With an expired Google Drive web session, syncLibrary swallowed the
AUTH_FAILED from the index pull and proceeded with remoteIndex = null,
which is indistinguishable from a first sync: every book looked
unpushed, uploadedHashes was empty, and the engine attempted to upload
the entire library (Uploading 16 / 682), logging one failure per book.
Worse, a null index also skips the peers-tombstone union in the final
index re-push, so a transient index-pull failure could have rewritten
library.json and resurrected deleted books (#4860 class).
- An unreadable index (throw) now aborts the run; an absent one
(404 -> null) keeps first-sync semantics.
- A terminal-failure latch stops the work pools on the first mid-run
AUTH_FAILED (a token can expire mid-run), skips the index re-push,
and rethrows so callers surface one re-auth error instead of a
per-book failure list. Mirrors the existing deleteRemoteBookDir
contract: auth failures rethrow, everything else aggregates.
- On web, the auto library sync now skips while the Drive session is
expired (hasValidWebDriveToken), matching the settings form's
disabled Sync now with its Reconnect CTA.
Tests: unreadable-index abort with zero writes, mid-run abort bounded
to in-flight work with no index re-push, non-auth failures still
non-aborting, absent-index first sync unchanged.
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Huang Xin
3503b0234f