Optional cross-machine resumable story-builder sessions

[atomantic]

Optional cross-machine resumable sessions. Sessions are intentionally local-only in v1 (excluded from peer sync). If cross-machine resume is wanted later, key the staleness model on a content hash carried in the session (the integrity helper already produces one) rather than live-record diffing, so a peer's universe edit doesn't false-positive-stale the local session.

Migrated from PLAN.md by /do:replan --issues. Plan slug: story-builder-session-sync.

[atomantic]

Shipped a first slice in PR #861 (merged): the opt-in flag + the sync-safe staleness model — the prerequisite this issue calls out.

What shipped:

• Story Builder sessions gain an opt-in sync flag (default off — local-only stays the default).
• Staleness is now keyed on a content hash carried in the session (syncedHashes) for sync:true sessions, instead of live-record diffing. The baseline moves only on explicit session gestures (lock, sync-enable, reconcile), so a peer's universe edit can't false-positive-stale a session that traveled across machines. Local-only sessions keep the existing Upstream-hash detects input drift, not out-of-band output edits #731 live-diff behavior unchanged.
• New service actions + routes: POST /:id/sync (toggle) and POST /:id/reconcile (re-baseline against the current machine's live records). Reconcile rejects a local-only session.
• Tests cover: peer edit not false-positiving a synced session, the same edit still flagging a local-only session, single-step (not whole-map) lock re-baselining, reconcile surfacing genuine drift, and disabling reverting to live-diff.

What remains (follow-up):

• The actual cross-machine sync wire integration — peer push schema, manifest kind, importer apply path, subscriptions/auto-subscribe, tombstone GC, and a schemaVersions.js version gate (the full bundled-record sync guard set). This is a larger multi-file feature and warrants its own PR.
• Client UI for the per-session sync toggle + reconcile action (the API exists; no UI ships in this slice).

Leaving this open to track the wire integration + UI.

[atomantic]

Shipped the cross-machine sync wire integration in PR #866 (merged).

What shipped:

• A new storyBuilder snapshot-sync category: a session marked sync: true now rides the 60s snapshot loop, union-merged by id with LWW on updatedAt. Local-only sessions (the default) are never included in the snapshot or its checksum.
• Full bundled-record guard set: PORTOS_SCHEMA_VERSIONS.storyBuilder v1 + a per-category version gate (a newer peer can't corrupt an older one; only storyBuilder transfers pause on a mismatch, not unrelated categories). Wire form is sanitize-first, byte-stable (strips the local-only ephemeral marker), first-wins dedup on a duplicate id, refuses to flip a local session's sync mode back on from a stale peer push, and converges tombstones. Additive wire contract — no on-disk migration needed (existing sessions are sync: false and simply don't sync).
• Per-peer "Story Builder" sync toggle on the Instances page + schema parity in DEFAULT_SYNC_CATEGORIES, the syncCategories Zod schema, and the manual sync-route category enum.
• Tests cover the wire sanitize, the merge contract (adopt/LWW-both-ways/refuse-local-only/refuse-non-sync/first-wins/tombstone), snapshot only-sync filtering + checksum convergence, fresh-receiver round-trip, and the per-category schema gate. Reviewed by codex + claude (converged CLEAN).

Sessions are tiny metadata records with no assets and no child records, so they intentionally ride the snapshot transport rather than the heavier per-record push/asset/reverse-subscribe pipeline used by universe/series.

What remains (follow-up):

• The per-session sync toggle + reconcile-action UI on the Story Builder page itself. The API for both already exists (POST /:id/sync, POST /:id/reconcile from PR feat([issue-730]): opt-in sync-safe staleness for story-builder sessions #861); only the in-page UI controls are missing.

Leaving this open to track the remaining UI work.