waterplane 0.0.1 → 0.1.6

package/packages/host/dist/settle.js

@@ -0,0 +1,409 @@
+import { echoAmbiguous, echoProbe, isSlashText, logEcho, screenEcho, squash, } from "./echo.js";
+import { FALLBACK_ROWS, ROW_WINDOW, composerEcho, } from "./composer.js";
+import { liveSourceFor } from "./livesources.js";
+/**
+ * How far before the delivery a matching turn still counts as "this one".
+ *
+ * The client's `since` is when IT queued the entry; the turn is stamped by the
+ * CLI when it accepted the prompt. Clock skew between the two is real (phone vs
+ * desktop), and a delivery that raced a turn boundary can be stamped slightly
+ * early. Generous, because the alternative failure is the bad one: a landed
+ * prompt read as absent gets sent a second time.
+ */
+export const MATCH_SLACK_MS = 5 * 60_000;
+/**
+ * The same window when the HOST is the one asking.
+ *
+ * `deliver.ts` and the sweep pass their own `Date.now()` from the moment the
+ * delivery started, on the same machine and the same clock that stamps the log,
+ * so there is no skew to absorb — only the sub-second gap between "we began
+ * typing" and "the CLI wrote the record". Tight on purpose: the whole risk on
+ * this side is matching an OLDER identical prompt (the same instruction fired
+ * at the same session twice in an afternoon is ordinary), and five minutes of
+ * slack is five minutes in which that is possible.
+ */
+export const HOST_SLACK_MS = 30_000;
+/**
+ * Log turns already spent as proof, and by whom.
+ *
+ * A whole-text comparison tells two DIFFERENT prompts apart; it cannot tell two
+ * deliveries of the SAME text apart, and that is the ordinary case here —
+ * re-sending the same words is what a person does when the app says a prompt
+ * did not run. Without a ledger both rows read the one turn and both settle
+ * `landed`; the second one never ran and its row retires saying it did.
+ *
+ * So a turn is evidence for exactly one delivery. The second one to arrive gets
+ * `unknown` — deliberately NOT `absent`: "somebody already claimed this turn"
+ * is not a readable log that lacks the words, and answering `absent` would
+ * authorise a re-send and run the same instruction twice, which is a worse
+ * outcome than the false `landed` it is replacing.
+ *
+ * In memory and bounded. Losing it at a restart only makes the host more
+ * permissive, i.e. exactly as permissive as it was before this existed, and
+ * `opendeliveries.ts` re-seeds it from the rows it persisted, which is where
+ * the long-lived questions are.
+ */
+const SPENT_CAP = 500;
+const spentTurns = new Map();
+/** Record that this delivery has used this log turn as its proof. Idempotent
+ *  for the same claimer; a Map keeps insertion order, so eviction is FIFO. */
+export function spendTurn(turnId, claimer) {
+    if (!turnId || !claimer)
+        return;
+    if (spentTurns.get(turnId) === claimer)
+        return;
+    if (!spentTurns.has(turnId)) {
+        while (spentTurns.size >= SPENT_CAP) {
+            const oldest = spentTurns.keys().next().value;
+            if (oldest === undefined)
+                break;
+            spentTurns.delete(oldest);
+        }
+    }
+    spentTurns.set(turnId, claimer);
+}
+/** Test seam: the ledger is per-boot module state, and a unit test that could
+ *  not clear it would be asserting the previous test's leftovers. */
+export function forgetSpentTurns() { spentTurns.clear(); }
+/** Is this turn already somebody else's proof? A turn with no id at all cannot
+ *  be tracked and is treated as free — an untracked turn is how the code
+ *  behaved before the ledger, and never worse. */
+function spentByAnother(turnId, claimer) {
+    if (!turnId)
+        return false;
+    const owner = spentTurns.get(turnId);
+    return !!owner && owner !== claimer;
+}
+/**
+ * The last parse of each session's log, reused only while the file has not
+ * moved.
+ *
+ * Transcripts are parsed from a tail of the conversation log, which for a busy
+ * session is megabytes. A phone settles its whole failed queue in one message,
+ * and those rows are routinely all in the same session — so parsing once is
+ * worth real time.
+ *
+ * The validity test is the log's MTIME, not a clock. It began as a five-second
+ * time window, which was fine while a phone was the only caller and became a
+ * bug the moment `deliver.ts` started asking: the delivery poll fills the cache
+ * with "there is no log", the log appears a second later, and the next question
+ * about that session is answered from the memory of the second before. A stat
+ * per call is cheaper than being wrong, and `getTranscript` already answers
+ * "unchanged" from one.
+ */
+const cache = new Map();
+/**
+ * How many sessions' parsed prompts to keep — the same argument as `SPENT_CAP`
+ * above, which this map did not have.
+ *
+ * Every entry can hold 500 turns of FULL prompt text (`transcript.ts` caps one
+ * prompt at 200 000 chars), session ids are minted freely — one per fan-out
+ * target, a fresh one per resurrect — and nothing in this file ever hears that
+ * a session ended, so the map was set-only for the life of a daemon that runs
+ * for weeks. That is a slow, permanent leak of the user's own prose.
+ *
+ * A `Map` keeps insertion order and a hit is re-inserted, so eviction is LRU by
+ * session: the sessions a phone is actually settling stay warm, which is the
+ * whole point of the cache (a phone settles its failed queue in one message,
+ * and those rows are routinely all in one session).
+ */
+const CACHE_CAP = 40;
+/** User turns from the CLI's OWN log, or null when there is no such log. */
+function loggedPrompts(sessions, sessionId) {
+    // A backend that keeps no claude log is asked NOTHING, and the bail is here
+    // rather than at the verdict below. `source === "jsonl"` already made an
+    // opencode document count as no evidence — correctly, these verdicts are about
+    // claude's log — but only AFTER `getTranscript` had opened opencode's SQLite
+    // store, read every message and part of the conversation and folded it into a
+    // document, synchronously, on the loop that pumps every PTY, once per settled
+    // session. The answer was always "no evidence", so the work was pure cost —
+    // and the cache below could not have absorbed it, since `getTranscript` is
+    // what it asks to find out whether anything changed.
+    if (!sessions.keepsClaudeLog(sessionId))
+        return null;
+    const hit = cache.get(sessionId);
+    // Stamped BEFORE the read: a write that lands during the parse must look
+    // newer than the cache entry, or it is invisible until the next one.
+    const at = Date.now();
+    let prompts = null;
+    try {
+        const doc = sessions.getTranscript(sessionId, hit?.at ?? 0, "lite");
+        if (doc === "unchanged" && hit) {
+            // Touch it, so the sessions being asked about are the ones that survive
+            // eviction.
+            cache.delete(sessionId);
+            cache.set(sessionId, hit);
+            return hit.prompts;
+        }
+        // ONLY the jsonl source counts. The `history` fallback is OUR OWN record of
+        // what we typed (`recordPrompt`, called before the Return is pressed), so a
+        // prompt that echoed and was never submitted is in it — using that as proof
+        // it ran would confirm exactly the case this exists to catch.
+        if (doc && doc !== "unchanged" && doc.source === "jsonl") {
+            // `t.id` is the conversation log's own uuid for the prompt record — a
+            // name for THIS turn that survives a re-parse, which is what makes the
+            // spent-turn ledger possible at all.
+            prompts = doc.turns.map((t) => ({ id: t.id, text: t.prompt, at: t.sentAt }));
+        }
+    }
+    catch { /* unreadable log → no evidence, never an exception into a socket */ }
+    if (!cache.has(sessionId)) {
+        while (cache.size >= CACHE_CAP) {
+            const oldest = cache.keys().next().value;
+            if (oldest === undefined)
+                break;
+            cache.delete(oldest);
+        }
+    }
+    cache.set(sessionId, { at, prompts });
+    return prompts;
+}
+export function logMatch(sessions, sessionId, text, since, opts = {}) {
+    if (!echoProbe(text))
+        return { verdict: "unknown" };
+    if (isSlashText(text))
+        return { verdict: "unknown" };
+    const logged = loggedPrompts(sessions, sessionId);
+    if (!logged)
+        return { verdict: "unknown" };
+    const floor = since - (opts.slackMs ?? MATCH_SLACK_MS);
+    /** A turn carrying our words that another delivery has already spent. It is
+     *  not proof FOR us and it is emphatically not proof against us. */
+    let taken = false;
+    for (const p of logged) {
+        if (p.at != null && p.at < floor)
+            continue;
+        if (!logEcho(p.text, text))
+            continue;
+        if (spentByAnother(p.id, opts.claimer)) {
+            taken = true;
+            continue;
+        }
+        if (opts.claimer)
+            spendTurn(p.id, opts.claimer);
+        return { verdict: "landed", turnId: p.id };
+    }
+    // A readable log whose only matching turn belongs to someone else says
+    // nothing about this delivery — so it says `unknown`. Answering `absent` here
+    // would be the ledger causing the very duplicate it exists to prevent.
+    return { verdict: taken ? "unknown" : "absent" };
+}
+/**
+ * `logMatch`'s question asked of a backend's OWN channel — `sources.delivery
+ * .userTurns` (design §2, WP1c) — for a session whose backend keeps no claude
+ * log. Null means "no source applies here" and the caller asks `logMatch`,
+ * which is every claude session and every backend without a source: exactly
+ * the old path.
+ *
+ * The rules are `logMatch`'s, not a second opinion: the WHOLE text
+ * (`logEcho`), the same recency floor, and the same spent-turn ledger keyed on
+ * the SOURCE's turn id — one user message is evidence for exactly one delivery.
+ * `absent` still requires evidence: only a list the source actually returned
+ * can lack our words. A source that cannot say (`null`, a throw) is `unknown`,
+ * never `absent`, because `absent` authorises a re-send.
+ */
+async function sourceMatch(sessions, sessionId, text, since, opts) {
+    if (sessions.keepsClaudeLog(sessionId))
+        return null;
+    const live = liveSourceFor(sessionId);
+    const src = live?.sources.delivery;
+    if (!live || !src)
+        return null;
+    if (!echoProbe(text) || isSlashText(text))
+        return { verdict: "unknown" };
+    const floor = since - (opts.slackMs ?? MATCH_SLACK_MS);
+    let turns = null;
+    try {
+        turns = await src.userTurns(live.session, floor);
+    }
+    catch {
+        turns = null;
+    }
+    if (!Array.isArray(turns))
+        return { verdict: "unknown" };
+    let taken = false;
+    for (const t of turns) {
+        if (typeof t?.at === "number" && t.at < floor)
+            continue;
+        if (typeof t?.text !== "string" || !logEcho(t.text, text))
+            continue;
+        if (spentByAnother(t.id, opts.claimer)) {
+            taken = true;
+            continue;
+        }
+        if (opts.claimer)
+            spendTurn(t.id, opts.claimer);
+        return { verdict: "landed", turnId: t.id };
+    }
+    return { verdict: taken ? "unknown" : "absent" };
+}
+/** The verdict alone — for callers with nothing to claim and nothing to record. */
+export function logVerdict(sessions, sessionId, text, since, opts = {}) {
+    return logMatch(sessions, sessionId, text, since, opts).verdict;
+}
+/**
+ * Wait a bounded moment for the log to say the prompt ran.
+ *
+ * The CLI writes the user record when it ACCEPTS the prompt, so in the ordinary
+ * case the evidence is on disk before the caller even asks. The poll is for the
+ * disorderly cases — a log file created milliseconds after the first turn, a
+ * write that has not been flushed, a session whose conversation id was only
+ * just detected. Polling rather than one blind read because a single early read
+ * of a file that appears 200 ms later is indistinguishable from no log at all,
+ * and that mistake costs a prompt its `ok`.
+ *
+ * LOOKING again is free — it is RETYPING that stacks copies, and nothing here
+ * writes. Returns as soon as the answer is `landed`; `absent`/`unknown` keep
+ * polling until the deadline, because both can still turn into `landed`.
+ */
+export async function awaitLanded(sessions, sessionId, text, since, ms, slackMs = HOST_SLACK_MS, claimer) {
+    if (isSlashText(text) || !echoProbe(text))
+        return false;
+    const deadline = Date.now() + ms;
+    for (;;) {
+        // Claiming here matters as much as in the sweep: this is the path that
+        // answers `ok`, and an `ok` is never revisited by anything. A turn spent on
+        // this delivery cannot then prove a second delivery of the same words ran.
+        if (logVerdict(sessions, sessionId, text, since, { slackMs, claimer }) === "landed")
+            return true;
+        if (Date.now() >= deadline)
+            return false;
+        await new Promise((r) => setTimeout(r, 250));
+    }
+}
+/**
+ * What actually became of a delivery the host could not confirm at the time.
+ *
+ * `text` is what was sent and `since` is when it was queued. From the phone
+ * both come off the wire, because the host deliberately does not keep an
+ * un-acked prompt anywhere it could be resurrected from; from the host's own
+ * sweep they come off the open-question row, which is that copy, kept on
+ * purpose.
+ *
+ * `opts.others` is what stops the screen half from answering about somebody
+ * else's prompt, and `opts.claimer` is what stops the log half from handing one
+ * turn to two rows. Both are the same principle applied at different distances:
+ * this file may say "I cannot tell", and may not say something confident and
+ * wrong.
+ */
+export async function settleDelivery(sessions, sessionId, text, since, opts = {}) {
+    const info = sessions.get(sessionId);
+    const alive = info?.running === true;
+    const probe = echoProbe(text);
+    if (!probe)
+        return { verdict: "unknown", alive };
+    // 1. Did it RUN? The conversation log is the CLI's own record and outlives
+    //    the session, so this is answerable for a session that has since closed.
+    //    A backend with no claude log but a delivery source answers from its own
+    //    channel instead (`sourceMatch`); everything else is `logMatch`, unchanged.
+    const fromLog = (await sourceMatch(sessions, sessionId, text, since, opts)) ?? logMatch(sessions, sessionId, text, since, opts);
+    if (fromLog.verdict === "landed")
+        return { verdict: "landed", alive, turnId: fromLog.turnId };
+    // 2. Is it SITTING THERE? Only a live session has a screen to read.
+    if (!alive)
+        return { verdict: fromLog.verdict === "absent" ? "absent" : "unknown", alive };
+    let screen = "";
+    let inComposer = "none";
+    try {
+        // The ANCHORED read gets `deliver.ts`'s window, not the 40 rows this file
+        // used to take. The two must not disagree about how much screen there is:
+        // the tear this whole rule was written for can strand the composer frame
+        // well above the bottom of the replay, and a narrower window here made
+        // exactly that delivery confirmable by `deliver.ts` and invisible to the
+        // reader asked about it minutes later (anchored ⇒ null on rows that do not
+        // reach the box, fallback slice ⇒ `none`, verdict `unknown`).
+        //
+        // Everything else in here keeps the old depth. `screen` is what stands
+        // between the fall-through and `absent`, and `absent` authorises a re-send:
+        // widening it would change which prompts get sent twice, which is not a
+        // change to make as a side effect of fixing a window. Same for the fallback
+        // slice below, for the reason written at `composer.ts`'s `FALLBACK_ROWS`.
+        const wide = (await sessions.screenText(sessionId, ROW_WINDOW)).split("\n");
+        const rows = wide.slice(-FALLBACK_ROWS);
+        const raw = rows.join("\n");
+        screen = squash(raw);
+        // `inComposer` is a claim about WHERE the text is, not merely that it is on
+        // screen — the whole 40 rows include the scrollback, and this CLI scrolls
+        // rather than repainting, so a prompt that already ran is still sitting up
+        // there verbatim. Matching it there and answering `composer` tells the user
+        // (and `opendeliveries.ts`) "it is in the box, press Return", which submits
+        // an EMPTY composer.
+        //
+        // The narrowing used to be a bottom-`depth` slice, and `deliver.ts` used to
+        // do the same thing — the two were meant to be the same rule and now
+        // genuinely are: `composerEcho` finds the box the CLI draws to take typing
+        // and asks whether the text is INSIDE it. Distance from the bottom of the
+        // render was never the composer, it was the tear: the replay is a fixed
+        // 50-row VT fed the whole buffer, so mid-turn a half-done repaint leaves
+        // stale rows under the newest frame and the box is nowhere near the last
+        // row. That is exactly the delivery that arrives here — an interjection the
+        // echo window could not confirm — and it used to settle `unknown` with the
+        // words visible in the box.
+        //
+        // A screen with no `❯` box on it falls back to the old slice, over the old
+        // rows: deep enough for the wrapped text plus the box borders and the hint
+        // line. An upstream redraw must cost us the improvement, never the reading.
+        const anchored = composerEcho(wide, text);
+        if (anchored !== null)
+            inComposer = anchored;
+        else {
+            const depth = Math.min(FALLBACK_ROWS, 10 + Math.ceil(text.length / 40));
+            inComposer = screenEcho(squash(rows.slice(Math.max(0, rows.length - depth)).join("\n")), text);
+        }
+    }
+    catch {
+        return { verdict: "unknown", alive };
+    }
+    if (!screen)
+        return { verdict: "unknown", alive };
+    // The screen rules, in the order of how much they prove — and then the
+    // question that decides whether the answer may be acted on at all.
+    //
+    // A long prompt in the composer shows as `[Pasted text #1 +N lines]` plus its
+    // tail — or, when it holds no newline at all, as a bare `[Pasted text #1]`
+    // with nothing beside it. Either way the head the probe is cut from is HIDDEN
+    // behind the placeholder. Reading that as "not there" would answer `absent`, and
+    // `absent` is acted on by the HOST as well as the client: a second copy
+    // stacked on top of the first, in the composer, which is the one outcome this
+    // file exists to prevent. Same rule as `deliver.ts`'s echo check, tied to
+    // this text by its tail (or by a hidden-line count that covers all of it).
+    // Asked of the WHOLE screen first, because that answer is what stands between
+    // the fall-through and `absent` — and `absent` authorises a re-send. Text
+    // visible anywhere means we may not claim it never ran, even when we cannot
+    // say it is in the box. So the narrowing below only ever downgrades a
+    // `composer` to `unknown`; it can never manufacture an `absent`.
+    //
+    // "Seen" is therefore the OR of the two readings, and it has to be: the
+    // anchored rule can find the box further up the replay than the narrow tail
+    // reaches, and gating it on the tail would have made the wider window here a
+    // no-op — the text inside a composer frame fifty rows up would have fallen
+    // through to `absent` for want of being visible in the last forty rows, and
+    // `absent` is the verdict that sends a prompt a second time. The narrowing
+    // still only ever DOWNGRADES: `rule` is the structural answer alone, so text
+    // merely visible in the tail and not in any box is `unknown` exactly as
+    // before.
+    const rule = inComposer;
+    const seen = rule !== "none" || screenEcho(screen, text) !== "none";
+    if (seen && rule === "none")
+        return { verdict: "unknown", alive };
+    if (rule !== "none") {
+        // …and the prefix half of that is only evidence about OUR prompt when
+        // nothing else that could be in this composer would have matched it too.
+        // Two prompts sharing a fourteen-character head were both settled
+        // `composer` in the live run — "press Return there, never retype it" — and
+        // the composer they pointed at was empty. `unknown` costs one more sweep
+        // and says something true.
+        if (!echoAmbiguous(rule, text, opts.others ?? []))
+            return { verdict: "composer", alive };
+        return { verdict: "unknown", alive };
+    }
+    // 3. Readable, and not there.
+    //
+    // `absent` is only sayable with the LOG in hand. A screen is the last 40 rows:
+    // a prompt that ran and then produced a long answer has scrolled off it, so
+    // "not on screen" alone would call a delivered prompt absent — and `absent`
+    // is the verdict that authorises sending it again. The log is what makes the
+    // negative a fact rather than a small window.
+    return { verdict: fromLog.verdict === "absent" ? "absent" : "unknown", alive };
+}
+//# sourceMappingURL=settle.js.map

package/packages/host/dist/settle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"settle.js","sourceRoot":"","sources":["../src/settle.ts"],"names":[],"mappings":"AAuCA,OAAO,EACL,aAAa,EACb,SAAS,EACT,WAAW,EACX,OAAO,EACP,UAAU,EACV,MAAM,GACP,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,aAAa,EACb,UAAU,EACV,YAAY,GACb,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAcjD;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAG,MAAM,CAAC;AAEzC;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC;AA+BpC;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,SAAS,GAAG,GAAG,CAAC;AACtB,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;AAE7C;8EAC8E;AAC9E,MAAM,UAAU,SAAS,CAAC,MAAc,EAAE,OAAe;IACvD,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO;QAAE,OAAO;IAChC,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,OAAO;QAAE,OAAO;IAC/C,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5B,OAAO,UAAU,CAAC,IAAI,IAAI,SAAS,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YAC9C,IAAI,MAAM,KAAK,SAAS;gBAAE,MAAM;YAChC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IACD,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAClC,CAAC;AAED;qEACqE;AACrE,MAAM,UAAU,gBAAgB,KAAW,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;AAEhE;;kDAEkD;AAClD,SAAS,cAAc,CAAC,MAA0B,EAAE,OAA2B;IAC7E,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACrC,OAAO,CAAC,CAAC,KAAK,IAAI,KAAK,KAAK,OAAO,CAAC;AACtC,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,KAAK,GAAG,IAAI,GAAG,EAAuF,CAAC;AAE7G;;;;;;;;;;;;;;GAcG;AACH,MAAM,SAAS,GAAG,EAAE,CAAC;AAErB,4EAA4E;AAC5E,SAAS,aAAa,CAAC,QAAwB,EAAE,SAAiB;IAChE,4EAA4E;IAC5E,yEAAyE;IACzE,+EAA+E;IAC/E,6EAA6E;IAC7E,8EAA8E;IAC9E,8EAA8E;IAC9E,4EAA4E;IAC5E,2EAA2E;IAC3E,qDAAqD;IACrD,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IACrD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACjC,yEAAyE;IACzE,qEAAqE;IACrE,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACtB,IAAI,OAAO,GAAuD,IAAI,CAAC;IACvE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,QAAQ,CAAC,aAAa,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;QACpE,IAAI,GAAG,KAAK,WAAW,IAAI,GAAG,EAAE,CAAC;YAC/B,wEAAwE;YACxE,YAAY;YACZ,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACxB,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;YAC1B,OAAO,GAAG,CAAC,OAAO,CAAC;QACrB,CAAC;QACD,4EAA4E;QAC5E,4EAA4E;QAC5E,4EAA4E;QAC5E,8DAA8D;QAC9D,IAAI,GAAG,IAAI,GAAG,KAAK,WAAW,IAAI,GAAG,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YACzD,sEAAsE;YACtE,uEAAuE;YACvE,qCAAqC;YACrC,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAC,oEAAoE,CAAC,CAAC;IAChF,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC,IAAI,IAAI,SAAS,EAAE,CAAC;YAC/B,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YACzC,IAAI,MAAM,KAAK,SAAS;gBAAE,MAAM;YAChC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IACD,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IACtC,OAAO,OAAO,CAAC;AACjB,CAAC;AAmCD,MAAM,UAAU,QAAQ,CACtB,QAAwB,EACxB,SAAiB,EACjB,IAAY,EACZ,KAAa,EACb,OAAmB,EAAE;IAErB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IACpD,IAAI,WAAW,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IACrD,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAClD,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IAC3C,MAAM,KAAK,GAAG,KAAK,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,cAAc,CAAC,CAAC;IACvD;wEACoE;IACpE,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC,CAAC,EAAE,IAAI,IAAI,IAAI,CAAC,CAAC,EAAE,GAAG,KAAK;YAAE,SAAS;QAC3C,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC;YAAE,SAAS;QACrC,IAAI,cAAc,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAAC,KAAK,GAAG,IAAI,CAAC;YAAC,SAAS;QAAC,CAAC;QACnE,IAAI,IAAI,CAAC,OAAO;YAAE,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAChD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;IAC7C,CAAC;IACD,uEAAuE;IACvE,8EAA8E;IAC9E,uEAAuE;IACvE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;AACnD,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,KAAK,UAAU,WAAW,CACxB,QAAwB,EACxB,SAAiB,EACjB,IAAY,EACZ,KAAa,EACb,IAAgB;IAEhB,IAAI,QAAQ,CAAC,cAAc,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,MAAM,IAAI,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC;IACnC,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAC/B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IACzE,MAAM,KAAK,GAAG,KAAK,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,cAAc,CAAC,CAAC;IACvD,IAAI,KAAK,GAAsD,IAAI,CAAC;IACpE,IAAI,CAAC;QAAC,KAAK,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,KAAK,GAAG,IAAI,CAAC;IAAC,CAAC;IACjF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IACzD,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,OAAO,CAAC,EAAE,EAAE,KAAK,QAAQ,IAAI,CAAC,CAAC,EAAE,GAAG,KAAK;YAAE,SAAS;QACxD,IAAI,OAAO,CAAC,EAAE,IAAI,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC;YAAE,SAAS;QACpE,IAAI,cAAc,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAAC,KAAK,GAAG,IAAI,CAAC;YAAC,SAAS;QAAC,CAAC;QACnE,IAAI,IAAI,CAAC,OAAO;YAAE,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAChD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;IAC7C,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;AACnD,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,UAAU,CACxB,QAAwB,EACxB,SAAiB,EACjB,IAAY,EACZ,KAAa,EACb,OAAmB,EAAE;IAErB,OAAO,QAAQ,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC;AAClE,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,QAAwB,EACxB,SAAiB,EACjB,IAAY,EACZ,KAAa,EACb,EAAU,EACV,OAAO,GAAG,aAAa,EACvB,OAAgB;IAEhB,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC;IACjC,SAAS,CAAC;QACR,uEAAuE;QACvE,4EAA4E;QAC5E,2EAA2E;QAC3E,IAAI,UAAU,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACjG,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ;YAAE,OAAO,KAAK,CAAC;QACzC,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,QAAwB,EACxB,SAAiB,EACjB,IAAY,EACZ,KAAa,EACb,OAAmB,EAAE;IAErB,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,IAAI,EAAE,OAAO,KAAK,IAAI,CAAC;IACrC,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAEjD,2EAA2E;IAC3E,6EAA6E;IAC7E,6EAA6E;IAC7E,gFAAgF;IAChF,MAAM,OAAO,GAAG,CAAC,MAAM,WAAW,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,IAAI,QAAQ,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IAChI,IAAI,OAAO,CAAC,OAAO,KAAK,QAAQ;QAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;IAE9F,oEAAoE;IACpE,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC;IAC3F,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,UAAU,GAAa,MAAM,CAAC;IAClC,IAAI,CAAC;QACH,0EAA0E;QAC1E,0EAA0E;QAC1E,yEAAyE;QACzE,uEAAuE;QACvE,yEAAyE;QACzE,2EAA2E;QAC3E,8DAA8D;QAC9D,EAAE;QACF,uEAAuE;QACvE,4EAA4E;QAC5E,wEAAwE;QACxE,4EAA4E;QAC5E,0EAA0E;QAC1E,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5E,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,aAAa,CAAC,CAAC;QACxC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5B,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QACrB,4EAA4E;QAC5E,0EAA0E;QAC1E,2EAA2E;QAC3E,4EAA4E;QAC5E,4EAA4E;QAC5E,qBAAqB;QACrB,EAAE;QACF,4EAA4E;QAC5E,qEAAqE;QACrE,2EAA2E;QAC3E,0EAA0E;QAC1E,wEAAwE;QACxE,yEAAyE;QACzE,yEAAyE;QACzE,4EAA4E;QAC5E,2EAA2E;QAC3E,4BAA4B;QAC5B,EAAE;QACF,2EAA2E;QAC3E,2EAA2E;QAC3E,4EAA4E;QAC5E,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC1C,IAAI,QAAQ,KAAK,IAAI;YAAE,UAAU,GAAG,QAAQ,CAAC;aACxC,CAAC;YACJ,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC;YACxE,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACjG,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAAC,CAAC;IACjD,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAClD,uEAAuE;IACvE,mEAAmE;IACnE,EAAE;IACF,8EAA8E;IAC9E,2EAA2E;IAC3E,8EAA8E;IAC9E,iFAAiF;IACjF,wEAAwE;IACxE,8EAA8E;IAC9E,0EAA0E;IAC1E,2EAA2E;IAC3E,8EAA8E;IAC9E,0EAA0E;IAC1E,4EAA4E;IAC5E,sEAAsE;IACtE,iEAAiE;IACjE,EAAE;IACF,wEAAwE;IACxE,4EAA4E;IAC5E,6EAA6E;IAC7E,2EAA2E;IAC3E,4EAA4E;IAC5E,2EAA2E;IAC3E,6EAA6E;IAC7E,wEAAwE;IACxE,UAAU;IACV,MAAM,IAAI,GAAG,UAAU,CAAC;IACxB,MAAM,IAAI,GAAG,IAAI,KAAK,MAAM,IAAI,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,MAAM,CAAC;IACpE,IAAI,IAAI,IAAI,IAAI,KAAK,MAAM;QAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAClE,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,sEAAsE;QACtE,yEAAyE;QACzE,kEAAkE;QAClE,2EAA2E;QAC3E,yEAAyE;QACzE,2BAA2B;QAC3B,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;QACzF,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACvC,CAAC;IAED,8BAA8B;IAC9B,EAAE;IACF,+EAA+E;IAC/E,4EAA4E;IAC5E,4EAA4E;IAC5E,6EAA6E;IAC7E,8CAA8C;IAC9C,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC;AACjF,CAAC"}

package/packages/host/dist/setupprefs.d.ts

@@ -0,0 +1,51 @@
+import { type OptInChoice } from "@waterplane/shared";
+export declare class SetupPrefsStore {
+    private path;
+    private doc;
+    constructor(root: string);
+    /** The window the `auto-compact` fix writes, and whether somebody chose it. */
+    autoCompactDefault(): {
+        value: string;
+        chosen: boolean;
+    };
+    /** Store a chosen window, or `null` to go back to the shipped one. Refuses
+     *  in words and stores nothing for a value outside the range. */
+    setAutoCompactDefault(raw: unknown): {
+        ok: true;
+    } | {
+        ok: false;
+        error: string;
+    };
+    ignored(worktree: string): string[];
+    setIgnored(worktree: string, id: string, ignore: boolean): {
+        ok: true;
+    } | {
+        ok: false;
+        error: string;
+    };
+    optInChoices(worktree: string): Record<string, OptInChoice>;
+    /** Store the person's word on one offer, or `null` to take it back. */
+    setOptInChoice(worktree: string, id: string, choice: OptInChoice | null): {
+        ok: true;
+    } | {
+        ok: false;
+        error: string;
+    };
+    private save;
+}
+export declare function setSetupPrefsStore(store: SetupPrefsStore | null): void;
+/** Boot: the two stores the setup checklist reads (`contextlimits.ts`'s
+ *  thresholds and this file's choices), installed in one call from `main.ts`. */
+export declare function installChecklistStores(root: string): void;
+export declare function setupPrefsStore(): SetupPrefsStore | null;
+/** The window the checklist writes and passes at — the chosen one, else the shipped one. */
+export declare function autoCompactDefault(): string;
+export declare function ignoredChecks(worktree: string): string[];
+/** What the person said about each opt-in offer in this repo — empty without a store. */
+export declare function optInChoices(worktree: string): Record<string, OptInChoice>;
+export declare function setOptInChoice(worktree: string, id: string, choice: OptInChoice | null): {
+    ok: true;
+} | {
+    ok: false;
+    error: string;
+};

package/packages/host/dist/setupprefs.js

@@ -0,0 +1,178 @@
+/**
+ * What this person decided about the setup checklist, as opposed to what the
+ * checklist measures: which advisory rows they chose to ignore in which repo,
+ * and which auto-compact window the checklist offers to write.
+ *
+ * Same shape and same reasons as `contextlimits.ts`:
+ *
+ *  - **A host store, never a file written into the repo.** `setupwatch.ts`
+ *    sweeps repos nobody opened and never writes into one, and "ignore this
+ *    here" is this desktop's opinion about a directory, not a fact about its
+ *    source. `<STATE_DIR>/setupprefs.json`.
+ *  - **Keyed by REALPATH**, so the ignore saved from the sheet is the one the
+ *    sweep reads.
+ *  - **Only `ADVISORY_CHECKS` can be ignored.** A committed secret or an
+ *    un-ignored outbox is a finding; letting it be hidden would make the badge
+ *    a switch rather than a reading.
+ *  - **Host-side, not a synced setting**, because `settings.ts` stores opaque
+ *    strings the daemon never parses, and the sweep needs the chosen window
+ *    with no client attached (it decides where the row passes).
+ *  - **Unset is a silent no-op**: `inspectRepo()` called from a test with no
+ *    store installed gets no ignores and the shipped default.
+ */
+import { existsSync, mkdirSync, realpathSync } from "node:fs";
+import { join } from "node:path";
+import { ContextLimitsStore, setContextLimitsStore } from "./contextlimits.js";
+import { ADVISORY_CHECKS, AUTO_COMPACT_SUGGESTED, OPT_INS, cleanAutoCompactDefault } from "@waterplane/shared";
+import { hostStateDir } from "./branddirs.js";
+import { readJsonGuarded, writeJsonAtomic } from "./jsonstore.js";
+function key(worktree) {
+    try {
+        return realpathSync(worktree);
+    }
+    catch {
+        return worktree;
+    }
+}
+export class SetupPrefsStore {
+    path;
+    doc = { ignored: {}, optIns: {} };
+    constructor(root) {
+        this.path = join(hostStateDir(root), "setupprefs.json");
+        try {
+            if (existsSync(this.path)) {
+                const raw = readJsonGuarded(this.path, null);
+                // Cleaned on the way IN too: a hand-edit must not put an unreadable
+                // window or a non-advisory id where the checklist reads it.
+                if (raw?.autoCompactDefault != null) {
+                    const c = cleanAutoCompactDefault(raw.autoCompactDefault);
+                    if (c.ok)
+                        this.doc.autoCompactDefault = c.value;
+                }
+                if (raw?.ignored && typeof raw.ignored === "object" && !Array.isArray(raw.ignored)) {
+                    for (const [k, v] of Object.entries(raw.ignored)) {
+                        const ids = Array.isArray(v) ? v.map(String).filter((id) => ADVISORY_CHECKS.includes(id)) : [];
+                        if (ids.length)
+                            this.doc.ignored[k] = [...new Set(ids)];
+                    }
+                }
+                if (raw?.optIns && typeof raw.optIns === "object" && !Array.isArray(raw.optIns)) {
+                    for (const [k, v] of Object.entries(raw.optIns)) {
+                        if (!v || typeof v !== "object" || Array.isArray(v))
+                            continue;
+                        const m = {};
+                        for (const [id, c] of Object.entries(v)) {
+                            if (OPT_INS.some((d) => d.id === id) && (c === "declined" || c === "done"))
+                                m[id] = c;
+                        }
+                        if (Object.keys(m).length)
+                            this.doc.optIns[k] = m;
+                    }
+                }
+            }
+        }
+        catch { /* corrupt or unreadable → nothing ignored, the shipped default */ }
+    }
+    /** The window the `auto-compact` fix writes, and whether somebody chose it. */
+    autoCompactDefault() {
+        return this.doc.autoCompactDefault
+            ? { value: this.doc.autoCompactDefault, chosen: true }
+            : { value: AUTO_COMPACT_SUGGESTED, chosen: false };
+    }
+    /** Store a chosen window, or `null` to go back to the shipped one. Refuses
+     *  in words and stores nothing for a value outside the range. */
+    setAutoCompactDefault(raw) {
+        if (raw == null || raw === "") {
+            delete this.doc.autoCompactDefault;
+            this.save();
+            return { ok: true };
+        }
+        const c = cleanAutoCompactDefault(raw);
+        if (!c.ok)
+            return c;
+        this.doc.autoCompactDefault = c.value;
+        this.save();
+        return { ok: true };
+    }
+    ignored(worktree) {
+        return [...(this.doc.ignored[key(worktree)] ?? [])];
+    }
+    setIgnored(worktree, id, ignore) {
+        if (!ADVISORY_CHECKS.includes(id)) {
+            return { ok: false, error: `"${id}" is not a check that can be ignored — only ${ADVISORY_CHECKS.join(", ")}` };
+        }
+        const k = key(worktree);
+        const cur = new Set(this.doc.ignored[k] ?? []);
+        if (ignore)
+            cur.add(id);
+        else
+            cur.delete(id);
+        if (cur.size)
+            this.doc.ignored[k] = [...cur];
+        else
+            delete this.doc.ignored[k];
+        this.save();
+        return { ok: true };
+    }
+    optInChoices(worktree) {
+        return { ...(this.doc.optIns[key(worktree)] ?? {}) };
+    }
+    /** Store the person's word on one offer, or `null` to take it back. */
+    setOptInChoice(worktree, id, choice) {
+        if (!OPT_INS.some((d) => d.id === id))
+            return { ok: false, error: `"${id}" is not an opt-in this desktop knows` };
+        if (choice !== null && choice !== "declined" && choice !== "done") {
+            return { ok: false, error: `"${String(choice)}" is not a choice — only "declined", "done", or null to clear` };
+        }
+        const k = key(worktree);
+        const cur = { ...(this.doc.optIns[k] ?? {}) };
+        if (choice)
+            cur[id] = choice;
+        else
+            delete cur[id];
+        if (Object.keys(cur).length)
+            this.doc.optIns[k] = cur;
+        else
+            delete this.doc.optIns[k];
+        this.save();
+        return { ok: true };
+    }
+    save() {
+        try {
+            mkdirSync(join(this.path, ".."), { recursive: true });
+            writeJsonAtomic(this.path, this.doc, { space: 2 });
+        }
+        catch { /* a preference that could not be persisted is not worth a crash */ }
+    }
+}
+// The settable singleton, for the reason `contextlimits.ts` gives.
+let current = null;
+export function setSetupPrefsStore(store) {
+    current = store;
+}
+/** Boot: the two stores the setup checklist reads (`contextlimits.ts`'s
+ *  thresholds and this file's choices), installed in one call from `main.ts`. */
+export function installChecklistStores(root) {
+    setContextLimitsStore(new ContextLimitsStore(root));
+    setSetupPrefsStore(new SetupPrefsStore(root));
+}
+export function setupPrefsStore() {
+    return current;
+}
+/** The window the checklist writes and passes at — the chosen one, else the shipped one. */
+export function autoCompactDefault() {
+    return current?.autoCompactDefault().value ?? AUTO_COMPACT_SUGGESTED;
+}
+export function ignoredChecks(worktree) {
+    return current?.ignored(worktree) ?? [];
+}
+/** What the person said about each opt-in offer in this repo — empty without a store. */
+export function optInChoices(worktree) {
+    return current?.optInChoices(worktree) ?? {};
+}
+export function setOptInChoice(worktree, id, choice) {
+    if (!current)
+        return { ok: false, error: "no preference store is installed on this host" };
+    return current.setOptInChoice(worktree, id, choice);
+}
+//# sourceMappingURL=setupprefs.js.map