@polycode-projects/the-mechanical-code-talker 4.1.1 → 4.1.2

package/src/domain/memory/trust.mjs

@@ -25,6 +25,33 @@ function parseChatTagRest(rest) {
   return { createdAt, ...(sessionId ? { sessionId } : {}) };
 }
 
+/** The segment a relabeled peer tag carries its origin's stable node id in.
+ *  Chosen so the shipped parser above needs no change to tolerate it: it takes
+ *  everything between the first `:` and the `@` as one opaque session slot, so
+ *  a reader that predates this segment reads `<name>#node:<id>` whole and still
+ *  keys on something node-unique. */
+const PEER_NODE_MARKER = "#node:";
+const PEER_TAG_PREFIX = "peer:";
+
+/** `peer:<displayName>#node:<nodeId>@<ts>` — the wire shape a broadcasting peer
+ *  relabels its own teach/operator tags into. The node id is the origin's
+ *  stable identity and the only part that keys the Source; the display name is
+ *  user-chosen, mutable and collidable, so it records who to SHOW, not who it
+ *  is — the same discipline `child:`'s term and `world:`'s turn segments hold.
+ *  Null for anything without the segment, so an older peer tag falls through to
+ *  the plain teach parse unchanged. */
+function parsePeerNodeTagRest(rest) {
+  if (!rest.startsWith(PEER_TAG_PREFIX)) return null;
+  const at = rest.indexOf("@");
+  const beforeAt = at >= 0 ? rest.slice(0, at) : rest;
+  const createdAt = at >= 0 ? rest.slice(at + 1) : "";
+  const marker = beforeAt.indexOf(PEER_NODE_MARKER);
+  if (marker < 0) return null;
+  const nodeId = beforeAt.slice(marker + PEER_NODE_MARKER.length);
+  if (!nodeId) return null;
+  return { kind: "teachNode", nodeId, displayName: beforeAt.slice(PEER_TAG_PREFIX.length, marker), createdAt };
+}
+
 /**
  * Parse one legacy provenance TAG into a Source descriptor over the closed
  * kind set (the kinds SOURCE_PRIOR scores):
@@ -40,15 +67,23 @@ function parseChatTagRest(rest) {
  *      same tier the hand-written tier2 corpus already scores at; the :turnN
  *      segment a snapshot write carries records when, not who, and is not
  *      part of the Source identity)
- *   mud:<character>[:turnN][:gone] -> { kind:"corpus", name:"mud:<character>" }
+ *   mud:<character>[:epochE][:turnN][:gone] -> { kind:"corpus", name:"mud:<character>" }
  *     (one character's own testimony in a multi-character world — what it told
  *      someone, what it examined for itself, and with `:gone` what it saw leave
  *      the world. Same tier as the world, but one Source per character; the
  *      `mud:` prefix in the name keeps that Source apart from a world of the
- *      same literal name. Both trailing segments say when and what, not who, so
- *      neither is part of the Source identity)
+ *      same literal name. The trailing segments say which run of the world it
+ *      was, when, and what — none of them says who, so none is part of the
+ *      Source identity)
  *   ace:chat:<session>@<ts>    -> { kind:"operator",  createdAt:<ts>, sessionId:<session> }
  *   teach:chat:<session>@<ts>  -> { kind:"teach",     createdAt:<ts>, sessionId:<session> }
+ *   teach:peer:<name>#node:<id>@<ts>
+ *                              -> { kind:"teachNode", nodeId:<id>, displayName:<name>, createdAt:<ts> }
+ *     (a peer's own tag, relabeled for the wire by whichever node authored it.
+ *      The node id keys the Source; the display name is presentation only. A
+ *      peer tag with no `#node:` segment predates the segment and parses as a
+ *      plain "teach" whose session slot is the whole name — which is what lets
+ *      old and new readers share one wire.)
  *   web:<url> | url:<url>      -> { kind:"web",       url:<url> }
  *   reference:<pack>:<article>[@revid] -> { kind:"reference", pack, article }
  *     (split on the first two colons only; the article keeps any @revid and
@@ -105,7 +140,7 @@ export function provenanceTagToSource(tag) {
   // authored shipped content scored at the corpus tier; the per-turn tail is
   // dropped from the id so every write of one world corroborates one Source.
   if (head.startsWith("world:")) return { kind: "corpus", name: head.slice("world:".length).split(":")[0] || "unknown" };
-  // mud:<character>[:turnN] — one character's own testimony inside a multi-
+  // mud:<character>[:epochE][:turnN] — one character's own testimony inside a multi-
   // character world: what it told another character, and what it saw for
   // itself. Same corpus tier as the world it stands in, but a Source per
   // CHARACTER, so every claim an animal makes over a whole game accumulates on
@@ -115,8 +150,13 @@ export function provenanceTagToSource(tag) {
   if (head.startsWith("mud:")) return { kind: "corpus", name: `mud:${head.slice("mud:".length).split(":")[0] || "unknown"}` };
   if (head.startsWith("ace:")) return { kind: "operator", ...parseChatTagRest(head.slice("ace:".length)) };
   if (head.startsWith("teach:")) {
+    const rest = head.slice("teach:".length);
+    // teach:peer:<name>#node:<id>@<ts> — a peer's own relabeled tag off the
+    // wire, keyed on the node id rather than the name beside it.
+    const peerNode = parsePeerNodeTagRest(rest);
+    if (peerNode) return peerNode;
     // the chat teach lane's natural frames — chat.mjs's teachProvenanceTag
-    return { kind: "teach", ...parseChatTagRest(head.slice("teach:".length)) };
+    return { kind: "teach", ...parseChatTagRest(rest) };
   }
   if (head.startsWith("web:")) return { kind: "web", url: head.slice("web:".length) };
   if (head.startsWith("url:")) return { kind: "web", url: head.slice("url:".length) };
@@ -143,6 +183,36 @@ export const SOURCE_PRIOR = Object.freeze({
   entailed: 0.3,
 });
 
+// The read-side of the Source split ontology/tmct-core.ttl declares. tmct:Source
+// is one flat class over a sourceType key whose values fall into all three of
+// PROV's disjoint top classes; this maps each stored sourceType to its read-side
+// subclass and PROV top class. Nothing on disk changes — sourceType is already
+// stored on every Source — so this is derivation, not migration. It lives beside
+// SOURCE_PRIOR because both are tables over the same closed type set, and both
+// the ontology reader in core.mjs and the observation-time chain in
+// resolution.mjs read it.
+export const PROV_CLASS_BY_SOURCE_TYPE = Object.freeze({
+  operator: { subClass: "tmct:AgentSource", prov: "prov:Agent" },
+  teach: { subClass: "tmct:AgentSource", prov: "prov:Agent" },
+  provider: { subClass: "tmct:AgentSource", prov: "prov:Agent" },
+  corpus: { subClass: "tmct:DocumentSource", prov: "prov:Entity" },
+  corpusWeak: { subClass: "tmct:DocumentSource", prov: "prov:Entity" },
+  reference: { subClass: "tmct:DocumentSource", prov: "prov:Entity" },
+  referenceLive: { subClass: "tmct:DocumentSource", prov: "prov:Entity" },
+  web: { subClass: "tmct:DocumentSource", prov: "prov:Entity" },
+  extracted: { subClass: "tmct:DocumentSource", prov: "prov:Entity" },
+  optimisticExtract: { subClass: "tmct:DocumentSource", prov: "prov:Entity" },
+  entailed: { subClass: "tmct:ActivitySource", prov: "prov:Activity" },
+});
+
+/** The source types that assert as a live agent rather than as a document or a
+ *  derivation — the prov:Agent rows above, derived so the two can never drift.
+ *  An agent asserting a claim is witnessing it, which is the whole reason the
+ *  observation-time chain lets these fall back to their own assertion time. */
+export const AGENT_SOURCE_TYPES = new Set(
+  Object.entries(PROV_CLASS_BY_SOURCE_TYPE).filter(([, v]) => v.prov === "prov:Agent").map(([t]) => t),
+);
+
 const RECENCY_HALF_LIFE_MS = 30 * 24 * 60 * 60 * 1000; // 30 days
 export const RECENCY_FLOOR = 0.9; // recency multiplier stays within [0.9, 1.0]
 
@@ -228,6 +298,106 @@ export function computeTrust(fact, sourcesById = {}, opts = {}) {
   return { score, inputs };
 }
 
+/** One assertion record's OWN effective prior: its single source's type prior,
+ *  nudged by that source's own reliability, clamped to [0,1]. A write-time
+ *  constant — recency is deliberately absent, because recency is a function of
+ *  the READING moment, not the writing one, and a stored number that bakes it
+ *  in is already wrong by the time anyone reads it. `source` is that record's
+ *  own Source individual; an absent/unknown one reads as the neutral 1.0. */
+export function assertionPrior(sourceType, source) {
+  const p = (SOURCE_PRIOR[sourceType] ?? 0) * sourceReliabilityOf(source);
+  return round(Math.max(0, Math.min(1, p)));
+}
+
+/** The most any ONE source type's corroboration can contribute to a group,
+ *  however many sources of that type assert the triple. Identities are free to
+ *  mint in a mesh with no central authority, so identity COUNT on its own must
+ *  never buy certainty: a thousand cooperating peers asymptote here instead of
+ *  climbing to 1. `operator` is uncapped, because the person holding the store
+ *  is the one authority this model trusts outright; an unrecognised type is
+ *  uncapped too, since there is no prior to derive a ceiling from.
+ *
+ *  The (prior + 1) / 2 formula is a starting guess. It has not been measured or
+ *  tuned against real corroboration or abuse data, and it is meant to be
+ *  revisited once such data exists. */
+export function aggregateCeilingFor(sourceType) {
+  if (sourceType === "operator") return 1;
+  const prior = SOURCE_PRIOR[sourceType];
+  if (prior === undefined) return 1;
+  return (prior + 1) / 2;
+}
+
+/**
+ * Trust for one assertion GROUP — every live head sharing a triple hash, one
+ * record per asserting source. Noisy-OR over each record's own effective prior,
+ * each decayed by ITS OWN assertion time rather than the group's first write:
+ * every hop ages separately, so a fresh assertion is no longer dragged down by
+ * an old corpus record's timestamp beside it.
+ *
+ * The noisy-OR runs per source TYPE first, each type's aggregate is clamped to
+ * that type's own ceiling, and the clamped aggregates then combine across
+ * types. So same-type corroboration asymptotes at its ceiling, while
+ * cross-type corroboration still climbs past any single type's: an independent
+ * corpus record and an independent peer say more together than either alone.
+ *
+ * The ceiling bounds what CORROBORATION adds, so it never drags a type below
+ * its own strongest single record. One record is testimony, not agreement, and
+ * the Sybil lever this caps is minting extra asserters — an entailed
+ * conclusion whose premise-derived trust already sits above the entailed
+ * ceiling, or a peer whose track record has earned it a prior above the teach
+ * ceiling, keeps what it scored on its own.
+ *
+ * `records` supplies `{ ownTrust, assertedAt, sourceId?, sourceType? }` per
+ * head. Deterministic given the same inputs and `opts.now`. Returns
+ * { score, inputs }, inputs in the per-record order it was handed.
+ */
+export function computeAssertionGroupTrust(records, opts = {}) {
+  const now = typeof opts.now === "number" ? opts.now : Date.now();
+  const heads = Array.isArray(records) ? records : [];
+  const byType = new Map();
+  const inputs = [];
+  for (const r of heads) {
+    const recency = recencyNudge(r?.assertedAt, now, opts.halfLifeMs);
+    const own = Math.max(0, Math.min(1, Number(r?.ownTrust) || 0));
+    const sourceType = r?.sourceType || "";
+    const contribution = Math.max(0, Math.min(1, own * recency));
+    const bucket = byType.get(sourceType) || { complement: 1, strongest: 0 };
+    bucket.complement *= 1 - contribution;
+    bucket.strongest = Math.max(bucket.strongest, contribution);
+    byType.set(sourceType, bucket);
+    inputs.push({ sourceId: r?.sourceId || "", sourceType, ownTrust: own, recency: round(recency) });
+  }
+  let complement = 1;
+  for (const [sourceType, bucket] of byType) {
+    const ceiling = Math.max(aggregateCeilingFor(sourceType), bucket.strongest);
+    complement *= 1 - Math.min(1 - bucket.complement, ceiling);
+  }
+  return { score: heads.length ? round(Math.min(1, 1 - complement)) : 0, inputs };
+}
+
+/** A half-life that decays nothing: `age / Infinity` is 0, so every record's
+ *  multiplier comes out at exactly 1 and computeAssertionGroupTrust returns the
+ *  same noisy-OR with the time axis removed. */
+export const NO_DECAY_HALF_LIFE = Infinity;
+
+/**
+ * The recency-free BASE of an assertion group's aggregate — the only part of it
+ * that a store can materialise and keep.
+ *
+ * Recency is a function of the READING moment, so an aggregate with the decay
+ * folded in is already wrong by the time anyone reads it back: it would have to
+ * be rewritten on every tick of the clock to stay true. What survives storage is
+ * the part that only changes when the group's own records change. A reader takes
+ * this base's audit trail and runs the same aggregate again at its own `now`,
+ * which is where the decay belongs and the only place it can be right.
+ *
+ * `records` is the same per-record shape computeAssertionGroupTrust folds —
+ * `{ ownTrust, assertedAt, sourceId?, sourceType? }`. Returns { score, inputs }.
+ */
+export function computeAssertionGroupTrustBase(records) {
+  return computeAssertionGroupTrust(records, { halfLifeMs: NO_DECAY_HALF_LIFE });
+}
+
 // Laplace/"add-k" pseudo-count: without it a single data point would saturate
 // mgx:sourceReliability to the bare max/min immediately.
 const RELIABILITY_CONFIDENCE_PSEUDOCOUNT = 19;

package/src/domain/memory-facts.mjs

@@ -0,0 +1,139 @@
+// memory-facts.mjs — the projection from a session's own memory fact rows
+// (`{subject, predicate, object}`, the shape memory/core.mjs's readFactRows
+// returns) to the `{individuals, objectProperties}` payload parseEntities
+// consumes, so a page whose only store is taught facts can hand `ask()` a real
+// graph of them instead of an empty one.
+//
+// sprite-facts.mjs does the same job for a CLOSED catalog. It knows every
+// predicate ahead of time, so it can name a class per predicate tail. A chat or
+// ledger session has no catalog: its vocabulary is whatever a visitor taught,
+// pasted or researched this session. So this projection reads the classes OFF
+// the rows rather than off a table.
+//
+//   - a class-membership row (`rdf:type` / `rdfs:subClassOf`) classes its
+//     subject by its object, which is what makes "list pegs" and "how many pegs
+//     are there" answer for a class no vocabulary table has ever heard of —
+//     ask()'s dynamicClassQuery resolves a class noun straight against
+//     `individual.class`;
+//   - every term the store mentions is also an individual of class `term`, so a
+//     term carrying no type of its own is still resolvable and still counted by
+//     "how many terms are there".
+//
+// Nothing here is entailed. A term taught as a peg is listed under `peg`, and
+// under `toy` only if someone taught it that too — following the chain would
+// mean "list toys" reaching a term nobody called a toy. That is sound OWL, and
+// it is also how this projection stops being bounded by the store: a taxonomy
+// 200 classes deep turns 6,000 stored rows into a quarter of a million
+// individuals, which every later resolveObject scan then pays for on a page
+// that has to stay responsive. Chasing a subclass chain is the syllogism
+// engine's job, and it already does it through a chat turn; a projection that
+// wants entailed classes should read them from there rather than re-deriving a
+// partial copy per ask.
+//
+// One individual shape stays OUT: a row itself, classed `Fact` and labelled
+// with its own triple. It reads well ("list facts" prints the stored rows), but
+// a label like "ann rdf:type person" contains its own terms, so resolveObject's
+// containment tier matches it whenever someone asks about "person" — and a term
+// that matches two individuals resolves as AMBIGUOUS rather than as a miss.
+// ask() runs its class-count and world-relation fallbacks only after an honest
+// miss, so those triple labels quietly switch off the very lanes this
+// projection exists to reach. The turn engine already counts and reads back the
+// stored rows on its own.
+//
+// A term's own entries are ordered `term` first, then the classes it was
+// taught, in the order those rows were stored. The tail of that list is what
+// parseEntities' `byId` keeps, so a subject resolves through the most recent
+// class someone actually taught it rather than through `term`.
+//
+// The taught predicate travels in `prop`, and `predicate` is deliberately left
+// empty. codegraph.mjs's relationKind falls back to matching `predicate`
+// against code relation-kind regexes, and a taught predicate hits one by
+// accident easily: "the fabric changes colour" stores `mgx:change`, which the
+// `/(touch|chang|modif)/` rule reads as a `touches` edge, and "what does fabric
+// touch" would then answer "colour". A taught fact is not a code relation, so
+// the code lanes keep the same honest miss they give on a page with no code
+// graph. The world-relation lane still reaches these edges, because it matches
+// `prop` as well as `predicate`.
+//
+// Pure, and deterministic for identical row order.
+
+/** The class every term in the store carries, on top of whatever it was
+ *  taught — the ledger's own word for a node of this graph. */
+export const MEMORY_TERM_CLASS = "term";
+
+const CLASS_MEMBERSHIP_PREDICATES = new Set(["rdf:type", "rdfs:subClassOf"]);
+
+/** Terms and predicates are arbitrary user text, so a dedup key can't join them
+ *  on any separator a term might itself carry. */
+const dedupKey = (...parts) => JSON.stringify(parts);
+
+function usableRows(rows) {
+  return (rows || []).filter((row) => {
+    if (!row || !row.subject || !row.predicate) return false;
+    return row.object !== undefined && row.object !== null && String(row.object) !== "";
+  });
+}
+
+/** subject -> the classes it was directly taught, in stored order. */
+function directClasses(rows) {
+  const direct = new Map();
+  for (const row of rows) {
+    if (!CLASS_MEMBERSHIP_PREDICATES.has(row.predicate)) continue;
+    const subject = String(row.subject);
+    const object = String(row.object);
+    if (subject === object) continue;
+    const taught = direct.get(subject) || [];
+    if (!taught.includes(object)) taught.push(object);
+    direct.set(subject, taught);
+  }
+  return direct;
+}
+
+/**
+ * Project memory fact rows into the graph payload parseEntities consumes.
+ * Every individual and every edge traces back to a row that is actually stored.
+ */
+export function memoryFactGraphPayload(rows) {
+  const kept = usableRows(rows);
+  const direct = directClasses(kept);
+
+  const terms = [];
+  const seenTerm = new Set();
+  const noteTerm = (term) => {
+    if (!term || seenTerm.has(term)) return;
+    seenTerm.add(term);
+    terms.push(term);
+  };
+  for (const row of kept) {
+    noteTerm(String(row.subject));
+    noteTerm(String(row.object));
+  }
+
+  const individuals = [];
+  const seenIndividual = new Set();
+  const addIndividual = (id, label, cls) => {
+    const key = dedupKey(id, cls);
+    if (seenIndividual.has(key)) return;
+    seenIndividual.add(key);
+    individuals.push({ id, label, class: cls });
+  };
+
+  for (const term of terms) {
+    addIndividual(term, term, MEMORY_TERM_CLASS);
+    for (const cls of direct.get(term) || []) addIndividual(term, term, cls);
+  }
+
+  const groups = new Map();
+  const seenEdge = new Set();
+  for (const row of kept) {
+    const subject = String(row.subject);
+    const object = String(row.object);
+    const key = dedupKey(row.predicate, subject, object);
+    if (seenEdge.has(key)) continue;
+    seenEdge.add(key);
+    if (!groups.has(row.predicate)) groups.set(row.predicate, { prop: row.predicate, predicate: "", examples: [] });
+    groups.get(row.predicate).examples.push({ subject, object });
+  }
+
+  return { individuals, objectProperties: [...groups.values()] };
+}

package/src/domain/p2p/facts.mjs

@@ -12,16 +12,23 @@ export const WORLD_NAME_PREDICATE = "mgx:worldName";
 export const NODE_NAME_PREDICATE = "mgx:nodeName";
 export const PLAYED_BY_PREDICATE = "mgx:playedBy";
 export const WAVED_PREDICATE = "mgx:waved";
+export const INVITED_BY_PREDICATE = "mgx:invitedBy";
 
 export const P2P_PREDICATES = Object.freeze([
   WORLD_NAME_PREDICATE,
   NODE_NAME_PREDICATE,
   PLAYED_BY_PREDICATE,
   WAVED_PREDICATE,
+  INVITED_BY_PREDICATE,
 ]);
 
 const provenanceFor = (id, timestamp) => `ace:p2p:${id}@${timestamp}`;
 
+/** The term a node id takes as a fact subject or object, matching `peer:` for
+ *  connection-scoped peer ids. A node id is the stable one — it outlives a
+ *  reconnect, which is what an admission edge needs. */
+export const nodeTerm = (nodeId) => `node:${nodeId}`;
+
 export function worldNameFact(worldId, name, timestamp) {
   return { subject: worldId, predicate: WORLD_NAME_PREDICATE, object: name, provenance: provenanceFor(worldId, timestamp) };
 }
@@ -34,6 +41,20 @@ export function playedByFact(characterId, peerId, timestamp) {
   return { subject: characterId, predicate: PLAYED_BY_PREDICATE, object: `peer:${peerId}`, provenance: provenanceFor(characterId, timestamp) };
 }
 
+/** Who let a node into the mesh. There is no open discovery here — every node
+ *  arrives through an invite a member chose to send — so this edge records a
+ *  social admission graph that identities cannot mint for themselves. The
+ *  joiner writes it, because the joiner is the only side that knows both node
+ *  ids at the moment it decides to join. */
+export function invitedByFact(joinerNodeId, inviterNodeId, timestamp) {
+  return {
+    subject: nodeTerm(joinerNodeId),
+    predicate: INVITED_BY_PREDICATE,
+    object: nodeTerm(inviterNodeId),
+    provenance: provenanceFor(joinerNodeId, timestamp),
+  };
+}
+
 export function waveFact(characterId, roomId, timestamp) {
   return { subject: characterId, predicate: WAVED_PREDICATE, object: roomId, provenance: provenanceFor(`${characterId}-${roomId}`, timestamp) };
 }

package/src/domain/p2p/peer-id.mjs

@@ -16,6 +16,21 @@ export function generateWorldId() {
   return globalThis.crypto?.randomUUID?.() ?? fallbackId("world");
 }
 
+/** A store's stable node id: 16 lowercase hex characters. A peer id is minted
+ *  per connection and a display name is user-chosen and collidable, so neither
+ *  keys a node's own assertions across its lifetime; this one is minted once,
+ *  the first time a store joins a room, and never regenerated. Hex only, so it
+ *  is safe to carry inside a provenance tag beside the `#`, `:` and `@`
+ *  separators that tag's parser splits on. */
+export function generateNodeId() {
+  const bytes = new Uint8Array(8);
+  if (globalThis.crypto?.getRandomValues) globalThis.crypto.getRandomValues(bytes);
+  else for (let i = 0; i < bytes.length; i += 1) bytes[i] = Math.floor(Math.random() * 256);
+  let hex = "";
+  for (const b of bytes) hex += b.toString(16).padStart(2, "0");
+  return hex;
+}
+
 /** Two distinct words drawn from the lexicon's own noun list — a mnemonic
  *  label, not a credential. `random` is injectable for deterministic tests;
  *  defaults to Math.random. Callers add a numeric suffix themselves if a

package/src/domain/p2p/provenance-relabel.mjs

@@ -8,11 +8,22 @@ import { provenanceTagToSource } from "../memory/trust.mjs";
 
 const RELABELED_KINDS = new Set(["teach", "operator"]);
 
+/** The outgoing tag for one fact this node is asserting. The `#node:<id>`
+ *  segment is what makes the origin identifiable across reconnects and
+ *  renames: a display name is user-chosen and collidable, and a peer id is
+ *  minted fresh per connection, so neither keys a node over its own lifetime.
+ *  A node with no id yet emits the older segment-free shape, which every
+ *  reader still parses. */
+export function peerProvenanceTag(displayName, timestamp, nodeId = "") {
+  const node = nodeId ? `#node:${nodeId}` : "";
+  return `teach:peer:${displayName}${node}@${timestamp}`;
+}
+
 /** `provenance` may already be a " | "-joined union of several tags (the
  *  same fact taught more than once, from different sources) — relabel each
  *  segment independently and rejoin, so a segment this peer didn't author
  *  passes through untouched. */
-export function relabelForBroadcast(provenance, myDisplayName, timestamp) {
+export function relabelForBroadcast(provenance, myDisplayName, timestamp, myNodeId = "") {
   const tag = String(provenance || "");
   if (!tag) return tag;
   return tag
@@ -20,7 +31,7 @@ export function relabelForBroadcast(provenance, myDisplayName, timestamp) {
     .map((segment) => {
       const source = provenanceTagToSource(segment);
       if (!source || !RELABELED_KINDS.has(source.kind)) return segment;
-      return `teach:peer:${myDisplayName}@${timestamp}`;
+      return peerProvenanceTag(myDisplayName, timestamp, myNodeId);
     })
     .join(" | ");
 }

package/src/domain/p2p/sync-filter.mjs

@@ -6,7 +6,11 @@
 // actually added since boot.
 import { provenanceTagToSource } from "../memory/trust.mjs";
 
-const CHAT_SYNCABLE_KINDS = new Set(["teach", "operator"]);
+// "teachNode" is the same human teaching, seen from one hop further out: a
+// peer's own relabeled tag, keyed on the node id it carries. It syncs for
+// exactly the reason "teach" does, and leaving it out would silently strand
+// every fact that had already crossed the wire once.
+const CHAT_SYNCABLE_KINDS = new Set(["teach", "operator", "teachNode"]);
 
 /** chat.html: every fact a human (locally or via a peer) actually taught or
  *  asserted — never a row from the shipped corpus. */

package/src/domain/p2p/wire.mjs

@@ -20,12 +20,15 @@ function fromBase64Url(b64url) {
 
 /** Encode one invite envelope — an offer (from the sharer) or a reply (from
  *  the joiner) — into a URL-safe string. An offer carries the world id and
- *  name so a fresh joiner can be shown them before connecting; a reply only
- *  needs to carry the answer SDP back to the inviter. */
-export function encodeInviteBlob({ kind, sdp, world, worldName }) {
+ *  name so a fresh joiner can be shown them before connecting, plus the
+ *  inviter's own node id, which is what lets the joiner record who admitted it;
+ *  a reply only needs to carry the answer SDP back to the inviter. */
+export function encodeInviteBlob({ kind, sdp, world, worldName, node }) {
   if (!INVITE_KINDS.has(kind)) throw new Error(`encodeInviteBlob: unknown kind "${kind}"`);
   if (typeof sdp !== "string" || !sdp) throw new Error("encodeInviteBlob: sdp is required");
-  const envelope = kind === "offer" ? { v: 1, kind, sdp, world, worldName } : { v: 1, kind, sdp };
+  const envelope = kind === "offer"
+    ? { v: 1, kind, sdp, world, worldName, ...(node ? { node } : {}) }
+    : { v: 1, kind, sdp };
   return toBase64Url(JSON.stringify(envelope));
 }
 

package/src/domain/scene-compose.mjs

@@ -83,8 +83,8 @@ function resolveSpanToClass(graph, classIndex, tokens, used, start, longestClass
  *  appears, paired with the real material label (one of that SAME class's own
  *  swatch labels — never another class's, never a fabricated one) immediately
  *  preceding it, or `null`. `classIndex` is `{className: {materials}}` with
- *  `materials` keyed by lowercase label (sprites.html's own client-side
- *  `buildClassIndexFromDom` output, or an equivalent test fixture) — a class name
+ *  `materials` keyed by lowercase label (sprite-catalog-viz.mjs's own
+ *  `sceneComposerClassIndex` output, or an equivalent test fixture) — a class name
  *  absent from `classIndex` can never match, and a modifier word that isn't one
  *  of ITS matched class's own material labels is silently dropped rather than
  *  guessed at, the same honest-miss posture an unrecognized class name gets (an

package/src/services/adventure-viz.mjs

@@ -1208,6 +1208,7 @@ ${engineBundleJs ? `<script>\n${embedScriptText(engineBundleJs)}\n</script>` : `
   let persist = null;
   let persistSaveTimer = null;
   window.tmctAdventureLastSave = null;
+  window.tmct.lastSave = null;
 
   // The deploy's own version, read off the service worker file the build
   // already stamps (its cache name embeds package.json's version) — the only
@@ -1238,7 +1239,10 @@ ${engineBundleJs ? `<script>\n${embedScriptText(engineBundleJs)}\n</script>` : `
       }
       const visitedRoomIds = lastSnapshot ? lastSnapshot.visitedRoomIds : [];
       persist.save({ memoryPayload: memoryPayload, visitedRoomIds: visitedRoomIds }).then((saved) => {
-        if (saved) window.tmctAdventureLastSave = { at: Date.now(), ms: Math.round(performance.now() - started) };
+        if (saved) {
+          window.tmctAdventureLastSave = { at: Date.now(), ms: Math.round(performance.now() - started) };
+          window.tmct.lastSave = window.tmctAdventureLastSave;
+        }
       });
     }, 500);
   }