@1agh/maude 0.60.6 → 1.0.2

package/apps/studio/test/workspace-containment.test.ts

@@ -71,10 +71,12 @@ describe('checkContainment — what a cell may serve', () => {
 
   test('a VARIANT of a forbidden route is still forbidden', () => {
     // The realistic way this gets reintroduced: not `/_api/export` verbatim, but
-    // a sibling that does the same thing under a new name.
+    // a sibling that does the same thing under a new name. (`/_api/export-jobs`
+    // moved OUT of this list when render-workers excepted it explicitly — an
+    // except-listed exact path is a classified decision, not a variant.)
     for (const route of [
-      '/_api/export-jobs',
       '/_api/export/png',
+      '/_api/export-jobs-v2',
       '/_api/github/repos',
       '/_api/claude/signin',
       '/_ws/acp',
@@ -237,7 +239,10 @@ describe('the vocabulary itself', () => {
       '/_api/generate',
       '/_api/github',
       '/_api/hub',
-      '/_api/photo-edit',
+      // `/_api/photo-edit` left this list on purpose: it stores a validated
+      // JSON sidecar and evaluates nothing — the decode happens in the
+      // member's browser. Withholding it made photo edits unsavable in the
+      // cloud. See workspace-mode.ts's header for the fuller account.
       // Spawns a headless browser against the studio — same evaluation as
       // `/_api/export`, and there is no browser in a cell image.
       '/_api/shell-shot',
@@ -281,15 +286,16 @@ describe('pruneForWorkspace — how a cell can boot at all', () => {
     expect(Object.keys(routes).sort()).toEqual([
       '/_api/asset',
       '/_api/comments',
-      '/_api/git-committers',
-      '/_health',
-    ]);
-    expect(removed).toEqual([
-      '/_api/export',
+      // Kept since render-workers — the job lane enqueues/streams, it never
+      // evaluates (the `except` escape on the `/_api/export` prefix).
       '/_api/export-jobs',
-      '/_api/generate/keys',
+      '/_api/git-committers',
+      // Kept since the unwithhold — a photo edit is a stored sidecar, and a
+      // cell that cannot store it cannot save photo edits at all.
       '/_api/photo-edit',
+      '/_health',
     ]);
+    expect(removed).toEqual(['/_api/export', '/_api/generate/keys']);
     // Handlers are carried through by reference — pruning must not rebuild them.
     expect(routes['/_api/asset']).toBe('a');
   });
@@ -310,6 +316,36 @@ describe('pruneForWorkspace — how a cell can boot at all', () => {
     expect(() => assertContainment(Object.keys(table), { env: CELL })).toThrow(/REFUSING TO START/);
   });
 
+  test('the export JOB lane survives the prune; the synchronous render does not (render-workers)', () => {
+    // feature-cloud-export-render-workers: enqueue/list/download evaluate
+    // nothing — the render happens in the maude-render service (or refuses,
+    // lane `none`). The synchronous `/_api/export` stays forbidden, and so
+    // does any FUTURE `/_api/export-*` variant nobody has classified — the
+    // escape is an explicit exact-path allowlist, not a loosened prefix.
+    const table = {
+      '/_api/export': 'x',
+      '/_api/export-jobs': 'j',
+      '/_api/export-jobs/download': 'd',
+      '/_api/export-history': 'h',
+      '/_api/export-next-phase-surprise': 'f',
+      '/_health': 'ok',
+    };
+    const { routes, removed } = pruneForWorkspace(table);
+    expect(Object.keys(routes).sort()).toEqual([
+      '/_api/export-history',
+      '/_api/export-jobs',
+      '/_api/export-jobs/download',
+      '/_health',
+    ]);
+    expect(removed).toEqual(['/_api/export', '/_api/export-next-phase-surprise']);
+    // The single predicate agrees (the fetch fall-through gates on it too).
+    expect(isForbiddenRoute('/_api/export')).toBe(true);
+    expect(isForbiddenRoute('/_api/export-jobs')).toBe(false);
+    expect(isForbiddenRoute('/_api/export-jobs/download')).toBe(false);
+    expect(isForbiddenRoute('/_api/export-history')).toBe(false);
+    expect(isForbiddenRoute('/_api/export-next-phase-surprise')).toBe(true);
+  });
+
   test('pruning an already-clean table is a no-op', () => {
     const table = Object.fromEntries(ALLOWED_ROUTES.map((r) => [r, () => {}]));
     const { routes, removed } = pruneForWorkspace(table);

package/apps/studio/tsconfig.json

@@ -19,15 +19,14 @@
     "noEmit": true,
     "allowJs": true,
     "forceConsistentCasingInFileNames": true,
-    "allowImportingTsExtensions": true
+    "allowImportingTsExtensions": true,
+    // @maude/canvas-lib is the virtual specifier canvases import; the dev-server's
+    // Bun.build plugin resolves it to this same file (DDR-025).
+    "paths": {
+      "@maude/canvas-lib": ["./canvas-lib.tsx"]
+    }
   },
-  "include": [
-    "*.ts",
-    "draw/**/*.ts",
-    "client/**/*.ts",
-    "client/**/*.tsx",
-    "client/**/*.jsx",
-    "test/**/*.ts"
-  ],
-  "exclude": ["node_modules", "dist", "**/*.test.ts"]
+  "//include": "Broad by design. An explicit root list silently orphaned 52 tracked files (canvas-lib.tsx, every overlay, commands/**) because it lacked '*.tsx' — reached by no checker at all. scripts/check-tsc-coverage.sh pins this: every tracked non-test .ts/.tsx here must appear in `tsc --listFiles`.",
+  "include": ["**/*.ts", "**/*.tsx", "**/*.jsx"],
+  "exclude": ["node_modules", "dist", "**/*.test.ts", "**/*.test.tsx"]
 }

package/apps/studio/use-annotation-resize.tsx

@@ -39,7 +39,7 @@ import {
   strokeCenter,
   strokeRotation,
 } from './annotations-layer.tsx';
-import { useViewportControllerContext } from './canvas-lib.tsx';
+import { getLiveViewport, useViewportControllerContext } from './canvas-lib.tsx';
 import { useAnnotationSelection } from './use-annotation-selection.tsx';
 
 const RESIZE_CSS = `
@@ -583,9 +583,12 @@ export function AnnotationResizeOverlay({ store }: { store: StrokesStoreValue |
     return store.strokes.find((s) => s.id === selectedId) ?? null;
   }, [selectedId, store]);
 
+  // Live for the same reason the rAF loop is: a trackpad pinch mid-drag moves
+  // the camera without republishing, and unprojecting the pointer through a
+  // stale viewport would resize the stroke to the wrong world size.
   const screenToWorld = useCallback(
     (cx: number, cy: number): [number, number] => {
-      const v = vp ?? { x: 0, y: 0, zoom: 1 };
+      const v = getLiveViewport() ?? vp ?? { x: 0, y: 0, zoom: 1 };
       const z = v.zoom || 1;
       return [(cx - v.x) / z, (cy - v.y) / z];
     },
@@ -595,6 +598,14 @@ export function AnnotationResizeOverlay({ store }: { store: StrokesStoreValue |
   // rAF loop — repositions handles on every frame while a single resizable
   // stroke is selected. Cheaper than wiring pan/zoom observers because the
   // halo overlays already follow the same pattern.
+  //
+  // It MUST read `getLiveViewport()` per tick, not the `vp` captured in this
+  // effect's closure: the published viewport is settle-cadence (SETTLE_MS), so
+  // through a pan/zoom the closure holds one frozen value and the loop spends
+  // the whole gesture recomputing the SAME stale screen positions. The handles
+  // sat where the selection used to be and only snapped onto it ~half a second
+  // after the gesture ended. `liveViewport` is written on every applyViewport
+  // with no publish lag, and equals `vp` once settled.
   useEffect(() => {
     if (!selectedStroke || !isResizable(selectedStroke)) {
       const c = containerRef.current;
@@ -609,7 +620,7 @@ export function AnnotationResizeOverlay({ store }: { store: StrokesStoreValue |
       rafRef.current = null;
       const c = containerRef.current;
       if (!c) return;
-      const v = vp ?? { x: 0, y: 0, zoom: 1 };
+      const v = getLiveViewport() ?? vp ?? { x: 0, y: 0, zoom: 1 };
       const z = v.zoom || 1;
       // Wave H — screen-constant halo offset (HALO_PAD_PX at any zoom).
       const positions = handlePositions(selectedStroke, HALO_PAD_PX / z);

package/apps/studio/use-collab.tsx

@@ -18,6 +18,7 @@
 
 import * as decoding from 'lib0/decoding';
 import * as encoding from 'lib0/encoding';
+import type { JSX } from 'react';
 import {
   createContext,
   type ReactNode,
@@ -602,7 +603,8 @@ function createSession(slug: string): CollabSession {
 
   function sendFrame(ws: WebSocket, payload: Uint8Array) {
     try {
-      ws.send(payload);
+      // Uint8Array<ArrayBufferLike> vs BufferSource — see saveAsset in api.ts.
+      ws.send(payload as Uint8Array<ArrayBuffer>);
     } catch {
       /* dead socket — close handler will reconnect */
     }

package/apps/studio/whats-new.json

@@ -1,6 +1,105 @@
 {
   "$schema": "./whats-new.schema.json",
   "entries": [
+    {
+      "id": "export-from-the-cloud-studio",
+      "version": "1.0.1",
+      "date": "2026-08-20",
+      "kind": "feature",
+      "surface": "design-ui",
+      "title": "Export works in the cloud studio now",
+      "summary": "Exporting a canvas to PNG, PDF, PPTX, ZIP or video from a project open in your browser used to fail. Now it runs as a background job — kick it off, keep working, and download it from the notifications when it's done. Where a workspace has no render service configured, the formats that need one say so and point you at the desktop app; ZIP always works."
+    },
+    {
+      "id": "your-sync-controls-are-in-the-app-now",
+      "version": "1.0.1",
+      "date": "2026-08-20",
+      "kind": "feature",
+      "surface": "design-ui",
+      "title": "Sync settings, consent and a Trash you can find",
+      "summary": "The Sync panel now holds the controls that used to mean editing a config file by hand: turn file sync or delete propagation on and off, choose how first-link conflicts resolve, and see per-file delivery. A first-time notice asks before a workspace starts mirroring your whole design folder, and deleted or replaced files land in a Trash section you can restore from or clear — no more hunting for a hidden folder."
+    },
+    {
+      "id": "moving-a-canvas-reaches-every-machine",
+      "version": "1.0.0",
+      "date": "2026-08-20",
+      "kind": "fix",
+      "surface": "design-ui",
+      "title": "Moving a canvas reaches every machine",
+      "summary": "Moving a canvas into a folder now shows up everywhere, instead of only on the machine that moved it. Canvases made on one machine also stop arriving blank or reverting when you edit them somewhere else."
+    },
+    {
+      "id": "durable-backups-for-every-file",
+      "version": "1.0.0",
+      "date": "2026-08-20",
+      "kind": "improvement",
+      "surface": "design-ui",
+      "title": "Every file in a cloud project is backed up now",
+      "summary": "Cloud-hosted projects now keep a durable copy of every file — design-system stylesheets, shared modules, fonts, and images anywhere in the folder, not just top-level assets. A project that restarts in the cloud comes back whole instead of missing its styling."
+    },
+    {
+      "id": "the-whole-design-folder-syncs",
+      "version": "1.0.0",
+      "date": "2026-08-20",
+      "kind": "feature",
+      "surface": "design-ui",
+      "title": "Your whole design folder syncs now",
+      "summary": "A linked project mirrors everything in .design/ both ways — design-system stylesheets, READMEs, fonts, images — not just the canvases. Before, a teammate opening the project got every canvas and none of the styling it depended on."
+    },
+    {
+      "id": "deleting-a-file-deletes-it-everywhere",
+      "version": "1.0.0",
+      "date": "2026-08-20",
+      "kind": "feature",
+      "surface": "design-ui",
+      "title": "Delete a file and it stays deleted",
+      "summary": "Removing a file now removes it for everyone, instead of it quietly coming back on the next sync. If more than a handful go at once — a branch switch, a bad restore — sync pauses and the Sync panel says what it was about to do; nothing is removed until you agree. Anything it does remove is moved to a trash folder on both machines rather than deleted."
+    },
+    {
+      "id": "repo-owned-or-hub-owned",
+      "version": "1.0.0",
+      "date": "2026-08-20",
+      "kind": "improvement",
+      "surface": "design-ui",
+      "title": "One owner for your design folder",
+      "summary": "A project is either committed to your repo or mirrored by your hub — never both, which used to let a git pull and a sync undo each other. Switching either way takes one command and never moves a file off your disk. Linking also asks, once, whether that hub may send shared code to this machine."
+    },
+    {
+      "id": "history-follows-the-cloud",
+      "version": "1.0.0",
+      "date": "2026-08-20",
+      "kind": "fix",
+      "title": "History shows what the cloud is saving",
+      "summary": "When a folder is connected to Maude Cloud, the History tab now lists the cloud's saved versions instead of your machine's — headed by the cloud project's name, and you can open a canvas at any of them, including versions that only ever existed in the cloud. If the cloud can't be reached it says so, with a Retry, rather than looking empty. While the cloud is saving, the app also stops keeping a separate account of the folder: no unsaved marks in the tree, no draft switcher. Disconnect and it all returns live. Your own git is untouched.",
+      "surface": "design-ui"
+    },
+    {
+      "id": "canvas-zoom-and-selection-feel",
+      "version": "1.0.0",
+      "date": "2026-08-20",
+      "kind": "improvement",
+      "title": "Zooming and drawing feel right",
+      "summary": "The mouse wheel and trackpad pinch now move the zoom about twice as far per notch, closer to the canvas tools you already use. Ink you draw scales with the zoom in the browser the way it always did in the desktop app, and the resize handles around a selection now follow a pan or zoom live instead of sitting where the shape used to be until you let go.",
+      "surface": "design-ui"
+    },
+    {
+      "id": "cloud-canvases-heal-themselves",
+      "version": "1.0.0",
+      "date": "2026-08-20",
+      "kind": "fix",
+      "title": "The cloud stops needing a reload",
+      "summary": "A file that arrives in the cloud now shows up in an open tab by itself. Before, the bytes landed but nothing told the page, so a picture stayed a broken frame until you reloaded by hand — it looked like sync had failed when it had already finished.",
+      "surface": "design-ui"
+    },
+    {
+      "id": "instant-asset-sync",
+      "version": "0.60.7",
+      "date": "2026-08-16",
+      "kind": "improvement",
+      "title": "Pictures sync in seconds",
+      "summary": "A picture you drop on a canvas is pushed by itself the moment it lands, and the other side fetches it the moment the reference arrives — seconds end to end, instead of waiting for the next full sweep or polling tick.",
+      "surface": "design-ui"
+    },
     {
       "id": "assets-arrive-and-heal",
       "version": "0.60.6",

package/apps/studio/workspace-mode.ts

@@ -35,79 +35,118 @@ export function isWorkspaceMode(env: NodeJS.ProcessEnv = process.env): boolean {
   return env.MAUDE_WORKSPACE_MODE === '1';
 }
 
+/**
+ * Where an export gets rendered — the one question every export surface asks.
+ *
+ *   `local`   this process spawns the capture browser (desktop / plain server;
+ *             pre-render-worker behavior, unchanged).
+ *   `remote`  a workspace cell with a render service configured: browser-needing
+ *             formats are dispatched to `MAUDE_RENDER_URL` as jobs; the browser
+ *             never enters THIS image (the containment invariant holds).
+ *   `none`    a workspace cell with no render service: browser-needing formats
+ *             refuse with a remedy, browser-free formats (zip) still run here.
+ *
+ * Resolved once per boot-shaped question (env does not change while a cell
+ * runs — env applies at container start, see apps/cells/wrangler.toml).
+ */
+export type RenderLane = 'local' | 'remote' | 'none';
+
+export function resolveRenderLane(env: NodeJS.ProcessEnv = process.env): RenderLane {
+  if (!isWorkspaceMode(env)) return 'local';
+  return env.MAUDE_RENDER_URL ? 'remote' : 'none';
+}
+
 /**
  * Route paths a workspace cell must not expose, with the reason each one
  * violates containment. The reason travels with the entry so the error message
  * teaches rather than just refusing.
  *
- * These are prefixes: `/_api/export-jobs` is caught by `/_api/export` and that
- * is intended — a variant of a forbidden surface is still forbidden.
+ * These are prefixes: a variant of a forbidden surface is still forbidden.
+ * The ONE escape is an entry's `except` list — EXACT paths that leave the
+ * prefix's shadow because they hold none of what the prefix is forbidden for.
+ * feature-cloud-export-render-workers used it first: `/_api/export-jobs` +
+ * `/_api/export-history` enqueue, list and stream — the EVALUATION the
+ * `/_api/export` prefix names happens in the maude-render service (or is
+ * refused, lane `none`), never here. An unlisted future `/_api/export-*`
+ * route stays forbidden by default, which is the property that makes an
+ * exact-path allowlist safer than narrowing the prefix.
  *
  * TWO KINDS OF ENTRY LIVE HERE, and both belong:
  *
- *   1. surfaces that EVALUATE tenant content on our compute (export, photo-edit);
+ *   1. surfaces that EVALUATE tenant content on our compute (export, shell-shot);
+ *      — NOT `/_api/photo-edit`, which was withheld here for a while under
+ *      that rationale and never fit it: the route validates and stores a JSON
+ *      sidecar (`assets/<sha8>.photo.json`), and the DECODING it was blamed
+ *      for happens in the member's own browser (PhotoPreviewBridge) — the
+ *      exact same division of labour that makes `/_canvas-shell` servable.
+ *      The withhold's real effect was that photo edits could not be saved in
+ *      the cloud at all, reported as "photo editing doesn't work";
  *   2. surfaces that hold, spend or reveal a SECRET on our compute — a provider
  *      key, the operator's GitHub token, the user's own `claude` session, the
  *      process log. DDR-123's "claude never on our infra" is only a fact while
  *      these are unreachable, and Cloud Phase 27 D1 is where they stop being in
  *      the image at all. Until then, unreachable is the floor, not the ceiling.
  */
-export const FORBIDDEN_ROUTE_PREFIXES: ReadonlyArray<{ prefix: string; why: string }> =
-  Object.freeze([
-    {
-      prefix: '/_api/export',
-      why: 'export renders the canvas through a headless browser — it EVALUATES tenant TSX',
-    },
-    {
-      prefix: '/_api/photo-edit',
-      why: 'photo editing decodes and processes tenant-supplied media in-process',
-    },
-    {
-      prefix: '/_api/generate',
-      why: 'media generation runs tenant-authored prompts against a provider key held here',
-    },
-    {
-      prefix: '/_api/figma',
-      why: 'the Figma lane STORES and SPENDS a user personal access token, and imports write the design root — a cell must hold no provider credential (DDR-216 D2/D3, same class as /_api/generate)',
-    },
-    {
-      prefix: '/_api/shell-shot',
-      why: 'the shell screenshot spawns a headless browser against the studio — the same evaluation `/_api/export` is forbidden for',
-    },
-    {
-      prefix: '/_ws/acp',
-      why: 'the ACP bridge spawns the user’s own `claude` and can drive file edits (DDR-123 is desktop-only)',
-    },
-    // ---- Cloud Phase 27 D1 — the secret-bearing surfaces, named at last ----
-    {
-      prefix: '/_api/acp',
-      why: 'the ACP surface drives the user’s own `claude` session; a cell must not hold one (DDR-123)',
-    },
-    {
-      prefix: '/_api/claude',
-      why: 'installing or signing in to `claude` from a cell would put a user’s subscription on our infra (DDR-123)',
-    },
-    {
-      prefix: '/_api/cloud',
-      why: 'cloud sign-in mints and stores an account session — a cell IS the cloud, it must not be a client of it',
-    },
-    {
-      prefix: '/_api/github',
-      why: 'the GitHub lane spends an operator credential; a cell asks the control plane, it never holds one (DDR-201)',
-    },
-    {
-      prefix: '/_api/hub',
-      why: 'hub linking rewrites which server owns this project — a cell must not repoint itself',
-    },
-    {
-      prefix: '/_api/debug-bundle',
-      why: 'the diagnostic bundle reads this process’s logs, where every cell secret has had a chance to appear',
-    },
-    {
-      prefix: '/_api/design',
-      why: 'design-system init shells out to the CLI on our compute against tenant-chosen input',
-    },
-  ]);
+export const FORBIDDEN_ROUTE_PREFIXES: ReadonlyArray<{
+  prefix: string;
+  why: string;
+  except?: readonly string[];
+}> = Object.freeze([
+  {
+    prefix: '/_api/export',
+    why: 'export renders the canvas through a headless browser — it EVALUATES tenant TSX',
+    // The job lane: enqueue / list+stream / history. No evaluation happens
+    // in-cell — browser formats dispatch to maude-render (exporters/jobs.ts
+    // render lane), zip runs browser-free, and lane `none` refuses with a
+    // remedy. DDR amending DDR-209 A′1 records the contract.
+    except: ['/_api/export-jobs', '/_api/export-jobs/download', '/_api/export-history'],
+  },
+  {
+    prefix: '/_api/generate',
+    why: 'media generation runs tenant-authored prompts against a provider key held here',
+  },
+  {
+    prefix: '/_api/figma',
+    why: 'the Figma lane STORES and SPENDS a user personal access token, and imports write the design root — a cell must hold no provider credential (DDR-216 D2/D3, same class as /_api/generate)',
+  },
+  {
+    prefix: '/_api/shell-shot',
+    why: 'the shell screenshot spawns a headless browser against the studio — the same evaluation `/_api/export` is forbidden for',
+  },
+  {
+    prefix: '/_ws/acp',
+    why: 'the ACP bridge spawns the user’s own `claude` and can drive file edits (DDR-123 is desktop-only)',
+  },
+  // ---- Cloud Phase 27 D1 — the secret-bearing surfaces, named at last ----
+  {
+    prefix: '/_api/acp',
+    why: 'the ACP surface drives the user’s own `claude` session; a cell must not hold one (DDR-123)',
+  },
+  {
+    prefix: '/_api/claude',
+    why: 'installing or signing in to `claude` from a cell would put a user’s subscription on our infra (DDR-123)',
+  },
+  {
+    prefix: '/_api/cloud',
+    why: 'cloud sign-in mints and stores an account session — a cell IS the cloud, it must not be a client of it',
+  },
+  {
+    prefix: '/_api/github',
+    why: 'the GitHub lane spends an operator credential; a cell asks the control plane, it never holds one (DDR-201)',
+  },
+  {
+    prefix: '/_api/hub',
+    why: 'hub linking rewrites which server owns this project — a cell must not repoint itself',
+  },
+  {
+    prefix: '/_api/debug-bundle',
+    why: 'the diagnostic bundle reads this process’s logs, where every cell secret has had a chance to appear',
+  },
+  {
+    prefix: '/_api/design',
+    why: 'design-system init shells out to the CLI on our compute against tenant-chosen input',
+  },
+]);
 
 /**
  * Routes a cell MAY serve, but only while the contract that makes them safe is
@@ -168,9 +207,18 @@ function matches(route: string, prefix: string): boolean {
   return route === prefix || route.startsWith(prefix);
 }
 
-/** True when `route` is (or starts with) a forbidden prefix. */
+/** The forbidden entry shadowing `route`, honoring exact-path `except` escapes. */
+function forbiddenEntryFor(
+  route: string
+): { prefix: string; why: string; except?: readonly string[] } | undefined {
+  return FORBIDDEN_ROUTE_PREFIXES.find(
+    (f) => matches(route, f.prefix) && !f.except?.includes(route)
+  );
+}
+
+/** True when `route` is (or starts with) a forbidden prefix and is not excepted. */
 export function isForbiddenRoute(route: string): boolean {
-  return FORBIDDEN_ROUTE_PREFIXES.some((f) => matches(route, f.prefix));
+  return forbiddenEntryFor(route) !== undefined;
 }
 
 /** True when `route` is one a cell may serve only while the sandbox is armed. */
@@ -234,7 +282,7 @@ export function checkContainment(
   const routes: ContainmentReport['routes'] = [];
   const unattested: ContainmentReport['unattested'] = [];
   for (const route of routeNames) {
-    const forbidden = FORBIDDEN_ROUTE_PREFIXES.find((f) => matches(route, f.prefix));
+    const forbidden = forbiddenEntryFor(route);
     if (forbidden) {
       routes.push({ route, prefix: forbidden.prefix, why: forbidden.why });
       continue;

package/apps/studio/ws.ts

@@ -10,6 +10,7 @@ import type { Collab, RoomConn } from './collab/index.ts';
 import type { Context } from './context.ts';
 import { createContainerWriteBridge, createHmrBroadcaster } from './hmr-broadcast.ts';
 import type { InspectRegistry } from './inspect.ts';
+import { startCellFileEvents } from './sync/cell-file-events.ts';
 import { isWorkspaceMode } from './workspace-mode.ts';
 
 /**
@@ -274,7 +275,27 @@ export function createWs(
   // iframe stays stale until a manual reload (inspector-edits-live-render RCA).
   // Synthesise the fs:any the watcher owes us from each write's activity:suppress
   // arm. Workspace-mode only — locally fs.watch fires and this would double-load.
-  if (isWorkspaceMode()) createContainerWriteBridge(ctx);
+  if (isWorkspaceMode()) {
+    createContainerWriteBridge(ctx);
+    // Sync v2 Increment 2/3 (DDR-226 §4) — the OTHER half of the same gap, and
+    // now both ways across it. The bridge above covers writes THIS process
+    // makes; a desktop asset PUT or a bucket→checkout refill happens in the HUB
+    // process, and nothing crossed that boundary.
+    //
+    //   hub → child   the hub pokes over the reserved `maude.files` channel and
+    //                 this turns the poke into the `fs:any` the watcher owed us
+    //   child → hub   the same `fs:any` (from the bridge above) is named to the
+    //                 hub, which journals it at once instead of finding it on
+    //                 the 15-minute walk-import belt
+    //
+    // Without the second direction the two sync directions have wildly
+    // different latency — seconds one way, up to a quarter of an hour the other
+    // — which is indistinguishable from "cloud → desktop is broken".
+    //
+    // Deliberately NOT gated on cell pairing — that is a one-tenant pilot and
+    // the gap is fleet-wide. See sync/ctl-provider.ts.
+    startCellFileEvents(ctx);
+  }
 
   // Phase 13 / DDR-029 — canvas activity overlay. activity.ts emits
   // `activity:change` per file as edits land + go idle. The overlay renders

package/cli/bin/claude-design-server.mjs

@@ -0,0 +1,19 @@
+#!/usr/bin/env node
+// `claude-design-server` — legacy direct alias for the design dev server.
+// Historically this bin WAS the zero-dep Node server (apps/studio/server.mjs);
+// that server is gone (Bun authoritative since DDR-009, deleted in the post-1.0
+// hardening pass), so the alias now forwards to `maude design serve`, which owns
+// binary resolution, the RCA G3 bun shim, and the loud no-runtime refusal.
+import { spawn } from 'node:child_process';
+import { resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const maude = resolve(fileURLToPath(import.meta.url), '..', 'maude.mjs');
+const child = spawn(process.execPath, [maude, 'design', 'serve', ...process.argv.slice(2)], {
+  stdio: 'inherit',
+});
+child.on('exit', (code) => process.exit(code ?? 0));
+child.on('error', (err) => {
+  process.stderr.write(`claude-design-server: ${err.message}\n`);
+  process.exit(1);
+});

package/cli/commands/design.mjs

@@ -13,7 +13,7 @@ import { createRequire } from 'node:module';
 import { homedir } from 'node:os';
 import { basename, dirname, join, resolve } from 'node:path';
 import { parseArgs } from '../lib/argv.mjs';
-import { runAdopt, runLink, runStatus, runUnlink } from '../lib/design-link.mjs';
+import { runAdopt, runDetach, runLink, runStatus, runUnlink } from '../lib/design-link.mjs';
 import { writeGitignoreBlock } from '../lib/gitignore-block.mjs';
 import { isCompiledBinary } from '../lib/pkg-root.mjs';
 
@@ -23,6 +23,7 @@ const SUBCOMMANDS = new Set([
   'export',
   'link',
   'unlink',
+  'detach',
   'status',
   'adopt',
   'help',
@@ -171,6 +172,7 @@ export async function run({ args, pkgRoot }) {
   if (sub === 'export') return runExport({ args });
   if (sub === 'link') return runLink({ args });
   if (sub === 'unlink') return runUnlink({ args });
+  if (sub === 'detach') return runDetach({ args });
   if (sub === 'status') return runStatus({ args });
   if (sub === 'adopt') return runAdopt({ args });
 }
@@ -323,7 +325,7 @@ function usage() {
   return `maude design <verb> [options]
 
 Lifecycle:
-  serve · init · export · link · adopt · unlink · status
+  serve · init · export · link · adopt · detach · unlink · status
 
 Dev-tooling (dispatch to the dev-server bash helpers — DDR-062):
   screenshot · server-up · prep · slug · bootstrap-check · runtime-health
@@ -380,6 +382,12 @@ Dev-tooling (dispatch to the dev-server bash helpers — DDR-062):
         Alias of 'link --adopt'. Shipped as a discoverable subcommand so
         first-time bootstrap reads like 'git remote add' + 'git push -f'.
 
+  detach [--yes] [--keep-token]
+        Take .design/ back into this repo: unlink the hub and remove the
+        hub-owned ignore, so git sees the folder again. Nothing is
+        downloaded — the local mirror is already complete — and nothing
+        is committed for you. The reverse of 'adopt' (DDR-228).
+
   unlink [--keep-token]
         Drop linkedHub from .design/config.json + remove the per-machine
         token (unless --keep-token). Repo returns to solo mode. Local
@@ -466,7 +474,6 @@ async function runServe({ args, pkgRoot }) {
   }
 
   const tsEntry = resolve(pkgRoot, 'apps', 'studio', 'server.ts');
-  const mjsEntry = resolve(pkgRoot, 'apps', 'studio', 'server.mjs');
 
   const hasBun = await new Promise((res) => {
     const probe = spawn('bun', ['--version'], { stdio: 'ignore' });
@@ -474,9 +481,21 @@ async function runServe({ args, pkgRoot }) {
     probe.on('exit', (code) => res(code === 0));
   });
 
-  const child = hasBun
-    ? spawn('bun', ['run', tsEntry, ...forwarded], { stdio: 'inherit', env: process.env })
-    : spawn(process.execPath, [mjsEntry, ...forwarded], { stdio: 'inherit', env: process.env });
+  if (!hasBun) {
+    // The pre-DDR-009 zero-dep Node server used to be the silent fallback here.
+    // It was deleted (post-1.0 hardening, T0b): it served a years-stale feature
+    // surface, so "works without bun" really meant "silently degrades to a
+    // different product". Bun is authoritative (DDR-009) — refuse loud instead.
+    process.stderr.write(
+      `maude design serve: running from source requires bun (DDR-009 — the dev\nserver is Bun-authoritative; the old Node fallback served a stale feature\nsurface and was removed).\n\n  Install bun:  curl -fsSL https://bun.sh/install | bash\n  Or use the shipped platform binary instead of the source tree:\n    npm i -g @1agh/maude && maude design serve\n\nRepo: ${pkgRoot}\n`
+    );
+    process.exit(1);
+  }
+
+  const child = spawn('bun', ['run', tsEntry, ...forwarded], {
+    stdio: 'inherit',
+    env: process.env,
+  });
   child.on('exit', (code) => process.exit(code ?? 0));
   child.on('error', (err) => {
     process.stderr.write(`maude design serve: ${err.message}\n`);