@1agh/maude 0.53.2 → 0.54.0

package/apps/studio/api.ts

@@ -98,6 +98,7 @@ import { createHistory } from './history.ts';
 import { clearLocatorSlug, readLocator, writeLocator } from './locator.ts';
 import { STICKERS_DIR } from './paths.ts';
 import { getPaperPreset, MAX_PRINT_MM } from './print/units.ts';
+import { sessionDir } from './session-scope.ts';
 
 // Directories that never hold user-facing canvases. Exported so the
 // external-canvas watcher (`canvas-list-watch.ts`) shares one source instead of
@@ -1324,8 +1325,11 @@ export function createApi(ctx: Context, hooks: ApiHooks): Api {
 
   // ---------- Canvas state ----------
 
+  // Cloud Phase 27 D3 — one member's place in the project is not another's.
+  // `sessionDir` is a no-op without an ambient session, so a desktop resolves
+  // the identical path it always did.
   function canvasStatePath(file: string): string {
-    return path.join(paths.canvasStateDir, `${fileSlug(file)}.json`);
+    return path.join(sessionDir(paths.canvasStateDir), `${fileSlug(file)}.json`);
   }
 
   async function loadCanvasState(file: string) {
@@ -1468,7 +1472,9 @@ export function createApi(ctx: Context, hooks: ApiHooks): Api {
    *  canvas-ext). Returns null when `file` is not a valid canvas path. */
   function canvasViewPath(file: string): string | null {
     if (!canvasMetaPath(file)) return null; // reuse the containment + ext gate
-    return path.join(paths.canvasStateDir, `${fileSlug(file)}.view.json`);
+    // D3 again — the camera is the other per-machine singleton two members in
+    // one cell were silently sharing.
+    return path.join(sessionDir(paths.canvasStateDir), `${fileSlug(file)}.view.json`);
   }
 
   const MAX_OVERLAY_KEYS = 32;
@@ -1572,7 +1578,7 @@ export function createApi(ctx: Context, hooks: ApiHooks): Api {
     const vp = normalizeViewport(viewport);
     if (!vp) return null;
     try {
-      await mkdir(paths.canvasStateDir, { recursive: true });
+      await mkdir(sessionDir(paths.canvasStateDir), { recursive: true });
       const current = await readCanvasViewRaw(file);
       await Bun.write(viewAbs, `${JSON.stringify({ ...current, viewport: vp }, null, 2)}\n`);
       return vp;
@@ -1597,7 +1603,7 @@ export function createApi(ctx: Context, hooks: ApiHooks): Api {
     const ov = normalizeOverlays(overlays);
     if (ov === null) return null;
     try {
-      await mkdir(paths.canvasStateDir, { recursive: true });
+      await mkdir(sessionDir(paths.canvasStateDir), { recursive: true });
       const current = await readCanvasViewRaw(file);
       const prevOverlays =
         current.overlays && typeof current.overlays === 'object' && !Array.isArray(current.overlays)
@@ -1710,7 +1716,7 @@ export function createApi(ctx: Context, hooks: ApiHooks): Api {
           try {
             const current = await readCanvasViewRaw(file);
             const { overlays: _drop, ...rest } = current;
-            await mkdir(paths.canvasStateDir, { recursive: true });
+            await mkdir(sessionDir(paths.canvasStateDir), { recursive: true });
             await Bun.write(viewAbs, `${JSON.stringify(rest, null, 2)}\n`);
           } catch {
             /* best-effort clear */
@@ -1732,12 +1738,12 @@ export function createApi(ctx: Context, hooks: ApiHooks): Api {
           const current = await readCanvasViewRaw(file);
           if (patch.locked === null) {
             const { locked: _drop, ...rest } = current;
-            await mkdir(paths.canvasStateDir, { recursive: true });
+            await mkdir(sessionDir(paths.canvasStateDir), { recursive: true });
             await Bun.write(viewAbs, `${JSON.stringify(rest, null, 2)}\n`);
           } else {
             const lk = normalizeLocked(patch.locked);
             if (lk !== null) {
-              await mkdir(paths.canvasStateDir, { recursive: true });
+              await mkdir(sessionDir(paths.canvasStateDir), { recursive: true });
               await Bun.write(viewAbs, `${JSON.stringify({ ...current, locked: lk }, null, 2)}\n`);
             }
           }

package/apps/studio/bin/screenshot.sh

@@ -292,6 +292,27 @@ pw_screenshot() {
 # iframe to appear. Every leg is best-effort — chrome is the point of this mode,
 # so a missing row or a slow mount degrades to "chrome, nothing open" rather
 # than failing the capture.
+# A reachable port is not a mounted app: the server can answer while the client
+# bundle is still parsing, or React can fail to mount and leave an empty #root
+# (the exact shape of the v0.51.1 blank-window bug). Wait for the studio's own
+# file list before capturing, so a broken shell fails loud instead of shipping a
+# blank PNG that looks like a real screenshot.
+await_studio_shell() {
+  [ "$ENGINE" = "agent-browser" ] || return 0
+  local poll=0
+  while [ $poll -lt "$TIMEOUT" ]; do
+    local n
+    n=$("$AB" eval "document.querySelectorAll('[data-testid^=\"canvas-row-\"]').length" 2>/dev/null | tr -d '[:space:]')
+    case "$n" in
+      ''|*[!0-9]*|0) ;;
+      *) return 0 ;;
+    esac
+    sleep 1
+    poll=$((poll + 1))
+  done
+  return 1
+}
+
 open_active_in_shell() {
   [ "$ENGINE" = "agent-browser" ] || return 0
   [ -n "$ACTIVE" ] || { echo "→ shell: no active canvas — capturing chrome as-is" >&2; return 0; }
@@ -332,11 +353,22 @@ open_active_in_shell() {
 
 navigate_once() {
   if [ "$ENGINE" = "agent-browser" ]; then
-    "$AB" open "$URL" >&2
+    # A failed navigation MUST propagate. agent-browser leaves the session on a
+    # blank page and `screenshot` then happily writes a ~4 kB white PNG, so
+    # ignoring this exit code turns "the server is down" into "here is your
+    # screenshot" — which for the Report-a-Bug shell shot means a blank image
+    # labelled "Maude window" lands in someone's bug report.
+    if ! "$AB" open "$URL" >&2; then
+      echo "✗ navigation failed: $URL" >&2
+      return 1
+    fi
     # Shell mode lands on the studio root, which has no DC mount to poll for —
     # the canvas arrives only after we click a row.
     if [ "$MODE" = "shell" ]; then
-      sleep 1
+      if ! await_studio_shell; then
+        echo "✗ the studio shell never mounted at $URL" >&2
+        return 1
+      fi
       open_active_in_shell
       apply_theme_override
       return 0
@@ -503,7 +535,15 @@ if [ $ALL_SCREENS -eq 1 ]; then
 fi
 
 # ---------- single-shot ----------
-navigate_once
+# A failed navigation is exactly the port-bounce case (DDR-094), so give
+# relive_url its one shot before giving up rather than capturing a blank page.
+if ! navigate_once; then
+  if ! relive_url || ! navigate_once; then
+    echo "✗ could not load $URL — no screenshot written" >&2
+    rm -f "$OUT"
+    exit 3
+  fi
+fi
 if capture_resilient "$CSS_SEL" "$OUT"; then
   echo "$OUT"
   exit 0

package/apps/studio/build.ts

@@ -21,6 +21,8 @@ import { fileURLToPath } from 'node:url';
 
 import { browserslistToTargets, bundle as lcssBundle } from 'lightningcss';
 
+import { cloudStubPlugin } from './cloud-build.ts';
+
 const ROOT = dirname(fileURLToPath(import.meta.url));
 const DIST = join(ROOT, 'dist');
 
@@ -32,6 +34,9 @@ const MODE: 'dev' | 'release' | 'dry' = ARGS.has('--dry-run')
     ? 'release'
     : 'dev';
 const WATCH = ARGS.has('--watch');
+/** Cloud Phase 27 D1 — build the CELL's variant (secret-bearing surfaces
+ *  removed from the binary, not merely un-routed). `--cloud` with `--release`. */
+const CLOUD = ARGS.has('--cloud');
 
 const PLATFORM_MATRIX = [
   'bun-darwin-arm64',
@@ -336,11 +341,20 @@ import ${JSON.stringify(realServerRel)};
   return entryPath;
 }
 
-async function buildServerBinary(target: PlatformTarget): Promise<{ outPath: string }> {
+async function buildServerBinary(
+  target: PlatformTarget,
+  /**
+   * Cloud Phase 27 D1 — the variant a CELL runs, with the secret-bearing
+   * surfaces removed from the binary rather than merely un-routed. Named
+   * separately (`maude-cloud-<slug>`) so a desktop release can never pick one
+   * up by accident, and so both can be built from one checkout.
+   */
+  { cloud = false }: { cloud?: boolean } = {}
+): Promise<{ outPath: string }> {
   ensureDist();
   const slug = platformSlug(target);
   const ext = slug.startsWith('win32') ? '.exe' : '';
-  const outPath = join(DIST, `maude-${slug}${ext}`);
+  const outPath = join(DIST, `maude-${cloud ? 'cloud-' : ''}${slug}${ext}`);
   const realEntry = join(ROOT, 'server.ts');
   if (!existsSync(realEntry)) {
     // Legacy fallback — pre-DDR-009 .mjs path. Doesn't use oxc-parser, so the
@@ -369,6 +383,26 @@ async function buildServerBinary(target: PlatformTarget): Promise<{ outPath: str
   // filter skipped it (cross-compile case — see ensureBindingForTarget docs).
   await ensureBindingForTarget(oxcBindingSlug(slug));
   const entry = writeCompileEntry(target);
+
+  // The CLOUD variant goes through the Bun.build API rather than the CLI,
+  // because that is the only path that takes a plugin — and a plugin is what
+  // makes D1 elimination rather than un-routing. `--define` + dead-code
+  // elimination was tried first and does not do it: Bun inlines the
+  // dynamically-imported module and keeps the branch, so the bytes stay.
+  if (cloud) {
+    const result = await Bun.build({
+      entrypoints: [entry],
+      target: 'bun',
+      minify: true,
+      plugins: [cloudStubPlugin(ROOT)],
+      compile: { target, outfile: outPath },
+    } as Parameters<typeof Bun.build>[0]);
+    if (!result.success) {
+      throw new Error(`cloud compile failed for ${target}:\n${result.logs.map(String).join('\n')}`);
+    }
+    return { outPath };
+  }
+
   const proc = Bun.spawn(
     [
       'bun',
@@ -538,7 +572,7 @@ async function main() {
       : [currentTarget()];
     for (const target of targets) {
       const t = performance.now();
-      const bin = await buildServerBinary(target);
+      const bin = await buildServerBinary(target, { cloud: CLOUD });
       console.log(`[build] ${bin.outPath}  (${(performance.now() - t).toFixed(0)} ms)`);
     }
   }

package/apps/studio/client/app.jsx

@@ -2430,7 +2430,12 @@ function Sidebar({
   // affordances are absent (buttons, composer, row menus, drag & drop).
   readOnly = false,
   /** `{ dashboardUrl, projectName }` when this is a cloud tab, else null. */
-  cloud = null,
+  // Tri-state (see the note where this value is created): `undefined` until
+  // the server config answers, `null` for the desktop, an object for a cloud
+  // tab. Defaulting it to `null` here is what re-broke the boot 404 after the
+  // call sites were fixed — a default fires on `undefined`, so "not known yet"
+  // became "not cloud" one layer further in, invisibly.
+  cloud,
   groups,
   activePath,
   activeDsName,
@@ -2709,6 +2714,7 @@ function Sidebar({
           <StIcon name="search" size={13} />
           <input
             type="search"
+            data-testid="canvas-search"
             placeholder="Search canvases…"
             value={search}
             onChange={(e) => setSearch(e.target.value)}
@@ -2832,7 +2838,7 @@ function Sidebar({
           Absent rather than disabled, because unlike the agent chat there is
           nothing here to explain — the capability is not missing, it is
           already satisfied. */}
-      {cloud ? null : <CloudBar />}
+      {cloud === null ? <CloudBar /> : null}
       {/* Phase 28 (E3) — GitHub identity as a compact avatar docked at the BOTTOM:
           sign in, connected account + New/Pull/Share, sign out. Self-contained
           (owns its device-code + CreateProject dialogs). Renders nothing in browser. */}
@@ -3622,7 +3628,12 @@ function Menubar({
   activePath,
   project,
   /** `{ dashboardUrl, projectName }` when this is a cloud tab, else null. */
-  cloud = null,
+  // Tri-state (see the note where this value is created): `undefined` until
+  // the server config answers, `null` for the desktop, an object for a cloud
+  // tab. Defaulting it to `null` here is what re-broke the boot 404 after the
+  // call sites were fixed — a default fires on `undefined`, so "not known yet"
+  // became "not cloud" one layer further in, invisibly.
+  cloud,
   tabsCount,
   openMenu,
   setOpenMenu,
@@ -3890,7 +3901,12 @@ function Menubar({
   }, [openMenu, setOpenMenu]);
 
   return (
-    <header className="st-menubar" role="menubar" aria-label="Application menubar">
+    <header
+      className="st-menubar"
+      role="menubar"
+      aria-label="Application menubar"
+      data-testid="menubar"
+    >
       <span className="st-brand" data-tour="brand">
         <span className="st-brand-mark">
           <svg viewBox="0 0 32 32" width="100%" height="100%" fill="none" aria-hidden="true"><path d="M16 5l2.8 8.2L27 16l-8.2 2.8L16 27l-2.8-8.2L5 16l8.2-2.8z" fill="currentColor" /></svg>
@@ -4044,11 +4060,45 @@ function Menubar({
           <span
             className="st-stamp st-stamp--viewonly"
             data-testid="view-only-stamp"
-            data-tip="Your role in this project is viewer — you can browse, comment when available, and export. Ask a project owner for edit access."
+            data-tip={
+              cloud?.user
+                ? `${cloud.user} is a viewer on this project — you can browse, comment and export. Ask a project owner for edit access, or sign out if that is not the account you meant to use.`
+                : 'Your role in this project is viewer — you can browse, comment when available, and export. Ask a project owner for edit access.'
+            }
           >
             VIEW ONLY
           </span>
         )}
+        {/* Cloud Phase 27 C4 — WHO YOU ARE, AND HOW TO STOP BEING THEM.
+            A browser tab carries no account identity of its own: the cookie is
+            invisible, and the only thing on screen that reflected it was a
+            three-word stamp. An owner who read VIEW ONLY had no way to tell
+            whether the role was wrong or the ACCOUNT was, and no way to change
+            either — the session outlived any fix by up to twelve hours because
+            nothing in the studio could end it. This ends it. */}
+        {cloud?.user ? (
+          <span className="st-cloudwho" data-testid="cloud-account">
+            <span
+              className="st-cloudwho-email"
+              title={cloud.role ? `Signed in as ${cloud.user} — ${cloud.role}` : cloud.user}
+            >
+              {cloud.user}
+            </span>
+            {/* A FORM, not a link. Signing out revokes the token server-side,
+                so it is a write — and a write behind a GET is one any page can
+                force on you from across the internet. */}
+            <form method="post" action="/auth/browser/signout" className="st-cloudwho-form">
+              <button
+                type="submit"
+                className="st-cloudwho-out"
+                data-testid="cloud-signout"
+                title="Sign out of this project"
+              >
+                Sign out
+              </button>
+            </form>
+          </span>
+        ) : null}
         {isNativeApp() && !readOnly && (
           <button
             type="button"
@@ -4514,7 +4564,7 @@ function StatusBar({
   })();
 
   return (
-    <footer className="st-statusbar" role="contentinfo">
+    <footer className="st-statusbar" role="contentinfo" data-testid="statusbar">
       <span className="st-sb-slot st-sb-active" role="group" aria-label="Active file">
         <span className="lead" aria-hidden="true" />
         <span className="lbl">active</span>
@@ -4792,6 +4842,69 @@ function CommentsPanel({
 // Phase 32 (Task 1) — auto-update notice. Shown after the shell has downloaded +
 // staged a newer build in the background. Non-blocking: "Restart now" applies it,
 // "Later" dismisses (the next focus/4h check re-stages and re-surfaces it).
+/**
+ * What this role can do, said once, where a teammate lands — Cloud Phase 27 C3.
+ *
+ * A browser tab arrives with none of the context a desktop has: no window
+ * title, no app the person chose to install, and — for a viewer — a set of
+ * controls that will refuse them without explaining why. One line, dismissible,
+ * remembered per role. It re-appears if the role CHANGES, because "you can edit
+ * this now" is worth saying exactly as much as the first sentence was.
+ *
+ * Copy comes from the role the cell vouched (`role-matrix.mjs` is the authority
+ * on what each one means; this is its sentence, not a second opinion).
+ */
+const ROLE_LINE = {
+  owner: 'You own this project — edit, invite and export.',
+  member: 'You can edit this project, comment and export.',
+  viewer: 'You can look at this project, comment and download it, but not change it.',
+};
+
+function CloudRoleBanner({ cloud }) {
+  const role = cloud?.role || null;
+  // Dismissal is READ AT RENDER, not seeded into state. `cfg.cloud` is
+  // `undefined` until `/_config` lands, so a `useState` initializer runs while
+  // there is no role yet — and whatever it decided then would stick forever,
+  // which on the first attempt meant the banner never appeared at all. Found by
+  // opening it in a browser; no test in this repo would have said a word.
+  const [dismissedNow, setDismissedNow] = useState(false);
+  if (!role || dismissedNow) return null;
+  const storageKey = `maude-cloud-role-seen:${role}`;
+  let alreadySeen = false;
+  try {
+    alreadySeen = localStorage.getItem(storageKey) === '1';
+  } catch {
+    /* private mode / storage disabled — show it, saying it twice beats never */
+  }
+  if (alreadySeen) return null;
+  const line = ROLE_LINE[role];
+  if (!line) return null;
+  return (
+    <div
+      role="status"
+      aria-live="polite"
+      className="st-banner st-banner--info"
+      data-testid="cloud-role-banner"
+    >
+      <span className="st-banner-dot" aria-hidden="true" />
+      <span>{line}</span>
+      <button
+        type="button"
+        className="btn btn--ghost btn--sm"
+        data-testid="cloud-role-banner-dismiss"
+        onClick={() => {
+          setDismissedNow(true);
+          try {
+            localStorage.setItem(storageKey, '1');
+          } catch {}
+        }}
+      >
+        Got it
+      </button>
+    </div>
+  );
+}
+
 function UpdateBanner({ update, onDismiss }) {
   const [restarting, setRestarting] = useState(false);
   if (!update) return null;
@@ -8304,6 +8417,9 @@ function photoAssetOfSelection(el) {
 }
 
 function InspectorPanel({
+  /** E4 — `inspector-panel` / `layers-panel`, so one parity spec can assert
+   *  both shells show them. Undefined elsewhere; the attribute simply absent. */
+  testId,
   selected,
   onClose,
   layersTree,
@@ -8773,6 +8889,7 @@ function InspectorPanel({
       style={width ? { width, flexBasis: width } : undefined}
       aria-label="Inspector"
       data-tour="inspector"
+      data-testid={testId}
     >
       <div
         className="st-rp-tabs"
@@ -9236,7 +9353,18 @@ function App() {
   // `config-updated` push (config.json hot-reload — /design:setup-ds rewrites
   // it mid-session) — informs canvasUrl() so TSX iframes can pass the right
   // ?designRel + ?tokens query to the canvas mount shell.
-  const [cfg, setCfg] = useState({ designRel: '.design' });
+  // `cloud` is deliberately TRI-STATE, and the third state is the useful one:
+  //   undefined — `/_config` has not answered yet; which shell this is is
+  //               UNKNOWN, and anything that would behave differently in the
+  //               two shells must wait rather than assume the desktop.
+  //   null      — desktop or plain local browser.
+  //   object    — a cloud tab (`{ dashboardUrl, projectName, user, role }`).
+  //
+  // Collapsing unknown into "not cloud" is what made the cloud studio open with
+  // two console 404s every time: the sign-in bar and the export centre mounted
+  // for one frame, each fired the request its shell exists to refuse, and then
+  // unmounted. Nothing was broken and everything looked broken.
+  const [cfg, setCfg] = useState({ designRel: '.design', cloud: undefined });
   // Cloud Phase 25 C2 — viewer role, known at boot from /_config. Every
   // editing affordance in the shell gates on this (absent, not hidden).
   const viewerMode = !!cfg.readOnly;
@@ -9278,13 +9406,11 @@ function App() {
           // both of these went missing and the cloud studio rendered without
           // its chrome and with every canvas iframe unauthenticated.
           canvasToken: data.canvasToken,
-          // C2/C4 — `{ dashboardUrl, projectName }` when this is a cloud tab.
-          // Its presence is what tells the shared client it is in a browser tab
-          // on somebody else's machine.
+          // C2/C4 — `{ dashboardUrl, projectName, user, role }` when this is a
+          // cloud tab. Its presence is what tells the shared client it is in a
+          // browser tab on somebody else's machine; `user`/`role` are what let
+          // it say WHICH account that tab is, and offer the way out.
           cloud: data.cloud ?? null,
-          // C2/C4 — `{ dashboardUrl, projectName }` when this is a cloud tab.
-          // Its presence is what tells the shared client it is in a browser tab
-          // on somebody else's machine.
         }));
       })
       .catch(() => {});
@@ -9633,7 +9759,10 @@ function App() {
   // toggles on its own and coexists with Inspector/Changes/Comments/Chat.
   const toggleTimeline = useCallback(() => setTimelineOpen((v) => !v), []);
   const whatsNew = useWhatsNew(MDCC_VERSION);
-  const exportCenter = useExportCenter();
+  // Same tri-state rule as the sign-in bar: the export queue is a LOCAL job
+  // runner, `/_api/export-jobs` is one of the routes a cell refuses outright
+  // (DDR-209 D1), and hydrating before the shell is known 404s every boot.
+  const exportCenter = useExportCenter({ enabled: cfg.cloud === null });
   // Phase 29 (E4) — first-run onboarding wizard. The native shell boots a minimal
   // "welcome" project on first launch; we ask it whether this is a first run and, if
   // so, show the wizard OVER the (empty) canvas browser. Completing any door switches
@@ -11006,6 +11135,41 @@ function App() {
     if (path !== SYSTEM_TAB) setLoadingPath(path);
   }, []);
 
+  /**
+   * First open lands on a rendered canvas — Cloud Phase 27 C3.
+   *
+   * A desktop user chose this project, installed the app and knows what is in
+   * it; the empty state is a helpful "pick a screen". A teammate following a
+   * link has done none of that, and an empty pane with an arrow pointing at a
+   * list is the browser saying "the thing you came for is somewhere else".
+   *
+   * CLOUD ONLY, and once. The desktop's empty state is deliberately unchanged —
+   * it earns its keep there (the ⌘-hover lesson, quick setup) — and re-opening
+   * a canvas the person deliberately closed would be a UI arguing with them.
+   */
+  const autoOpened = useRef(false);
+  useEffect(() => {
+    if (autoOpened.current) return;
+    if (!cfg.cloud) return; // desktop / unknown-yet
+    if (tabs.length > 0) return;
+    if (!groups.length) return; // tree not loaded
+    // The first canvas that is somebody's WORK — a design-system specimen is a
+    // rendered canvas too, and not what a teammate followed a link to see.
+    let first = null;
+    for (const g of groups) {
+      for (const p of g.paths || []) {
+        if (!CANVAS_EXT_RE.test(p)) continue;
+        if (/(^|\/)system\//.test(p)) continue;
+        first = p;
+        break;
+      }
+      if (first) break;
+    }
+    if (!first) return;
+    autoOpened.current = true;
+    openTab(first);
+  }, [cfg.cloud, groups, tabs.length, openTab]);
+
   const openSystem = useCallback(
     (dsName) => {
       // DsFolderRow passes the clicked DS name → scope the System view to it so
@@ -13475,10 +13639,17 @@ function App() {
       }
       // Cmd+Shift+I — toggle Inspector. Was bare "I", which collided with the
       // canvas highlighter tool (same letter, different action by focus).
-      // Cloud Phase 25 C2 — absent for a viewer (the panel is edit chrome).
+      //
+      // Cloud Phase 27 C1 — a VIEWER GETS THIS TOO, and the line above used to
+      // say the opposite ("the panel is edit chrome"). C1 reversed that on
+      // purpose: read-only means cannot CHANGE, not cannot SEE, and a reviewer
+      // needs structure and measured values as much as anyone. The View menu
+      // already offers it (`viewerHiddenPanels` no longer hides it); the
+      // shortcut had been left behind, so the menu said yes and the keyboard
+      // said no. Found by writing the parity spec that runs in both shells.
       if (meta && e.shiftKey && (e.key === 'i' || e.key === 'I')) {
         e.preventDefault();
-        if (!viewerMode) toggleRightPanel('inspector');
+        toggleRightPanel('inspector');
         return;
       }
       // Phase 31 (DDR-123) — Cmd+Shift+A opens the native ACP chat sidepanel.
@@ -13807,9 +13978,15 @@ function App() {
   // assigned to it and which one is active (the open one). Layers is only a
   // dockable panel in `separate` mode; Assistant is native-only.
   const panelAvailable = (id) => {
-    // Cloud Phase 25 C2 — edit-chrome panels don't exist for a viewer: no
-    // dock tab, no shortcut, no empty slot.
-    if (viewerMode && (id === 'assistant' || id === 'inspector' || id === 'layers')) return false;
+    // The AGENT is genuinely absent for a viewer (it edits; Phase 25 C2).
+    //
+    // Inspector and Layers are NOT — Cloud Phase 27 C1 reversed that, and this
+    // line had been left behind: `viewerHiddenPanels` stopped hiding them in
+    // the View menu while this still refused to give them a dock slot, so the
+    // menu offered a panel that could never appear. Read-only means cannot
+    // CHANGE, not cannot SEE: a reviewer needs structure and measured values,
+    // which is the whole reason C1 exists.
+    if (viewerMode && id === 'assistant') return false;
     return id === 'assistant' ? isNativeApp() : id === 'layers' ? layersMode === 'separate' : true;
   };
   const idsForSide = (side) =>
@@ -13842,13 +14019,15 @@ function App() {
   // which owns the resizable width). Assistant is handled separately below as an
   // always-mounted ChatPanel so its stream survives a tab switch.
   const renderPanelBody = (id) => {
-    // Cloud Phase 25 C2 — the Inspector/Layers panels are edit chrome; a
-    // viewer's session never mounts them (absent, not hidden).
-    if (viewerMode && (id === 'inspector' || id === 'layers')) return null;
+    // C1 again, the second half of the same gate. The panels MOUNT for a
+    // viewer; what they must not do is offer an edit, and that is already
+    // handled inside them (`readOnly` is threaded through every control).
+    // Refusing to mount was a blunter instrument than the role model asks for.
+    
     if (id === 'tree')
       return (
         <Sidebar
-          cloud={cfg?.cloud ?? null}
+          cloud={cfg.cloud}
           readOnly={viewerMode}
           groups={groups}
           activePath={activePath}
@@ -13903,6 +14082,9 @@ function App() {
     if (id === 'inspector' || id === 'layers')
       return (
         <InspectorPanel
+          // Cloud Phase 27 E4 — the parity spec asserts these two panels exist
+          // in BOTH shells, so each needs a name a spec can ask for.
+          testId={id === 'layers' ? 'layers-panel' : 'inspector-panel'}
           layersOnly={id === 'layers'}
           hideLayersTab={layersMode === 'separate'}
           cpMode={cpMode}
@@ -13983,6 +14165,7 @@ function App() {
       onContextMenu={onShellContextMenu}
     >
       {firstRun && <OnboardingWizard />}
+      <CloudRoleBanner cloud={cfg.cloud} />
       <UpdateBanner update={updateReady} onDismiss={() => setUpdateReady(null)} />
       <SyncBanner status={syncStatus} />
       {!usageNudge && !tourSteps && <WhatsNewToast wn={whatsNew} />}
@@ -14013,7 +14196,7 @@ function App() {
           // Cloud Phase 27 C2/C4 — the ONE cloud-only input the shared chrome
           // takes. A prop, not the whole `cfg`: the Menubar needs to know it is
           // in a browser tab on somebody else's machine, and nothing else.
-          cloud={cfg?.cloud ?? null}
+          cloud={cfg.cloud}
           activePath={activePath}
           project={project}
           tabsCount={tabs.length}
@@ -15013,7 +15196,7 @@ function App() {
       )}
       {settingsOpen && (
         <SettingsPanel
-          cloud={cfg?.cloud ?? null}
+          cloud={cfg.cloud}
           onClose={() => setSettingsOpen(false)}
           initialTab={typeof settingsOpen === 'string' ? settingsOpen : undefined}
           theme={theme}

package/apps/studio/client/export-center.jsx

@@ -65,7 +65,14 @@ async function saveNative(id, filename) {
   return saveExport(filename || 'export', id);
 }
 
-export function useExportCenter() {
+/**
+ * @param {{ enabled?: boolean }} [opts] — `enabled` false suppresses the
+ *   hydration fetch. The cloud shell passes false: `/_api/export-jobs` is
+ *   refused there by design, so asking is guaranteed noise. It stays UNDEFINED
+ *   until `/_config` answers, and undefined is not "false" here — see the
+ *   tri-state note on `cfg.cloud`.
+ */
+export function useExportCenter({ enabled = true } = {}) {
   const [jobs, setJobs] = useState(() => new Map());
   const [panelOpen, setPanelOpen] = useState(false);
   const [toastQueue, setToastQueue] = useState([]);
@@ -77,6 +84,7 @@ export function useExportCenter() {
   const startToastShownRef = useRef(new Set()); // "Exporting…" toast fires at most once per job
 
   useEffect(() => {
+    if (!enabled) return undefined;
     let alive = true;
     fetch('/_api/export-jobs')
       .then((r) => r.json())
@@ -99,7 +107,7 @@ export function useExportCenter() {
     return () => {
       alive = false;
     };
-  }, []);
+  }, [enabled]);
 
   const upsert = useCallback((job) => {
     if (!job || typeof job.id !== 'string') return;

package/apps/studio/client/panels/SettingsPanel.jsx

@@ -802,7 +802,12 @@ function AppearanceTab({ theme, onSetTheme, cpMode, onSetCpMode }) {
 
 export default function SettingsPanel({
   /** `{ dashboardUrl, projectName }` when this is a cloud tab, else null. */
-  cloud = null,
+  // Tri-state (see the note where this value is created): `undefined` until
+  // the server config answers, `null` for the desktop, an object for a cloud
+  // tab. Defaulting it to `null` here is what re-broke the boot 404 after the
+  // call sites were fixed — a default fires on `undefined`, so "not known yet"
+  // became "not cloud" one layer further in, invisibly.
+  cloud,
   onClose,
   initialTab,
   theme,