merge: task 8 sync engine

docs/TODO.md

@@ -29,6 +29,15 @@ Small, specific, independently actionable. Remove only when actually done.
 - [ ] Restore: an unlink of identical attachment bytes between the pre-write and the commit could remove the file;
   mitigated by re-writing after commit, not locked.
 - [ ] Export bundles hold attachment bytes in memory; very large libraries need a streaming zip.
+- [ ] Sync: `list` records are snapshotted but not applied to `lists` (Trakt/Hardcover emit them). Decide
+  the mapping (one list per record, items by matched work) and apply it through the change engine.
+- [ ] Sync: accepting a `removed` event on an engagement de-duplicated across sources soft-deletes it even if
+  another connection still reports it; consider detaching that connection's `engagement_sources` row instead.
+- [ ] Sync: pending `changed`/`conflict` events for a value the source has since moved past stay pending;
+  consider superseding them when a newer value for the same field arrives.
+- [ ] Sync: two concurrent runs of the same connection can both insert a new `source_records` row for one key
+  (one fails on the unique key and is logged as a record error). The job worker should lock per connection.
+- [ ] Sync: `ingestListens` does one lookup and one insert per listen; batch it for large backfills.
 - [ ] Admin merge does not merge colliding children recursively; colliding children stay under the tombstoned parent.
 - [ ] Matching: a shared parent resolved without external IDs or position (title/year reuse in
   `packages/core/src/matching.ts`) has no unique key, so concurrent matches can create it twice.