/**
 * Paths from `paths` that a pull result actually landed on disk.
 *
 * Base hashes must only ever be recorded for files that really arrived:
 * recording a failed file poisons the synced manifest — the app then
 * believes the file was pulled, the external-deletion detector sees it
 * missing from disk and marks it for delete, and every later revert
 * re-poisons itself into the same state (field-reported as "everything is
 * marked for delete and revert does nothing").
 */
export function pulledCleanly(paths, result) {
  if (!result) return [];
  const errors = result.errors ?? [];
  // Transport-level failure (invoke rejected / guard refusal): no per-file
  // report exists, so nothing can be assumed to have landed.
  if (!result.ok && errors.length === 0) return [];
  if (errors.length === 0) return paths;
  const failed = new Set(errors.map((e) => e.path));
  return paths.filter((path) => !failed.has(path));
}
