fix(desktop): prevent sidebar prefs from reverting on stale-localStorage boot

[wpfleger96]

Fixes the bug where running a dev build with stale localStorage would publish outdated channel sections, sort preferences, starred channels, and muted channels to the relay, clobbering the DMG installation's live state.

Root cause

All four sidebar-preference sync managers (channelSectionsSync, channelSortSync, channelStarsSync, channelMutesSync) collapsed five distinct fetch outcomes — no event, timeout, error, auth-race empty result, decrypt/parse failure — into a single null. Each hook's boot effect treated null as "no remote exists" and seed-published whatever was in localStorage, stamped at max(now, lastRemoteCreatedAt+1) with lastRemoteCreatedAt reset to 0 on every boot. A dev build with stale localStorage therefore re-signed old state as newer, and the DMG's live subscription applied it.

Two guards

1. Tri-state fetch result (found | absent | failed) — decrypt failure on an existing event reports failed and records event.created_at, so seed-publish is blocked even when the payload is unreadable.

2. Persisted head watermark (sidebarSyncWatermark.ts) — keyed {blobType, pubkey, normalizedRelayUrl}, written to localStorage on every observed remote event (before decrypt on all paths: initial fetch, live subscription, fetchOwnBlobBeforePublish), hydrated at construction. Any session that has ever seen a remote blob skips seed-publish on the next boot even when the fetch returns empty. Relay URLs are normalised via shared/lib/normalizeRelayUrl (also used by profile storage) so the same relay written two ways never produces two keys.

Bootstrap owns the seed. Each manager exposes bootstrap(localStore) that fetches, records the raw head, and delegates the decision to the single runBootstrap policy: hold on failed or absent + prior watermark, seed on genuine first-sync (absent + zero watermark + non-empty local), apply-remote when a blob was found. Hooks only act on apply-remote; they cannot publish during bootstrap. First-time sync is unchanged: successful EOSE with no event, zero watermark, and non-empty local state still seeds.

LWW baseline preservation

fetchOwnBlobBeforePublish for sections/sort snapshots the watermark before recordRemoteHead advances it, then compares the fetched event against the snapshot — advancing first would make remote.createdAt > lastRemoteCreatedAt always false and silently kill the whole-blob LWW merge. Stars/mutes merge per-entry via mergeStores, so no snapshot is needed there.

Relay lifecycle

All four hooks require a defined relayUrl (plumbed from communitiesHook.activeCommunity?.relayUrl in AppShell.tsx); while it is undefined no manager is constructed and no boot/live/reconnect effect binds. All effects depend on [pubkey, relayUrl], so community switches tear down and rebind. destroy() cancels pending publishes without flushing — flushing would race community switching and could publish relay A's state to relay B via the shared relayClient singleton. Pending debounce-window edits are intentionally dropped: stars/mutes entries survive via per-entry merge on the next publish; a dropped sections/sort edit is lost because bootstrap whole-blob-replaces from remote on return.

Known trade-off: a first boot with the relay unreachable holds (never seeds) until the user's next explicit edit — preferred over risking a stale seed-publish.

Files

• sidebarSyncWatermark.ts — watermark persistence + runBootstrap policy (tri-state FetchResult, readWatermark, advanceWatermark)
• shared/lib/normalizeRelayUrl.ts — relay-URL normalisation shared by watermark keys and profile storage
• channelSectionsSync.ts, channelSortSync.ts, channelStarsSync.ts, channelMutesSync.ts — tri-state fetch, pre-decrypt recordRemoteHead on all paths, sections/sort watermark snapshot for LWW, bootstrap(), cancel-without-flush destroy()
• useChannelSections.ts, useChannelSortPreference.ts, useChannelStars.ts, useChannelMutes.ts — act on bootstrap() results, gate on relayUrl, [pubkey, relayUrl] deps on all effects
• AppShell.tsx — passes activeCommunity?.relayUrl to useChannelMutes and useChannelStars
• sidebarSyncTestHelpers.mjs — shared fake-window/localStorage/Tauri mocks for the four manager suites
• Test suites — mutation-sensitive coverage: failed→hold, absent+watermark→hold, first-sync seeds, undecryptable head recorded on all paths, relay-A/B watermark isolation, watermark restart round-trip, sections/sort LWW baseline