feat(sync): allow nested local roots via a managed primary-folder ignore block

[acmore]

Follow-up to #156: the disjoint-only rule forced results directories to live outside the repo (../collected), which is awkward. An additional mapping's local root may now nest inside the primary mapping's local root — ./results inside the repo just works. Remote roots stay disjoint-only.

How the exclusion is guaranteed (not raced)

The primary folder must not carry the nested subtree, or the same files would have two opposing authorities. okdev maintains a managed block in the primary root's .stignore:

// okdev:begin managed sync excludes
/collected
// okdev:end managed sync excludes

(Syncthing's comment syntax is // — #... lines would be patterns.) Ordering is structural: adding a mapping changes the sync config hash → the sync process chain restarts → the block is merged into the file before the local syncthing daemon starts, so the daemon's first scan already honors it. If a hot-apply path is ever added, it must go through PUT /rest/db/ignores (atomic), never raw file edits.

Removal semantics: never silently widen a folder

Removing a nested mapping prunes its syncthing folder (both sides) and keeps local files, but the ignore entry is retained as a tombstone:

// okdev: retained after mapping removal - delete the next line to sync it via the primary folder
/collected

Without this, removal would bulk-sync the subtree through the code channel — a surprise transfer with data-overwrite potential. Re-inclusion is an explicit one-line deletion. Sync start prints a notice for newly retained entries; status --details lists active and retained excludes.

Validation matrix

• allowed: extra local nested inside the primary local root
• rejected: equal local roots (impossible in syncthing — shared .stignore), nesting between additional mappings, an extra containing the primary, any remote overlap

Testing

• Unit: validation matrix, ignore-pattern derivation (/rel/path, sorted), managed-block merge (create / idempotent / tombstone / re-add / user content preserved before & after block), no-op without file+patterns, status rendering.
• Kind e2e: nested ./collected mapping — exclusion effective from first scan (/workspace/collected never appears on the pod while results flow through the child folder), managed block asserted in .stignore, status shows the exclude; then the mapping is removed and the tombstone + still-excluded behavior is asserted end-to-end.
• gofmt -l clean; go test -race ./... passes.

🤖 Generated with Claude Code