@1agh/maude 1.3.0 → 1.4.0

package/apps/studio/git/accepted-guard.ts

@@ -0,0 +1,36 @@
+// Plan T34 / writer registry H09 — the checkout of a project that saves through
+// accepted revisions (DDR-241) is a PROJECTION of the shared history, not a
+// second author.
+//
+// A Git operation that rewrites the checkout's files — switching or adding a
+// draft, discarding, getting latest, resolving a merge — would change files
+// under the sync runtime, and its watcher would propose the result as this
+// person's edit: a local Git graph silently overriding what the team accepted.
+// In that mode these routes refuse, and say where the same intent lives:
+// History (restore an earlier version as a new action). Commit, branch, push
+// and fetch stay — they touch the Git graph, not the files (H10).
+
+/** The `/_api/git/*` routes that rewrite checkout files. */
+export const CHECKOUT_REWRITING_GIT_ROUTES = [
+  '/_api/git/checkout',
+  '/_api/git/fold',
+  '/_api/git/discard',
+  '/_api/git/pull',
+  '/_api/git/resolve',
+] as const;
+
+export const ACCEPTED_GIT_REFUSAL = {
+  ok: false,
+  code: 'accepted-project',
+  error:
+    'This project saves through its shared history, so its files cannot be rewritten from Git here. To go back to an earlier version, restore it from History — it becomes a new change everyone sees.',
+} as const;
+
+/** A refusal when the linked project is in accepted-revisions mode, else null. */
+export function refuseCheckoutRewrite(acceptedMode: (() => boolean) | undefined): Response | null {
+  if (acceptedMode?.() !== true) return null;
+  return Response.json(ACCEPTED_GIT_REFUSAL, {
+    status: 409,
+    headers: { 'Cache-Control': 'no-store' },
+  });
+}

package/apps/studio/hmr-broadcast.ts

@@ -46,8 +46,19 @@ export interface HmrMessage {
   version: number;
   /** Echo of `_lib`-scoped changes for debug + scope reasoning. */
   scope?: 'lib' | 'canvas';
+  /**
+   * The change was written by sync — the project's version landing on this
+   * disk — not by this person's own edit. The iframe may skip a reload it
+   * believes is the echo of an optimistic edit it already shows; it must never
+   * skip one of these, because a teammate's change can ride the same write (a
+   * lost race re-applied onto theirs).
+   */
+  remote?: boolean;
 }
 
+/** How long after a sync write its file's change still counts as remote. */
+export const REMOTE_WRITE_WINDOW_MS = 3_000;
+
 export interface HmrBroadcaster {
   /** Stop subscribing to fs-watch events. */
   stop(): void;
@@ -103,9 +114,28 @@ export function createHmrBroadcaster(
     });
   }
 
+  // Files sync just wrote (see HmrMessage.remote), with the time of the write.
+  const projectedAt = new Map<string, number>();
+  const isRemote = (rel: string | undefined): boolean => {
+    if (!rel) return false;
+    const at = projectedAt.get(rel);
+    return at !== undefined && Date.now() - at < REMOTE_WRITE_WINDOW_MS;
+  };
+  const offProjected = ctx.bus.on('sync:projected', (rel: unknown) => {
+    if (typeof rel !== 'string' || !rel) return;
+    const now = Date.now();
+    projectedAt.set(rel.replace(/\\/g, '/'), now);
+    if (projectedAt.size > 256) {
+      for (const [k, at] of projectedAt)
+        if (now - at >= REMOTE_WRITE_WINDOW_MS) projectedAt.delete(k);
+    }
+  });
+
   function enqueue(msg: HmrMessage) {
     const key = msg.mode === 'hard' ? GLOBAL_KEY : (msg.file ?? GLOBAL_KEY);
     const prev = pendingByKey.get(key);
+    // Coalescing never loses "a teammate's change is in here".
+    if (prev?.remote) msg.remote = true;
     // Same-key coalescing keeps the strongest mode (refreshing the payload for
     // equal rank, so the latest version token wins).
     if (!prev || rank[msg.mode] >= rank[prev.mode]) pendingByKey.set(key, msg);
@@ -115,12 +145,15 @@ export function createHmrBroadcaster(
 
   const offAny = ctx.bus.on('fs:any', (rel: string) => {
     const msg = classify(rel);
-    if (msg) enqueue(msg);
+    if (!msg) return;
+    if (isRemote(rel.replace(/\\/g, '/')) || isRemote(msg.file)) msg.remote = true;
+    enqueue(msg);
   });
 
   return {
     stop() {
       offAny();
+      offProjected();
       if (pending) clearTimeout(pending);
       pending = null;
       pendingByKey.clear();

package/apps/studio/http.ts

@@ -98,6 +98,7 @@ import {
   resolveAutoEngine,
   whisperSetup,
 } from './generation/whisper-models.ts';
+import { refuseCheckoutRewrite } from './git/accepted-guard.ts';
 import { createGitEndpoints } from './git/endpoints.ts';
 import { gitShowFile } from './git/service.ts';
 import { createGitHubEndpoints } from './github/endpoints.ts';
@@ -2632,6 +2633,8 @@ export function createHttp(
         return new Response('cross-origin write rejected', { status: 403 });
       if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
+      const rewrite = refuseCheckoutRewrite(ctx.syncControl?.current?.()?.acceptedMode);
+      if (rewrite) return rewrite;
       const body = await readJson<unknown>(req, 8 * 1024);
       return gitJson(await gitApi.checkout(body));
     },
@@ -2644,6 +2647,8 @@ export function createHttp(
         return new Response('cross-origin write rejected', { status: 403 });
       if (!isTrustedRequestHost(req))
         return new Response('adding a draft requires a local request', { status: 403 });
+      const rewrite = refuseCheckoutRewrite(ctx.syncControl?.current?.()?.acceptedMode);
+      if (rewrite) return rewrite;
       const body = await readJson<unknown>(req, 8 * 1024);
       return gitJson(await gitApi.fold(body));
     },
@@ -2676,6 +2681,8 @@ export function createHttp(
         return new Response('cross-origin write rejected', { status: 403 });
       if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
+      const rewrite = refuseCheckoutRewrite(ctx.syncControl?.current?.()?.acceptedMode);
+      if (rewrite) return rewrite;
       const body = await readJson<unknown>(req, 256 * 1024);
       return gitJson(await gitApi.discard(body));
     },
@@ -2700,6 +2707,8 @@ export function createHttp(
         return new Response('cross-origin write rejected', { status: 403 });
       if (!isTrustedRequestHost(req))
         return new Response('get latest requires a local request', { status: 403 });
+      const rewrite = refuseCheckoutRewrite(ctx.syncControl?.current?.()?.acceptedMode);
+      if (rewrite) return rewrite;
       const body = await readJson<unknown>(req, 8 * 1024);
       return gitJson(await gitApi.pull(body));
     },
@@ -2714,6 +2723,8 @@ export function createHttp(
         return new Response('cross-origin write rejected', { status: 403 });
       if (!isTrustedRequestHost(req))
         return new Response('resolve requires a local request', { status: 403 });
+      const rewrite = refuseCheckoutRewrite(ctx.syncControl?.current?.()?.acceptedMode);
+      if (rewrite) return rewrite;
       const body = await readJson<unknown>(req, 8 * 1024);
       return gitJson(await gitApi.resolve(body));
     },
@@ -5518,9 +5529,12 @@ export function createHttp(
         if (!body || typeof body.body !== 'string' || !body.body.trim()) {
           return new Response('body.body required', { status: 400 });
         }
+        // In a cell the proxy vouches who is replying; a body cannot claim
+        // somebody else (and the cell's git identity is the machine's).
+        const vouched = isWorkspaceMode() ? req.headers.get('x-maude-user') : null;
         const next = await api.commentsAddReply(id, {
           body: body.body,
-          author: typeof body.author === 'string' ? body.author : undefined,
+          author: vouched || (typeof body.author === 'string' ? body.author : undefined),
         });
         if (!next) return new Response('Not found', { status: 404 });
         return Response.json(next, { headers: { 'Cache-Control': 'no-store' } });

package/apps/studio/managed-projects.ts

@@ -69,6 +69,15 @@ export function groupsFromBootstrap(boot: {
   return [...out].slice(0, 32);
 }
 
+function sameServer(a: string | undefined, b: string): boolean {
+  if (!a) return false;
+  try {
+    return normalizeUrl(a) === normalizeUrl(b);
+  } catch {
+    return false;
+  }
+}
+
 async function bootstrapOf(url: string, token: string): Promise<Record<string, unknown> | null> {
   try {
     const res = await fetch(`${url}/api/projects/current/v1/bootstrap`, {
@@ -135,6 +144,19 @@ export async function prepareManagedProject(
     return { ok: false, error: 'The sign-in could not be saved on this computer.', status: 500 };
   const boot = await bootstrapOf(serverUrl, token);
   if (boot && typeof boot.projectId === 'string') projectId ??= boot.projectId;
+  // SIGN IN AGAIN (T20): a new credential for the server this studio is
+  // already syncing with. Reopening the same project attaches to this very
+  // process (the shell never starts a second one for a running project), and
+  // the running runtime still holds the credential the project refused — so
+  // cycle it onto the one just stored. The link is unchanged and never re-read
+  // from disk; only the credential is new, and this process wrote it.
+  if (input.kind !== 'known-hub' && sameServer(ctx.cfg?.linkedHub?.url, serverUrl)) {
+    try {
+      await ctx.syncControl?.restart();
+    } catch (err) {
+      console.error('[managed] could not restart sync on the new sign-in:', err);
+    }
+  }
   const host = new URL(serverUrl).host;
   projectId ??= host;
   if (!/^[A-Za-z0-9._-]{1,128}$/.test(projectId)) projectId = host.replace(/[^A-Za-z0-9._-]/g, '-');

package/apps/studio/server.ts

@@ -468,6 +468,9 @@ function startServer(port: number): BunServer {
             // D3 — whose socket this is, from the proxy's vouched header. Same
             // handshake-time reasoning as `readOnly` below; `''` on a desktop.
             session: WORKSPACE ? normalizeSessionKey(req.headers.get(SESSION_HEADER)) : '',
+            // Who, for attribution (a comment's author) — the proxy's vouched
+            // member; a desktop leaves it to the project's git identity.
+            user: WORKSPACE ? (req.headers.get('x-maude-user') ?? '').slice(0, 120) : '',
             // Cloud Phase 27 — stamp the role onto the socket at the handshake,
             // the one moment the session is unambiguous. Fails CLOSED in a cell
             // for the same reason the HTTP gate does: an absent header is an

package/apps/studio/sync/accepted-link.ts

@@ -41,6 +41,8 @@ export interface AcceptedLinkOptions {
   client?: TransactionClient;
   /** T16 — an AI action opened, was held, or ended. */
   onStage?: (summary: StageSummary | null) => void;
+  /** Every bootstrap the project answered (its manifest and its own config). */
+  onBootstrap?: (b: Bootstrap) => void;
 }
 
 export type StructuralOutcome = ProposalOutcome & { queued?: boolean };
@@ -96,6 +98,7 @@ export function createAcceptedLink(opts: AcceptedLinkOptions) {
       }
       mode = next;
       manifest = b;
+      opts.onBootstrap?.(b);
       return b;
     } catch (err) {
       if (err instanceof TransactionError && err.code === 'absent') mode = 'legacy';

package/apps/studio/sync/file-plane.ts

@@ -1600,6 +1600,21 @@ export function createFilePlane(opts: FilePlaneOptions): FilePlane {
         holdOversized(out, ledger, here);
         continue;
       }
+      // THE FILE THAT WAS TOO BIG IS GONE. It never reached the project and
+      // is no longer on this machine, so nothing is held any more — the panel
+      // kept saying "1 file — too big" for a file that no longer existed.
+      const kept = ledger.row(rel);
+      if (
+        !here &&
+        kept?.state === 'refused' &&
+        kept.blockedClass === 'too-large' &&
+        !kept.syncedHash &&
+        !(row && !row.deleted) &&
+        !ledger.remoteOf(rel)
+      ) {
+        ledger.forget(rel);
+        continue;
+      }
       // What the hub holds: this page when it spoke about the path, otherwise
       // what we last learned. `undefined` (never learned) reads as null only
       // after a full read has had the chance to say so.

package/apps/studio/sync/index.ts

@@ -36,6 +36,7 @@ import * as Y from 'yjs';
 import { renewHubCredential } from '../cloud/renew.ts';
 import { Y_TYPES } from '../collab/persistence.ts';
 import type { Context, LinkedHub } from '../context.ts';
+import { PROJECT_CONFIG_CACHE_REL, reloadConfig, sanitizeProjectConfig } from '../context.ts';
 import { createHistory } from '../history.ts';
 import { SYNTHETIC_FS_DELAY_MS } from '../hmr-broadcast.ts';
 import { acceptedColdStart } from './accepted-cold-start.ts';
@@ -924,8 +925,39 @@ export function createSyncRuntime(
         retryMs: opts.transactionRetryMs,
         onStats: (stats) => statusStore?.updateAccepted?.(stats),
         onStage: (summary) => statusStore?.updateAiAction?.(summary),
+        onBootstrap: (b) => noteProjectConfig(b.projectConfig),
       })
     : null;
+  /**
+   * The project's own group labels and design systems, kept for this copy's
+   * config to fill in what it lacks (context.ts `withProjectConfig`) — so a
+   * managed desktop copy shows the project's design system. Written only when
+   * it changed; the live config reloads and the shells refetch it.
+   */
+  function noteProjectConfig(raw: unknown): void {
+    const clean = sanitizeProjectConfig(raw);
+    if (!clean) return;
+    const file = path.join(ctx.paths.designRoot, PROJECT_CONFIG_CACHE_REL);
+    const text = `${JSON.stringify(clean, null, 2)}\n`;
+    try {
+      if (readFileSync(file, 'utf8') === text) return;
+    } catch {
+      /* first answer */
+    }
+    try {
+      mkdirSync(path.dirname(file), { recursive: true });
+      writeFileSync(file, text);
+    } catch {
+      return; // best-effort — the next bootstrap tries again
+    }
+    if (reloadConfig(ctx)) {
+      console.log(
+        `[sync] the project's design systems: ${clean.designSystems.map((d) => d.name).join(', ') || 'none'}`
+      );
+      ctx.bus.emit('config-updated');
+      ctx.bus.emit('canvas-list-update', { action: 'config' });
+    }
+  }
   const acceptedOn = (): boolean => acceptedLink?.on() === true;
   /**
    * T26 — which accepted action carried a given canvas content of ours, so the
@@ -1222,6 +1254,9 @@ export function createSyncRuntime(
   /** The outbound delete-lane subscriptions — see `noteToHub`. */
   let deletedUnsub: (() => void) | null = null;
   let createdUnsub: (() => void) | null = null;
+  /** Folders made outside the app while running — see `proposeLocalFolders`. */
+  let foldersUnsub: (() => void) | null = null;
+  let foldersTimer: ReturnType<typeof setTimeout> | null = null;
   /** Periodic remote-document poll — the hub-side half of discovery. */
   let remotePollTimer: ReturnType<typeof setInterval> | null = null;
   /** The stall watchdog's tick — see `stallCheck` in `start()`. */
@@ -1312,6 +1347,15 @@ export function createSyncRuntime(
    * work), and passes are floored `MIN_PASS_INTERVAL_MS` apart.
    */
   let planePassInFlight = false;
+  /**
+   * News that arrived WHILE a pass ran. The running pass may already have read
+   * the disk and the hub's listing, so it cannot carry a file written — or a
+   * row a poke announced — after that point; absorbing the request silently
+   * parked such a file until the next 20 s tick (plan T17/L03: a new image
+   * took 15–20 s to reach a teammate while an edit took one). One more pass,
+   * floored like any other, answers it.
+   */
+  let planePassAgain = false;
   let lastPlanePassAt = 0;
   let planePassWaiter: Promise<void> | null = null;
   let lastPlaneResult: import('./file-plane.ts').FilePlaneResult | null = null;
@@ -1323,7 +1367,10 @@ export function createSyncRuntime(
     // A pass already running IS this pass: it reads the same disk and the same
     // cursor, so the caller waits for its answer rather than racing it. The
     // poll's `await` therefore still means "a pass has happened".
-    if (planePassInFlight) return await (planePassWaiter ?? Promise.resolve());
+    if (planePassInFlight) {
+      planePassAgain = true;
+      return await (planePassWaiter ?? Promise.resolve());
+    }
     const since = Date.now() - lastPlanePassAt;
     // The floor governs POKES. The 20 s poll and the explicit `pullRemoteNow`
     // seam are already bounded by their own callers, and silently deferring a
@@ -1346,6 +1393,10 @@ export function createSyncRuntime(
       } finally {
         planePassInFlight = false;
         planePassWaiter = null;
+        if (planePassAgain) {
+          planePassAgain = false;
+          schedulePlanePass();
+        }
       }
     })();
     planePassWaiter = run;
@@ -1867,9 +1918,33 @@ export function createSyncRuntime(
     return abs;
   };
   const designRelPosix = ctx.paths.designRel.replace(/^\.\//, '').replace(/^\/+|\/+$/g, '');
+  /**
+   * A folder the project removed or moved away is taken off this disk only
+   * once it is empty — but the canvases inside leave AFTER the pull that
+   * learned of the action (their moves and deletions land through their own
+   * documents a beat later). Waiting for the next poke or 20 s tick left the
+   * old folder in a teammate's tree for up to 20 s (plan T31/L02). So a
+   * deferred removal asks for another pass shortly, a bounded number of times.
+   */
+  let dirsRetryTimer: ReturnType<typeof setTimeout> | null = null;
+  let dirsRetries = 0;
+  const DIRS_RETRY_MS = 1_500;
+  const DIRS_RETRY_MAX = 12;
+  function retryDeferredDirs(): void {
+    if (stopped || dirsRetryTimer !== null || dirsRetries >= DIRS_RETRY_MAX) return;
+    dirsRetries += 1;
+    dirsRetryTimer = setTimeout(() => {
+      dirsRetryTimer = null;
+      if (stopped || !acceptedOn()) return;
+      if (documentDiscovery) documentDiscovery.schedule();
+      else applyProjectDirs(acceptedLink?.manifest?.dirs ?? []);
+    }, DIRS_RETRY_MS);
+    dirsRetryTimer.unref?.();
+  }
   function applyProjectDirs(dirs: readonly string[]): void {
     const next = new Set(dirs);
     let changed = false;
+    let deferred = 0;
     for (const rel of next) {
       if (knownProjectDirs.has(rel)) continue;
       const abs = projectDirAbs(rel);
@@ -1903,8 +1978,11 @@ export function createSyncRuntime(
           continue;
         }
         // Canvases inside leave through their own deletion/move first; until
-        // then the folder stays and the next poll tries again.
-        if (entries.some((e) => e !== '.gitkeep')) continue;
+        // then the folder stays and a pass shortly tries again.
+        if (entries.some((e) => e !== '.gitkeep')) {
+          deferred += 1;
+          continue;
+        }
         try {
           for (const e of readdirSync(abs)) rmSync(path.join(abs, e), { force: true });
           rmdirSync(abs);
@@ -1920,6 +1998,8 @@ export function createSyncRuntime(
       changed = true;
     }
     if (changed) saveProjectDirs();
+    if (deferred > 0) retryDeferredDirs();
+    else dirsRetries = 0;
   }
 
   /**
@@ -1975,9 +2055,17 @@ export function createSyncRuntime(
    * project as ONE action at cold start. Only additive: a folder the manifest
    * lists and this disk lacks is never proposed as a deletion from here.
    */
+  let folderProposal: Promise<void> | null = null;
+  let folderProposalAgain = false;
   function proposeLocalFolders(): void {
     if (!acceptedLink) return;
-    const listed = new Set(acceptedLink.manifest?.dirs ?? []);
+    // One proposal at a time: a second walk while the first is unanswered
+    // would offer the same folders twice.
+    if (folderProposal) {
+      folderProposalAgain = true;
+      return;
+    }
+    const listed = new Set([...(acceptedLink.manifest?.dirs ?? []), ...knownProjectDirs]);
     const found: string[] = [];
     const walk = (abs: string, rel: string, depth: number) => {
       if (depth > 16 || found.length >= 200) return;
@@ -2006,13 +2094,25 @@ export function createSyncRuntime(
       if (rel) walk(path.join(ctx.paths.designRoot, ...rel.split('/')), rel, 1);
     }
     if (found.length === 0) return;
-    void acceptedLink.dirsCreate(found).then((r) => {
-      if (r.status === 'accepted') {
-        for (const d of found) knownProjectDirs.add(d);
-        saveProjectDirs();
-        console.log(`[sync] added ${found.length} local folder(s) to the project.`);
-      }
-    });
+    folderProposal = acceptedLink
+      .dirsCreate(found)
+      .then((r) => {
+        if (r.status === 'accepted') {
+          for (const d of found) knownProjectDirs.add(d);
+          saveProjectDirs();
+          console.log(`[sync] added ${found.length} local folder(s) to the project.`);
+        }
+      })
+      .catch(() => {
+        /* the next folder event or cold start offers them again */
+      })
+      .finally(() => {
+        folderProposal = null;
+        if (folderProposalAgain) {
+          folderProposalAgain = false;
+          proposeLocalFolders();
+        }
+      });
   }
 
   function proposeFolder(
@@ -3535,7 +3635,15 @@ export function createSyncRuntime(
                 // the HMR broadcaster's per-file coalescing collapses the pair
                 // into one `canvas-hmr`. The projector's own echo guard drops the
                 // resulting file→doc read, so this cannot loop.
-                ...(cellPairing ? { onWrote: announceWrite } : {}),
+                onWrote: (abs: string) => {
+                  // Tell the canvas layer this write carries the PROJECT's
+                  // version — possibly a teammate's change merged under this
+                  // person's own — so an open canvas never discards its reload
+                  // as the echo of an optimistic edit (hmr-broadcast `remote`).
+                  const rel = path.relative(ctx.paths.designRoot, abs).split(path.sep).join('/');
+                  if (rel && !rel.startsWith('..')) ctx.bus.emit('sync:projected', rel);
+                  if (cellPairing) announceWrite(abs);
+                },
               });
               projection.start();
               projections.set(canvas.slug, projection);
@@ -3818,6 +3926,18 @@ export function createSyncRuntime(
     });
     discoveryRescan = rescan;
     discoveryUnsub = ctx.bus.on('canvas-list-update', () => rescan.schedule());
+    // A folder made OUTSIDE the app while it runs — an agent's `mkdir` plus
+    // `.gitkeep`, Finder, a `git checkout` — joins the project the way a cold
+    // start adds one: additively, never as a deletion. Without this it stayed
+    // on this machine until the next launch.
+    foldersUnsub = ctx.bus.on('fs:any', (rel: unknown) => {
+      if (typeof rel !== 'string' || !rel.endsWith('/.gitkeep') || !acceptedOn()) return;
+      if (foldersTimer) clearTimeout(foldersTimer);
+      foldersTimer = setTimeout(() => {
+        foldersTimer = null;
+        if (acceptedOn()) proposeLocalFolders();
+      }, 300);
+    });
 
     // The OUTBOUND half of the delete lane. `api.ts` emits these two only from
     // its privileged create/delete routes, never from the filesystem watcher —
@@ -4518,6 +4638,12 @@ export function createSyncRuntime(
     attachOne = null;
     discoveryUnsub?.();
     discoveryUnsub = null;
+    foldersUnsub?.();
+    foldersUnsub = null;
+    if (foldersTimer) clearTimeout(foldersTimer);
+    foldersTimer = null;
+    if (dirsRetryTimer) clearTimeout(dirsRetryTimer);
+    dirsRetryTimer = null;
     deletedUnsub?.();
     deletedUnsub = null;
     createdUnsub?.();

package/apps/studio/sync/presentation.ts

@@ -427,6 +427,27 @@ export function syncPresentation(
     };
   }
 
+  // Accepted revisions: the project answered "sign in first" to a change —
+  // the sign-in was revoked or its person removed. The change is kept on this
+  // device and retried, but it cannot reach anyone until someone signs in
+  // again, so this is a refusal, never "Saving … check your connection".
+  const refusedSignIn = readAcceptedRefused(status.accepted);
+  if (refusedSignIn) {
+    const n = refusedSignIn.pending;
+    return {
+      phase: 'refused',
+      online: false,
+      label: 'sign in again',
+      title:
+        `${project} no longer accepts your sign-in — ` +
+        (n > 0
+          ? `${n} change${n === 1 ? ' is' : 's are'} kept on this device and not shared.`
+          : 'your changes are not shared.'),
+      next: 'Sign in again to share them.',
+      names: [],
+    };
+  }
+
   // A refused SOURCE change outranks an unreachable hub for the same reason a
   // refusal does: it is sticky, and it is the part that needs a person.
   // (With the hub reachable, the same sentence lists every other lane too.)
@@ -634,6 +655,15 @@ function readAcceptedPending(
   };
 }
 
+/** `status.accepted.credentialRefused`, validated — only a literal `true` counts. */
+function readAcceptedRefused(raw: unknown): { pending: number } | null {
+  if (!raw || typeof raw !== 'object') return null;
+  const r = raw as { credentialRefused?: unknown; pending?: unknown };
+  if (r.credentialRefused !== true) return null;
+  const p = r.pending;
+  return { pending: typeof p === 'number' && Number.isInteger(p) && p > 0 && p <= 1e6 ? p : 0 };
+}
+
 /** `status.aiAction`, validated — never trusted off disk. */
 function readAiAction(raw: unknown): { state: 'open' | 'held'; canvases: number } | null {
   if (!raw || typeof raw !== 'object') return null;

package/apps/studio/sync/status.ts

@@ -103,6 +103,8 @@ export interface AcceptedSaveStatus {
   oldestPendingAt: number | null;
   ackMs: { last: number | null; p95: number | null; n: number };
   rejected: number;
+  /** The project refuses this sign-in — changes wait for signing in again. */
+  credentialRefused?: boolean;
 }
 
 export interface SyncNotice {
@@ -406,7 +408,9 @@ export function createSyncStatusStore(opts: SyncStatusStoreOptions): SyncStatusS
       accepted = next;
       // Going from waiting to caught-up (or back) is news; a latency tick is not.
       flush(
-        ((was?.pending ?? 0) === 0) !== (next.pending === 0) || next.rejected !== was?.rejected
+        ((was?.pending ?? 0) === 0) !== (next.pending === 0) ||
+          next.rejected !== was?.rejected ||
+          !!next.credentialRefused !== !!was?.credentialRefused
       );
     },
     updateFiles(next) {

package/apps/studio/sync/transaction-client.ts

@@ -51,6 +51,9 @@ export interface Bootstrap {
   }[];
   dirs: string[];
   you?: { actor: string; readOnly: boolean };
+  /** What the project's own config says about itself (UNTRUSTED — a copy
+   *  re-validates it; see context.ts `withProjectConfig`). */
+  projectConfig?: unknown;
 }
 
 interface OutboxAction {
@@ -98,6 +101,14 @@ export interface TransactionStats {
   ackMs: { last: number | null; p95: number | null; n: number };
   /** Final rejections this session (conflicts, invalid source, rights…). */
   rejected: number;
+  /**
+   * The project answered the last attempt "sign in first": this sign-in was
+   * revoked or its person disabled. The change stays in the outbox and is
+   * retried with whatever credential `token()` returns next — it is not lost,
+   * but it cannot be shared until someone signs in again, which is what a
+   * person must be told instead of "check your connection".
+   */
+  credentialRefused: boolean;
 }
 
 const sha256 = (s: string) => createHash('sha256').update(s, 'utf8').digest('hex');
@@ -139,6 +150,12 @@ export function createTransactionClient(opts: TransactionClientOptions) {
   const waiting = new Map<string, number>();
   const acks: number[] = [];
   let rejectedCount = 0;
+  let credentialRefused = false;
+  const setCredentialRefused = (next: boolean) => {
+    if (credentialRefused === next) return;
+    credentialRefused = next;
+    opts.onStats?.(stats());
+  };
   function stats(): TransactionStats {
     const sorted = [...acks].sort((a, b) => a - b);
     return {
@@ -152,6 +169,7 @@ export function createTransactionClient(opts: TransactionClientOptions) {
         n: acks.length,
       },
       rejected: rejectedCount,
+      credentialRefused,
     };
   }
   const setPending = (delta: number) => {
@@ -239,13 +257,24 @@ export function createTransactionClient(opts: TransactionClientOptions) {
         if (attempt > 0) {
           const known = await request('GET', `transactions/${entry.transactionId}`);
           if (known.status === 200 && known.json) {
+            setCredentialRefused(false);
             rmSync(file, { force: true });
             return known.json as ProposalResult;
           }
         }
         const { status, json } = await request('POST', 'proposals', entry.bytes);
+        // Not an answer about the change — about who is asking. Kept and
+        // retried (a new sign-in supplies a new token), and said out loud.
+        if (status === 401) {
+          setCredentialRefused(true);
+          throw new TransactionError(
+            'the project no longer accepts this sign-in',
+            'unauthenticated'
+          );
+        }
         const result = json as ProposalResult | null;
         if (result && (result.status === 'accepted' || result.status === 'rejected')) {
+          setCredentialRefused(false);
           if (result.status === 'rejected' && (result.code === 'retryable' || status >= 500)) {
             throw new TransactionError('hub asked to retry', 'retryable');
           }