LLP 0276 + 0277: hidden rows stay off the sync gate; an answer-less config is not a reconfigure

[bgmcmullen]

Two onboarding-wizard fixes, one commit and one LLP decision each.

LLP 0276: a hidden picker row stays off the sync gate too

On every enrolled machine the sync gate led with the two hidden raw-proxy rows (raw-anthropic / raw-openai) labelled · managed by your fleet - rows the picker had deliberately never offered (LLP 0202). They classify locked because @hypaware/ai-gateway sits in the central layer, so the only fleet-labelled rows were the two nobody had seen, and the label read as a property of the client rows beneath them.

• runInitWizard now passes the locked descriptors through visiblePickerDescriptors, the same display filter the pick lane uses. Filtered at the screen, never at the locked set: dropping hidden ids from lockedSources upstream would re-compose the org's gateway into the local layer (the LLP 0129 collision).
• The no-candidates short-circuit in runWizardSyncScope splits: with no visible org row to name, it prints "You picked nothing to record, so nothing syncs to your server" instead of attributing an empty list to the fleet. Both paths stay noQuestion, so the step counter is unaffected.
• Supersedes LLP 0202's consequence line "the sync/opt-out menu is unchanged" (written before PR Onboarding wizard cleanup: defaults gate, back navigation, enrolled default sync, CLI severity colour #629 added locked rows to that gate).

LLP 0277: an answer-less config does not make a reconfigure

hyp remote add before the first hyp init (the documented team onboarding order) writes a config holding only query.remotes. The pick phase classified any readable config file as a reconfigure, so the first real onboarding run seeded from an empty read-back instead of from detection: every box arrived unchecked but still labelled · detected, no defaults/express gate rendered, and the export read-back flipped the first-run local-parquet default to keep-local.

• The classification now keys on whether the config records a pick answer, discriminated by the plugins key (configRecordsPickAnswer): the pick composer always writes a plugins array, the side-channel writers never touch it.
• An answer-less config seeds like no config at all - detection pre-checks, gates render, export takes the first-run default - while its keys (the added remote) still carry through the composition fold.
• plugins: [] remains a reconfigure: an emptied install cannot be told from one, and re-seeding it from detection would re-consent on the user's behalf, which is what LLP 0183 forbids.
• The reconfigure telemetry attribute on wizard.pick.start follows the answer-keyed classification.
• Residual noted in the doc: the returning gate (LLP 0129/0182) still keys on file existence, so hyp init after hyp remote add still fronts the "already set up" summary; left to a follow-up.

Testing

• node --test test/core/cli/wizard/*.test.js: 132 pass, 0 fail (new coverage for the filtered sync gate, both no-candidates lines, answer-less seeding, key carry-forward, and the plugins: [] boundary).
• npm test: 28 failures in query/parquet/report suites, identical count on a clean master (pre-existing, unrelated).

🤖 Generated with Claude Code

[philcunliffe]

neutral review round: PR #874 @ 86ceb2e6

Verdict: approve after fixes (both fixed and pushed on this branch).

The LLP 0267 half is clean. Two medium findings in the LLP 0266 half, both on the sync gate, both fixed in 11bd103e.

Verification on the reviewed head: npm test 4489 pass / 0 fail, npm run typecheck clean. Same after the fixes: npm test 4490 pass / 0 fail / 1 skipped, npm run typecheck clean.

---

Finding 1 (medium, FIXED): the no-candidates line claims nothing syncs while locked rows are standing

src/core/cli/wizard/sync_scope.js:94 (reviewed head)

The new short-circuit prints "You picked nothing to record, so nothing syncs to your server." whenever opts.locked is empty. After this PR's change that branch is reached on exactly the machine class LLP 0266 targets: an enrolled machine whose only locked rows are raw-anthropic / raw-openai, which runInitWizard now strips out of opts.locked via visiblePickerDescriptors (src/core/cli/wizard/index.js:529).

Those rows are still in picked.lockedSources, are still composed by the org's central layer (@hypaware/ai-gateway carries the org listen address and proxy_mode), and per LLP 0188 §locked they always sync and can never be opted out. So something does leave the machine, and the gate says nothing does.

It is also reachable with a genuinely picked hidden row: a config that collects only raw-anthropic carries it through (carried in resolvePickSeeding, pick.js:225), the locked filter drops it from sources, so candidates is empty too. Before this PR the same screen at least listed those rows as fleet-managed. The change turned an over-disclosure into an affirmatively false statement about what leaves the machine, which is the failure LLP 0188 §never-silent exists to prevent.

Fix: the branch now splits three ways, driven by a new lockedHidden count (RunWizardSyncScopeOptions.lockedHidden, src/core/cli/wizard/types.d.ts:87) that runInitWizard computes as allLockedDescriptors.length - lockedDescriptors.length:

state	line
a visible org row	"Everything you picked is managed by your fleet and always syncs." + the rows
no visible org row, lockedHidden > 0	"You picked nothing to record, but capture your fleet manages directly still syncs to your server."
no locked row at all	"You picked nothing to record, so nothing syncs to your server."

A count, not a list: the lane must be able to tell the truth about the withheld rows without being able to name them. All three paths stay noQuestion, so LLP 0191 §back-edges and the step counter are unaffected.

Finding 2 (medium, FIXED): the display filter was applied to locked but not to candidates

src/core/cli/wizard/index.js:539 (reviewed head)

LLP 0266's stated invariant widens LLP 0202 to "absent from every wizard screen", but only half of the screen was filtered. candidates: picked.descriptors is sources.map(id => descriptors.get(id)), and sources carries a hidden id whenever that id is not locked, via the LLP 0202 carry-through:

• a machine configured hyp init --source raw-anthropic (config collects nothing visible, so carried = ['raw-anthropic']) that then runs hyp init on the team pathway, where the join's org-config converge has not landed yet and lockedSet is empty;
• an enrolled machine whose central layer does not declare @hypaware/ai-gateway.

The sync gate then listed "Anthropic API" as an editable candidate and rendered it as a checkbox, and unchecking it writes a local-only policy entry for a source the picker deliberately never offered.

Fix:candidates: visiblePickerDescriptors(picked.descriptors). Filtered at the screen, not in pick.js, which keeps LLP 0266's own "filter at the screen, never at the locked set" rule and leaves configure.js's needs-setup read of picked.descriptors untouched. The policy store's editor semantics are correct under this: an existing opt-out entry for a now-unshown row is kept, never silently dropped, which is what runWizardSyncScope already documents.

No issues in the LLP 0267 half

configRecordsPickAnswer is a sound discriminator: composePickerConfig always emits a plugins array (including []), and mutateLocalConfig (the only remote add / remove writer) never touches the key. carryForwardExistingConfig handles existing.plugins === undefined safely, the reconfigure span attribute and the export read-back are consistently keyed to configured !== undefined, and expressRowsSafe reuses resolvePickSeeding so the express gate cannot drift from the pick lane. The returning-gate mismatch (configExists && configValid) is already declared a residual in LLP 0267 §consequences.

---

What was pushed

11bd103e on wizard-sync-gate-and-answerless-config:

• src/core/cli/wizard/index.js: both row lists through visiblePickerDescriptors; lockedHidden passed to the lane.
• src/core/cli/wizard/sync_scope.js: three-way no-candidates split.
• src/core/cli/wizard/types.d.ts: lockedHidden?: number, and the doc comments on candidates / locked now say both arrive display-filtered.
• test/core/cli/wizard/sync_scope.test.js: hidden-only locked set does not claim nothing syncs and still never names the withheld rows.
• test/core/cli/wizard/index.test.js: a hidden picked row is not a sync candidate; lockedHidden is threaded.
• llp/0266-hidden-rows-stay-off-the-sync-gate.decision.md: §sync-gate, §no-candidates, and §consequences updated to match. Amended in place rather than superseded because the doc is introduced by this same unmerged PR, so there is no landed decision to preserve.

[philcunliffe]

neutral review round: e613ba25 (adopted PR, healed in place)

Verdict: findings (1 actionable, fixed and pushed).

The LLP 0277 half (configRecordsPickAnswer) checks out. The plugins-key discriminator was verified against every local-config writer in the tree: remote_commands.js:mutateLocalConfig (the remote add/remove path) is the only one that never touches plugins, while composePickerConfig, carryForwardExistingConfig, client_enable.js, and gateway_proxy_enable.js all write it unconditionally. The export/reconfigure/telemetry keying off configured !== undefined is consistent, and carryForwardExistingConfig handles a missing plugins correctly. No issues.

Finding 1 (medium) - the sync gate can claim "nothing syncs" while a hidden picked row syncs

src/core/cli/wizard/sync_scope.js:97-104 (at e613ba25), fed by src/core/cli/wizard/index.js:534.

The new display filter is applied to both row lists, but only the locked list reports how many rows it removed (lockedHidden). There is no candidate counterpart. A carried hidden row (LLP 0202 #carry-through) reaches picked.descriptors whenever it is not locked - the team pathway whose org config has not converged, the case LLP 0276 §sync-gate names itself and the new test 'a hidden picked row is not a sync-scope candidate' constructs. When it is the only pick, candidates filters to [], locked is [], and lockedHidden is 0, so the no-question branch takes the strongest of its three sentences.

Confirmed end-to-end through runInitWizard (catalog holding only raw-anthropic with hidden: true, pick returning descriptors: [rawDescriptor], lockedSources: []):

CANDIDATES []
LOCKEDHIDDEN 0
SYNCLINES ["Step 3 of 5 · Choose what syncs",
"You picked nothing to record, so nothing syncs to your server."]

raw-anthropic is in sources, composes the Anthropic gateway upstream into the local layer, and has no local-only entry in the client sync store, so it syncs. This is exactly the outcome LLP 0276 §no-candidates rules out for the locked case ("Saying 'nothing syncs' here would trade LLP 0202's over-disclosure for an affirmatively false claim about what leaves the machine"). The decision applied that reasoning to hidden locked rows and did not carry it to hidden candidate rows.

Fixed in 6038b120:

• src/core/cli/wizard/index.js computes the filtered candidate list once and passes candidatesHidden alongside lockedHidden - one count per filtered list.
• src/core/cli/wizard/sync_scope.js gains a fourth no-question line: with no locked row but a hidden pick standing, it prints "You picked nothing to record, but capture already set up on this machine still syncs to your server." It names neither the withheld row nor the fleet, which does not own it. All four paths stay noQuestion, so the step counter is unaffected.
• src/core/cli/wizard/types.d.ts documents candidatesHidden.
• LLP 0276 §no-candidates extended with the fourth case and the sentence (the doc is new in this PR, so this is an amendment to an unlanded draft, not an edit to a settled record); §consequences updated.
• New test zero visible candidates with a hidden picked row: does not claim nothing syncs, never names the fleet in test/core/cli/wizard/sync_scope.test.js; the two runInitWizard filter tests now also assert candidatesHidden. The new test was verified to fail against e613ba25's sync_scope.js and pass after the fix.

Notes (not actionable)

• With a visible locked row present and a hidden pick, the gate prints "Everything you picked is managed by your fleet and always syncs". Left as-is: the carried hidden row was never offered, so it was not "picked", and the sentence stays defensible under that reading. The false claim was only the "so nothing syncs" clause.
• The PR body cites LLP 0266/0267; the docs on the branch are numbered 0276/0277. Body text only, no code impact.

Checks

• npm test: 4491 pass / 0 fail / 1 skipped (at 6038b120).
• npm run typecheck: clean.

[philcunliffe]

neutral triage: PR #874 @ 6038b120

The review-round cap is reached, so the residual findings were triaged at the head. Every actionable finding from both rounds (86ceb2e6, e613ba25) is fixed on the branch and verified in the head code; the remaining residuals are all non-blocking:

1. Sync-gate wording when a visible org row and a hidden carried pick coexist (src/core/cli/wizard/sync_scope.js:114) - phrasing precision, no false claim, behaviour unaffected.
2. Returning gate keys on config existence rather than a recorded pick answer (src/core/cli/wizard/fork.js:184) - declared residual in LLP 0277 §consequences.
3. PR title/body still cite LLP 0266/0267 after the renumber to 0276/0277 - metadata only.

Deferred to follow-up issue #911. Verification at head: node --test test/core/cli/wizard/sync_scope.test.js test/core/cli/wizard/index.test.js passes 79/79.