3, all killed): the E_SYNC_DISABLED refusal dropped, the pull flag check before the position dropped, sent misreported.

Checks

• typecheck: contracts, core, and cleo (against a rebuilt core dist);
• tests: nexus-vault "C-1|S5-1" and nexus-vault-cli (37/37);
• biome on the changed set;
• gates 28, 36, 40, 4, contracts purity, generated drift, 1 and 6 (baseline), and 38 --base origin/feat/T12343-pull;
• skill coverage and lint-changesets.

🤖 Generated with Claude Code