@promptctl/cc-candybar 1.33.0 → 1.34.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@promptctl/cc-candybar",
-  "version": "1.33.0",
+  "version": "1.34.1",
   "description": "Statusline renderer for Claude Code — a JSON5-configurable DSL with daemon-cached data sources, byte-clean palette-aware composition, and OSC8 click verbs.",
   "type": "module",
   "main": "./dist/index.mjs",
@@ -91,9 +91,9 @@
     "mobx": "^6.15.0"
   },
   "optionalDependencies": {
-    "@promptctl/cc-candybar-darwin-arm64": "1.33.0",
-    "@promptctl/cc-candybar-darwin-x64": "1.33.0",
-    "@promptctl/cc-candybar-linux-x64": "1.33.0",
-    "@promptctl/cc-candybar-linux-arm64": "1.33.0"
+    "@promptctl/cc-candybar-darwin-arm64": "1.34.1",
+    "@promptctl/cc-candybar-darwin-x64": "1.34.1",
+    "@promptctl/cc-candybar-linux-x64": "1.34.1",
+    "@promptctl/cc-candybar-linux-arm64": "1.34.1"
   }
 }

package/src/check.ts

@@ -121,6 +121,17 @@ export function checkPayload(
     tmux: { session: "work" },
     theme: { effective: effective.theme },
     look: { effective: effective.look },
+    // [LAW:one-source-of-truth] Was missing here even though EffectiveGlobals
+    // already carried `preset` — a pre-existing gap this ticket's own fixture
+    // needs closed: a preset trigger's `.preset.effective` label and
+    // brandon-layout-edit-2gc.5's `.preset.customized` gate both silently
+    // fell back to their declared defaults ("" / false) rather than the
+    // resolved value, exactly the drift the sibling `*.effective` fields
+    // already guard against.
+    preset: {
+      effective: effective.preset,
+      customized: effective.presetCustomized,
+    },
     style: { effective: effective.style },
     charset: { effective: effective.charset },
     colorCompatibility: { effective: effective.colorCompatibility },
@@ -294,6 +305,14 @@ function loadRegisterRender(
     const globals = presetGlobals(config, preset);
     const effective: EffectiveGlobals = {
       preset,
+      // [LAW:no-silent-failure] `check` validates a config file in isolation
+      // — it never reads the daemon-owned overrides file, so there is no
+      // rootOps log to be customized BY. false is the honest value for THIS
+      // (primary, returned) render, not a stand-in default: a fresh session
+      // has never customized anything. A second render pass below also
+      // exercises `true`, so a `.preset.customized`-gated segment still
+      // gets checked — just not through this value.
+      presetCustomized: false,
       theme: effectiveThemeName(null, globals.palette),
       look: effectiveLookName(null, globals.look, config.looks),
       style: effectiveStripStyle(null, globals.style),
@@ -310,40 +329,90 @@ function loadRegisterRender(
     // authoring agent is not looking at the bar; check collects the same errors
     // through the render's observer seam and fails the verdict, so exit 0 never
     // blesses a bar that renders ⚠.
-    const segmentErrors: string[] = [];
-    const rendered = renderDsl(
-      config,
-      compiled,
-      store,
-      registry,
-      checkPayload(effective),
-      paletteForThemeName(effective.theme),
-      {
-        style: effective.style,
-        width: CHECK_WIDTH,
-        colorCompatibility: effective.colorCompatibility,
-        wrap: effective.autoWrap,
-        padding: effective.padding,
-        charset: effective.charset,
-      },
-      {
-        onSegmentError: (segName, message) =>
-          segmentErrors.push(`segment "${segName}": ${message}`),
-      },
-      {
-        look: lookKeyByName(config.looks, effective.look),
-        preset: effective.preset,
-      },
-    );
-    if (segmentErrors.length > 0) {
+    const renderOnce = (
+      payloadEffective: EffectiveGlobals,
+    ): { rendered: string; segmentErrors: Map<string, string> } => {
+      // [LAW:types-are-the-program] Keyed by segment NAME, not appended to a
+      // list — a segment errors at most once per pass, so this is the
+      // strongest true shape (dedupe-by-construction within one pass) and
+      // what makes deduping ACROSS the two passes below a plain key check
+      // rather than a message-text comparison.
+      const segmentErrors = new Map<string, string>();
+      const rendered = renderDsl(
+        config,
+        compiled,
+        store,
+        registry,
+        checkPayload(payloadEffective),
+        paletteForThemeName(payloadEffective.theme),
+        {
+          style: payloadEffective.style,
+          width: CHECK_WIDTH,
+          colorCompatibility: payloadEffective.colorCompatibility,
+          wrap: payloadEffective.autoWrap,
+          padding: payloadEffective.padding,
+          charset: payloadEffective.charset,
+        },
+        {
+          onSegmentError: (segName, message) =>
+            segmentErrors.set(segName, message),
+        },
+        {
+          look: lookKeyByName(config.looks, payloadEffective.look),
+          preset: payloadEffective.preset,
+        },
+      );
+      return { rendered, segmentErrors };
+    };
+
+    const primary = renderOnce(effective);
+    // [LAW:verifiable-goals] `.preset.customized` is the ONE gate this
+    // config surface adds that a rich, data-driven fixture (checkPayload's
+    // own stated design one comment up) can never drive true on its own —
+    // every OTHER field a segment might gate on is a VALUE checkPayload can
+    // just supply richly; this one is a daemon-resolved FACT about session
+    // state, not a hookData field a config author's own file ever carries.
+    // Without a second pass, a typo or MissingFieldError inside a user's
+    // OWN `when: '{{ .preset.customized }}'`-gated content (docs/
+    // interaction-authoring.md's own documented pattern) would pass check
+    // clean and only surface later as a live ⚠ error cell. Second pass
+    // only — the RETURNED rendering stays the realistic default (a fresh
+    // session has never customized anything); this pass exists purely to
+    // catch broken content behind the one gate the first pass can't reach.
+    const customizedCheck = renderOnce({
+      ...effective,
+      presetCustomized: true,
+    });
+
+    // [LAW:no-silent-failure] An UNCONDITIONAL segment error (one whose
+    // `when`, if any, is true in both passes — the two renders share the
+    // same config/store/registry and differ only in `presetCustomized`)
+    // fires in BOTH passes identically. Deduped by segment NAME rather than
+    // concatenated: a customizedCheck error is only genuinely NEW
+    // information when primary didn't already report that same segment —
+    // reporting it twice would double-count one bug and the "(under
+    // .preset.customized = true)" tag would misdirect the reader into
+    // thinking it's specific to that gate when it isn't.
+    const errors = [
+      ...[...primary.segmentErrors].map(
+        ([segName, message]) => `segment "${segName}": ${message}`,
+      ),
+      ...[...customizedCheck.segmentErrors]
+        .filter(([segName]) => !primary.segmentErrors.has(segName))
+        .map(
+          ([segName, message]) =>
+            `segment "${segName}": ${message} (under .preset.customized = true)`,
+        ),
+    ];
+    if (errors.length > 0) {
       throw new Error(
-        `config renders with ${segmentErrors.length} segment error${
-          segmentErrors.length === 1 ? "" : "s"
+        `config renders with ${errors.length} segment error${
+          errors.length === 1 ? "" : "s"
         } (the daemon would render ⚠ error cells):\n` +
-          segmentErrors.map((m) => `  ${m}`).join("\n"),
+          errors.map((m) => `  ${m}`).join("\n"),
       );
     }
-    return rendered;
+    return primary.rendered;
   } finally {
     // [LAW:single-enforcer] The registry owns every async handle the config
     // declared (timers, fs watchers, git subscriptions); a one-shot check must

package/src/config/default-dsl-config.ts

@@ -378,6 +378,17 @@ export const RAW_DEFAULT_DSL_CONFIG = {
       path: "preset.effective",
       default: "",
     },
+    // [LAW:one-source-of-truth] brandon-layout-edit-2gc.5 — presetIsCustomized
+    // over the SAME reload's presetRootOps, resolved alongside preset.effective
+    // (RenderPayload.preset.customized). edit-chrome.ts's synthesized "↺ …
+    // customized" segment gates on this directly; a hand-authored config can
+    // read it too for its own reset affordance.
+    "preset.customized": {
+      kind: "input",
+      path: "preset.customized",
+      type: "boolean",
+      default: false,
+    },
     // [LAW:one-type-per-behavior] style/charset/colorCompatibility/autoWrap/
     // padding are theme/look's twins over the remaining persistable globals
     // (candybar-config-engine-71o.3) — the SAME values BuildLineOptions

package/src/config/edit-chrome.ts

@@ -32,6 +32,8 @@ import type {
 } from "./dsl-types.js";
 import { collectSegmentNames } from "./layout-ops.js";
 import { presetByName, presetNames, presetRoot } from "./presets.js";
+import { presetRootOpsKey } from "./loader/persist-target.js";
+import { ident } from "./ident.js";
 import {
   EDIT_MODE_GATE,
   EDIT_NS,
@@ -51,6 +53,16 @@ import {
   disclosureStateVar,
 } from "./disclosure.js";
 
+// [LAW:dataflow-not-control-flow] brandon-layout-edit-2gc.5's diagnostic gate
+// — read the SAME way EDIT_MODE_GATE is: a bare boolean input var, false
+// only on the literal text "false" (evaluateWhen's documented contract).
+// `.preset.customized` is a per-render payload fact (presetIsCustomized over
+// entry.state.presetRootOps for whichever preset is ACTIVE), not config-time
+// knowledge, so the banner below is spliced UNCONDITIONALLY for every
+// preset — same shape, every reload — and this predicate is what decides
+// whether it's visible, never a branch in this synthesis pass.
+const PRESET_CUSTOMIZED_GATE = "{{ .preset.customized }}";
+
 // [LAW:one-source-of-truth] group/menu-synthesized segments (`groups.`/
 // `menus.`) and edit mode's own trigger/chrome (`edit.`) are structural —
 // removing one via `-` would strand its sibling artifacts (a toggle segment
@@ -65,13 +77,15 @@ function isChromeExempt(name: string): boolean {
   );
 }
 
-// [LAW:types-are-the-program] Collapse an arbitrary name to a template-
-// identifier-safe fragment — the SAME shape menu-keys.ts's `ident` enforces,
-// reimplemented here rather than imported (menu-keys.ts's copy is
-// module-private) since both need only the one rule: alphanumerics survive,
-// everything else collapses to `_`.
-function ident(name: string): string {
-  return name.replace(/[^A-Za-z0-9]+/g, "_");
+// [LAW:no-silent-failure] Go-template string-literal escaping for a preset
+// NAME spliced into DISPLAY text (prependCustomizedBanner) rather than an
+// identifier — the same hazard loader/layout.ts's group `label` synthesis
+// already guards against, reimplemented here since that copy is
+// module-private and this one small rule doesn't warrant its own shared
+// module the way `ident` (checked for agreement across three sites —
+// see ./ident.ts) did.
+function escapeTemplateLiteral(s: string): string {
+  return s.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
 }
 
 // [LAW:one-source-of-truth] Every synthesized decl this pass produces, keyed
@@ -258,6 +272,55 @@ function spliceContainer(
   return { ...node, children };
 }
 
+// brandon-layout-edit-2gc.5's other per-preset affordance: a `+`/`-` sibling
+// that isn't about ONE gap but about the preset's rootOps log as a whole —
+// synthesized the SAME way (one reset action targeting this preset's exact
+// `persist` key, one segment hosting `{{ action }}`), UNCONDITIONALLY, with
+// visibility carried entirely by PRESET_CUSTOMIZED_GATE
+// [LAW:dataflow-not-control-flow]. Prepended as an extra ROW (not spliced
+// into the row-interleaved chrome spliceContainer builds) because it is not
+// bound to any one segment gap — it is a fact about the whole tree — so it
+// gets its own line above it, visible or not by the SAME `when` every other
+// synthesized affordance here already uses.
+function prependCustomizedBanner(
+  splicedRoot: LayoutNode,
+  presetName: string,
+  presetIdent: string,
+  rootOpsKey: string,
+  artifacts: ChromeArtifacts,
+): LayoutNode {
+  const actionName = `${EDIT_NS}${presetIdent}.resetLayout`;
+  const chromeSegName = `${EDIT_NS}${presetIdent}.customized`;
+  // [LAW:no-silent-failure] `reset` clears `rootOpsKey` outright, restoring
+  // presetRoot's own fallback (the config's literal, hand-authored root) on
+  // the next reload — the exact undo the ticket's guardrail asked for.
+  // `rootOpsKey` is gated the SAME way every other `presets.<name>.rootOps`
+  // target is (deriveConfigActionValidators), and is ALWAYS a registered
+  // key — config-validators.ts's presetRootOpsContributions registers it
+  // for every declared preset UNCONDITIONALLY, specifically so a preset
+  // edited down to zero non-exempt segments (no removeChrome/insertChrome
+  // persist actions left to register it) doesn't orphan this exact click.
+  artifacts.actions[actionName] = { reset: rootOpsKey };
+  const label = escapeTemplateLiteral(presetName);
+  artifacts.segments[chromeSegName] = {
+    template: `{{ action "${actionName}" "↺ ${label} customized" }}`,
+    when: PRESET_CUSTOMIZED_GATE,
+  };
+  // [LAW:no-silent-failure] A preset's root may carry its OWN top-level
+  // `when` (the A-grammar's container schemas all permit one) — an author
+  // gating the whole preset behind a condition. `spliceContainer` preserves
+  // that onto `splicedRoot` via its `{...node, children}` spread, but this
+  // new OUTER wrapper is a brand-new node with no `when` of its own; without
+  // carrying it up, the reset banner would render even when the author's
+  // own condition is false, leaking past a gate they wrote.
+  return {
+    kind: "container",
+    direction: "vertical",
+    children: [{ kind: "segment", name: chromeSegName }, splicedRoot],
+    ...(splicedRoot.when !== undefined && { when: splicedRoot.when }),
+  };
+}
+
 // One preset's chrome-spliced root. A bare-segment root (the A-grammar
 // collapses a single top-level segment ref to `{ kind: "segment", name }`
 // with no enclosing container) is wrapped in a synthetic horizontal
@@ -269,15 +332,28 @@ function spliceEditChromeForPreset(
   artifacts: ChromeArtifacts,
 ): LayoutNode {
   const { node } = presetRoot(config, presetName);
-  const rootOpsKey = `presets.${presetName}.rootOps`;
+  const rootOpsKey = presetRootOpsKey(presetName);
   const domainName = addableDomainName(presetName);
   const presetIdent = ident(presetName);
   const posCounter = { n: 0 };
+  // [LAW:no-silent-failure] The bare-segment-root case (the A-grammar's
+  // `{ seg, when }` shorthand is a legal PresetDecl.root) carries its OWN
+  // `when` onto this synthetic wrapper too — prependCustomizedBanner's own
+  // when-carry-up reads `splicedRoot.when`, which is this wrapper's `when`
+  // once spliceContainer's `{...node, children}` passes it through
+  // unchanged; without copying it here, a bare-segment preset root's own
+  // gate would never reach that carry-up at all, leaking the reset banner
+  // past it exactly like the container case did before that fix.
   const container: ContainerNode =
     node.kind === "container"
       ? node
-      : { kind: "container", direction: "horizontal", children: [node] };
-  return spliceContainer(
+      : {
+          kind: "container",
+          direction: "horizontal",
+          children: [node],
+          ...(node.when !== undefined && { when: node.when }),
+        };
+  const spliced = spliceContainer(
     container,
     presetIdent,
     rootOpsKey,
@@ -285,6 +361,13 @@ function spliceEditChromeForPreset(
     artifacts,
     posCounter,
   );
+  return prependCustomizedBanner(
+    spliced,
+    presetName,
+    presetIdent,
+    rootOpsKey,
+    artifacts,
+  );
 }
 
 // [LAW:single-enforcer] THE synthesis entry point, called once from

package/src/config/ident.ts

@@ -0,0 +1,22 @@
+// [LAW:one-source-of-truth] THE identifier-collapse rule — collapse an
+// arbitrary name (a segment, action, preset, or menu-host name) to an
+// identifier-shaped fragment so synthesized var/action/segment names carry
+// no dots, brackets, or other characters that would break a template field
+// path or a synthesis-time accumulator key. Every non-alphanumeric RUN
+// collapses to a single `_`.
+//
+// [LAW:no-silent-failure] Multiple sites depend on this SAME collapse
+// producing the SAME result for the SAME input: menu-keys.ts derives a
+// menu's synthesized SessionState/action identity from it; edit-chrome.ts
+// keys synthesized per-preset reset/±-chrome artifacts by it;
+// loader/cross-ref.ts's presetIdentCollisions checks that no two preset
+// names collide under it BEFORE edit-chrome.ts ever runs. Before this
+// module existed, three call sites reimplemented the same regex
+// independently (module-privacy taken too far) — a genuine drift risk: if
+// one copy changed without the others, the collision GUARD would stop
+// matching the collision RULE it exists to enforce, silently reopening the
+// exact "second preset steals the first's synthesized action" bug the
+// guard was written to prevent. One function now; every site imports it.
+export function ident(name: string): string {
+  return name.replace(/[^A-Za-z0-9]+/g, "_");
+}

package/src/config/loader/cross-ref.ts

@@ -11,6 +11,7 @@ import {
   walkNodes,
   type DslConfig,
   type LayoutNode,
+  type PresetDecl,
   type VariableDecl,
 } from "../dsl-types.js";
 import {
@@ -28,6 +29,7 @@ import {
 import { listGlobalsFieldNames } from "./globals.js";
 import { parsePersistTarget } from "./persist-target.js";
 import { presetNames } from "../presets.js";
+import { ident } from "../ident.js";
 import { findKeyLine } from "./diagnostics.js";
 import { isPlainObject, type ValidateCtx } from "./validate-core.js";
 import {
@@ -47,6 +49,54 @@ export const RENAMED_SEGMENTS: Readonly<Record<string, string>> = {
   gitTaculous: "gitaculous",
 };
 
+// [LAW:single-enforcer] Runs HERE — on `cfg.presets`, the MERGED map — not
+// in loader/presets.ts's per-file structural pass (where a round-1 version
+// of this check lived): that pass validates one config source at a time
+// (the bundled default's own RAW_DEFAULT_DSL_CONFIG, or a user's file,
+// independently), so it could only ever catch a collision between two
+// preset names declared in ONE source. synthesizeEditChrome — the thing
+// this guard protects, which keys its per-preset reset action/segment (and
+// the pre-existing per-gap +/- actions) by `ident(presetName)` in a plain
+// object accumulator with no re-entrant cross-ref check — runs on the
+// MERGED config (dsl-loader.ts), so the collision it can actually produce
+// is a merged one: a user preset whose ident collides with a name the
+// BUNDLED library or a different file contributed. This is the one place
+// that sees that merged set, so it's the one place that can prove no
+// collision exists in it.
+//
+// [LAW:one-source-of-truth] `ident` is imported from ../ident.ts — the ONE
+// collapse rule menu-keys.ts, edit-chrome.ts, and this guard all now share,
+// so a future tweak to the rule can't silently desync the guard from the
+// thing it checks.
+//
+// [LAW:no-silent-failure] Two preset names that collapse to the SAME
+// synthesis identifier (e.g. "quick-look" and "quick_look" both → "quick_
+// look") would silently steal each other's synthesized artifacts: the
+// SECOND preset processed overwrites the first's entries, leaving the
+// first preset's already-built tree holding a segment ref to a name that
+// now points at the second preset's reset action. A user clicking "reset"
+// on preset A would silently reset preset B instead.
+function presetIdentCollisions(
+  ctx: ValidateCtx,
+  presets: Readonly<Record<string, PresetDecl>>,
+): void {
+  const byIdent = new Map<string, string[]>();
+  for (const name of Object.keys(presets)) {
+    const id = ident(name);
+    const names = byIdent.get(id);
+    if (names) names.push(name);
+    else byIdent.set(id, [name]);
+  }
+  for (const [id, names] of byIdent) {
+    if (names.length < 2) continue;
+    ctx.issues.push({
+      path: "presets",
+      message: `preset names ${names.map((n) => JSON.stringify(n)).join(" and ")} both collapse to the same synthesis identifier "${id}" — edit mode's synthesized reset affordance would silently steal one preset's action for the other. Rename one.`,
+      line: findKeyLine(ctx.source, ["presets"]),
+    });
+  }
+}
+
 export function validateCrossReferences(
   ctx: ValidateCtx,
   cfg: DslConfig,
@@ -83,6 +133,7 @@ export function validateCrossReferences(
       line: findKeyLine(ctx.source, ["globals", "preset"]),
     });
   }
+  presetIdentCollisions(ctx, cfg.presets);
   // [LAW:one-source-of-truth] A `set … from` NAME must resolve — checked
   // against this config's per-config domains ("looks", the merged looks:
   // block) plus the global registry (themes/styles, and any future

package/src/config/loader/persist-target.ts

@@ -34,7 +34,26 @@ export type PersistTarget =
 // `presets.<name>.root` (src/config/presets.ts), a different namespace this
 // key must never be confused with.
 const SEGMENT_PALETTE_KEY = /^segments\.([^.]+)\.palette$/;
-const PRESET_ROOT_OPS_KEY = /^presets\.([^.]+)\.rootOps$/;
+// [LAW:one-source-of-truth] GREEDY capture, not `[^.]+` — a preset name is
+// validated only non-empty/slash/newline-free (loader/presets.ts), so a dot
+// is a legal preset name (e.g. "v1.compact"). presetRootOpsKey always
+// appends the literal ".rootOps" suffix, so a greedy `(.+)` backtracks to
+// the RIGHTMOST occurrence of that anchored suffix and correctly recovers
+// the full name for ANY preset name, dotted or not — round-tripping
+// presetRootOpsKey exactly, rather than restricting preset names further
+// to dodge the ambiguity a non-greedy/exclusive-dot capture would have.
+const PRESET_ROOT_OPS_KEY = /^presets\.(.+)\.rootOps$/;
+
+// [LAW:one-source-of-truth] THE builder for a preset's rootOps key — the
+// inverse of PRESET_ROOT_OPS_KEY's parse. Two independent sites used to
+// spell `presets.${name}.rootOps` themselves (edit-chrome.ts's synthesis,
+// config-validators.ts's always-registered contribution), with only the
+// regex above as a read-side authority and no shared write-side one — they
+// happened to agree, but nothing enforced it. One function now; both call
+// sites import it.
+export function presetRootOpsKey(name: string): string {
+  return `presets.${name}.rootOps`;
+}
 
 export function parsePersistTarget(key: string): PersistTarget | null {
   if (isGlobalsField(key)) return { scope: "globals", field: key };

package/src/config/loader/presets.ts

@@ -85,10 +85,22 @@ export function validatePresets(
     // config load, not only once an action ranges the "presets" domain (the
     // identical guard looks.ts applies to look names, for the identical
     // reason).
-    if (name === "" || name.includes("/")) {
+    //
+    // [LAW:one-source-of-truth] Newlines are ALSO rejected — the same reason
+    // loader/layout.ts's groupLabelSpec rejects \n/\r in a group's `label`
+    // before it ever reaches escapeTemplateLiteral: a preset name is spliced
+    // as DISPLAY TEXT into a synthesized Go-template string literal
+    // (edit-chrome.ts's "customized" banner), and that escaper only handles
+    // backslash/quote — an embedded newline produces an unterminated string
+    // literal go-template-js forbids, breaking synthesis for the WHOLE
+    // config, not just this one preset. Unlike a label, a preset name is
+    // also an identifier used across other seams (the `presets` domain, the
+    // `presets.<name>.rootOps` wire key), so this belongs in its general
+    // validity check, not a narrower escape-harder fix at the one splice site.
+    if (name === "" || name.includes("/") || /[\n\r]/.test(name)) {
       ctx.issues.push({
         path: `presets.${name}`,
-        message: `preset name ${JSON.stringify(name)} must be non-empty and slash-free — a preset picker writes the name on the set-state wire, which rejects empty values and splits on "/"`,
+        message: `preset name ${JSON.stringify(name)} must be non-empty, slash-free, and newline-free — a preset picker writes the name on the set-state wire (which rejects empty values and splits on "/"), and edit mode splices it into a synthesized template string`,
         line: findKeyLine(ctx.source, ["presets", name]),
       });
       continue;

package/src/config/menu-keys.ts

@@ -22,6 +22,8 @@
 //               the key" position magic: identity depends only on names a reader
 //               can see in the template, never on tree position.
 
+import { ident } from "./ident.js";
+
 // [LAW:one-source-of-truth] The reserved namespace every synthesized menu
 // artifact (state var + cycle action) lives under, mirroring group sugar's
 // `groups.`. A user-authored name under this prefix is a load error so synthesis
@@ -34,14 +36,6 @@ export const MENU_NS = "menus.";
 // drift. This module keeps only the menu's own IDENTITY derivation (member = apply
 // name; key = optional shared key), which group sugar derives differently.
 
-// [LAW:types-are-the-program] Collapse an arbitrary name to an identifier-shaped
-// id so the synthesized var/action/SessionState-key names carry no dots or
-// brackets that would break template field paths. Distinct names never collide
-// under this map for the alphanumeric segment/action names the config uses.
-function ident(name: string): string {
-  return name.replace(/[^A-Za-z0-9]+/g, "_");
-}
-
 // [LAW:single-enforcer] A menu's member name IS its apply-action name. Both the
 // loader and the helper call this so neither restates the rule.
 export function menuMember(applyName: string): string {

package/src/config/presets.ts

@@ -188,6 +188,36 @@ export function sanitizePersistedPresetOverride(
   return rest;
 }
 
+// [LAW:no-silent-failure] sanitizePersistedPresetOverride's twin for the
+// SAME machine-global overrides file, one field over: `presets.<name>.
+// rootOps` entries persist by NAME, and that name only has meaning against
+// the config it was clicked against. Loading a DIFFERENT project's config
+// — one that never declared "compact", say — would otherwise reach
+// applyPresetRootOpsOverrides -> presetRoot -> presetByName, which THROWS
+// for an undeclared name (correctly so for a hand-AUTHORED preset root: a
+// typo in a file the author can see). A stale overrides entry is not that
+// — it is the expected shape of a file that outlives any one project's
+// preset names — so it gets the SAME treatment sanitizePersistedPresetOverride
+// already gives `globals.preset`: dropped before replay ever sees it,
+// never a fatal error replacing an unrelated project's entire bar
+// (brandon-layout-edit-2gc.5 PR review).
+export function sanitizePersistedPresetRootOps(
+  presetRootOps: Readonly<Record<string, readonly string[]>>,
+  declaredPresets: Readonly<Record<string, PresetDecl>>,
+): Readonly<Record<string, readonly string[]>> {
+  const known = new Set(presetNames(declaredPresets));
+  const entries = Object.entries(presetRootOps).filter(([name]) =>
+    known.has(name),
+  );
+  // [LAW:carrying-cost] Identity return when nothing was dropped — the
+  // common case (this daemon serves one project, or every persisted name
+  // happens to be declared) costs one Set build and no new allocation.
+  if (entries.length === Object.keys(presetRootOps).length) {
+    return presetRootOps;
+  }
+  return Object.fromEntries(entries);
+}
+
 // [LAW:one-source-of-truth] brandon-layout-edit-2gc.1's replay step — the
 // SAME "patch an already-merged config" shape applySegmentPaletteOverrides
 // (src/config/loader/merge.ts) uses one field over, run at the SAME point in
@@ -208,6 +238,48 @@ export function sanitizePersistedPresetOverride(
 // already removed it. A malformed individual token (decodeLayoutOp -> null;
 // can only arise from hand-edited or previous-version state, never from this
 // process's own encodeLayoutOp) is filtered the same way, never applied.
+// [LAW:one-source-of-truth] brandon-layout-edit-2gc.5's diagnostic seam — the
+// ONE definition of "does this preset's rendered layout currently differ
+// from what's literally declared in the config file", read from the SAME
+// raw op-log record applyPresetRootOpsOverrides replays (never re-derived by
+// diffing the replayed tree against a fresh presetRoot() call, which would
+// be a second, weaker definition — a structural coincidence between two
+// unrelated edits could equal zero net ops and still disagree with the raw
+// log's own length). A name absent from the record (never edited) and a
+// name present with an empty token list (edited down to nothing, e.g. by
+// undo) are the SAME "not customized" — presence in the record only ever
+// means "this reload's overrides file had an entry", not "and it's non-
+// empty" [LAW:no-defensive-null-guards].
+//
+// Decodes each token the SAME way applyPresetRootOpsOverrides does, rather
+// than trusting the raw token COUNT — a token list where every token
+// decodes to null (malformed, or written by a previous protocol version)
+// is exactly the case applyPresetRootOpsOverrides itself treats as "no ops
+// to replay" (`ops.length === 0 → continue`, leaving the root untouched).
+// Counting raw tokens would disagree with that: "customized" would read
+// true over a tree that is, in fact, byte-identical to the literal
+// declared root — the inverted form of the drift this diagnostic exists to
+// catch.
+//
+// [LAW:carrying-cost] Verifies DECODE only, not whether the decoded op's
+// target/anchor still resolves against the CURRENT tree — that check would
+// need this to duplicate applyLayoutOps' own stale-target resolution
+// (a real walk of the tree) just to COUNT, on every render, a fact only a
+// LATER hand-authored config edit can produce (removing a segment a stored
+// op still names — see the stale-op comment on applyPresetRootOpsOverrides
+// above). A rare, later-edit-triggered false "customized" is the honest,
+// documented cost of keeping this an O(tokens) check rather than an O(tree)
+// one; the doc at docs/interaction-authoring.md's "Knowing when a preset's
+// layout has been edited" section states this same limit.
+export function presetIsCustomized(
+  presetRootOps: Readonly<Record<string, readonly string[]>>,
+  name: string,
+): boolean {
+  const tokens = presetRootOps[name];
+  if (tokens === undefined) return false;
+  return tokens.some((t) => decodeLayoutOp(t) !== null);
+}
+
 export function applyPresetRootOpsOverrides(
   config: DslConfig,
   presetRootOps: Readonly<Record<string, readonly string[]>>,