instar 1.3.526 → 1.3.527

package/dist/core/PreferencesReplicatedStore.d.ts

@@ -0,0 +1,212 @@
+/**
+ * PreferencesReplicatedStore — the FIRST concrete consumer of the HLC
+ * replicated-store foundation (WS2.1, multi-machine-replicated-store-foundation
+ * §4 + §7.2 + §13). It layers the `pref-record` replicated kind onto the generic
+ * substrate (ReplicatedRecordEnvelope / UnionReader / ConflictStore /
+ * RollbackUnmerge / ReplicationBudget / StoreSnapshot) so a user preference
+ * learned on machine A is honored on machine B — ONE memory, not one-per-machine.
+ *
+ * THIS IS PURE LOGIC. No fs, no Date directly, no network. It defines:
+ *   A. The `pref-record` store schema (the StoreFieldSchema the registry validates
+ *      on top of the envelope) + the store's IMPACT TIER (high) + per-kind bounds.
+ *   B. The emit-envelope builder: PreferenceEntry → the `data` object a journal
+ *      `pref-record` entry carries (recordKey=dedupeKey, hlc, op, origin, observed).
+ *   C. The union-aware read: a `Map<recordKey, UnionResult>` (from
+ *      ReplicatedStoreReader.readAll('preferences')) → a `PreferenceEntry[]` for
+ *      the session-start block. THE LOAD-BEARING ADVISORY RECONCILIATION (the §15.1
+ *      decision): on an OPEN conflict for a dedupeKey, BOTH variants are injected as
+ *      hints — they ARE advisory, both are usable guidance — rather than blocking on
+ *      operator resolution. Operator resolution (POST /state/resolve-conflict) is
+ *      OPTIONAL cleanup that collapses the flag; it is NEVER a gate on the hint
+ *      being injected. A flag is observability + optional cleanup, not a blocked
+ *      preference. This is what kills the §15.1 over-flag-fatigue concern.
+ *
+ * SUPERSESSION (CMT-1416): this foundation path SUPERSEDES the earlier advisory
+ * `PreferencesSync.ts` (the seamlessness-spec WS2.1, behind
+ * multiMachine.seamlessness.ws21PreferencesPool). BOTH ship dark/default-off, so
+ * there is ZERO runtime duplication today. PreferencesSync is retained dark until
+ * this path is validated, then removed (tracked CMT-1416 — a separate cleanup PR).
+ * They are MUTUALLY EXCLUSIVE in practice: the consumer reads ONE path at a time
+ * (the foundation reader is consulted only when `multiMachine.stateSync.preferences`
+ * is enabled; the legacy merge only when `seamlessness.ws21PreferencesPool` is). An
+ * operator who enables BOTH gets the foundation path's precedence (it is the
+ * principled substrate); the legacy path is the fallback for an agent that has not
+ * yet flipped to the foundation flag.
+ *
+ * SAFETY POSTURE (§14): MECHANISM, dark by default. Nothing here blocks a
+ * user-initiated action. `violationPattern` (the operator's self-violation
+ * detection regex/keywords) is a LOCAL-ONLY signal that reveals the operator's
+ * security posture, so it is NEVER part of the replicated store schema and is
+ * stripped from every emitted envelope (mirrors PreferencesSync finding #1).
+ */
+import type { PreferenceEntry } from './PreferencesManager.js';
+import type { StoreFieldSchema, ReplicatedEnvelope, ReplicatedOp } from './ReplicatedRecordEnvelope.js';
+import type { ImpactTier, OriginRecord, UnionResult } from './UnionReader.js';
+import type { ReplicatedKindBounds } from './ReplicationBudget.js';
+import type { HlcTimestamp } from './HybridLogicalClock.js';
+/** The stateSync config sub-key + advert suffix for this store (e.g.
+ *  `multiMachine.stateSync.preferences.enabled`). Equal to the advert flag key
+ *  `stateSyncReceive['preferences']`. */
+export declare const PREF_STORE_KEY = "preferences";
+/** The JournalKind string this store rides — the DUAL-REGISTRY's dynamic half.
+ *  MUST also be present in CoherenceJournal.JOURNAL_KINDS (the static half), or the
+ *  store advertises receive=true yet serves/applies/pulls nothing (§4 callout). */
+export declare const PREF_RECORD_KIND = "pref-record";
+/**
+ * Preferences are HIGH-impact (spec §614 / master-spec decision 2): a concurrent
+ * divergent edit to the SAME dedupeKey from different origins goes through
+ * APPEND-BOTH-AND-FLAG — both versions preserved, ONE deduped conflict, never a
+ * silent overwrite. (The CONSUMER read path still injects BOTH variants as advisory
+ * hints — see mergeUnionToPreferences — so the flag never suppresses guidance.)
+ */
+export declare const PREF_IMPACT_TIER: ImpactTier;
+/**
+ * Per-kind replication bounds (§8). Preferences are FEW — a tight window with a
+ * coalescing rate cap (the burst of edits to one dedupeKey collapses to the latest
+ * state per interval). Mirrors the PreferencesSync precedent's per-store cap
+ * (DEFAULT_MAX_REPLICATED_PREFERENCES=500). The retention here matches the
+ * journal-level `pref-record` fallback in CoherenceJournal.DEFAULT_RETENTION; the
+ * aggregate journal budget (64 MiB default) trivially covers a 2 MiB pref stream.
+ */
+export declare const PREF_RECORD_BOUNDS: ReplicatedKindBounds;
+/**
+ * The store-specific field names the `pref-record` schema OWNS (the unknown-field
+ * counter's allowlist). NOTE: `violationPattern` is DELIBERATELY ABSENT — it is a
+ * LOCAL-ONLY signal (the operator's self-violation regex/keywords) that must never
+ * replicate (PreferencesSync finding #1). `dedupeKey` is ABSENT too — it is the
+ * recordKey (a reserved envelope field), never a store field. `lastMutatedSeq`,
+ * `storeIncarnation` etc. are local replication bookkeeping, never replicated here.
+ */
+export declare const PREF_STORE_KNOWN_FIELDS: ReadonlyArray<string>;
+/** Caps mirroring the PreferencesManager discipline — a value over the cap REJECTS
+ *  the whole record (never truncate-and-accept). */
+export declare const MAX_LEARNING_LENGTH: number;
+export declare const MAX_PROVENANCE_LENGTH = 64;
+/**
+ * The `pref-record` store schema (§4). Strict typed validation on top of the
+ * envelope: reject free text beyond the known fields, jail any path-shaped string,
+ * narrow each field. Returns the validated store-specific object, or null to reject
+ * the WHOLE record. PURE (no I/O, no mutation of `raw`).
+ */
+export declare const prefRecordStoreSchema: StoreFieldSchema;
+/** The `data` object a `pref-record` journal entry carries: the validated store
+ *  fields PLUS the envelope fields. Deterministic shape; `observed` omitted when
+ *  absent. */
+export type PrefRecordData = Record<string, unknown>;
+/** The credential scrubber seam (injected so this module stays pure — the real
+ *  wiring passes `redactForLiveTail`). Returns the scrubbed text + whether anything
+ *  was redacted. */
+export type LearningScrubber = (input: string) => {
+    text: string;
+    redactedCount: number;
+};
+/** Input to buildPrefRecordData: the entry to emit, the freshly-ticked hlc, the op,
+ *  this machine's origin id, and the observed-witness (the hlc already merged for
+ *  THIS dedupeKey before writing, or absent). */
+export interface BuildPrefRecordInput {
+    entry: Pick<PreferenceEntry, 'learning' | 'confidence' | 'dedupeCount' | 'provenance' | 'recordedAt' | 'dedupeKey'>;
+    hlc: HlcTimestamp;
+    op: ReplicatedOp;
+    origin: string;
+    /** The HLC already merged for THIS dedupeKey before writing, or absent (§7.2). */
+    observed?: HlcTimestamp;
+    /** Credential scrubber applied to `learning` at emit time (PreferencesSync finding
+     *  #5: usefulness never depends on the scan — a flagged learning still replicates,
+     *  redacted). Omitted ⇒ no scrub (the in-process default is to pass the real
+     *  scrubber). */
+    scrub?: LearningScrubber;
+}
+/**
+ * Build the `pref-record` envelope `data` for emission (§4). recordKey = the
+ * preference `dedupeKey` (the natural primary key — the same dedupeKey on two
+ * machines is the SAME learned lesson). `violationPattern` is NEVER included (local-
+ * only). `learning` is credential-scrubbed when a scrubber is supplied. The returned
+ * object is the journal entry's `data`; the envelope fields are authoritative.
+ *
+ * NOTE: this does NOT validate — it produces a well-formed `data` the journal emit
+ * path serializes; the RECEIVE door (validateReplicatedEnvelope + the store schema)
+ * re-validates on apply. Emission is GATED upstream by
+ * `multiMachine.stateSync.preferences.enabled` (the caller checks
+ * isStoreEmissionEnabled before calling this) — when off, this is never reached.
+ */
+export declare function buildPrefRecordData(input: BuildPrefRecordInput): PrefRecordData;
+/**
+ * Reconstruct a PreferenceEntry from an OriginRecord's store `data` (the envelope
+ * fields stripped). Defensive: a field that does not narrow falls back to the same
+ * safe default PreferencesManager.read() uses. `dedupeKey` is the recordKey.
+ */
+export declare function prefEntryFromOriginRecord(rec: OriginRecord): PreferenceEntry;
+/**
+ * Build an OriginRecord for the OWN preference store (the single-origin
+ * materialization the union reader merges). recordKey = dedupeKey; the envelope
+ * carries a SYNTHETIC own-origin stamp. NOTE: this is the OWN record at rest — it
+ * is NOT the wire/journal hlc (that is minted by clock.tick() at the EMIT path);
+ * here we only need a stable own-origin record for the union to merge against peer
+ * replicas. `lastMutatedSeq` is folded into a deterministic logical counter so the
+ * own record has a well-formed, monotone HLC position relative to its own edits.
+ * `violationPattern` is NEVER carried into the replicated namespace (local-only).
+ */
+export declare function prefEntryToOriginRecord(entry: PreferenceEntry, origin: string): OriginRecord;
+/**
+ * THE LOAD-BEARING ADVISORY RECONCILIATION (§15.1 decision, recorded verbatim).
+ *
+ * Collapse a `Map<recordKey, UnionResult>` (from
+ * ReplicatedStoreReader.readAll('preferences')) into the PreferenceEntry[] the
+ * session-start block consumes. The §15.1 contract:
+ *   - A resolved single value ⇒ inject that one entry.
+ *   - An OPEN HIGH-impact conflict ⇒ inject BOTH (all) concurrent variants as
+ *     separate hints. They ARE advisory — both are usable guidance — so the open
+ *     conflict NEVER suppresses a usable hint. Operator resolution (POST
+ *     /state/resolve-conflict) is OPTIONAL cleanup that collapses the flag; it is
+ *     NEVER a gate on the hint being injected.
+ *   - A LOW-impact divergence ⇒ the HLC-winner is `value`; inject it (the overwrite
+ *     was flagged for observability, but the value is usable).
+ *   - A null `value` with no conflict (every origin deleted, or no record) ⇒ nothing
+ *     to inject for that key.
+ *
+ * This is the proof obligation the §12 wiring test exercises: an OPEN conflict for a
+ * dedupeKey STILL yields both variants in the output (it can never suppress a usable
+ * hint waiting on operator resolution). The conflict's `versions` carry every
+ * concurrent origin's record; we map EACH to a PreferenceEntry hint.
+ *
+ * Determinism: variants from a conflict are emitted in the union reader's stable
+ * (HLC-sorted) version order, so the injected block is stable across reads.
+ */
+export declare function mergeUnionToPreferences(union: Map<string, UnionResult>): PreferenceEntry[];
+/**
+ * Build the session-start preferences block from a union read (the foundation
+ * path's equivalent of PreferencesManager.sessionContext()). Reuses the SAME
+ * deterministic, byte-bounded, priority-ordered renderer
+ * (`formatPreferencesForSessionStart`) so the injected block shape is identical to
+ * the single-machine path — only the SOURCE differs (the no-clobber union vs the
+ * local store). An open conflict yields BOTH variants in the block (§15.1).
+ */
+export declare function buildUnionSessionContext(union: Map<string, UnionResult>, maxBytes?: number): {
+    present: boolean;
+    block: string;
+    count: number;
+    scope: 'mesh';
+};
+/** The ReplicatedKindRegistry registration for the `pref-record` store. server.ts
+ *  registers this onto the shared registry; the dual-registry coupling test asserts
+ *  `kind` is also present in JOURNAL_KINDS. */
+export declare const PREF_KIND_REGISTRATION: {
+    readonly kind: "pref-record";
+    readonly store: "preferences";
+    readonly schema: StoreFieldSchema;
+};
+/** Convenience re-export for the rollback-unmerge `kindsForStore('preferences')`
+ *  wiring + any caller that needs the store's contributing journal kinds. */
+export declare function prefContributingKinds(): string[];
+/**
+ * The store's impact tier resolver, for ReplicatedStoreReader.tierOf. Returns the
+ * preferences tier (high) for the `preferences` store. An UNKNOWN store also
+ * resolves to `high` — the CONSERVATIVE direction (append-both-and-flag never
+ * silently clobbers), so a future store wired before its own tierOf lands can never
+ * accidentally get the silent-overwrite path. The reader composes per-store; this is
+ * the default a server wires for the preferences store specifically.
+ */
+export declare function prefTierOf(_store: string): ImpactTier;
+/** Re-export the envelope type for callers building/applying pref-record envelopes. */
+export type { ReplicatedEnvelope };
+//# sourceMappingURL=PreferencesReplicatedStore.d.ts.map

package/dist/core/PreferencesReplicatedStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PreferencesReplicatedStore.d.ts","sourceRoot":"","sources":["../../src/core/PreferencesReplicatedStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,KAAK,EACV,eAAe,EAEhB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,KAAK,EACV,gBAAgB,EAEhB,kBAAkB,EAClB,YAAY,EACb,MAAM,+BAA+B,CAAC;AAEvC,OAAO,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC9E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAM5D;;yCAEyC;AACzC,eAAO,MAAM,cAAc,gBAAgB,CAAC;AAE5C;;mFAEmF;AACnF,eAAO,MAAM,gBAAgB,gBAAgB,CAAC;AAE9C;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,EAAE,UAAmB,CAAC;AAEnD;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,EAAE,oBAKhC,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,EAAE,aAAa,CAAC,MAAM,CAMxD,CAAC;AAEH;oDACoD;AACpD,eAAO,MAAM,mBAAmB,QAAW,CAAC;AAC5C,eAAO,MAAM,qBAAqB,KAAK,CAAC;AAExC;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,EAAE,gBA4CnC,CAAC;AAMF;;cAEc;AACd,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAErD;;oBAEoB;AACpB,MAAM,MAAM,gBAAgB,GAAG,CAAC,KAAK,EAAE,MAAM,KAAK;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1F;;iDAEiD;AACjD,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,IAAI,CAAC,eAAe,EAAE,UAAU,GAAG,YAAY,GAAG,aAAa,GAAG,YAAY,GAAG,YAAY,GAAG,WAAW,CAAC,CAAC;IACpH,GAAG,EAAE,YAAY,CAAC;IAClB,EAAE,EAAE,YAAY,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,kFAAkF;IAClF,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB;;;qBAGiB;IACjB,KAAK,CAAC,EAAE,gBAAgB,CAAC;CAC1B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,oBAAoB,GAAG,cAAc,CAqB/E;AAWD;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,YAAY,GAAG,eAAe,CAe5E;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,GAAG,YAAY,CAqB5F;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,GAAG,eAAe,EAAE,CAsB1F;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,EAC/B,QAAQ,SAAO,GACd;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAOnE;AAMD;;+CAE+C;AAC/C,eAAO,MAAM,sBAAsB;;;;CAIzB,CAAC;AAEX;6EAC6E;AAC7E,wBAAgB,qBAAqB,IAAI,MAAM,EAAE,CAEhD;AAED;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAErD;AAED,uFAAuF;AACvF,YAAY,EAAE,kBAAkB,EAAE,CAAC"}

package/dist/core/PreferencesReplicatedStore.js

@@ -0,0 +1,330 @@
+/**
+ * PreferencesReplicatedStore — the FIRST concrete consumer of the HLC
+ * replicated-store foundation (WS2.1, multi-machine-replicated-store-foundation
+ * §4 + §7.2 + §13). It layers the `pref-record` replicated kind onto the generic
+ * substrate (ReplicatedRecordEnvelope / UnionReader / ConflictStore /
+ * RollbackUnmerge / ReplicationBudget / StoreSnapshot) so a user preference
+ * learned on machine A is honored on machine B — ONE memory, not one-per-machine.
+ *
+ * THIS IS PURE LOGIC. No fs, no Date directly, no network. It defines:
+ *   A. The `pref-record` store schema (the StoreFieldSchema the registry validates
+ *      on top of the envelope) + the store's IMPACT TIER (high) + per-kind bounds.
+ *   B. The emit-envelope builder: PreferenceEntry → the `data` object a journal
+ *      `pref-record` entry carries (recordKey=dedupeKey, hlc, op, origin, observed).
+ *   C. The union-aware read: a `Map<recordKey, UnionResult>` (from
+ *      ReplicatedStoreReader.readAll('preferences')) → a `PreferenceEntry[]` for
+ *      the session-start block. THE LOAD-BEARING ADVISORY RECONCILIATION (the §15.1
+ *      decision): on an OPEN conflict for a dedupeKey, BOTH variants are injected as
+ *      hints — they ARE advisory, both are usable guidance — rather than blocking on
+ *      operator resolution. Operator resolution (POST /state/resolve-conflict) is
+ *      OPTIONAL cleanup that collapses the flag; it is NEVER a gate on the hint
+ *      being injected. A flag is observability + optional cleanup, not a blocked
+ *      preference. This is what kills the §15.1 over-flag-fatigue concern.
+ *
+ * SUPERSESSION (CMT-1416): this foundation path SUPERSEDES the earlier advisory
+ * `PreferencesSync.ts` (the seamlessness-spec WS2.1, behind
+ * multiMachine.seamlessness.ws21PreferencesPool). BOTH ship dark/default-off, so
+ * there is ZERO runtime duplication today. PreferencesSync is retained dark until
+ * this path is validated, then removed (tracked CMT-1416 — a separate cleanup PR).
+ * They are MUTUALLY EXCLUSIVE in practice: the consumer reads ONE path at a time
+ * (the foundation reader is consulted only when `multiMachine.stateSync.preferences`
+ * is enabled; the legacy merge only when `seamlessness.ws21PreferencesPool` is). An
+ * operator who enables BOTH gets the foundation path's precedence (it is the
+ * principled substrate); the legacy path is the fallback for an agent that has not
+ * yet flipped to the foundation flag.
+ *
+ * SAFETY POSTURE (§14): MECHANISM, dark by default. Nothing here blocks a
+ * user-initiated action. `violationPattern` (the operator's self-violation
+ * detection regex/keywords) is a LOCAL-ONLY signal that reveals the operator's
+ * security posture, so it is NEVER part of the replicated store schema and is
+ * stripped from every emitted envelope (mirrors PreferencesSync finding #1).
+ */
+import { formatPreferencesForSessionStart } from './PreferencesManager.js';
+import { jailStoreStringField } from './ReplicatedRecordEnvelope.js';
+// ───────────────────────────────────────────────────────────────────────────
+// A. Identity, tier, schema, bounds
+// ───────────────────────────────────────────────────────────────────────────
+/** The stateSync config sub-key + advert suffix for this store (e.g.
+ *  `multiMachine.stateSync.preferences.enabled`). Equal to the advert flag key
+ *  `stateSyncReceive['preferences']`. */
+export const PREF_STORE_KEY = 'preferences';
+/** The JournalKind string this store rides — the DUAL-REGISTRY's dynamic half.
+ *  MUST also be present in CoherenceJournal.JOURNAL_KINDS (the static half), or the
+ *  store advertises receive=true yet serves/applies/pulls nothing (§4 callout). */
+export const PREF_RECORD_KIND = 'pref-record';
+/**
+ * Preferences are HIGH-impact (spec §614 / master-spec decision 2): a concurrent
+ * divergent edit to the SAME dedupeKey from different origins goes through
+ * APPEND-BOTH-AND-FLAG — both versions preserved, ONE deduped conflict, never a
+ * silent overwrite. (The CONSUMER read path still injects BOTH variants as advisory
+ * hints — see mergeUnionToPreferences — so the flag never suppresses guidance.)
+ */
+export const PREF_IMPACT_TIER = 'high';
+/**
+ * Per-kind replication bounds (§8). Preferences are FEW — a tight window with a
+ * coalescing rate cap (the burst of edits to one dedupeKey collapses to the latest
+ * state per interval). Mirrors the PreferencesSync precedent's per-store cap
+ * (DEFAULT_MAX_REPLICATED_PREFERENCES=500). The retention here matches the
+ * journal-level `pref-record` fallback in CoherenceJournal.DEFAULT_RETENTION; the
+ * aggregate journal budget (64 MiB default) trivially covers a 2 MiB pref stream.
+ */
+export const PREF_RECORD_BOUNDS = {
+    retention: { maxFileBytes: 2 * 1024 * 1024, rotateKeep: 4 },
+    // A few preferences, occasional edits — a tight cap with coalescing. Capacity is
+    // the burst; refill is the sustained rate. Well under the aggregate budget.
+    rateCap: { capacity: 50, refillPerSec: 10 },
+};
+/**
+ * The store-specific field names the `pref-record` schema OWNS (the unknown-field
+ * counter's allowlist). NOTE: `violationPattern` is DELIBERATELY ABSENT — it is a
+ * LOCAL-ONLY signal (the operator's self-violation regex/keywords) that must never
+ * replicate (PreferencesSync finding #1). `dedupeKey` is ABSENT too — it is the
+ * recordKey (a reserved envelope field), never a store field. `lastMutatedSeq`,
+ * `storeIncarnation` etc. are local replication bookkeeping, never replicated here.
+ */
+export const PREF_STORE_KNOWN_FIELDS = Object.freeze([
+    'learning',
+    'confidence',
+    'dedupeCount',
+    'provenance',
+    'recordedAt',
+]);
+/** Caps mirroring the PreferencesManager discipline — a value over the cap REJECTS
+ *  the whole record (never truncate-and-accept). */
+export const MAX_LEARNING_LENGTH = 8 * 1024;
+export const MAX_PROVENANCE_LENGTH = 64;
+/**
+ * The `pref-record` store schema (§4). Strict typed validation on top of the
+ * envelope: reject free text beyond the known fields, jail any path-shaped string,
+ * narrow each field. Returns the validated store-specific object, or null to reject
+ * the WHOLE record. PURE (no I/O, no mutation of `raw`).
+ */
+export const prefRecordStoreSchema = {
+    knownFields: PREF_STORE_KNOWN_FIELDS,
+    // `learning` is free-text user content — credential-scrubbed at SERVE time
+    // (buildPrefEnvelope), not here. It is NOT path-sensitive in the path-jail sense
+    // (a learning may legitimately mention a slash), so it is not auto-jailed; we
+    // length-cap it instead. No store field holds an artifact path, so
+    // pathSensitiveFields is empty — but we still jail `provenance` imperatively below
+    // as defense-in-depth (a provenance value can never be path-shaped).
+    validate(raw, ctx) {
+        // learning — required non-empty string, length-capped.
+        const learning = raw.learning;
+        if (typeof learning !== 'string' || learning.length === 0 || learning.length > MAX_LEARNING_LENGTH) {
+            return null;
+        }
+        // confidence — a finite number in [0,1] (clamped, not rejected, to match the
+        // PreferencesManager clamp discipline; an absent/garbage value → 0.5).
+        let confidence = 0.5;
+        if (typeof raw.confidence === 'number' && Number.isFinite(raw.confidence)) {
+            confidence = raw.confidence < 0 ? 0 : raw.confidence > 1 ? 1 : raw.confidence;
+        }
+        // dedupeCount — a positive integer (≥1).
+        let dedupeCount = 1;
+        if (typeof raw.dedupeCount === 'number' && Number.isFinite(raw.dedupeCount)) {
+            dedupeCount = Math.max(1, Math.floor(raw.dedupeCount));
+        }
+        // provenance — a short enum-like slug; jail (path-shaped → reject whole record).
+        // Slice 1a only ever writes 'correction-loop'; any other (incl. an unknown
+        // future) slug is COERCED to it (forward-compat — never reject for a future
+        // provenance), so the field is effectively a constant today but the jail still
+        // guards against a path-shaped value smuggled into the slot.
+        const provenance = 'correction-loop';
+        if (raw.provenance !== undefined) {
+            const jailed = jailStoreStringField(raw.provenance, ctx);
+            if (jailed === null)
+                return null; // path-shaped provenance → reject whole record
+        }
+        // recordedAt — an ISO string; a missing/garbage one is coerced to epoch-0 (the
+        // PreferencesManager read() discipline) rather than rejecting the record.
+        const recordedAt = typeof raw.recordedAt === 'string' && raw.recordedAt.length > 0 && raw.recordedAt.length <= 64
+            ? raw.recordedAt
+            : new Date(0).toISOString();
+        return { learning: learning.trim(), confidence, dedupeCount, provenance, recordedAt };
+    },
+};
+/**
+ * Build the `pref-record` envelope `data` for emission (§4). recordKey = the
+ * preference `dedupeKey` (the natural primary key — the same dedupeKey on two
+ * machines is the SAME learned lesson). `violationPattern` is NEVER included (local-
+ * only). `learning` is credential-scrubbed when a scrubber is supplied. The returned
+ * object is the journal entry's `data`; the envelope fields are authoritative.
+ *
+ * NOTE: this does NOT validate — it produces a well-formed `data` the journal emit
+ * path serializes; the RECEIVE door (validateReplicatedEnvelope + the store schema)
+ * re-validates on apply. Emission is GATED upstream by
+ * `multiMachine.stateSync.preferences.enabled` (the caller checks
+ * isStoreEmissionEnabled before calling this) — when off, this is never reached.
+ */
+export function buildPrefRecordData(input) {
+    const { entry, hlc, op, origin, observed, scrub } = input;
+    const scrubbed = scrub ? scrub(entry.learning) : { text: entry.learning, redactedCount: 0 };
+    const learning = scrubbed.redactedCount > 0 ? scrubbed.text : entry.learning;
+    const data = {
+        // store-specific fields FIRST (the envelope fields are appended authoritatively
+        // by the journal's validateReplicatedEnvelope on the receive side; on emit we
+        // include them so the on-disk shape is complete).
+        learning,
+        confidence: clamp01(entry.confidence),
+        dedupeCount: Math.max(1, Math.floor(entry.dedupeCount || 1)),
+        provenance: entry.provenance ?? 'correction-loop',
+        recordedAt: entry.recordedAt,
+        // envelope fields (recordKey = dedupeKey).
+        recordKey: entry.dedupeKey,
+        hlc,
+        op,
+        origin,
+        ...(observed !== undefined ? { observed } : {}),
+    };
+    return data;
+}
+function clamp01(v) {
+    if (typeof v !== 'number' || Number.isNaN(v))
+        return 0.5;
+    return v < 0 ? 0 : v > 1 ? 1 : v;
+}
+// ───────────────────────────────────────────────────────────────────────────
+// C. Union-aware read — the LOAD-BEARING advisory reconciliation (§15.1)
+// ───────────────────────────────────────────────────────────────────────────
+/**
+ * Reconstruct a PreferenceEntry from an OriginRecord's store `data` (the envelope
+ * fields stripped). Defensive: a field that does not narrow falls back to the same
+ * safe default PreferencesManager.read() uses. `dedupeKey` is the recordKey.
+ */
+export function prefEntryFromOriginRecord(rec) {
+    const d = rec.data;
+    const learning = typeof d.learning === 'string' ? d.learning : '';
+    const confidence = typeof d.confidence === 'number' && Number.isFinite(d.confidence) ? clamp01(d.confidence) : 0.5;
+    const dedupeCount = typeof d.dedupeCount === 'number' && Number.isFinite(d.dedupeCount) ? Math.max(1, Math.floor(d.dedupeCount)) : 1;
+    const recordedAt = typeof d.recordedAt === 'string' && d.recordedAt.length > 0 ? d.recordedAt : new Date(0).toISOString();
+    return {
+        learning,
+        provenance: 'correction-loop',
+        dedupeKey: rec.envelope.recordKey,
+        recordedAt,
+        confidence,
+        dedupeCount,
+    };
+}
+/**
+ * Build an OriginRecord for the OWN preference store (the single-origin
+ * materialization the union reader merges). recordKey = dedupeKey; the envelope
+ * carries a SYNTHETIC own-origin stamp. NOTE: this is the OWN record at rest — it
+ * is NOT the wire/journal hlc (that is minted by clock.tick() at the EMIT path);
+ * here we only need a stable own-origin record for the union to merge against peer
+ * replicas. `lastMutatedSeq` is folded into a deterministic logical counter so the
+ * own record has a well-formed, monotone HLC position relative to its own edits.
+ * `violationPattern` is NEVER carried into the replicated namespace (local-only).
+ */
+export function prefEntryToOriginRecord(entry, origin) {
+    const physical = Date.parse(entry.recordedAt);
+    const hlc = {
+        physical: Number.isFinite(physical) ? physical : 0,
+        logical: Math.max(0, Math.floor(entry.lastMutatedSeq ?? 0)),
+        node: origin,
+    };
+    const data = {
+        learning: entry.learning,
+        confidence: clamp01(entry.confidence),
+        dedupeCount: Math.max(1, Math.floor(entry.dedupeCount || 1)),
+        provenance: entry.provenance ?? 'correction-loop',
+        recordedAt: entry.recordedAt,
+    };
+    const envelope = {
+        recordKey: entry.dedupeKey,
+        hlc,
+        op: 'put',
+        origin,
+    };
+    return { origin, envelope, data };
+}
+/**
+ * THE LOAD-BEARING ADVISORY RECONCILIATION (§15.1 decision, recorded verbatim).
+ *
+ * Collapse a `Map<recordKey, UnionResult>` (from
+ * ReplicatedStoreReader.readAll('preferences')) into the PreferenceEntry[] the
+ * session-start block consumes. The §15.1 contract:
+ *   - A resolved single value ⇒ inject that one entry.
+ *   - An OPEN HIGH-impact conflict ⇒ inject BOTH (all) concurrent variants as
+ *     separate hints. They ARE advisory — both are usable guidance — so the open
+ *     conflict NEVER suppresses a usable hint. Operator resolution (POST
+ *     /state/resolve-conflict) is OPTIONAL cleanup that collapses the flag; it is
+ *     NEVER a gate on the hint being injected.
+ *   - A LOW-impact divergence ⇒ the HLC-winner is `value`; inject it (the overwrite
+ *     was flagged for observability, but the value is usable).
+ *   - A null `value` with no conflict (every origin deleted, or no record) ⇒ nothing
+ *     to inject for that key.
+ *
+ * This is the proof obligation the §12 wiring test exercises: an OPEN conflict for a
+ * dedupeKey STILL yields both variants in the output (it can never suppress a usable
+ * hint waiting on operator resolution). The conflict's `versions` carry every
+ * concurrent origin's record; we map EACH to a PreferenceEntry hint.
+ *
+ * Determinism: variants from a conflict are emitted in the union reader's stable
+ * (HLC-sorted) version order, so the injected block is stable across reads.
+ */
+export function mergeUnionToPreferences(union) {
+    const out = [];
+    for (const result of union.values()) {
+        if (result.conflict) {
+            // OPEN HIGH-impact conflict: inject BOTH (all) concurrent variants as hints —
+            // NEVER suppress a usable hint waiting on operator resolution (§15.1). A `put`
+            // tombstone variant (op==='delete') contributes no usable guidance, so it is
+            // skipped, but every surviving `put` variant is injected.
+            for (const v of result.conflict.versions) {
+                if (v.envelope.op === 'delete')
+                    continue;
+                out.push(prefEntryFromOriginRecord(v));
+            }
+            continue;
+        }
+        // Resolved value (single origin, clean sequential chain, or LOW-impact HLC-win).
+        // `value` is null when the resolved winner is a delete tombstone (or no record) —
+        // nothing usable to inject for that key.
+        if (result.value && result.value.envelope.op !== 'delete') {
+            out.push(prefEntryFromOriginRecord(result.value));
+        }
+    }
+    return out;
+}
+/**
+ * Build the session-start preferences block from a union read (the foundation
+ * path's equivalent of PreferencesManager.sessionContext()). Reuses the SAME
+ * deterministic, byte-bounded, priority-ordered renderer
+ * (`formatPreferencesForSessionStart`) so the injected block shape is identical to
+ * the single-machine path — only the SOURCE differs (the no-clobber union vs the
+ * local store). An open conflict yields BOTH variants in the block (§15.1).
+ */
+export function buildUnionSessionContext(union, maxBytes = 4000) {
+    const preferences = mergeUnionToPreferences(union);
+    const block = formatPreferencesForSessionStart({ schemaVersion: 1, preferences }, maxBytes);
+    return { present: block.length > 0, block, count: preferences.length, scope: 'mesh' };
+}
+// ───────────────────────────────────────────────────────────────────────────
+// Registration descriptor (consumed by server.ts to register the dual registry)
+// ───────────────────────────────────────────────────────────────────────────
+/** The ReplicatedKindRegistry registration for the `pref-record` store. server.ts
+ *  registers this onto the shared registry; the dual-registry coupling test asserts
+ *  `kind` is also present in JOURNAL_KINDS. */
+export const PREF_KIND_REGISTRATION = {
+    kind: PREF_RECORD_KIND,
+    store: PREF_STORE_KEY,
+    schema: prefRecordStoreSchema,
+};
+/** Convenience re-export for the rollback-unmerge `kindsForStore('preferences')`
+ *  wiring + any caller that needs the store's contributing journal kinds. */
+export function prefContributingKinds() {
+    return [PREF_RECORD_KIND];
+}
+/**
+ * The store's impact tier resolver, for ReplicatedStoreReader.tierOf. Returns the
+ * preferences tier (high) for the `preferences` store. An UNKNOWN store also
+ * resolves to `high` — the CONSERVATIVE direction (append-both-and-flag never
+ * silently clobbers), so a future store wired before its own tierOf lands can never
+ * accidentally get the silent-overwrite path. The reader composes per-store; this is
+ * the default a server wires for the preferences store specifically.
+ */
+export function prefTierOf(_store) {
+    return PREF_IMPACT_TIER;
+}
+//# sourceMappingURL=PreferencesReplicatedStore.js.map

package/dist/core/PreferencesReplicatedStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PreferencesReplicatedStore.js","sourceRoot":"","sources":["../../src/core/PreferencesReplicatedStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAMH,OAAO,EAAE,gCAAgC,EAAE,MAAM,yBAAyB,CAAC;AAO3E,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAKrE,8EAA8E;AAC9E,oCAAoC;AACpC,8EAA8E;AAE9E;;yCAEyC;AACzC,MAAM,CAAC,MAAM,cAAc,GAAG,aAAa,CAAC;AAE5C;;mFAEmF;AACnF,MAAM,CAAC,MAAM,gBAAgB,GAAG,aAAa,CAAC;AAE9C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAe,MAAM,CAAC;AAEnD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAyB;IACtD,SAAS,EAAE,EAAE,YAAY,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE;IAC3D,iFAAiF;IACjF,4EAA4E;IAC5E,OAAO,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE;CAC5C,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAA0B,MAAM,CAAC,MAAM,CAAC;IAC1E,UAAU;IACV,YAAY;IACZ,aAAa;IACb,YAAY;IACZ,YAAY;CACb,CAAC,CAAC;AAEH;oDACoD;AACpD,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,GAAG,IAAI,CAAC;AAC5C,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAExC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAqB;IACrD,WAAW,EAAE,uBAAuB;IACpC,2EAA2E;IAC3E,iFAAiF;IACjF,8EAA8E;IAC9E,mEAAmE;IACnE,mFAAmF;IACnF,qEAAqE;IACrE,QAAQ,CAAC,GAAsC,EAAE,GAAyB;QACxE,uDAAuD;QACvD,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;QAC9B,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,GAAG,mBAAmB,EAAE,CAAC;YACnG,OAAO,IAAI,CAAC;QACd,CAAC;QACD,6EAA6E;QAC7E,uEAAuE;QACvE,IAAI,UAAU,GAAG,GAAG,CAAC;QACrB,IAAI,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1E,UAAU,GAAG,GAAG,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC;QAChF,CAAC;QACD,yCAAyC;QACzC,IAAI,WAAW,GAAG,CAAC,CAAC;QACpB,IAAI,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YAC5E,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;QACzD,CAAC;QACD,iFAAiF;QACjF,2EAA2E;QAC3E,4EAA4E;QAC5E,+EAA+E;QAC/E,6DAA6D;QAC7D,MAAM,UAAU,GAAyB,iBAAiB,CAAC;QAC3D,IAAI,GAAG,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,oBAAoB,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;YACzD,IAAI,MAAM,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC,CAAC,+CAA+C;QACnF,CAAC;QACD,+EAA+E;QAC/E,0EAA0E;QAC1E,MAAM,UAAU,GACd,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,IAAI,EAAE;YAC5F,CAAC,CAAC,GAAG,CAAC,UAAU;YAChB,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QAEhC,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC;IACxF,CAAC;CACF,CAAC;AAiCF;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAA2B;IAC7D,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IAC1D,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC;IAC5F,MAAM,QAAQ,GAAG,QAAQ,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC;IAC7E,MAAM,IAAI,GAAmB;QAC3B,gFAAgF;QAChF,8EAA8E;QAC9E,kDAAkD;QAClD,QAAQ;QACR,UAAU,EAAE,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC;QACrC,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,IAAI,CAAC,CAAC,CAAC;QAC5D,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,iBAAiB;QACjD,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,2CAA2C;QAC3C,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,GAAG;QACH,EAAE;QACF,MAAM;QACN,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,OAAO,CAAC,CAAS;IACxB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAAE,OAAO,GAAG,CAAC;IACzD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACnC,CAAC;AAED,8EAA8E;AAC9E,yEAAyE;AACzE,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CAAC,GAAiB;IACzD,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC;IACnB,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IAClE,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACnH,MAAM,WAAW,GACf,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnH,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IAC1H,OAAO;QACL,QAAQ;QACR,UAAU,EAAE,iBAAiB;QAC7B,SAAS,EAAE,GAAG,CAAC,QAAQ,CAAC,SAAS;QACjC,UAAU;QACV,UAAU;QACV,WAAW;KACZ,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAsB,EAAE,MAAc;IAC5E,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAiB;QACxB,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAClD,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,cAAc,IAAI,CAAC,CAAC,CAAC;QAC3D,IAAI,EAAE,MAAM;KACb,CAAC;IACF,MAAM,IAAI,GAA4B;QACpC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,UAAU,EAAE,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC;QACrC,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,IAAI,CAAC,CAAC,CAAC;QAC5D,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,iBAAiB;QACjD,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC;IACF,MAAM,QAAQ,GAAuB;QACnC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,GAAG;QACH,EAAE,EAAE,KAAK;QACT,MAAM;KACP,CAAC;IACF,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AACpC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAA+B;IACrE,MAAM,GAAG,GAAsB,EAAE,CAAC;IAClC,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;QACpC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACpB,8EAA8E;YAC9E,+EAA+E;YAC/E,6EAA6E;YAC7E,0DAA0D;YAC1D,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;gBACzC,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,KAAK,QAAQ;oBAAE,SAAS;gBACzC,GAAG,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC,CAAC;YACzC,CAAC;YACD,SAAS;QACX,CAAC;QACD,iFAAiF;QACjF,kFAAkF;QAClF,yCAAyC;QACzC,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;YAC1D,GAAG,CAAC,IAAI,CAAC,yBAAyB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CACtC,KAA+B,EAC/B,QAAQ,GAAG,IAAI;IAEf,MAAM,WAAW,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,gCAAgC,CAC5C,EAAE,aAAa,EAAE,CAAC,EAAE,WAAW,EAAE,EACjC,QAAQ,CACT,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AACxF,CAAC;AAED,8EAA8E;AAC9E,gFAAgF;AAChF,8EAA8E;AAE9E;;+CAE+C;AAC/C,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,IAAI,EAAE,gBAAgB;IACtB,KAAK,EAAE,cAAc;IACrB,MAAM,EAAE,qBAAqB;CACrB,CAAC;AAEX;6EAC6E;AAC7E,MAAM,UAAU,qBAAqB;IACnC,OAAO,CAAC,gBAAgB,CAAC,CAAC;AAC5B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,UAAU,CAAC,MAAc;IACvC,OAAO,gBAAgB,CAAC;AAC1B,CAAC"}

package/dist/core/PreferencesSync.d.ts

@@ -1,4 +1,12 @@
 /**
+ * DEPRECATED / SUPERSEDED (CMT-1416): this seamlessness-spec WS2.1 advisory
+ * replicator is superseded by the HLC-foundation `pref-record` replicated store
+ * (`multiMachine.stateSync.preferences`, src/core/PreferencesReplicatedStore.ts).
+ * Retained dark (behind `multiMachine.seamlessness.ws21PreferencesPool`) until the
+ * foundation path is validated, then removed — a separate reviewable cleanup PR.
+ * BOTH ship dark/default-off ⇒ zero runtime duplication; they are mutually
+ * exclusive in practice (the foundation path takes precedence when its flag is on).
+ *
  * PreferencesSync — WS2.1 of multi-machine seamlessness: the serve / receive /
  * merge engine behind the `preferences-sync` mesh verb. Replicates the
  * correction-learning preference store (PreferencesManager,

package/dist/core/PreferencesSync.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PreferencesSync.d.ts","sourceRoot":"","sources":["../../src/core/PreferencesSync.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAMH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAE/D,eAAO,MAAM,uBAAuB,QAAa,CAAC;AAClD,eAAO,MAAM,6BAA6B,QAAiB,CAAC;AAC5D,mFAAmF;AACnF,eAAO,MAAM,kCAAkC,MAAM,CAAC;AAItD,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,0FAA0F;AAC1F,MAAM,WAAW,oBAAqB,SAAQ,eAAe;IAC3D,eAAe,EAAE,MAAM,CAAC;IACxB,qEAAqE;IACrE,cAAc,EAAE,MAAM,CAAC;IACvB,kEAAkE;IAClE,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,wEAAwE;IACxE,OAAO,EAAE,oBAAoB,EAAE,CAAC;IAChC,6CAA6C;IAC7C,YAAY,EAAE,MAAM,CAAC;IACrB,qDAAqD;IACrD,IAAI,EAAE,OAAO,CAAC;IACd,sEAAsE;IACtE,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAID,uFAAuF;AACvF,MAAM,WAAW,mBAAoB,SAAQ,eAAe;IAC1D,gFAAgF;IAChF,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,oDAAoD;IACpD,OAAO,EAAE,mBAAmB,EAAE,CAAC;IAC/B,MAAM,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC;IACxD,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,sBAAsB,EAC3B,IAAI,EAAE,aAAa,GAClB,mBAAmB,CA6CrB;AAcD,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,8EAA8E;IAC9E,UAAU,EAAE,MAAM,CAAC;IACnB,gEAAgE;IAChE,QAAQ,EAAE,OAAO,CAAC;IAClB,mEAAmE;IACnE,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;GAKG;AACH,qBAAa,sBAAsB;IACjC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAa;IACjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwB;IAC/C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,KAAK,CAAuC;gBAExC,MAAM,EAAE;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;QACjB,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;QAC/B,iBAAiB,CAAC,EAAE,MAAM,CAAC;KAC5B;IAUD,8EAA8E;IAC9E,SAAS,CAAC,cAAc,EAAE,MAAM,GAAG;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE;IAK7E;;;OAGG;IACH,SAAS,CAAC,eAAe,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,GAAG,WAAW;IAwC1E,4DAA4D;IAC5D,WAAW,IAAI;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,oBAAoB,EAAE,CAAA;KAAE,EAAE;IAgBhG,OAAO,CAAC,OAAO;IAIf,OAAO,CAAC,IAAI;IA2BZ,OAAO,CAAC,OAAO;CAQhB;AAID,MAAM,WAAW,gBAAiB,SAAQ,eAAe;IACvD,qEAAqE;IACrE,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,6CAA6C;IAC7C,gBAAgB,EAAE,MAAM,CAAC;IACzB,6DAA6D;IAC7D,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,SAAS;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,GAAG,EAAE,eAAe,EAAE,CAAC;IACvB,QAAQ,EAAE;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,oBAAoB,EAAE,CAAA;KAAE,EAAE,CAAC;IAC5F,wFAAwF;IACxF,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,uBAAuB,QAAsB,CAAC;AA2B3D;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,SAAS,GAAG,gBAAgB,EAAE,CAyDxE"}
+{"version":3,"file":"PreferencesSync.d.ts","sourceRoot":"","sources":["../../src/core/PreferencesSync.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAMH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAE/D,eAAO,MAAM,uBAAuB,QAAa,CAAC;AAClD,eAAO,MAAM,6BAA6B,QAAiB,CAAC;AAC5D,mFAAmF;AACnF,eAAO,MAAM,kCAAkC,MAAM,CAAC;AAItD,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,0FAA0F;AAC1F,MAAM,WAAW,oBAAqB,SAAQ,eAAe;IAC3D,eAAe,EAAE,MAAM,CAAC;IACxB,qEAAqE;IACrE,cAAc,EAAE,MAAM,CAAC;IACvB,kEAAkE;IAClE,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,wEAAwE;IACxE,OAAO,EAAE,oBAAoB,EAAE,CAAC;IAChC,6CAA6C;IAC7C,YAAY,EAAE,MAAM,CAAC;IACrB,qDAAqD;IACrD,IAAI,EAAE,OAAO,CAAC;IACd,sEAAsE;IACtE,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAID,uFAAuF;AACvF,MAAM,WAAW,mBAAoB,SAAQ,eAAe;IAC1D,gFAAgF;IAChF,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,oDAAoD;IACpD,OAAO,EAAE,mBAAmB,EAAE,CAAC;IAC/B,MAAM,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC;IACxD,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,sBAAsB,EAC3B,IAAI,EAAE,aAAa,GAClB,mBAAmB,CA6CrB;AAcD,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,8EAA8E;IAC9E,UAAU,EAAE,MAAM,CAAC;IACnB,gEAAgE;IAChE,QAAQ,EAAE,OAAO,CAAC;IAClB,mEAAmE;IACnE,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;GAKG;AACH,qBAAa,sBAAsB;IACjC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAa;IACjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwB;IAC/C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,KAAK,CAAuC;gBAExC,MAAM,EAAE;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;QACjB,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;QAC/B,iBAAiB,CAAC,EAAE,MAAM,CAAC;KAC5B;IAUD,8EAA8E;IAC9E,SAAS,CAAC,cAAc,EAAE,MAAM,GAAG;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE;IAK7E;;;OAGG;IACH,SAAS,CAAC,eAAe,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,GAAG,WAAW;IAwC1E,4DAA4D;IAC5D,WAAW,IAAI;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,oBAAoB,EAAE,CAAA;KAAE,EAAE;IAgBhG,OAAO,CAAC,OAAO;IAIf,OAAO,CAAC,IAAI;IA2BZ,OAAO,CAAC,OAAO;CAQhB;AAID,MAAM,WAAW,gBAAiB,SAAQ,eAAe;IACvD,qEAAqE;IACrE,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,6CAA6C;IAC7C,gBAAgB,EAAE,MAAM,CAAC;IACzB,6DAA6D;IAC7D,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,SAAS;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,GAAG,EAAE,eAAe,EAAE,CAAC;IACvB,QAAQ,EAAE;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,oBAAoB,EAAE,CAAA;KAAE,EAAE,CAAC;IAC5F,wFAAwF;IACxF,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,uBAAuB,QAAsB,CAAC;AA2B3D;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,SAAS,GAAG,gBAAgB,EAAE,CAyDxE"}

package/dist/core/PreferencesSync.js

@@ -1,4 +1,12 @@
 /**
+ * DEPRECATED / SUPERSEDED (CMT-1416): this seamlessness-spec WS2.1 advisory
+ * replicator is superseded by the HLC-foundation `pref-record` replicated store
+ * (`multiMachine.stateSync.preferences`, src/core/PreferencesReplicatedStore.ts).
+ * Retained dark (behind `multiMachine.seamlessness.ws21PreferencesPool`) until the
+ * foundation path is validated, then removed — a separate reviewable cleanup PR.
+ * BOTH ship dark/default-off ⇒ zero runtime duplication; they are mutually
+ * exclusive in practice (the foundation path takes precedence when its flag is on).
+ *
  * PreferencesSync — WS2.1 of multi-machine seamlessness: the serve / receive /
  * merge engine behind the `preferences-sync` mesh verb. Replicates the
  * correction-learning preference store (PreferencesManager,