Synchronization and conflict resolution policy

1. WebSocket channel model

Every authenticated operator can subscribe to the tenant:<user_id>:* channel namespace. A cross-user subscribe (e.g. tenant:B:tasks:* by user A) is rejected at the handshake level; the connection closes KURAL 22 fail-closed. Evidence:

• core/routes/web_terminal.py — _ws_authenticate uses 3 paths: ?token=JWT + Bearer + lydos_sid cookie; failure → 1008 close (later nginx 4401).
• While the P5/P6/P7 pages feed PG RLS via the app.user_id GUC, the WS channel binds to the same identity.

2. Conflict resolution — last-write-wins (LWW)

LYDOS runs on a single-region federation DB. If two devices write concurrently to the same row (e.g. chat_files.content or user_workspace_prefs.streaming_enabled), PostgreSQL's serializable transaction queue applies the natural LWW ordering: the updated_at column is rewritten with now() on every UPDATE, and the last commit fixes the final value.

Detail: the user_workspace_prefs PUT UPSERT uses COALESCE(EXCLUDED.col, table.col) — a partial PUT preserves untouched toggles, only the explicitly sent fields are written. This behavior is pinned by the P7 wiring test (test_p7_prefs_wiring.py).

3. Optimistic UI + rollback

Toggle/edit actions on dashboard surfaces:

1. The UI optimistically shows the new value immediately.
2. The PUT/PATCH request goes to the backend. Response 2xx → state is kept.
3. Response 4xx/5xx → the UI change is rolled back (the user sees the previous value again) and an AlertTriangle banner explicitly shows the response detail field (the P7 prefs page exemplifies this discipline).

If the operator's verbose_errors preference is on, the raw backend detail field is shown; if off, a generic message. Live in the toggle prefs.

4. Reconnect + state recovery

When the WebSocket disconnects, the client:

• Reconnects with exponential backoff (1s → 30s, max 10 attempts). The M179 Fleet Bus WS hook (use-fleet-bus-ws.ts) exemplifies this model.
• Once reconnected, missed events are replayed from the server using the last event_seq cumulative sequencer.
• Connection health is monitored with a 20s heartbeat; if 2 consecutive heartbeats are lost, a forced reconnect occurs.

5. Honest boundaries

This policy is the rule LYDOS applies TODAY — controlled-beta, single-region:

• Multi-region active-active replication is ROADMAP (Q229). If a temporary cross-region disconnect happens today, the client reconnects to the local region with backoff.
• CRDT (conflict-free replicated data type) based offline-first sync is ROADMAP — today the offline-first experience is at the level of a PWA shell + opportunistic write queue (SW v28+).
• Sub-second cross-device sync is the target; the measured window is typically between 1–5s. If the p95 measurement causes complaints during continuous load testing, it will be updated here.