v1.64.0

transcend-reject 1.5.2 - claim prompted only where something prompted

prompted is Transcend's field for "this user has been shown a prompt", and
the record written where there is no engine was asserting it when no banner had
existed to show one - which told their sync endpoint a prompt had been answered
that was never shown. Their banner sets it itself, on render:

!hs(t) && !e.getConsent().prompted && e.setPrompted(!0)

and ui.js carries { confirmed: true, prompted: true } as Xe, the object it
passes with a decision. So the field now splits by whether a banner moment
happened at all: true where their engine readied and this replaced the banner
at the moment it would have rendered, left out where nothing readied and no
banner was ever built. Their schema has it optional and airgap coerces it with
!!, so absent reads as false. It gates nothing either way - the prompt turns
on confirmed.

Found by comparing the record this writes against a real refusal off a live
tenant, the first of six genuine samples to disagree. It is not a
disagreement: the other five came through a banner and that one did not.

Documentation

Their TCF banner. A tenant with the IAB layer on serves a second banner at
/cm/<id>/tcf/ui.js, and because * spans a path separator the shipped rules
match it too. That is now written down as deliberate, with what it trades: that
file owns the TCF record, declaring tcmTcf and tcmTcfMP itself, so
replacing it leaves a TCF vendor with no __tcfapi and no stored string -
no consent signal rather than a fabricated one. The url-matching test carries
the path.

The two rules that take the engine. /*/airgap.js and /cm/ both replace
the half that enforces the refusal and fetches the banner, so the rule somebody
wanted cannot fire at all. The cost of each is now measured on one tenant
across two loads rather than argued.

tcmQuarantine is not a failure signal. It is the engine's own store for
requests and cookies it intercepted, and it stays empty unless the tenant sets
quarantineSyncBudget. The tenant's matcher table is what answers whether a
refusal is being enforced.

Only transcend-reject.js changes. Every other resource is byte-identical to
v1.63.0.