fix(sync,daemon,lsp): prune data-loss guards, force-kill identity, quadratic diagnostics

Six medium findings from the audit. Each is pinned by a regression test.

sync/records.js: pruneRecords' only "don't prune after a failure" gate was
RUN-wide, so one converged row in any other table (counted as skipped)
disarmed it. A FIELD_FORBIDDEN 403 is a per-field permission property that
fails every row of exactly one table by design, so a wholly-failed table is
routine -- and under mirror+confirmDeletions its pre-existing dest rows were
deleted while the replacement data was never written, reporting phase=done.
Pass 1 now records per-table outcomes and prune skips a table that wrote
nothing and failed, emitting RECORDS_FAILED_PRUNE_SKIPPED.

sync/prune-schema.js: pruneSchema deleted the fieldMappings targets apply()
had just validated. A target must exist on the dest but not on the source --
the documented injection pattern (source autoNumber Code -> dest text field
InjectID) is dest-only by construction and so always an orphan. The records
job then re-validated, threw FIELD_MAP_INVALID and synced zero records: a
destination column destroyed and no data written.

sync/index.js: the drift guard fingerprints only the DESTINATION, but
plan.orphans is a statement about the SOURCE. A source-side addition between
plan and apply was invisible -- dest untouched so the fingerprint matched, no
DRIFT, no create action in the stale plan -- and pruneSchema then deleted the
dest field that now legitimately matched. expectedName cannot help; the field
kept its name. apply() now re-reads the source before any schema deletion and
drops orphans that regained a counterpart; if that read fails it skips all
schema deletion rather than trusting a stale list.

daemon/launcher.js: stopDaemon --force SIGKILLed a lockfile pid with no
identity check. isStale()'s bare process.kill(pid,0) cannot tell our daemon
from a process that recycled the pid, and on Windows SIGTERM maps to
TerminateProcess -- an unsavable hard kill of a stranger. Now probes
/daemon/health and requires the uuid to echo the lockfile's, mirroring the
extension's _verifyDaemonIdentity. Unproven means release the lock and leave
the process alone.

sync/records.js: buildUpdateCells never compared against the destination, so
every mapped scalar cell of every mapped row was re-posted on each re-sync --
updateRecords issues one serialized POST per CELL, i.e. 20,000 sequential
requests for a 1000-row x 20-field no-op run. Converged cells are now skipped.

language-services diagnostics.ts: isInsideExclusionRange was a linear scan run
once per character by three checkers, so cost was chars x field-refs with no
debounce and no size cap -- and in --tcp daemon mode that blocking is shared
by every attached editor. Now a binary search over the already-ascending
ranges. Measured on the repo's largest shipped example (38,830 chars / 741
refs): 83.3ms -> 9.6ms. On an 87KB/4000-ref synthetic: 592ms -> 10ms.
Diagnostic output identical.

Verified: 1451 mcp-server + 162 language-services + 88 webview tests pass,
check:tool-sync green, pnpm build succeeds. One extension test
(session-backup "rejects backups larger than 200 MB") fails with ENOSPC --
the disk is 100% full and that test truncates a 201 MB file. It passed
earlier this session and neither it nor packages/extension is touched by
this commit.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: ARHAEEM

CHANGELOG.md

@@ -6,6 +6,19 @@ Check [Keep a Changelog](http://keepachangelog.com/) for recommendations on how
 
 ## [Unreleased]
 
+### Fixed — formula diagnostics were quadratic, blocking the editor on every keystroke (2026-07-31)
+
+- **`isInsideExclusionRange` was a linear scan run once per character.** `ranges.some(...)` is
+  O(field refs) and is called per character by `checkParentheses`, `checkQuotes` and
+  `checkBrackets`, plus once per match by five more checkers — so cost was chars × refs, with no
+  debounce and no size cap on either entry point (`registration.ts`'s `onDidChangeTextDocument`
+  and the LSP's `onDidChangeContent`, which in `--tcp` daemon mode is shared by every attached
+  editor). `getFieldRefRanges` emits ascending, non-overlapping spans, so this is now a binary
+  search. Measured on this repo's own largest shipped example
+  (`examples/[IGD-JSON]~[Payload]~[Formula].formula`, 38,830 chars / 741 refs):
+  **83.3 ms → 9.6 ms** per run. On an 87 KB / 4,000-ref synthetic: **592 ms → 10 ms**. Diagnostic
+  output is byte-identical before and after.
+
 ### Fixed — Unconfigure destroyed unrelated config in Codex / Helix files (2026-07-31)
 
 - **`unconfigureMcpToml` and `unconfigureHelix` truncated the user's config file from our marker

packages/language-services/src/engines/formula/diagnostics.ts

@@ -120,11 +120,35 @@ function getExclusionRanges(text: string): Array<{ start: number; end: number }>
   return ranges;
 }
 
+/**
+ * Is `position` inside one of the excluded spans?
+ *
+ * Called once per CHARACTER by checkParentheses, checkQuotes and checkBrackets, and
+ * once per match by five more checkers. `ranges.some(...)` made that chars × refs —
+ * on this repo's own largest shipped example (38,830 chars / 741 field refs) that is
+ * ~29M comparisons of blocked extension host per keystroke, with no debounce and no
+ * size cap on either entry point (registration.ts's onDidChangeTextDocument and the
+ * LSP's onDidChangeContent, which in --tcp mode is shared by every attached editor).
+ *
+ * getFieldRefRanges scans left to right and does not nest, so `ranges` is already
+ * sorted and non-overlapping — binary search is a drop-in, allocation-free swap.
+ */
 function isInsideExclusionRange(
   position: number,
-  ranges: Array<{ start: number; end: number }>
+  ranges: Array<{ start: number; end: number }>,
+  startPad = 0,
+  endPad = 0
 ): boolean {
-  return ranges.some(range => position >= range.start && position < range.end);
+  let lo = 0;
+  let hi = ranges.length - 1;
+  while (lo <= hi) {
+    const mid = (lo + hi) >> 1;
+    const range = ranges[mid];
+    if (position < range.start + startPad) hi = mid - 1;
+    else if (position >= range.end + endPad) lo = mid + 1;
+    else return true;
+  }
+  return false;
 }
 
 // Spans of complete {…} field references, computed outside string literals (no nesting).
@@ -302,7 +326,11 @@ function checkBrackets(text: string, uri?: string): LsDiagnostic[] {
   for (let i = 0; i < text.length; i++) {
     // Skip the INTERIOR of complete {…} refs (a quote in a field name must not flip
     // string state) but still see the braces themselves so balance-checking works.
-    const interior = fieldRefRanges.some(r => i > r.start && i < r.end - 1);
+    // Binary search, not .some() — this runs once per character (see the note on
+    // isInsideExclusionRange). Shrinking the span by one at each end reproduces the
+    // old strict `i > r.start && i < r.end - 1` predicate: the braces stay visible so
+    // balance-checking still works, only the field NAME is skipped.
+    const interior = isInsideExclusionRange(i, fieldRefRanges, 1, -1);
     if (interior) continue;
 
     if (

packages/mcp-server/CHANGELOG.md

@@ -2,6 +2,52 @@
 
 ## [Unreleased]
 
+### Fixed (2026-07-31 — sync prune could delete data it had not replaced)
+
+- **`pruneRecords` had only a RUN-wide failure gate.** The "don't prune after a failed run" check
+  was `failed > 0 && created === 0 && updated === 0 && skipped === 0` against global accumulators,
+  so a single converged row in *any other table* (counted as `skipped`) disarmed it. A
+  `FIELD_FORBIDDEN` 403 is a per-field permission property that fails every row of exactly one
+  table by design, so "one table wholly failed, the rest fine" is routine — and under
+  `mirror` + `confirmDeletions` that table's pre-existing dest rows were deleted while their
+  replacement data was never written, with the job reporting `phase='done'`. Pass 1 now records
+  per-table outcomes (`result.perTable`) and `pruneRecords` skips any table with
+  `failed > 0 && created + updated + skipped === 0`, emitting `RECORDS_FAILED_PRUNE_SKIPPED` —
+  the same shape as the existing truncation guard.
+- **`pruneSchema` deleted the `fieldMappings` targets `apply()` had just validated.** A mapping
+  target must exist on the dest and be writable but is *not* required to exist on the source — the
+  documented injection pattern (source autoNumber `Code` → dest text field `InjectID`) is dest-only
+  by construction and therefore always classified an orphan. `apply()` validated the mappings, then
+  called `pruneSchema` without them and deleted the target; the background records job then
+  re-validated, threw `FIELD_MAP_INVALID` and synced zero records. Net effect: a destination column
+  destroyed and no data written. `fieldMappings` is now threaded through and targets are kept with
+  `FIELD_MAP_TARGET_PROTECTED`.
+- **The drift guard fingerprints only the DESTINATION, but `plan.orphans` is a statement about the
+  SOURCE.** A source-side *addition* between plan and apply was invisible: the dest was untouched so
+  the fingerprint matched, no `DRIFT`/`RESUME_DRIFT` fired, `applyPlan` had no create action for the
+  new field (the plan predates it) — and `pruneSchema` then deleted the dest field that now
+  legitimately matched, taking its data with it. `deleteField`'s `expectedName` guard cannot help,
+  because the dest field kept its name. `apply()` now re-reads the source before any schema deletion
+  and drops orphans that have regained a counterpart (`ORPHAN_STALE_SKIPPED`); if that read fails it
+  skips all schema deletion for the run rather than trusting a stale list (`ORPHAN_RECHECK_FAILED`).
+  The extra read is only paid when deletions are actually confirmed.
+
+### Fixed (2026-07-31 — force-stop could kill an unrelated process; converged re-syncs re-posted every cell)
+
+- **`stopDaemon --force` SIGKILLed a pid read from the lockfile with no identity check.** The only
+  thing establishing that the pid was the daemon was `isStale()`'s bare `process.kill(pid, 0)`
+  liveness probe, which cannot distinguish our daemon from a process that recycled the pid after an
+  unclean death. In that state the lock persists with a live-but-foreign pid, the 10s wait never
+  clears, and the force branch signalled a stranger — on Windows `SIGTERM` maps to
+  `TerminateProcess`, so even the "graceful" first step is an unsavable hard kill. Now mirrors the
+  extension's `_verifyDaemonIdentity`: probe `/daemon/health` and require the uuid to echo the
+  lockfile's. Unproven ⇒ release the stale lock, leave the process alone, and say so.
+- **`buildUpdateCells` performed no comparison against the destination.** `updateRecords` issues one
+  serialized HTTP POST *per cell*, and every mapped writable scalar was re-posted on every re-sync
+  even when nothing had changed — 1000 rows × 20 fields = 20,000 sequential requests for a run that
+  changes nothing. Converged cells are now skipped, which collapses most rows to zero cells and lets
+  the existing empty-row skip drop them entirely. Cleared-cell propagation is unaffected.
+
 ### Fixed (2026-07-31 — tunnel revocation reached only half the cases)
 
 - **The daemon held TWO independent `activeTunnel` handles**, one in `daemon/server.js` (filled by

packages/mcp-server/src/daemon/launcher.js

@@ -561,6 +561,36 @@ export async function stopDaemon(options = {}) {
   }
 
   const pid = recordForShutdown.pid;
+
+  // NEVER signal a pid we have not PROVEN is our daemon.
+  //
+  // isStale()'s liveness probe is a bare `process.kill(pid, 0)` — it cannot tell our
+  // daemon from an unrelated process that recycled the pid after an unclean death.
+  // In that state the lock persists with a live-but-foreign pid, so status is
+  // running/unhealthy, the 10s wait never clears, and this branch used to SIGTERM
+  // then SIGKILL a stranger's process. On Windows `process.kill(pid,'SIGTERM')` maps
+  // to TerminateProcess, so even the "graceful" step is an unsavable hard kill.
+  // The extension already gates its equivalent on _verifyDaemonIdentity; this
+  // mirrors it — probe /daemon/health and require the uuid to echo the lockfile's.
+  let provenOurDaemon = false;
+  try {
+    const health = await adminRequest(recordForShutdown, '/daemon/health', { method: 'GET' });
+    provenOurDaemon = !!recordForShutdown.uuid && health?.uuid === recordForShutdown.uuid;
+  } catch { /* unreachable → unproven, fall through */ }
+
+  if (!provenOurDaemon) {
+    // Release the lock so a fresh daemon can start, but leave the process alone.
+    try {
+      release({ lockPath: getLockfilePath(configDir), expectedUuid: recordForShutdown.uuid });
+    } catch { /* best-effort */ }
+    return {
+      stopped: false,
+      forced: false,
+      pid,
+      reason: `Refusing to force-kill pid ${pid}: it did not answer /daemon/health with this lockfile's uuid, so it cannot be shown to be our daemon — the pid may have been recycled by an unrelated process. The stale lock was released, so a new daemon can start normally. If you are certain pid ${pid} is a hung airtable-user-mcp daemon, end it yourself.`,
+    };
+  }
+
   let signalled = false;
   try {
     process.kill(pid, 'SIGTERM');

packages/mcp-server/src/sync/index.js

@@ -335,7 +335,52 @@ export async function apply({ client, sourceBaseId, destBaseId, planId, runStart
     // applyPlan so matched fields/views exist (orphan deps safe) and BEFORE the records job so
     // the schema is clean before record sync begins. Mutates `result` in-place.
     if (!result.aborted) {
-      await pruneSchema({ client, destAppId: destBaseId, plan: fullPlan, policy, policyOverrides, confirmDeletions, confirmTableDeletions, result });
+      // Re-validate the orphan list against the LIVE source before deleting anything.
+      //
+      // The drift guard above fingerprints only the DESTINATION, but `plan.orphans` is a
+      // statement about the SOURCE ("this dest object has no source counterpart"). A
+      // source-side ADDITION between plan and apply is therefore completely invisible:
+      // the dest is untouched so the fingerprint matches, no DRIFT fires, applyPlan has
+      // no create action for the new field (the plan predates it) — and pruneSchema then
+      // deletes the dest field that now legitimately matches, taking its data with it.
+      // deleteField's expectedName guard cannot help: the dest field kept its name.
+      //
+      // Only pay for the extra read when we are actually going to delete something.
+      let prunePlan = fullPlan;
+      const orphanList = fullPlan.orphans || [];
+      if (orphanList.length && (confirmDeletions || confirmTableDeletions)) {
+        try {
+          const srcNow = await snapshotSchemaOnly(client, sourceBaseId);
+          const srcTablesByName = new Map((srcNow.tables || []).map((t) => [t.name, t]));
+          const stillOrphaned = orphanList.filter((o) => {
+            if (o.kind === 'table') return !srcTablesByName.has(o.name);
+            const st = srcTablesByName.get(o.tableName);
+            if (!st) return true; // whole source table gone → its children are still orphans
+            const pool = o.kind === 'field' ? (st.fields || [])
+              : o.kind === 'view' ? (st.views || [])
+              : (st.sections || []);
+            return !pool.some((x) => x.name === o.name);
+          });
+          for (const o of orphanList.filter((o) => !stillOrphaned.includes(o))) {
+            result.warnings.push({
+              code: 'ORPHAN_STALE_SKIPPED',
+              message: `${o.kind} "${o.name}"${o.tableName ? ` in "${o.tableName}"` : ''} was planned for deletion but now has a source counterpart — the source changed after plan ${planId}. Kept. Re-run mode=plan to sync it.`,
+            });
+          }
+          if (stillOrphaned.length !== orphanList.length) prunePlan = { ...fullPlan, orphans: stillOrphaned };
+        } catch (e) {
+          // Cannot prove the orphan list is current → do not delete on a stale one.
+          prunePlan = { ...fullPlan, orphans: [] };
+          result.warnings.push({
+            code: 'ORPHAN_RECHECK_FAILED',
+            message: `Could not re-read the source to confirm ${orphanList.length} planned deletion(s) are still orphans (${e.message ?? e}); skipped all schema deletions this run.`,
+          });
+        }
+      }
+
+      // fieldMappings is threaded through so pruneSchema never deletes a mapping
+      // TARGET — those are dest-only by construction and therefore always orphans.
+      await pruneSchema({ client, destAppId: destBaseId, plan: prunePlan, policy, policyOverrides, confirmDeletions, confirmTableDeletions, result, fieldMappings });
 
       // Records phase: runs after schema apply, only if not aborted. It is minutes-long for large
       // bases, so we launch it in the BACKGROUND (fire-and-forget) and return immediately — a single

packages/mcp-server/src/sync/prune-schema.js

@@ -349,11 +349,41 @@ export function buildUpdateCells(srcFields, srcCells, destCells, idmap, warnings
       continue;
     }
     if (Array.isArray(coerced.value)) continue; // defensive: no array must ever enter the row payload
+    // Skip cells the destination already agrees with. updateRecords issues ONE
+    // serialized HTTP POST per CELL (client.js `updatePrimitiveCell`), and without
+    // this comparison every mapped scalar cell of every mapped row was re-posted on
+    // every re-sync even when nothing had changed — 1000 rows x 20 fields = 20,000
+    // sequential requests for a no-op run. On a converged table this collapses most
+    // rows to zero cells, which the existing empty-row skip then drops entirely.
+    if (destCells && sameCellValue(destCells[mapping.destFld], coerced.value)) continue;
     cells[mapping.destFld] = coerced.value;
   }
   return cells;
 }
 
+/**
+ * Value equality for the Pass-1 update diff.
+ *
+ * Only ever sees scalars here — array-shaped cells returned earlier, and the
+ * Array.isArray guard above is belt-and-braces — so strict equality covers the
+ * common case and a structural compare covers the object-shaped ones (select
+ * choices, dates carrying a timezone wrapper). Deliberately conservative: when in
+ * doubt it reports "different" and we simply write the cell as before.
+ */
+function sameCellValue(a, b) {
+  if (a === b) return true;
+  // An absent dest cell and an explicit null/'' source cell are not worth a request
+  // apart, but only treat them equal when BOTH sides are empty-ish.
+  const empty = (v) => v === undefined || v === null || v === '';
+  if (empty(a) && empty(b)) return true;
+  if (a === null || b === null || typeof a !== 'object' || typeof b !== 'object') return false;
+  try {
+    return JSON.stringify(a) === JSON.stringify(b);
+  } catch {
+    return false;
+  }
+}
+
 /**
  * Pass 1 record sync: scalar/select upsert + fill the global record map.
  *
@@ -558,6 +588,17 @@ export async function applyRecordsPass1({ client, srcSnapshot, destSnapshot, idm
   for (const srcTable of orderedTables) {
     // A session death latched by a prior table/chunk aborts the whole job — never start a new table.
     if (client.auth?.isSessionDead?.()) { markAborted(client, result); return; }
+    // Per-table write outcome, derived by diffing the run-wide counters across this
+    // iteration. pruneRecords needs it: the only "don't prune after a failure" gate
+    // used to be RUN-wide (failed>0 && created===0 && updated===0 && skipped===0), so a
+    // single converged row anywhere in the run disarmed it — and a table whose every
+    // write failed (a FIELD_FORBIDDEN 403 is a schema-level property that fails every
+    // row of one table by design) then had its pre-existing dest rows deleted under
+    // mirror while the replacement data was never written.
+    const countsBefore = {
+      created: result.created, updated: result.updated,
+      skipped: result.skipped, failed: result.failed,
+    };
     const destTableId = idmap.tables[srcTable.id];
     if (!destTableId) continue; // table not matched → skip
 
@@ -711,6 +752,16 @@ export async function applyRecordsPass1({ client, srcSnapshot, destSnapshot, idm
       }
       persist(idmap, journal);
     }
+
+    // Record what this table actually achieved, for pruneRecords' per-table gate.
+    // Tables that `continue` above never reach here — they attempted no writes, so
+    // the absence of an entry correctly reads as "nothing failed".
+    (result.perTable ??= {})[srcTable.name] = {
+      created: result.created - countsBefore.created,
+      updated: result.updated - countsBefore.updated,
+      skipped: result.skipped - countsBefore.skipped,
+      failed: result.failed - countsBefore.failed,
+    };
   }
 }
 
@@ -1706,6 +1757,24 @@ export async function pruneRecords({ client, destSnapshot, idmap, policy, policy
       continue;
     }
 
+    // Per-table write-failure gate. Deleting dest-only rows in a table whose every
+    // write failed destroys the existing data AND leaves nothing in its place — the
+    // run-wide RECORDS_ALL_FAILED gate cannot catch it, because one converged row in
+    // any other table (counted as `skipped`) disarms it. A FIELD_FORBIDDEN 403 is a
+    // per-field permission property, so "every row of exactly one table failed" is a
+    // routine outcome, not an exotic one.
+    const tableCounts = result.perTable?.[t.name];
+    if (tableCounts && tableCounts.failed > 0
+        && tableCounts.created === 0 && tableCounts.updated === 0 && tableCounts.skipped === 0) {
+      result.warnings.push({
+        code: 'RECORDS_FAILED_PRUNE_SKIPPED',
+        message: `Table "${t.name}": all ${tableCounts.failed} record write(s) failed — skipping mirror ` +
+          `deletion so dest-only rows are not destroyed while their replacement data was never written. ` +
+          `Fix the cause (see warnings) and re-run mode=apply with the same planId.`,
+      });
+      continue;
+    }
+
     // Prefer the first collaborative (non-personal) view; fall back to first view of any type.
     const views = t.views || [];
     const viewId = views.find((v) => !v.personalForUserId)?.id ?? views[0]?.id;