Implement the anti-entropy shard reconciler to detect and repair
replica drift using the fingerprint → diff → repair pipeline.
**Step 1 — Fingerprint**: iterate docs with filter=_miroir_shard={id}
paginated; hash(primary_key || canonical_content_hash); fold into
streaming xxh3 digest keyed by PK. All replicas produce same root.
**Step 2 — Diff on mismatch**: recompute per-bucket (pk-hash % 256)
digests, locate divergent buckets, enumerate divergent PKs.
**Step 3 — Repair**:
- For each divergent PK, read doc from each replica
- If any replica has _miroir_expires_at <= now: DELETE from all replicas
- Else: pick authoritative by highest _miroir_updated_at
- PUT to all replicas that disagree with origin=antientropy
**TTL interaction** (§13.14): AE treats any replica's expires_at <= now
as "delete from all" — the "highest updated_at wins" rule is suspended
for expired docs.
**Scaling mode** (plan §14.6): Mode A — each pod fingerprints and
repairs only its rendezvous-owned shards (shard_id % num_pods == pod_id).
**Config** (plan §4):
```yaml
anti_entropy:
enabled: true
schedule: "every 6h"
shards_per_pass: 0
max_read_concurrency: 2
fingerprint_batch_size: 1000
auto_repair: true
updated_at_field: _miroir_updated_at
```
**Metrics**: miroir_antientropy_shards_scanned_total,
miroir_antientropy_mismatches_found_total,
miroir_antientropy_docs_repaired_total,
miroir_antientropy_last_scan_completed_seconds
**Acceptance**:
- ✅ Induce divergence on 1 shard; reconciler detects and repairs
- ✅ Expired-doc test: stale write does NOT resurrect expired doc
- ✅ CDC subscribers do NOT see anti-entropy writes (origin tag)
- ✅ Mode A: 3 pods, each owns ~1/3 of shards; AE runs once per shard
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
ac1a0a8a81