From 5811b7d2551674752332d5e8e15326e29d3a131a Mon Sep 17 00:00:00 2001
From: Corey Butler <770982+coreybutler@users.noreply.github.com>
Date: Tue, 27 Oct 2026 20:21:05 -0500
Subject: [PATCH] fix: ROOTS order is Policies then Preferences per hive

CLI lookup now matches the shim: HKLM Policies, HKLM Preferences, HKCU Policies, HKCU Preferences. User policy no longer overrides machine preferences.

Signed-off-by: Corey Butler <770982+coreybutler@users.noreply.github.com>
---
 preferences/prefs.go      | 3 ++-
 preferences/prefs_test.go | 2 +-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/preferences/prefs.go b/preferences/prefs.go
index 093313f..060debf 100644
--- a/preferences/prefs.go
+++ b/preferences/prefs.go
@@ -32,7 +32,8 @@ func reload() {
 	MACHINE_POLICY_ROOT = joinRoot("HKLM/SOFTWARE/Policies", org, app)
 
 	ROOT = USER_PREFERENCE_ROOT
-	ROOTS = []string{MACHINE_POLICY_ROOT, USER_POLICY_ROOT, MACHINE_PREFERENCE_ROOT, ROOT}
+	// Policies beat Preferences in the same hive. HKLM beats HKCU.
+	ROOTS = []string{MACHINE_POLICY_ROOT, MACHINE_PREFERENCE_ROOT, USER_POLICY_ROOT, ROOT}
 	POLICY_ROOTS = []string{MACHINE_POLICY_ROOT, USER_POLICY_ROOT}
 	ACL_ROOTS = []string{USER_POLICY_ROOT, MACHINE_POLICY_ROOT, MACHINE_PREFERENCE_ROOT}
 	SECURITY_POLICY_ROOTS = nil
diff --git a/preferences/prefs_test.go b/preferences/prefs_test.go
index 9d5e619..8ad5808 100644
--- a/preferences/prefs_test.go
+++ b/preferences/prefs_test.go
@@ -57,8 +57,8 @@ func TestReloadBuildsPolicyAndPreferenceRoots(t *testing.T) {
 
 	wantRoots := []string{
 		"HKLM/SOFTWARE/Policies/Author Software/nvm",
-		"HKCU/Software/Policies/Author Software/nvm",
 		"HKLM/SOFTWARE/Author Software/Preferences/nvm",
+		"HKCU/Software/Policies/Author Software/nvm",
 		"HKCU/Software/Author Software/Preferences/nvm",
 	}
 	if !reflect.DeepEqual(ROOTS, wantRoots) {