fix(sync): narrow the dirty-rulesets guard to per-file excludes

One uncommitted file under the synced template paths used to skip all three rsyncs for every project. On 2026-07-30 that froze every template everywhere for a full day, and five workflow files went stale in one project alone with nothing reporting it. The blast radius had no relation to what I was editing.

Each dirty path now becomes an --exclude on its own rsync. rsync honors an exclude on both sides, so a withheld file is neither overwritten nor deleted downstream. Every clean file still propagates. A dirty protocols.org skips only its own single-file transfer. A rename withholds both names, since sweeping the old copy would delete a file the project still runs mid-rename.

The run now names what it held back, so a project can see it's one file behind.

The behind-upstream guard stays all-or-nothing. That staleness lives in the destination, so there's no single source file to narrow to.

I verified it against the real checkout mid-change: 48 workflows propagated while the two files dirty at the time were withheld and named. The same run under the old guard would have synced nothing.

1 files changed, 72 insertions, 16 deletions

diff --git a/.ai/scripts/sync-templates b/.ai/scripts/sync-templates
index c4db212..b9769f3 100755
--- a/.ai/scripts/sync-templates
+++ b/.ai/scripts/sync-templates
@@ -16,16 +16,23 @@
 #   Output: one line naming the outcome, matching the previous inline wording
 #   Exit:   0 always, as the inline block did — the outcome is on stdout
 #
-# Two guards decide whether the sync runs at all:
+# Two guards, and they work differently. One withholds files; the other skips
+# the whole run:
 #
-#   Rulesets dirty under the synced paths → skip. rsync -a --delete copies the
-#   working tree by disk presence, so an in-flight edit in rulesets would land
-#   downstream as drift the project never authored.
+#   Rulesets dirty under the synced paths → withhold exactly those files.
+#   rsync -a --delete copies the working tree by disk presence, so an in-flight
+#   edit in rulesets would otherwise land downstream as drift the project never
+#   authored. Each dirty path becomes an --exclude, which rsync honors on both
+#   sides: the file is neither overwritten nor deleted downstream, and every
+#   clean file still propagates. This was a global skip until 2026-07-31, which
+#   meant one uncommitted file in rulesets froze every template for every
+#   project until it was committed.
 #
-#   Project branch behind its upstream → skip. Syncing onto a stale committed
-#   .ai/ baseline measures the diff against old content, so it comes out huge
-#   and conflicts once the branch reconciles to an upstream that already
-#   carries the newer templates.
+#   Project branch behind its upstream → skip the whole sync. Syncing onto a
+#   stale committed .ai/ baseline measures the diff against old content, so it
+#   comes out huge and conflicts once the branch reconciles to an upstream that
+#   already carries the newer templates. This one stays all-or-nothing because
+#   the staleness is in the destination, not in any particular source file.
 #
 # The rulesets location is injectable (SYNC_RULESETS_DIR) so the guards can be
 # exercised against a fixture instead of the real checkout.
@@ -38,11 +45,59 @@ cd "$proj" || {
     exit 0
 }
 
-synced_dirty=$(cd "$rs" && git status --porcelain -- \
+# The dirty set under the synced paths, one repo-relative path per line.
+# core.quotePath=false keeps a non-ASCII filename literal instead of \xNN-escaped,
+# so the path we build an --exclude from is the path on disk.
+synced_dirty=$(cd "$rs" && git -c core.quotePath=false status --porcelain -- \
     claude-templates/.ai/protocols.org \
     claude-templates/.ai/workflows/ \
     claude-templates/.ai/scripts/ 2>/dev/null)
 
+# Turn that set into per-rsync --exclude flags rather than a global skip. An
+# excluded path is neither overwritten nor deleted on the receiving side, so an
+# in-flight edit stays in-flight while every file it doesn't touch propagates
+# normally. The all-or-nothing skip this replaces is what caused the 2026-07-30
+# outage: one uncommitted workflow file withheld every template from every
+# project for a full day.
+protocols_dirty=0
+wf_excludes=()
+sc_excludes=()
+withheld=()
+
+while IFS= read -r line; do
+    [ -z "$line" ] && continue
+    path="${line:3}"
+    # A rename reports "old -> new". Withhold both sides: the new name is
+    # half-landed, and sweeping the old copy downstream would delete a file the
+    # project still runs while the rename sits uncommitted.
+    if [[ "$path" == *" -> "* ]]; then
+        paths=("${path%% -> *}" "${path##* -> }")
+    else
+        paths=("$path")
+    fi
+    for p in "${paths[@]}"; do
+        p="${p%\"}"; p="${p#\"}"
+        case "$p" in
+            claude-templates/.ai/protocols.org)
+                # A single-file rsync has nothing to exclude within, so this one
+                # transfer is skipped outright while the other two still run.
+                protocols_dirty=1
+                withheld+=("$p")
+                ;;
+            claude-templates/.ai/workflows/*)
+                # Leading / anchors the pattern to the transfer root, so a dirty
+                # workflows/foo.org can't also suppress scripts/tests/foo.org.
+                wf_excludes+=("--exclude=/${p#claude-templates/.ai/workflows/}")
+                withheld+=("$p")
+                ;;
+            claude-templates/.ai/scripts/*)
+                sc_excludes+=("--exclude=/${p#claude-templates/.ai/scripts/}")
+                withheld+=("$p")
+                ;;
+        esac
+    done
+done <<< "$synced_dirty"
+
 # behind==0 (up-to-date or ahead-only) means HEAD contains all of upstream, so
 # the baseline is current. No upstream (new/unpushed branch) → rev-list fails →
 # proj_behind stays 0 → the sync runs.
@@ -53,23 +108,24 @@ if [ -d .git ]; then
         && proj_behind=1
 fi
 
-if [ -n "$synced_dirty" ]; then
-    echo "rulesets has uncommitted changes under the synced template paths — skipping .ai/ sync this session (catches up when rulesets is clean):"
-    echo "$synced_dirty" | sed 's/^/  /'
-elif [ "$proj_behind" -eq 1 ]; then
+if [ "$proj_behind" -eq 1 ]; then
     echo "project branch is behind upstream — skipping .ai/ sync this session (templates never land on a stale baseline; the sync runs once the branch is current)"
 else
-    rsync -a "$rs/claude-templates/.ai/protocols.org" .ai/protocols.org
-    rsync -a --delete "$rs/claude-templates/.ai/workflows/" .ai/workflows/
+    [ "$protocols_dirty" -eq 0 ] && rsync -a "$rs/claude-templates/.ai/protocols.org" .ai/protocols.org
+    rsync -a --delete "${wf_excludes[@]}" "$rs/claude-templates/.ai/workflows/" .ai/workflows/
     # Running rulesets' own pytest leaves these in the canonical scripts/tests/,
     # and rsync -a copies by disk presence regardless of .gitignore, so without
     # the excludes every project's tree collects machine-specific cache files.
     rsync -a --delete --exclude='__pycache__' --exclude='.pytest_cache' --exclude='*.pyc' \
-        "$rs/claude-templates/.ai/scripts/" .ai/scripts/
+        "${sc_excludes[@]}" "$rs/claude-templates/.ai/scripts/" .ai/scripts/
     # Known false-success path, inherited and characterized rather than fixed
     # here: this line prints unconditionally, so a run where all three rsyncs
     # failed (an absent canonical source, say) still reports a successful sync.
     # A last-synced manifest must not be written from this branch as it stands —
     # it would stamp success onto a sync that did nothing.
     echo ".ai/ synced from templates"
+    if [ ${#withheld[@]} -gt 0 ]; then
+        echo "  withheld — uncommitted in rulesets, lands once committed:"
+        printf '    %s\n' "${withheld[@]}"
+    fi
 fi