fix(sync): honor per-spoon auto-sync settings

packages/backend/convex/githubSync.ts

@@ -16,6 +16,7 @@ import {
   listPullRequests,
   syncForkBranch,
 } from './githubClient';
+import { shouldAutoSync, shouldCreateReviewThread } from './syncGating';
 
 const getRequiredUserId = async (ctx: ActionCtx) => {
   const userId = await getAuthUserId(ctx);
@@ -69,6 +70,16 @@ const refreshOwnedSpoon = async (
       'GitHub refresh is only available for GitHub Spoons.',
     );
   }
+  const settings = await ctx.runQuery(internal.spoonSettings.getInternal, {
+    spoonId,
+    ownerId,
+  });
+  const autoSyncEnabled = settings?.autoSyncEnabled ?? false;
+  const autoReviewEnabled = settings?.autoReviewEnabled ?? true;
+  const requireCleanCompareForSync =
+    settings?.requireCleanCompareForSync ?? true;
+  // requireAiLowRiskForSync applies to the future AI review-to-auto-merge path,
+  // which is deliberately deferred until Phase 4.
   const connection = await ctx.runQuery(internal.github.getConnectionForUser, {
     userId: ownerId,
   });
@@ -202,7 +213,13 @@ const refreshOwnedSpoon = async (
       summary: `GitHub refresh complete: ${upstreamCompare.aheadBy} upstream commit(s), ${forkCompare.aheadBy} fork-only commit(s).`,
     });
 
-    if (status === 'behind' && forkCompare.aheadBy === 0 && allowAutoSync) {
+    if (
+      allowAutoSync &&
+      shouldAutoSync(
+        { autoSyncEnabled, requireCleanCompareForSync },
+        { status, forkAheadBy: forkCompare.aheadBy },
+      )
+    ) {
       try {
         await syncForkBranch(octokit, {
           forkOwner,
@@ -258,7 +275,7 @@ const refreshOwnedSpoon = async (
       }
     }
 
-    if (status === 'diverged') {
+    if (shouldCreateReviewThread({ autoReviewEnabled }, { status })) {
       const threadId = await ctx.runMutation(
         internal.threads.createMaintenanceThread,
         {