feat(rules): preferences are writable, and their drift arrives (#3895)

Milestone 399 step 5. Steps 1-4 put preferences into the backend: a kind
column, an inverted write path, a third register in the injected block, a
delivery slot. Nothing the operator could touch. Rule 27 forbids leaving it
there, and here it matters more than usual, because the UI is the only
guard against the risk the milestone named up front — an agent misreads one
session, rewrites a preference, and follows the rewritten version forever
while the operator never sees the moment it changed.

Four things ship.

A preference is DISTINGUISHABLE. `kind` reaches the client (the server has
always sent it in rule_brief) and a preference carries a chip. Force is the
one thing a list of instructions must not leave the reader to infer, and a
row that renders identically to a rule teaches the opposite of both facts
about a preference: it does not bind, and a session may rewrite it.

A preference is WRITABLE. The editor gains the kind as a first-class choice
with the test beside it — what happens when someone does not do this — and
says plainly, when preference is chosen, that sessions rewrite these
without asking and every rewrite is kept.

DRIFT ARRIVES. `GET /api/rules/drift` returns one row per rewritten
preference carrying its latest rewrite: what it said, what it says now, and
the record named by `arose_from_id` that taught the change. Both texts ride
along so the list shows the diff without a call per row. The new pane sits
beside the staleness sweep, because drift belongs to no one rulebook, and
it answers a question the operator would not have thought to ask.

REVERSION IS ONE ACTION, and this is the carve-out worth arguing with.
Milestone 323 refused a one-click restore for rules — "a binding
instruction should not be revertible in one click", because a silent revert
erases the only record of why the rewrite happened. That reasoning turns on
the rewrite being the operator's own decision. A preference's is not: the
agent makes it mid-work without asking, so reverting is a veto over someone
else's edit rather than an undo of your own, and a veto costing more than a
shrug is not supervision. The route refuses anything but a preference (409),
and nothing is erased: the restore goes through update_rule, so it snapshots
too and the history GAINS the revert. An integration test pins that, because
it is the whole basis for the exception.

Tested against real Postgres — every claim is about which rows come back
and in what order, which a stand-in session cannot judge.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01821k5B3Ysecp9fNYs92Kuy

frontend/src/stores/rulebooks.ts

@@ -10,6 +10,7 @@ export const useRulebooksStore = defineStore("rulebooks", () => {
   const rulesByTopic = ref<Record<number, RuleHeader[]>>({});
   const currentRule = ref<Rule | null>(null);
   const rulesDue = ref<api.RuleVerificationRow[]>([]);
+  const drift = ref<api.PreferenceDrift[]>([]);
   // Kept so a verify re-reads the sweep with the SAME filters the operator is
   // looking at — re-fetching unfiltered would silently widen the list under
   // them at the moment they acted on it.
@@ -106,6 +107,10 @@ export const useRulebooksStore = defineStore("rulebooks", () => {
       title: rule.title,
       statement: rule.statement,
       topic_id: rule.topic_id,
+      // Carried, not defaulted: a row written here must render with the same
+      // force as the same row re-fetched, or a preference the operator just
+      // created would sit in the list looking like a rule until a reload.
+      kind: rule.kind,
       updated_at: rule.updated_at,
       when_to_apply: rule.when_to_apply || undefined,
       arose_from_id: rule.arose_from_id ?? undefined,
@@ -202,6 +207,46 @@ export const useRulebooksStore = defineStore("rulebooks", () => {
     return rule;
   }
 
+  /**
+   * What Scribe has changed about how it works with the operator.
+   *
+   * Preferences only — a rule changes when its author changes it, so
+   * including them would bury the unreviewed rows under the operator's own
+   * edits, which is the failure this surface exists to prevent.
+   */
+  async function fetchDrift(limit?: number) {
+    loading.value = true;
+    try {
+      drift.value = await api.listPreferenceDrift(limit);
+    } catch (e) {
+      useToastStore().show("Failed to load recent changes", "error");
+      throw e;
+    } finally {
+      loading.value = false;
+    }
+  }
+
+  /**
+   * Put a preference back to what a version said — the operator's veto.
+   *
+   * The drift list is RE-READ rather than patched, for the reason the sweep
+   * is: this surface is an ORDER (most recently changed first) and the
+   * restore is itself an edit, so the row's place in that order has just
+   * changed. A locally-mutated row would sit in its old position describing
+   * a rewrite that is no longer the latest one.
+   */
+  async function restoreVersion(ruleId: number, versionId: number) {
+    const rule = await api.restoreRuleVersion(ruleId, versionId);
+    if (currentRule.value?.id === ruleId) currentRule.value = rule;
+    for (const tid of Object.keys(rulesByTopic.value)) {
+      const list = rulesByTopic.value[Number(tid)];
+      const idx = list.findIndex((r) => r.id === ruleId);
+      if (idx >= 0) list[idx] = toHeader(rule);
+    }
+    if (drift.value.length) await fetchDrift();
+    return rule;
+  }
+
   async function deleteRule(id: number) {
     await api.deleteRule(id);
     if (currentRule.value?.id === id) currentRule.value = null;
@@ -211,12 +256,13 @@ export const useRulebooksStore = defineStore("rulebooks", () => {
   }
 
   return {
-    rulebooks, topicsByRulebook, rulesByTopic, currentRule, rulesDue, lastSweepOpts, loading,
+    rulebooks, topicsByRulebook, rulesByTopic, currentRule, rulesDue, drift, lastSweepOpts, loading,
     placeMovedRule,
     fetchRulebooks, fetchTopics, fetchRules, fetchRule,
     createRulebook, updateRulebook, deleteRulebook,
     createTopic, updateTopic, deleteTopic,
     createRule, updateRule, deleteRule, relateRules, unrelateRules,
     fetchRulesDue, verifyRule,
+    fetchDrift, restoreVersion,
   };
 });