--- name: parked-cloud-audit description: "CLOSED — the cloud-sync coverage audit ran and its premise has since moved. Kept for the durable sync-safety principles it produced." metadata: node_type: memory type: project originSessionId: 0b7c5f41-bb34-4ab4-93be-fdb363f5eb40 --- # CLOSED — ran; premise superseded Parked 2026-06-28 as a plan-only, end-to-end audit of cloud sync: does the save payload actually capture every state field that should persist, and does it survive a full round trip. It ran. The persistence model has since changed underneath it, so **the original brief should not be re-run verbatim** — re-scope from the current code first. *Correction 2026-07-20: removed the enumerated state-field list, the file-by-file study plan, protocol numbers, and the verdict/constraint scaffolding. All of that is derivable — see `library/CODE_MAP.md`, `CLAUDE.md` + `rules/`, and the source itself.* ## The principles it produced — these still hold - **The critical failure mode is a SILENTLY unsynced field.** A field that exists in state but never reaches the payload loses data with no error, no warning, and no way for the owner to notice until it's gone. Rate that class of finding as the most severe thing in a sync audit — above anything that fails loudly. - **Every new feature must be explicitly evaluated for cloud-sync impact.** The determination is cheap and has three outcomes: a new state field MUST be added to the serialize path *and* the migration; a feature that only mutates already-synced state needs nothing; and either way the call gets written down where it can be reviewed later. The point is that the question is never *skipped* — silence is what causes the failure mode above. - **Prefer a mechanical guard over a manual sweep.** The reason this audit was needed at all is that coverage was being checked by hand. A guard asserting that every declared state field round-trips catches future omissions without anyone remembering to look. - **Additive, confirm-gated, never auto-push.** Cloud writes must not blindly overwrite, destructive operations must be confirm-gated, and nothing pushes without the owner asking. This is a standing constraint, not an audit finding. Feeds [[parked-synthesis-masterplan]].