Program beta

A sync-reliability release fixing a permanent resync loop and a false "library was repaired" prompt on wiped devices:

• Uploaded rows are no longer stored as pending. The generic outbox push uploaded the full local row without stamping its sync status, so pending — the local marker for "still waiting to be pushed" — was written into the server copy and pulled straight back down. The row then looked stranded, the 1.0.21 stranded-row rescue re-queued it, and that local write scheduled the next sync: a self-sustaining loop that resynced hundreds of rows on a library nobody had touched (one report: 765 rows, four cycles in a row). Uploads now strip the server-managed columns and stamp synced at the single choke point every full-row upload passes, and pulls assert synced on every row written locally, so the wedged state cannot be represented on the device whatever arrives from the server. Existing backlogs heal on the next pull with no migration, and because the push also repairs the stored server value, devices still running an older build stop looping without updating.
• A device with no library is not "behind a library repair". "Wipe local database" deletes the device's library-generation marker along with everything else, and reading it back defaulted to generation 1 while the account's server generation stays where an earlier repair left it. "This device has no idea which generation it is on" was therefore indistinguishable from "this device is two generations behind", so every wiped or freshly installed device on a once-repaired account took the destructive catch-up path — prompting about unsynced changes an empty device cannot have, and on a send-only device raising a hard sync block it had no way to clear. A missing marker together with an empty library and an empty outbox is now recognised as a fresh device: it adopts the server generation and lets the ordinary full pull fetch the library. A library that has rows but no marker still gets the prompt, because those rows can genuinely be pushed at the wrong generation.
• Smaller fixes: the release publisher no longer aborts one channel's publish because a different, deliberately retired channel still lists deleted artifacts — asset checks are now scoped to the channel being published, and a channel marked unavailable is skipped entirely.