Structural fix for the bidirectional-sync data-loss class (a stray local write — e.g. an empty file from a failed redirect — propagating over pod-generated results). Versioning (#147) remains the safety net; this makes the direction a design choice.

Config shape: per-path from day one

spec.sync.paths entries accept a structured form alongside the compact string (fully backward compatible; plain mappings marshal back to the string form):

sync:
  paths:
    - .:/workspace              # compact form, direction defaults to bi
    # or:
    - local: .
      remote: /workspace
      direction: down           # bi | up | down

• up — local sendonly / pod receiveonly: code push-only; nothing on the pod can alter local files.
• down — pod sendonly / local receiveonly: the pod is the authority; a local write can never clobber pod results.

The single-mapping limit is unchanged for now, but the schema is per-path so lifting it later (multiple disjoint folders, each with its own direction) won't change config shape.

Why per-folder, not per-subpath

A previous attempt (remoteIgnore, #70) was removed in #81: Syncthing stores .stignore in the directory itself, and per-path folder types were explicitly rejected upstream (syncthing/syncthing#8061). Direction is therefore a property of a mapping's whole folder.

Plumbing

• syncengine.Pair carries the resolved direction (never empty).
• okdev sync --mode defaults to the configured path's direction; an explicit flag overrides per-invocation. Mode values validated (two-phase stays internal).
• okdev up starts sync in the configured direction; directional folders skip the two-phase bootstrap (it only exists to protect the remote before flipping to sendreceive — with up/down one side is already sendonly from the start). Direction participates in the sync config hash; explicit bi hashes like the legacy empty value, so upgrading doesn't restart existing sessions.
• Guards: up --reset-workspace and sync reset-remote error out under down — both reseed the remote from local, which would sync back as deletions over the pod's data.
• status --details shows direction: down (<-); JSON gains sync.direction. Mesh receivers stay receiveonly regardless.
• Docs: config-manifest direction guide (incl. keeping generated outputs out of the synced path, fetched via okdev cp / jobs logs), command-reference, multipod skill reference.

Testing

• Unit: YAML union decode/round-trip (compact + structured + malformed), per-path direction validation, ParsePairs direction normalization, mode resolution/validation precedence, syncStartMode directional cases, config-hash direction sensitivity (incl. bi≡legacy), status rendering.
• gofmt -l clean; go test -race ./... passes. E2E Kind previously green on this branch for the default bi path; re-dispatching after the rework.

🤖 Generated with Claude Code