fix(sync): federated collection reconciliation + Pull-from-peer + drawer resilience

[atomantic]

Follow-up to #468, fixing real issues found running federated media-collection sync across two machines (void ↔ null).

What was broken

1. Universe/series-linked collections never reconciled across peers. Each machine minted a random UUID for its Universe: X collection, so per-record sync (keyed on id) saw each machine's copy as a different record → integrity reported both sides "local only", and the merge created a duplicate collection on every peer.
2. "Sync to peer" was push-only → a record the local machine was behind on (e.g. a universe whose canon images live only on the peer) could not be fixed from the machine you were looking at. ("none of the buttons are fixing it")
3. Sync Details drawer hung on "Loading…" when the record fetch stalled.
4. The "Live-pushed records" list on the Instances page grew unbounded and added no value.

Fixes

• Deterministic linked-collection ids (uc-<universeId> / sc-<seriesId> via linkedCollectionId) so every machine converges on one record. Create paths reclaim the id when a tombstone holds it (re-create after delete). Migration 038 canonicalizes existing ids on each machine, merging (union of items) same-owner duplicates and rewriting mediaCollection subscription recordIds — idempotent; both machines converge independently.
• "Pull from peer" — GET /api/peer-sync/record (returns a record's push-payload) + POST /api/peer-sync/pull-record (fetch from peer → applyIncomingPush, which merges the record + background-pulls missing asset bytes). The drawer is now direction-aware: Pull for peer-only, Sync for local-only, both for diverged/assets-missing.
• Drawer resilience — 12s timeout + explicit error state; no more permanent spinner.
• Removed the "Live-pushed records" list (the Sync Details drawer covers per-record status); kept the peerSubs fetch that SchemaGapBadge/SyncStatusSection still use.

mediaCollections sync stays opt-in per peer (enable "Media Collections" on the Instances page).

Tests

Migration 038 (pure transforms + idempotent up()), deterministic-id + tombstone-reclaim units, GET /record & POST /pull-record routes, pullRecordFromPeer/getRecordPayloadForPeer service, drawer pull/push buttons + reject/timeout resilience, apiPeerSync wrapper. Server 7331, client 493, build + lint clean.

[Copilot]

Pull request overview

This PR fixes real-world issues in federated media-collection sync by making universe/series-linked collection identities converge across peers, adding a receiver-initiated “pull” path for per-record sync, and hardening the Sync Details drawer against hung record fetches while removing an unbounded UI list.

Changes:

• Introduces deterministic IDs for universe/series-linked media collections (uc-<universeId> / sc-<seriesId>) plus migration 038 to canonicalize existing data and rewrite affected peer subscriptions.
• Adds peer-sync “pull” capability via GET /api/peer-sync/record (serve push payload) and POST /api/peer-sync/pull-record (fetch + apply payload), with client wrapper + drawer actions.
• Improves SyncDetailDrawer resilience (12s timeout + explicit error state) and removes the Instances-page “Live-pushed records” list while keeping the underlying peerSubs fetch.

Reviewed changes

Copilot reviewed 14 out of 14 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
server/services/sharing/peerSync.js	Adds getRecordPayloadForPeer and pullRecordFromPeer service functions.
server/services/sharing/peerSync.test.js	Adds unit tests for new peer-sync pull/payload helpers.
server/routes/peerSync.js	Adds GET /record and POST /pull-record routes.
server/routes/peerSync.test.js	Adds route tests for /record and /pull-record.
server/services/mediaCollections.js	Switches linked collections to deterministic IDs and reclaims tombstoned IDs on create paths; adds linkedCollectionId.
server/services/mediaCollections.test.js	Adds tests for deterministic IDs and tombstone reclaim behavior.
scripts/migrations/038-canonicalize-linked-collection-ids.js	New migration to canonicalize linked collection IDs and rewrite mediaCollection peer subscriptions.
scripts/migrations/038-canonicalize-linked-collection-ids.test.js	Tests for migration transforms, idempotence, and on-disk rewrite.
client/src/services/apiPeerSync.js	Adds pullRecordFromPeer API wrapper.
client/src/services/apiPeerSync.test.js	Adds test coverage for the new API wrapper.
client/src/components/sync/SyncDetailDrawer.jsx	Adds direction-aware Pull/Sync buttons and record-fetch timeout/error state.
client/src/components/sync/SyncDetailDrawer.test.jsx	Adds UI tests for pull button visibility/call, and timeout/reject error states.
client/src/pages/Instances.jsx	Removes “Live-pushed records” section while keeping shared peerSubs fetch for status/badges.
.changelog/NEXT.md	Documents the reconciliation + pull-from-peer + drawer resilience + UI removal fixes.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 14 out of 14 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 14 out of 14 changed files in this pull request and generated 3 comments.

[Copilot]

Pull request overview

Copilot reviewed 14 out of 14 changed files in this pull request and generated 3 comments.

[Copilot]

Pull request overview

Copilot reviewed 14 out of 14 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 14 out of 14 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 14 out of 14 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (1)

client/src/pages/Instances.jsx:787

• peerSubsLoaded is never reset to false when peer.instanceId becomes available (null → value) or changes, so SnapshotSyncBadge can compute behind=true while peerSubs is still the initial [] and before the first listPeerSubscriptions() settles. Set peerSubsLoaded(false) at the start of this effect (when peer.instanceId is truthy) so “behind” stays suppressed until the first fetch completes for the current instanceId.

  useEffect(() => {
    if (!peer.instanceId) {
      setPeerSubs([]);
      setPeerSubsLoaded(true); // no instanceId → nothing to load; don't suppress forever
      return;
    }
    let cancelled = false;
    const refetch = () => listPeerSubscriptions({ peerId: peer.instanceId }, { silent: true })
      .then((r) => {
        if (!cancelled) setPeerSubs(r?.subscriptions || []);
      })
      .catch(() => {
        if (!cancelled) setPeerSubs([]);
      })
      .finally(() => {
        if (!cancelled) setPeerSubsLoaded(true);
      });

[Copilot]

Pull request overview

Copilot reviewed 14 out of 14 changed files in this pull request and generated 3 comments.

[Copilot]

Pull request overview

Copilot reviewed 14 out of 14 changed files in this pull request and generated 1 comment.