@1agh/maude 0.53.2 → 0.54.0

package/apps/studio/test/session-scope.test.ts

@@ -0,0 +1,100 @@
+// Cloud Phase 27 D3 — whose runtime state is this?
+//
+// `_active.json` and `_canvas-state/<slug>.view.json` are per-MACHINE
+// singletons by design (DDR-115), which is right for a desktop and wrong for a
+// cell: one studio process serves an owner and a viewer, so a colleague opening
+// a canvas switched YOUR tab and their pan moved YOUR camera. Silently — it
+// read as flakiness, not as two people sharing one file.
+//
+// The first test is the one that matters most: OUTSIDE a cell nothing changes.
+
+import { describe, expect, test } from 'bun:test';
+
+import {
+  currentSession,
+  normalizeSessionKey,
+  runInSession,
+  sessionDir,
+  sessionFile,
+} from '../session-scope.ts';
+
+describe('session scope', () => {
+  test('with no session every path is byte-for-byte what it was', () => {
+    expect(currentSession()).toBe('');
+    expect(sessionDir('/repo/.design/_canvas-state')).toBe('/repo/.design/_canvas-state');
+    expect(sessionFile('/repo/.design/_active.json')).toBe('/repo/.design/_active.json');
+  });
+
+  test('a session gives each member their own subtree and their own active file', () => {
+    runInSession('a1b2c3d4e5f60718', () => {
+      expect(currentSession()).toBe('a1b2c3d4e5f60718');
+      expect(sessionDir('/repo/.design/_canvas-state')).toBe(
+        '/repo/.design/_canvas-state/a1b2c3d4e5f60718'
+      );
+      // A SIBLING of `_active.json`, not a rename: the runtime-state taxonomy,
+      // the gitignore and `isMaudeRuntimeState` all match that stem by name,
+      // and a sibling keeps every one of them correct with no fourth list.
+      expect(sessionFile('/repo/.design/_active.json')).toBe(
+        '/repo/.design/_active.a1b2c3d4e5f60718.json'
+      );
+    });
+  });
+
+  test('the scope does not leak past the call', () => {
+    runInSession('deadbeef', () => expect(currentSession()).toBe('deadbeef'));
+    expect(currentSession()).toBe('');
+  });
+
+  test('two sessions do not see each other', () => {
+    runInSession('one', () => {
+      expect(currentSession()).toBe('one');
+      runInSession('two', () => expect(currentSession()).toBe('two'));
+      expect(currentSession()).toBe('one');
+    });
+  });
+
+  test('the scope survives an await — a request is not one tick', async () => {
+    await runInSession('async1', async () => {
+      await new Promise((r) => setTimeout(r, 5));
+      expect(currentSession()).toBe('async1');
+      await Promise.resolve();
+      expect(currentSession()).toBe('async1');
+    });
+  });
+
+  test('a key that is not proxy-shaped is refused, not sanitized', () => {
+    // The value becomes a path segment, so this is the traversal gate — and it
+    // REJECTS rather than strips, because a key we had to repair is not one
+    // whose intent we should be guessing. Falling back to the shared singleton
+    // is the same behaviour a desktop already has.
+    for (const bad of [
+      '../../etc/passwd',
+      'a/b',
+      'a\\b',
+      '.',
+      '..',
+      'has space',
+      'x'.repeat(65),
+      '',
+      null,
+      undefined,
+    ]) {
+      expect(normalizeSessionKey(bad as string)).toBe('');
+    }
+    for (const good of ['abc123', 'a1b2c3d4e5f60718', 'A_b-9']) {
+      expect(normalizeSessionKey(good)).toBe(good);
+    }
+    // …and a refused key means the shared path, never a traversed one.
+    runInSession('../../etc', () => {
+      expect(sessionDir('/repo/.design/_canvas-state')).toBe('/repo/.design/_canvas-state');
+    });
+  });
+
+  test('a file with no extension still gets a distinct per-session name', () => {
+    runInSession('k', () => {
+      expect(sessionFile('/repo/.design/_active')).toBe('/repo/.design/_active.k');
+      // A dot in a PARENT directory must not be mistaken for the extension.
+      expect(sessionFile('/repo/my.dir/_active')).toBe('/repo/my.dir/_active.k');
+    });
+  });
+});

package/apps/studio/test/shell-importmap.test.ts

@@ -43,7 +43,14 @@ describe('_shell.html importmap agrees with RUNTIME_PACKAGES', () => {
 
   for (const pkg of RUNTIME_PACKAGES) {
     test(`"${pkg}" resolves to its /_canvas-runtime/ bundle`, () => {
-      expect(imports[pkg]).toBe(`/_canvas-runtime/${slugFor(pkg)}.js`);
+      // RELATIVE (`./`), and that leading dot is load-bearing (Cloud Phase 27).
+      // An importmap value resolves against the DOCUMENT's base URL, so a
+      // root-absolute `/_canvas-runtime/…` is correct only where the shell is
+      // served from the origin root. On the fleet's shared canvas host the
+      // shell lives under `/<project>/`, and every bundle 404'd there — the
+      // grey-canvas failure the per-project origin was introduced to end.
+      // Relative is right in BOTH shapes, so it is the one form to hold.
+      expect(imports[pkg]).toBe(`./_canvas-runtime/${slugFor(pkg)}.js`);
     });
   }
 });

package/apps/studio/test/sync-autocommit.test.ts

@@ -12,6 +12,7 @@ import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import path from 'node:path';
 
+import { REPO_LOCK_FILE } from '../git/repo-lock.ts';
 import {
   commitMessage,
   createAutoCommit,
@@ -332,3 +333,78 @@ describe('mirror push — never rewrites someone else’s work', () => {
 function silent() {
   return { warn: () => {}, error: () => {}, log: () => {} };
 }
+
+describe('a contended lock must not lose the queue or the process (Phase 27 D2)', () => {
+  test('a lock timeout re-queues the files instead of dropping them', async () => {
+    // `flush()` clears `touched` BEFORE it commits, and `withRepoLock` THROWS
+    // when it cannot acquire. Without a catch, a contended autosave dropped its
+    // file list silently — the bytes stay on disk, uncommitted, with nothing to
+    // retry them — and rejected a promise the debounce timer discards, which on
+    // Node >= 15 takes the process down with it. Post-D2 the trigger is
+    // ordinary: `pull` and `checkout` hold this lock across a NETWORK call.
+    const dir = mkdtempSync(path.join(tmpdir(), 'autocommit-lock-'));
+    try {
+      mkdirSync(path.join(dir, '.git'), { recursive: true });
+      // A live holder that is not stale — every acquire attempt will time out.
+      writeFileSync(
+        path.join(dir, '.git', REPO_LOCK_FILE),
+        JSON.stringify({ pid: process.pid, holder: 'studio:pull', at: Date.now(), token: 'held' })
+      );
+
+      const ran: string[][] = [];
+      const auto = createAutoCommit({
+        repoRoot: dir,
+        debounceMs: 5,
+        log: { warn() {}, error() {}, log() {} },
+        run: async (args) => {
+          ran.push(args);
+          return { code: 0, stdout: '', stderr: '' };
+        },
+      });
+
+      auto.note('.design/ui/Home.tsx', { name: 'A', email: 'a@b.c' });
+      const outcome = await auto.flush();
+
+      expect(outcome?.ok).toBe(false);
+      // Nothing reached git — the lock was never acquired.
+      expect(ran).toEqual([]);
+      // THE POINT: the file is still queued, so the next quiescence retries it.
+      expect(auto.pending()).toEqual(['.design/ui/Home.tsx']);
+      auto.stop();
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  }, 30_000);
+
+  test('the debounce timer never surfaces an unhandled rejection', async () => {
+    // The timer fires unattended; a rejection it discards is a process exit.
+    const dir = mkdtempSync(path.join(tmpdir(), 'autocommit-timer-'));
+    try {
+      mkdirSync(path.join(dir, '.git'), { recursive: true });
+      writeFileSync(
+        path.join(dir, '.git', REPO_LOCK_FILE),
+        JSON.stringify({ pid: process.pid, holder: 'studio:fold', at: Date.now(), token: 'held' })
+      );
+      const rejections: unknown[] = [];
+      const onUnhandled = (err: unknown) => rejections.push(err);
+      process.on('unhandledRejection', onUnhandled);
+      try {
+        const auto = createAutoCommit({
+          repoRoot: dir,
+          debounceMs: 5,
+          log: { warn() {}, error() {}, log() {} },
+          run: async () => ({ code: 0, stdout: '', stderr: '' }),
+        });
+        auto.note('.design/ui/Home.tsx', { name: 'A', email: 'a@b.c' });
+        // Long enough for the debounce to fire AND the lock wait to expire.
+        await new Promise((r) => setTimeout(r, 1000));
+        auto.stop();
+      } finally {
+        process.off('unhandledRejection', onUnhandled);
+      }
+      expect(rejections).toEqual([]);
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  }, 30_000);
+});

package/apps/studio/test/sync-hardening.test.ts

@@ -137,6 +137,81 @@ describe('DDR-054 §2a — CI environment gate', () => {
   });
 });
 
+/* ------------------------------------------- Phase 27 D2 — a cell owns its history */
+
+describe('Cloud Phase 27 D2 — a workspace cell ignores the tenant´s linkedHub', () => {
+  let saved: string | undefined;
+
+  beforeEach(() => {
+    saved = process.env.MAUDE_WORKSPACE_MODE;
+  });
+  afterEach(() => {
+    if (saved === undefined) {
+      delete process.env.MAUDE_WORKSPACE_MODE;
+    } else process.env.MAUDE_WORKSPACE_MODE = saved;
+  });
+
+  function linkedCtx() {
+    const designRoot = join(dir, 'design');
+    mkdirSync(join(designRoot, 'ui'), { recursive: true });
+    return {
+      cfg: {
+        name: 't',
+        projectLabel: null,
+        designRoot: 'design',
+        canvasGroups: [{ label: 'Canvases', path: 'ui' }],
+        rootClass: 'app',
+        themeDefault: 'dark' as const,
+        tokensCssRel: 'system/x.css',
+        teamAccentDefault: null,
+        handoffTargets: [],
+        newCanvasDir: 'ui',
+        newComponentDir: 'ui/components',
+        // The TENANT's committed config, carrying whatever hub their desktop
+        // was linked to. It is versioned, so it arrives in the cell with the
+        // checkout.
+        linkedHub: { url: 'https://someone-elses-hub.example.com', linkedAt: 1 },
+        _source: 'defaults' as const,
+      },
+      projectLabel: 't',
+      paths: {
+        repoRoot: dir,
+        designRel: 'design',
+        designRoot,
+        serverInfoFile: '',
+        activeFile: '',
+        commentsDir: join(designRoot, '_comments'),
+        canvasStateDir: '',
+        historyDir: '',
+        tokensUrlRel: '',
+        systemDirRel: 'system',
+      },
+      // biome-ignore lint/suspicious/noExplicitAny: minimal bus stub
+      bus: { on: () => () => {}, emit: () => {} } as any,
+    };
+  }
+
+  test('in a cell it refuses, and says which authority won', () => {
+    // Honouring the tenant's `linkedHub` inside a cell would dial OUT to a
+    // third-party hub carrying their canvases, and start a SECOND autocommit
+    // over the tree the hub is already committing. Both were unreachable by
+    // accident (no `~/.config/maude/hubs.json` in a cell), and an accident is
+    // not an invariant.
+    const warned: string[] = [];
+    const original = console.warn;
+    console.warn = (...args: unknown[]) => warned.push(args.map(String).join(' '));
+    process.env.MAUDE_WORKSPACE_MODE = '1';
+    try {
+      expect(createSyncRuntime(linkedCtx())).toBeNull();
+      // Not just null — null for THIS reason. Without the message this test
+      // would pass on the missing-token path it is meant to precede.
+      expect(warned.join(' ')).toContain('the hub owns history');
+    } finally {
+      console.warn = original;
+    }
+  });
+});
+
 /* ---------------------------------------------------------------- §2b .tsx refusal */
 
 // Coverage moved to sync-runtime.test.ts > discoverCanvases >

package/apps/studio/use-collab.tsx

@@ -592,6 +592,13 @@ function createSession(slug: string): CollabSession {
   let cancelled = false;
   let reconnectTimer: ReturnType<typeof setTimeout> | null = null;
   let wsRef: WebSocket | null = null;
+  // Consecutive failed connects. A server that refuses the upgrade (403/401 —
+  // e.g. a deployment whose proxy does not carry the collab lane) used to be
+  // retried every second, forever, silently — which is indistinguishable from
+  // "nobody else is here" (the cloud-collab RCA shipped invisible exactly this
+  // way). Back off exponentially and say so once.
+  let failedConnects = 0;
+  let failureWarned = false;
 
   function sendFrame(ws: WebSocket, payload: Uint8Array) {
     try {
@@ -624,6 +631,8 @@ function createSession(slug: string): CollabSession {
     wsRef = ws;
 
     ws.addEventListener('open', () => {
+      failedConnects = 0;
+      failureWarned = false;
       session.connected = true;
       notifySession(session);
       // Sync step 1 — announce our state vector so the server can send the
@@ -637,11 +646,22 @@ function createSession(slug: string): CollabSession {
     });
 
     ws.addEventListener('close', () => {
+      const hadConnected = session.connected;
       session.connected = false;
       notifySession(session);
       wsRef = null;
       if (cancelled) return;
-      reconnectTimer = setTimeout(connect, 1000);
+      failedConnects = hadConnected ? 0 : failedConnects + 1;
+      if (failedConnects >= 5 && !failureWarned) {
+        failureWarned = true;
+        console.warn(
+          '[collab] live sync unavailable — the collab socket keeps being refused. ' +
+            'Presence, live annotations and cross-peer updates are off until it connects.'
+        );
+      }
+      // 1s → 2s → 4s → … capped at 15s; a healthy drop (was connected) retries fast.
+      const delay = Math.min(1000 * 2 ** Math.min(failedConnects, 4), 15000);
+      reconnectTimer = setTimeout(connect, delay);
     });
 
     ws.addEventListener('error', () => {

package/apps/studio/whats-new.json

@@ -1,6 +1,42 @@
 {
   "$schema": "./whats-new.schema.json",
   "entries": [
+    {
+      "id": "your-own-place-in-a-shared-project",
+      "version": "0.54.0",
+      "date": "2026-08-04",
+      "kind": "improvement",
+      "title": "A shared project keeps your place",
+      "summary": "Open a cloud project and you land on a canvas, not an empty pane, with one line telling you what you can do there. Your open canvas and your pan and zoom are now yours alone — a teammate moving around no longer moves you. And reading a project no longer means reading it blind: reviewers can open the Inspector and Layers panels, which quietly refused to appear before.",
+      "surface": "design-ui"
+    },
+    {
+      "id": "the-real-studio-in-your-browser",
+      "version": "0.54.0",
+      "date": "2026-08-04",
+      "kind": "feature",
+      "title": "The full studio, in your browser",
+      "summary": "A cloud project opened in a browser now gives you the same application as the desktop — Files, Layers, Inspector, search, the toolbar and the live status — and your designs look like your designs: photographs, logos and webfonts load on the canvas. The browser tab also names the account you are signed in as, and lets you sign out.",
+      "surface": "design-ui"
+    },
+    {
+      "id": "design-system-component-styles-load",
+      "version": "0.54.0",
+      "date": "2026-08-04",
+      "kind": "fix",
+      "title": "Design-system styles render on canvases",
+      "summary": "Canvases in a project with a bootstrapped design system were drawing without their component styles — buttons, cards, inputs and the rest fell back to unstyled defaults. They render correctly again, on the desktop as well as in the browser.",
+      "surface": "design-ui"
+    },
+    {
+      "id": "cloud-live-collaboration-connects",
+      "version": "0.54.0",
+      "date": "2026-08-04",
+      "kind": "fix",
+      "title": "Live collaboration works in the browser",
+      "summary": "Opening a cloud project in two browsers now actually collaborates: you see each other's cursors with names, annotations and comments appear live for everyone, and every change is saved to the project. Before, the live channel never connected — selections crossed over anonymously and annotations silently stayed on the machine that drew them.",
+      "surface": "design-ui"
+    },
     {
       "id": "bug-reports-see-the-maude-window",
       "version": "0.53.2",

package/apps/studio/ws.ts

@@ -9,7 +9,7 @@ import type { Api } from './api.ts';
 import type { Collab, RoomConn } from './collab/index.ts';
 import type { Context } from './context.ts';
 import { createHmrBroadcaster } from './hmr-broadcast.ts';
-import type { Inspect } from './inspect.ts';
+import type { InspectRegistry } from './inspect.ts';
 
 /**
  * Per-connection state. `kind` discriminates between the legacy JSON
@@ -29,6 +29,11 @@ export type WsData =
        *  per session, and a handshake is the one moment the session is
        *  unambiguous. */
       readOnly: boolean;
+      /** WHOSE socket this is — Cloud Phase 27 D3. Same reasoning as `readOnly`
+       *  one line up, for the other thing a cell has more than one of. `''` on
+       *  a desktop, which is what makes every broadcast below reach everybody
+       *  exactly as it always did. */
+      session: string;
     }
   | {
       id: string;
@@ -39,6 +44,14 @@ export type WsData =
        *  canvas iframe origin, whose sync frames go through the DDR-122
        *  origin gate in collab/room.ts. Set at upgrade time in server.ts. */
       realm: 'main' | 'canvas';
+      /** Cloud collab lane (RCA issue-cloud-live-collaboration-dead) — the
+       *  role this socket was opened under, stamped at upgrade time from the
+       *  proxy's injected header (fail-closed in a cell, always false on a
+       *  loopback desktop). A read-only collab socket receives everything and
+       *  publishes awareness (presence is the point), but its sync writes are
+       *  gated to the comment lane in collab/room.ts — the WS mirror of the
+       *  role matrix's `viewer.comment === true`. */
+      readOnly?: boolean;
     }
   | {
       // T2 (9.1-A) — HMR-only socket for the segregated canvas origin. Receives
@@ -139,7 +152,10 @@ export interface Ws {
 export function createWs(
   ctx: Context,
   api: Api,
-  inspect: Inspect,
+  /** Cloud Phase 27 D3 — one inspector per member, not one per process. Every
+   *  read/write below resolves through the socket's own session key, so a
+   *  desktop (key `''`) keeps hitting the single instance it always had. */
+  inspects: InspectRegistry,
   collab: Collab,
   activity: Activity,
   acp: Acp
@@ -156,10 +172,16 @@ export function createWs(
 
   // Privileged inspector feed — comments, selection, ai-activity, git-lifecycle,
   // sync:status, fs:*. ONLY the same-origin inspector clients (the shell) get it.
-  function broadcast(payload: unknown) {
+  function broadcast(payload: unknown, session?: string) {
     const msg = typeof payload === 'string' ? payload : JSON.stringify(payload);
     for (const ws of clients) {
       if (ws.data.kind !== 'inspector') continue;
+      // D3 — an event ABOUT one member goes only to that member. `session` is
+      // set by the emitter (inspect.ts stamps its own key); everything else —
+      // fs changes, comments, git lifecycle, sync status — is about the
+      // PROJECT and reaches everyone, which is why the audience is opt-in
+      // rather than the default.
+      if (session && ws.data.session !== session) continue;
       send(ws, msg);
     }
   }
@@ -177,8 +199,10 @@ export function createWs(
 
   // Wire bus -> WS broadcasts. inspect.ts emits 'selected' / 'active' after every
   // state write; fs-watch.ts emits 'fs:*' on every save.
-  ctx.bus.on('selected', (sel) => broadcast({ type: 'selected', selected: sel }));
-  ctx.bus.on('active', (file) => broadcast({ type: 'active', file }));
+  ctx.bus.on('selected', (sel, meta) =>
+    broadcast({ type: 'selected', selected: sel }, meta?.session)
+  );
+  ctx.bus.on('active', (file, meta) => broadcast({ type: 'active', file }, meta?.session));
   ctx.bus.on('fs:html', (file) => broadcast({ type: 'fs:html', file }));
   ctx.bus.on('fs:css', (file) => broadcast({ type: 'fs:css', file }));
   ctx.bus.on('fs:json', (file) => broadcast({ type: 'fs:json', file }));
@@ -259,11 +283,13 @@ export function createWs(
   function bindCollab(
     ws: ServerWebSocket<WsData>,
     slug: string,
-    realm: 'main' | 'canvas'
+    realm: 'main' | 'canvas',
+    readOnly: boolean
   ): RoomConn {
     const conn: RoomConn = {
       id: ws.data.id,
       realm,
+      readOnly,
       send(payload: Uint8Array) {
         try {
           // Bun's ws.send accepts Uint8Array directly as binary.
@@ -281,7 +307,12 @@ export function createWs(
     async open(ws) {
       if (ws.data.kind === 'collab') {
         const room = collab.registry.get(ws.data.slug);
-        const conn = bindCollab(ws, ws.data.slug, ws.data.realm ?? 'main');
+        const conn = bindCollab(
+          ws,
+          ws.data.slug,
+          ws.data.realm ?? 'main',
+          ws.data.readOnly === true
+        );
         await room.connect(conn);
         return;
       }
@@ -299,7 +330,11 @@ export function createWs(
       // opening mid-edit seeds its overlay state (Phase 13). Inspector-origin
       // sockets only — `canvas-hmr` sockets get no snapshot by design and rely
       // on live `activity` broadcasts.
-      send(ws, { type: 'snapshot', state: inspect.state, activity: activity.state });
+      send(ws, {
+        type: 'snapshot',
+        state: inspects.for(ws.data.kind === 'inspector' ? ws.data.session : '').state,
+        activity: activity.state,
+      });
     },
     async close(ws) {
       if (ws.data.kind === 'acp') {
@@ -377,6 +412,7 @@ export function createWs(
           });
           return;
         }
+        const inspect = inspects.for(ws.data.kind === 'inspector' ? ws.data.session : '');
         if (msg.type === 'active' && typeof msg.file === 'string') inspect.setActive(msg.file);
         else if (msg.type === 'tabs' && Array.isArray(msg.tabs)) inspect.setOpenTabs(msg.tabs);
         else if (msg.type === 'select' && msg.selection) inspect.setSelected(msg.selection);

package/cli/commands/kg.mjs

@@ -18,7 +18,7 @@ import { basename, join, resolve } from 'node:path';
 import { parseArgs } from '../lib/argv.mjs';
 
 const CONFIG_PATH = '.ai/workflows.config.json';
-const DEFAULT_ENGINE_VERSION = 'v0.1.9';
+const DEFAULT_ENGINE_VERSION = 'v1.0.0';
 const KGAI_REPO = 'kgaidev/kgai';
 
 const VERBS = new Set([
@@ -195,21 +195,32 @@ function verbDoctor(state) {
 async function verbCheckUpstream(state) {
   const pinned = state.engineVersion;
   process.stdout.write(`maude kg check-upstream\n\n  pinned (engineVersion): ${pinned}\n`);
-  let latest = null;
-  let assets = [];
-  try {
-    const res = await fetch(`https://api.github.com/repos/${KGAI_REPO}/releases/latest`, {
-      headers: { 'user-agent': 'maude-kg', accept: 'application/vnd.github+json' },
-      signal: AbortSignal.timeout(15000),
-    });
-    if (res.ok) {
+  const ghHeaders = { 'user-agent': 'maude-kg', accept: 'application/vnd.github+json' };
+  /** Asset names for one release ref, or null when the fetch itself failed. */
+  const assetsFor = async (path) => {
+    try {
+      const res = await fetch(`https://api.github.com/repos/${KGAI_REPO}/releases/${path}`, {
+        headers: ghHeaders,
+        signal: AbortSignal.timeout(15000),
+      });
+      if (!res.ok) return { ok: false, tag: null, assets: [] };
       const rel = await res.json();
-      latest = rel.tag_name;
-      assets = (rel.assets ?? []).map((a) => a.name);
+      return { ok: true, tag: rel.tag_name, assets: (rel.assets ?? []).map((a) => a.name) };
+    } catch {
+      return null; // offline — best-effort
     }
-  } catch {
-    /* offline — best-effort */
-  }
+  };
+
+  const latestRel = await assetsFor('latest');
+  const latest = latestRel?.tag ?? null;
+  // The PINNED release is the one that matters: sync-kg.mjs downloads the
+  // desktop sidecars from `releases/download/<pinned>`. Reporting `latest`'s
+  // assets here said "✓" while the pinned release had been stripped of every
+  // asset upstream, so this check stayed green through a desktop build that was
+  // failing on exactly what it claims to verify (v0.53.2, kgai v0.1.9). A tag is
+  // a name, not a content hash — upstream can rewrite what it points at.
+  const pinnedRel = await assetsFor(`tags/${encodeURIComponent(pinned)}`);
+  const assets = pinnedRel?.assets ?? [];
   if (!latest) {
     process.stdout.write('  latest: unknown (offline) — using pinned.\n');
     return 0;
@@ -218,12 +229,31 @@ async function verbCheckUpstream(state) {
   process.stdout.write(
     `  status:                 ${latest === pinned ? '✓ up to date' : `⚠ upstream moved ${pinned} → ${latest}`}\n`
   );
-  // Capability diff — flags/commands the plan's assumptions hinge on.
+  // Prebuilt assets ON THE PIN — what the desktop build actually downloads.
   const hasDarwin = assets.some((a) => /kg-darwin/.test(a));
   const hasKuzu = assets.some((a) => /libkuzu/.test(a));
-  process.stdout.write('\n  prebuilt assets:\n');
-  process.stdout.write(`    macOS kg binary:      ${hasDarwin ? '✓' : '✗'}\n`);
-  process.stdout.write(`    libkuzu dylib/so:     ${hasKuzu ? '✓' : '✗'}\n`);
+  const hasLinux = assets.some((a) => /kg-linux/.test(a));
+  process.stdout.write(`\n  prebuilt assets on the PIN (${pinned}):\n`);
+  if (pinnedRel === null) {
+    process.stdout.write('    (offline — not checked)\n');
+  } else if (!pinnedRel.ok) {
+    process.stdout.write(`    ✗ release ${pinned} not found upstream\n`);
+  } else {
+    process.stdout.write(`    macOS kg binary:      ${hasDarwin ? '✓' : '✗'}\n`);
+    process.stdout.write(`    linux kg binary:      ${hasLinux ? '✓' : '✗'}\n`);
+    process.stdout.write(`    libkuzu dylib/so:     ${hasKuzu ? '✓' : '✗'}\n`);
+  }
+  // A pin whose assets are gone breaks `sync-kg.mjs`, which fails the desktop
+  // build for macOS and Linux. Exit non-zero so this can gate a release.
+  const pinBroken = pinnedRel !== null && (!pinnedRel.ok || !hasDarwin || !hasKuzu || !hasLinux);
+  if (pinBroken) {
+    process.stdout.write(
+      `\n  ✗ the pinned release cannot build the desktop app — sync-kg.mjs downloads from\n` +
+        `    releases/download/${pinned}, and those assets are missing. Upstream deleted or\n` +
+        `    rewrote the release. Bump the pin to one that still carries them (verify\n` +
+        `    compatibility first: CLI surface diff + a canonical-export comparison).\n`
+    );
+  }
   if (latest !== pinned) {
     process.stdout.write(
       '\n  → Re-scan the capability surface (native --scope filter? kg import? Stop-hook/guessActor changes?),\n' +
@@ -231,7 +261,7 @@ async function verbCheckUpstream(state) {
         '    config.knowledgeGraph.engineVersion deliberately (never float — supply-chain surface, DDR-054/056).\n'
     );
   }
-  return 0;
+  return pinBroken ? 1 : 0;
 }
 
 // ── verb: session-sync (SessionStart hook — non-blocking pull) ──────────────

package/cli/lib/gitignore-block.mjs

@@ -34,6 +34,9 @@ export function buildBlock(designRel = '.design', { s3Assets = false } = {}) {
     `${root}/_server.log`,
     `${root}/_server.lock`,
     `${root}/_active.json`,
+    // Per-member siblings in a cloud cell (Phase 27 D3) — same runtime state,
+    // one file per person, and no more committable than the singleton.
+    `${root}/_active.*.json`,
     `${root}/_sync.json`, // linked-mode offline/sync status (Task 8)
     `${root}/_preflight.json`,
     `${root}/_locator.json`, // regenerable slug→path index

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1agh/maude",
-  "version": "0.53.2",
+  "version": "0.54.0",
   "description": "Marketplace of Claude Code plugins by Michal Dovrtěl: `design` (canvas-first design iteration) + `flow` (generic agentic workflow loop with .ai second brain). Ships the `maude` CLI (with `mdcc` legacy alias) to scaffold workspace, run the design dev server, and manage configs.",
   "type": "module",
   "engines": {
@@ -49,16 +49,18 @@
     "test:e2e:desktop:lifecycle": "pnpm --filter @maude/desktop-e2e e2e:lifecycle",
     "test:e2e:desktop:switchrepos": "pnpm --filter @maude/desktop-e2e e2e:switchrepos",
     "test:e2e:desktop:onboarding": "pnpm --filter @maude/desktop-e2e e2e:onboarding",
-    "test:e2e:desktop:acp-cold-start": "pnpm --filter @maude/desktop-e2e e2e:acp-cold-start"
+    "test:e2e:desktop:acp-cold-start": "pnpm --filter @maude/desktop-e2e e2e:acp-cold-start",
+    "test:e2e:desktop:parity": "pnpm --filter @maude/desktop-e2e e2e:parity",
+    "test:e2e:desktop:parity:cloud": "pnpm --filter @maude/desktop-e2e e2e:parity:cloud"
   },
   "optionalDependencies": {
-    "@1agh/maude-darwin-arm64": "0.53.2",
-    "@1agh/maude-darwin-x64": "0.53.2",
-    "@1agh/maude-linux-arm64": "0.53.2",
-    "@1agh/maude-linux-arm64-musl": "0.53.2",
-    "@1agh/maude-linux-x64": "0.53.2",
-    "@1agh/maude-linux-x64-musl": "0.53.2",
-    "@1agh/maude-win32-x64": "0.53.2"
+    "@1agh/maude-darwin-arm64": "0.54.0",
+    "@1agh/maude-darwin-x64": "0.54.0",
+    "@1agh/maude-linux-arm64": "0.54.0",
+    "@1agh/maude-linux-arm64-musl": "0.54.0",
+    "@1agh/maude-linux-x64": "0.54.0",
+    "@1agh/maude-linux-x64-musl": "0.54.0",
+    "@1agh/maude-win32-x64": "0.54.0"
   },
   "files": [
     "cli",

package/plugins/design/dependencies.json

@@ -156,7 +156,7 @@
       },
       "install": {
         "preferred": "See docs/kgai-onboarding.md — download the pinned kgai release binary (kgai is capability-gated + opt-out; nothing to install to use classic .ai/ mode)",
-        "darwin": "curl -fsSL https://github.com/kgaidev/kgai/releases/download/v0.1.9/kg-darwin-arm64 -o /usr/local/bin/kg && chmod +x /usr/local/bin/kg"
+        "darwin": "curl -fsSL https://github.com/kgaidev/kgai/releases/download/v1.0.0/kg-darwin-arm64 -o /usr/local/bin/kg && chmod +x /usr/local/bin/kg"
       },
       "autoInstall": false,
       "fallbackBehavior": "Design DS/canvas/brand decisions are not recorded to the kgai graph; the classic .ai/ path (via /flow:record-ddr) and on-disk sidecars are unchanged.",