@1agh/maude 1.4.0 → 1.4.2

package/apps/studio/http.ts

@@ -599,20 +599,26 @@ export function localDepsFromSource(
 /** mtime signature over the .tsx + every inlined relative dep (`.css` + local
  *  modules). A missing/unreadable file contributes 0 — a delete is itself a
  *  change (and a later create too), so the signature differs. */
-function canvasFreshnessSig(tsxAbsPath: string, deps: string[]): string {
+function canvasFreshnessSig(tsxAbsPath: string, deps: string[], tsxMtime?: number): string {
   const parts: string[] = [];
   for (const p of [tsxAbsPath, ...deps]) {
-    const mt = Bun.file(p).lastModified;
+    const mt = p === tsxAbsPath && tsxMtime !== undefined ? tsxMtime : Bun.file(p).lastModified;
     parts.push(`${p}@${Number.isFinite(mt) ? mt : 0}`);
   }
   return parts.join('|');
 }
 
-async function serveCanvasTsx(
+/** @internal Test seam — runs between reading the source and storing the build. */
+export interface ServeCanvasTestHooks {
+  afterRead?: () => void | Promise<void>;
+}
+
+export async function serveCanvasTsx(
   absPath: string,
   req: Request,
   ctx: Context,
-  locatorAbsPath: string
+  locatorAbsPath: string,
+  testHooks?: ServeCanvasTestHooks
 ): Promise<Response> {
   // Phase 27 (E2) — DiffView "before" pane. `?sha=<ref>` builds the canvas from
   // its source AT a past version (git show) instead of the working-tree file, so
@@ -634,8 +640,21 @@ async function serveCanvasTsx(
   const sig = canvasFreshnessSig(absPath, cached?.deps ?? []);
 
   if (!cached || cached.sig !== sig) {
+    // THE SIGNATURE OF WHAT WAS READ, taken before the read.
+    //
+    // It used to be recomputed after the build. A build is slow — out of
+    // process on a cell — and a canvas that changed again meanwhile stored the
+    // OLD module under the NEW file's signature, so the next request (the HMR
+    // for that very change) was a cache hit and served the previous body: a
+    // view stuck one edit behind while the file was right (surface row L23 on
+    // the hub, 2026-09-16). Stamped before reading, a change during the build
+    // leaves the stored signature older than the file, and the next request
+    // rebuilds. A dep is stamped before the build reads it, for the same reason.
+    const tsxMtime = file.lastModified;
     const source = await file.text();
     const deps = localDepsFromSource(source, absPath, ctx.paths.designRoot);
+    const builtSig = canvasFreshnessSig(absPath, deps, tsxMtime);
+    await testHooks?.afterRead?.();
     let result: Awaited<ReturnType<typeof buildCanvasModule>>;
     // DDR-209 A′2 — SAME ENGINE, DIFFERENT HOST. On a desktop the process that
     // parses your canvas is the process you own, so an in-process build costs
@@ -662,7 +681,7 @@ async function serveCanvasTsx(
         etag: built.etag,
       } as Awaited<ReturnType<typeof buildCanvasModule>>;
       cached = {
-        sig: canvasFreshnessSig(absPath, deps),
+        sig: builtSig,
         etag: `${result.etag}-${RUNTIME_BOOT_ID}-${CHROME_EPOCH}`,
         js: result.js,
         deps,
@@ -694,10 +713,10 @@ async function serveCanvasTsx(
         headers: { 'Content-Type': 'text/plain; charset=utf-8' },
       });
     }
-    // Recompute the signature against the freshly-parsed deps — this very edit
-    // may have added or removed a `.css` import.
+    // The signature against the freshly-parsed deps — this very edit may have
+    // added or removed a `.css` import — stamped before the build (above).
     cached = {
-      sig: canvasFreshnessSig(absPath, deps),
+      sig: builtSig,
       // Fold in the boot id (restart) + chrome epoch (live edit) so a chrome
       // change busts the browser's cached transpile even when the canvas source
       // (hence result.etag) is unchanged. See RUNTIME_BOOT_ID / CHROME_EPOCH.

package/apps/studio/sync/file-plane.ts

@@ -547,6 +547,16 @@ export interface FilePlane {
   doruceka(): Record<string, DeliveryState>;
   /** How many rows the ledger holds, before the doručenka's cap. */
   dorucekaTotal(): number;
+  /**
+   * The media this machine cannot place, in BYTES as well as files — T29.
+   * `null` when nothing is blocked, so a healthy project carries no field.
+   */
+  blocked(): {
+    files: number;
+    bytes: number;
+    unmeasured: number;
+    byClass: Record<string, { files: number; bytes: number }>;
+  } | null;
 }
 
 export function createFilePlane(opts: FilePlaneOptions): FilePlane {
@@ -2223,6 +2233,39 @@ export function createFilePlane(opts: FilePlaneOptions): FilePlane {
     dorucekaTotal() {
       return Object.keys(ledger.rows()).length;
     },
+    /**
+     * HOW MUCH MEDIA IS NOT HERE — plan T29.
+     *
+     * `failed` counts files, and a count is the wrong unit for the question
+     * an operator is actually asking. "Nine files failed" is unreadable: nine
+     * CSS sidecars is nothing, nine videos is the project. The bytes are what
+     * says whether a person is looking at a broken thumbnail or at a project
+     * whose media never arrived.
+     *
+     * Bounded by construction — one entry per blocked CLASS, and the classes
+     * are a fixed set (`file-ledger.ts`), never per path. Sizes come from the
+     * ledger's stat cache; a row we have never measured contributes to the
+     * file count and nothing to the bytes, which is honest about not knowing
+     * rather than guessing a size.
+     */
+    blocked() {
+      const byClass: Record<string, { files: number; bytes: number }> = {};
+      let files = 0;
+      let bytes = 0;
+      let unmeasured = 0;
+      for (const row of Object.values(ledger.rows())) {
+        if (row.state !== 'refused' && row.state !== 'stuck') continue;
+        const cls = row.blockedClass ?? (row.state === 'stuck' ? 'unreachable' : 'refused');
+        const size = typeof row.size === 'number' ? row.size : 0;
+        if (!row.size) unmeasured += 1;
+        byClass[cls] ??= { files: 0, bytes: 0 };
+        byClass[cls].files += 1;
+        byClass[cls].bytes += size;
+        files += 1;
+        bytes += size;
+      }
+      return files === 0 ? null : { files, bytes, unmeasured, byClass };
+    },
   };
 }
 

package/apps/studio/sync/index.ts

@@ -2009,6 +2009,30 @@ export function createSyncRuntime(
    * canvas accepted a moment ago is pulled on the next poll, not the one after
    * its row is written.
    */
+  /**
+   * Where the PROJECT says a document lives, under accepted revisions — or
+   * null when the project is not the authority (legacy mode, no bootstrap yet,
+   * a retired entry, or a path it never recorded).
+   *
+   * A pulled canvas used to start at the slug-derived fallback
+   * (`ui/surfaceboards-peer.tsx`) and wait for its document's own path to
+   * correct it after the handshake. A fresh copy that reached the handshake
+   * before that path was readable kept the fallback, and on a case-insensitive
+   * disk the lowercase file then sat beside nothing and matched nothing on its
+   * peers (surface run 2026-09-16, L24 final parity). The manifest already
+   * knows the answer before anything is fetched.
+   */
+  const manifestPathFor = (docName: string, slug?: string): string | null => {
+    if (!acceptedOn()) return null;
+    // By slug when there is one: the listing and the runtime name the same
+    // document in more than one spelling (`ui-x`, `ws/<w>/<b>/ui-x`).
+    const key = slug ?? slugFromDocName(docName);
+    const entry = acceptedLink?.manifest?.docs.find(
+      (d) => !d.retired && (d.doc === docName || slugFromDocName(d.doc) === key)
+    );
+    return typeof entry?.path === 'string' && entry.path.length > 0 ? entry.path : null;
+  };
+
   function withAcceptedDocs(
     listing: Awaited<ReturnType<typeof fetchRemoteListing>>
   ): Awaited<ReturnType<typeof fetchRemoteListing>> {
@@ -2310,7 +2334,7 @@ export function createSyncRuntime(
       path.join,
       path.resolve,
       path.sep,
-      { ...pathOpts, realpath: realpathOfDeepestExisting }
+      { ...pathOpts, realpath: realpathOfDeepestExisting, pathFor: manifestPathFor }
     );
     const pullNote = describeRemoteDiff(remoteDiff);
     if (pullNote) console.log(`[sync] ${pullNote}`);
@@ -3322,7 +3346,9 @@ export function createSyncRuntime(
       if (movedToFromDoc(doc) !== null) return true;
       const resolved = resolvePulledTarget({
         slug: canvas.slug,
-        path: canvasPathFromDoc(doc),
+        // The document's own record first (it is what a move rewrites), the
+        // project's manifest when the document has not carried one yet.
+        path: canvasPathFromDoc(doc) ?? manifestPathFor(docNameFor(canvas.slug), canvas.slug),
         designRoot: ctx.paths.designRoot,
         designRel: ctx.paths.designRel,
         canvasGroups: ctx.cfg.canvasGroups,
@@ -3507,8 +3533,23 @@ export function createSyncRuntime(
         );
       }
       // Cold-start reconcile fires once the provider has hub state.
-      const synced = provider.onceSynced().then(() => {
+      const synced = provider.onceSynced().then(async () => {
         if (deferSetup) {
+          // A DOCUMENT THAT DOES NOT NAME ITS PATH YET, UNDER A MANIFEST THAT
+          // PREDATES IT. A canvas created a moment ago is listed before this
+          // copy's last bootstrap knew it, and its document can answer the
+          // handshake before the accepted write that carries its path — so
+          // neither source names the path and the slug fallback (lowercase)
+          // would be written for good (surface run 2026-09-16: two long-running
+          // copies held `ui/surfaceassetsbusy.tsx`). Ask the project once.
+          if (
+            acceptedOn() &&
+            canvasPathFromDoc(provider.document) === null &&
+            manifestPathFor(docNameFor(canvas.slug), canvas.slug) === null
+          ) {
+            await acceptedLink?.refresh().catch(() => null);
+          }
+          if (stopped) return;
           // Settled either way below — run, or the canvas is released.
           owedSetups.delete(canvas.slug);
           // Abandon before `setup?.()`, so no projection and no agent is ever
@@ -3892,7 +3933,12 @@ export function createSyncRuntime(
         // days. Once the body is on disk the ordinary rules apply to it.
         for (const slug of [...pulledSlugs]) {
           const body = descriptors.get(slug)?.html;
-          if (body && existsSync(body)) pulledSlugs.delete(slug);
+          // …and only once THIS scan has seen it. A scan taken just before the
+          // body landed does not list it; dropping the pin anyway released a
+          // canvas pulled a moment ago and re-adopted it as a local file, whose
+          // cold start then read its own first write as a local edit and held
+          // the canvas ("source sync blocked (local-edit)" on a fresh copy).
+          if (body && existsSync(body) && bySlug.has(slug)) pulledSlugs.delete(slug);
         }
         const { added, removed } = diffCanvasSet(
           [...agents.keys(), ...projections.keys()],
@@ -4043,6 +4089,14 @@ export function createSyncRuntime(
     // not told the document exists.
     const pullRemoteOnce = async (): Promise<void> => {
       if (stopped) return;
+      // Read `token` at call time: a silent renewal swaps it in place.
+      //
+      // The listing FIRST, the manifest after it. A document the storage
+      // listing shows was accepted before it was stored, so a manifest fetched
+      // afterwards names it — and its path. The other order left a window in
+      // which a canvas created between the two requests was pulled with no
+      // path from either source (see `manifestPathFor`).
+      const rawListing = await fetchRemoteListing(linkedHub.url, token);
       // Accepted revisions: the save mode can change under a running peer (the
       // hub fences every socket when it does), and folders are manifest
       // entries — neither is in the document listing.
@@ -4050,8 +4104,7 @@ export function createSyncRuntime(
         await acceptedLink.refresh();
         if (acceptedOn()) applyProjectDirs(acceptedLink.manifest?.dirs ?? []);
       }
-      // Read `token` at call time: a silent renewal swaps it in place.
-      const listing = withAcceptedDocs(await fetchRemoteListing(linkedHub.url, token));
+      const listing = withAcceptedDocs(rawListing);
       // null = unreachable, refused, or a hub without the route. Not an error
       // here any more than it is at boot — sync continues, we ask again later.
       if (stopped || listing === null) return;
@@ -4078,6 +4131,7 @@ export function createSyncRuntime(
           // NEVER the fresh-link relaxation after boot. See `strictPullSlugs`.
           allowUndeclaredGroup: false,
           realpath: realpathOfDeepestExisting,
+          pathFor: manifestPathFor,
         }
       );
       const admitted = targets
@@ -4304,6 +4358,9 @@ export function createSyncRuntime(
         lastSeedProgress = progress;
         reportSeedProgress(progress, result);
       }
+      // Read once: calling it inside the spread evaluated it twice and made
+      // its `null` case the object's type.
+      const blockedMedia = filePlane?.blocked() ?? null;
       statusStore?.updateFiles?.({
         ...fileTotals,
         pushed: filePushed,
@@ -4314,6 +4371,9 @@ export function createSyncRuntime(
               ...(filePlane.dorucekaTotal() > MAX_DORUCEKA_ROWS
                 ? { deliveryTruncated: filePlane.dorucekaTotal() - MAX_DORUCEKA_ROWS }
                 : {}),
+              // T29 — the bytes, not just the count. Omitted entirely when
+              // nothing is blocked, so a healthy project carries no field.
+              ...(blockedMedia ? { blocked: blockedMedia } : {}),
             }
           : {}),
         ...(held.length > 0 ? { held } : {}),
@@ -5498,9 +5558,26 @@ export interface DisposableProviderFactory extends ProviderFactory {
 }
 
 /**
- * The production provider factory — DDR-102: ONE shared
- * `HocuspocusProviderWebsocket` per hub URL, with every canvas's
- * `HocuspocusProvider` attached to it, instead of one socket per canvas.
+ * Most documents one shared socket carries. Hocuspocus 4.3+ closes a socket
+ * with more than 100 documents mid-authentication (`maxPendingDocuments`), so
+ * this stays well under it with room for the refused documents a hub keeps
+ * counting — see the socket choice in `createDefaultProviderFactory`.
+ */
+export const SOCKET_DOCUMENT_LIMIT = 64;
+
+/** `SOCKET_DOCUMENT_LIMIT`, or a smaller positive override from
+ *  `MAUDE_SYNC_SOCKET_DOCUMENTS` — so a harness can put a small project on
+ *  several sockets without having to build a large one first. */
+function socketDocumentLimit(): number {
+  const n = Number.parseInt(process.env.MAUDE_SYNC_SOCKET_DOCUMENTS ?? '', 10);
+  return Number.isFinite(n) && n > 0 && n < SOCKET_DOCUMENT_LIMIT ? n : SOCKET_DOCUMENT_LIMIT;
+}
+
+/**
+ * The production provider factory — DDR-102: shared
+ * `HocuspocusProviderWebsocket`s per hub URL, each carrying up to
+ * `SOCKET_DOCUMENT_LIMIT` canvases' `HocuspocusProvider`s, instead of one
+ * socket per canvas.
  * An 83-canvas project used to open 83 WebSockets at boot — the auth burst
  * tripped the hub's per-token rate limit (100/min) the moment two peers
  * booted together, and the per-socket retry storm then pinned the bucket
@@ -5518,10 +5595,13 @@ export function createDefaultProviderFactory(
 ): DisposableProviderFactory {
   // biome-ignore lint/suspicious/noExplicitAny: provider runtime typed at call site.
   let mod: any = null;
-  // wsUrl → shared HocuspocusProviderWebsocket (one per hub URL; in practice a
-  // runtime only ever talks to one hub, but the map keeps the contract exact).
+  // wsUrl → the shared sockets to that hub, each carrying at most
+  // SOCKET_DOCUMENT_LIMIT documents (in practice a runtime only ever talks to
+  // one hub, but the map keeps the contract exact).
   // biome-ignore lint/suspicious/noExplicitAny: provider runtime typed at call site.
-  const sockets = new Map<string, any>();
+  const sockets = new Map<string, Array<{ socket: any; names: Set<string> }>>();
+  const allSockets = () => [...sockets.values()].flat().map((s) => s.socket);
+  const perSocket = socketDocumentLimit();
 
   const factory = async (args: {
     url: string;
@@ -5542,8 +5622,26 @@ export function createDefaultProviderFactory(
     // the scheme. The provider also accepts http(s):// and upgrades internally
     // in newer versions, but ws:// is explicit + portable.
     const wsUrl = toWsUrl(args.url);
-    let socket = sockets.get(wsUrl);
-    if (!socket) {
+    // A DOCUMENT KEEPS ITS SOCKET; A FULL SOCKET TAKES NO NEW ONES.
+    //
+    // Hocuspocus (4.3+) closes a socket that has more than 100 documents
+    // mid-authentication, and every document on a socket authenticates at
+    // once — when it opens, and again on every reconnect. One socket for a
+    // 123-canvas project was therefore cut off, reopened and cut off again
+    // for as long as the copy ran: it never synced, and each lap spent the
+    // designer's whole per-label allowance (2026-09-16 certification run,
+    // 4 618 closes). Newer hubs raise the limit; deployed ones keep it.
+    //
+    // Names are never taken back off a socket. The hub keeps a pending slot
+    // for a refused document that sends anything after its refusal — a
+    // detach's Close included — until the socket closes, so what a socket has
+    // EVER carried is what counts against the limit, not what it carries now.
+    const shards = sockets.get(wsUrl) ?? [];
+    sockets.set(wsUrl, shards);
+    let shard =
+      shards.find((s) => s.names.has(args.documentName)) ??
+      shards.find((s) => s.names.size < perSocket);
+    if (!shard) {
       // CONFIGURED, not defaulted (issue #118). The socket used to be built
       // from the URL alone, which inherited `timeout: 0` — no per-attempt
       // deadline — and that is the property that let one parked connection
@@ -5564,13 +5662,28 @@ export function createDefaultProviderFactory(
       //
       // Liveness is the runtime's job instead — see the stall watchdog in
       // `start()`, which is a layer we control and can make safe.
-      socket = new mod.HocuspocusProviderWebsocket({
-        url: wsUrl,
-        messageReconnectTimeout: 30_000,
-        maxDelay: 30_000,
-      });
-      sockets.set(wsUrl, socket);
+      shard = {
+        socket: new mod.HocuspocusProviderWebsocket({
+          url: wsUrl,
+          messageReconnectTimeout: 30_000,
+          maxDelay: 30_000,
+        }),
+        names: new Set<string>(),
+      };
+      shards.push(shard);
+      if (process.env.MAUDE_SYNC_DEBUG === '1') {
+        const tag = `[sync/socket ${shards.length}]`;
+        const own = shard;
+        own.socket.on('open', () => console.log(`${tag} open · ${own.names.size} document(s)`));
+        own.socket.on('close', (e: { event?: { code?: number; reason?: string } }) =>
+          console.log(
+            `${tag} close ${e?.event?.code ?? '?'} ${e?.event?.reason ?? ''} · ${own.names.size} document(s)`
+          )
+        );
+      }
     }
+    shard.names.add(args.documentName);
+    const socket = shard.socket;
     // Phase 9.2 (DDR-064) — attach to the shared room doc when the runtime
     // injected one; otherwise own a fresh doc (the legacy two-doc path).
     const document = args.document ?? new Y.Doc();
@@ -5717,7 +5830,7 @@ export function createDefaultProviderFactory(
 
   return Object.assign(factory, {
     dispose(): void {
-      for (const socket of sockets.values()) {
+      for (const socket of allSockets()) {
         try {
           socket.destroy();
         } catch {
@@ -5727,7 +5840,7 @@ export function createDefaultProviderFactory(
       sockets.clear();
     },
     reconnect(): void {
-      for (const socket of sockets.values()) {
+      for (const socket of allSockets()) {
         try {
           // NOT `disconnect()` + `connect()` — that pair WEDGES THE SOCKET SHUT,
           // deterministically, in exactly the state this is called from

package/apps/studio/sync/status.ts

@@ -159,6 +159,23 @@ export interface FilePlaneStatus {
    * added to cure, one lane over.
    */
   failed?: number;
+  /**
+   * HOW MUCH is not here — plan T29, the unit `failed` gets wrong.
+   *
+   * A count cannot answer the operator's question: nine blocked CSS sidecars
+   * is nothing and nine blocked videos is the project. `bytes` is what tells
+   * those apart. `byClass` is bounded by the ledger's fixed blocked-class set
+   * and never keyed by path; `unmeasured` says how many of the files have no
+   * size on record, so an under-count is visible rather than silent.
+   *
+   * Absent — not zero — when nothing is blocked.
+   */
+  blocked?: {
+    files: number;
+    bytes: number;
+    unmeasured: number;
+    byClass: Record<string, { files: number; bytes: number }>;
+  };
   /**
    * The hub asked us to slow down and the WHOLE LANE is paused until `until`.
    *

package/apps/studio/whats-new.json

@@ -1,6 +1,24 @@
 {
   "$schema": "./whats-new.schema.json",
   "entries": [
+    {
+      "id": "steadier-team-projects",
+      "version": "1.4.2",
+      "date": "2026-09-16",
+      "kind": "fix",
+      "title": "Steadier team projects",
+      "summary": "Large projects (over a hundred canvases) stay connected, the desktop app no longer freezes after switching canvases back and forth, and an open canvas always shows the newest change — including photo edits — instead of sometimes lagging one behind.",
+      "surface": "design-ui"
+    },
+    {
+      "id": "history-on-a-team-project",
+      "version": "1.4.1",
+      "date": "2026-09-16",
+      "kind": "fix",
+      "title": "Your project history, from the status bar",
+      "summary": "On a project you were invited to, the status bar now opens the project history — every change with who made it, and Undo on the ones that are yours. It was only reachable from the View menu before.",
+      "surface": "design-ui"
+    },
     {
       "id": "design-system-on-every-desktop",
       "version": "1.4.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1agh/maude",
-  "version": "1.4.0",
+  "version": "1.4.2",
   "description": "Marketplace of Claude Code plugins by Michal Dovrtěl: `design` (canvas-first design iteration) + `flow` (generic agentic workflow loop with .ai second brain). Ships the `maude` CLI (with `mdcc` legacy alias) to scaffold workspace, run the design dev server, and manage configs.",
   "type": "module",
   "engines": {
@@ -29,7 +29,8 @@
     "test:e2e:desktop:git": "pnpm --filter @maude/desktop-e2e e2e:git",
     "build": "pnpm -r --if-present --filter '!@maude/desktop' '!@maude/desktop-e2e' run build",
     "build:binary": "bun run apps/studio/build.ts --release",
-    "test": "node --test --test-reporter=spec cli/**/*.test.mjs && pnpm --filter @maude/hub test",
+    "test": "node --test --test-reporter=spec cli/**/*.test.mjs && pnpm --filter @maude/hub test && pnpm run test:harness",
+    "test:harness": "node --test $(find scripts/dev/sync-e2e -maxdepth 1 -name 'surface-*.test.mjs' ! -name 'surface-source-audit.test.mjs') && bun test scripts/dev/sync-e2e/surface-source-audit.test.mjs",
     "test:dev-server": "cd apps/studio && bun test --timeout 20000",
     "lint": "biome check .",
     "format": "biome format --write .",
@@ -53,16 +54,17 @@
     "test:e2e:desktop:parity": "pnpm --filter @maude/desktop-e2e e2e:parity",
     "test:e2e:desktop:sidecar-respawn": "pnpm --filter @maude/desktop-e2e e2e:sidecar-respawn",
     "test:e2e:desktop:team-project": "pnpm --filter @maude/desktop-e2e e2e:team-project",
+    "test:e2e:desktop:s20": "pnpm --filter @maude/desktop-e2e e2e:s20",
     "test:e2e:desktop:parity:cloud": "pnpm --filter @maude/desktop-e2e e2e:parity:cloud"
   },
   "optionalDependencies": {
-    "@1agh/maude-darwin-arm64": "1.4.0",
-    "@1agh/maude-darwin-x64": "1.4.0",
-    "@1agh/maude-linux-arm64": "1.4.0",
-    "@1agh/maude-linux-arm64-musl": "1.4.0",
-    "@1agh/maude-linux-x64": "1.4.0",
-    "@1agh/maude-linux-x64-musl": "1.4.0",
-    "@1agh/maude-win32-x64": "1.4.0"
+    "@1agh/maude-darwin-arm64": "1.4.2",
+    "@1agh/maude-darwin-x64": "1.4.2",
+    "@1agh/maude-linux-arm64": "1.4.2",
+    "@1agh/maude-linux-arm64-musl": "1.4.2",
+    "@1agh/maude-linux-x64": "1.4.2",
+    "@1agh/maude-linux-x64-musl": "1.4.2",
+    "@1agh/maude-win32-x64": "1.4.2"
   },
   "files": [
     "cli",

package/plugins/design/templates/_shell.html

@@ -272,12 +272,24 @@
       // the runtime is mounted — agent edits, manual edits, AND cross-peer synced
       // writes — so presence + in-canvas state survive. Falls back to the plain
       // location.reload() below only when no runtime is present.
+      //
+      // THE NEWEST REQUEST WINS, NOT THE LAST RESPONSE. Two changes in quick
+      // succession start two imports, and nothing makes them finish in the
+      // order they started — the first can be the slower build. Remounting
+      // whichever resolved last put the OLDER body on screen over the newer
+      // one while the file on disk was right (surface row L21, a peer's view
+      // stuck one edit behind). Only the latest request may remount or hold.
+      // soft-reload:begin
+      let softReloadSeq = 0;
+      const loadCanvasModule = (url) => import(url);
       function softReload(version) {
         if (!canvasUrl) { location.reload(); return; }
         const rt = window.__maudeCanvasRuntime;
         if (!rt || !rt.remount) { location.reload(); return; }
-        import(canvasUrl + (canvasUrl.includes('?') ? '&' : '?') + 'v=' + (version || Date.now()))
+        const seq = ++softReloadSeq;
+        loadCanvasModule(canvasUrl + (canvasUrl.includes('?') ? '&' : '?') + 'v=' + (version || Date.now()))
           .then((mod) => {
+            if (seq !== softReloadSeq) return;
             if (mod && typeof mod.default === 'function') {
               rt.remount(mod.default);
               if (rt.setHolding) rt.setHolding(false);
@@ -287,16 +299,19 @@
             }
           })
           .catch((err) => {
+            if (seq !== softReloadSeq) return;
             // Build/transpile/import error → keep the current render, surface a
             // non-destructive "holding" toast. Next good build swaps it in.
             // Same M8 diagnosis as the mount path: the 422 body names the
             // culprit, the TypeError never does.
             diagnoseImportFailure(canvasUrl, err).then((msg) => {
+              if (seq !== softReloadSeq) return;
               if (rt.setHolding) rt.setHolding(true, msg || 'build error');
             });
             console.warn('[canvas-shell] soft-reload held last good (build error):', err);
           });
       }
+      // soft-reload:end
       // Phase 6.5 — exporters pass ?hide-chrome=1 to flip the export-mode
       // stylesheet from `media="not all"` to `media="all"`, hiding the
       // dev-server overlays during capture. See `<style id="canvas-hide-chrome">`.
@@ -634,6 +649,20 @@
       }
       connectHmr();
 
+      // NO TOP-LEVEL AWAIT IN THIS MODULE.
+      //
+      // The boot below used to `await` at the top level, which made this the
+      // one asynchronously-evaluated module on the page — suspended, with its
+      // own dynamic `import()`s in flight, for as long as the canvas took to
+      // build. On the desktop (WKWebView) switching canvases away and straight
+      // back, which tears the half-loaded frame down in exactly that state,
+      // eventually wedged the whole web content process inside JavaScriptCore's
+      // module loader: 100 % CPU in `moduleLoaderEvaluate` microtasks, no script
+      // ever running again, every canvas and the shell frozen (surface row L23,
+      // 2026-09-16 — reproduced in a full run and in a ten-minute soak). An
+      // async function that nothing awaits gives the same boot with a module
+      // that finishes evaluating at once, the path every engine exercises most.
+      const boot = async () => {
       if (!canvasRel) {
         showError('Missing ?canvas= query parameter. Add ?canvas=ui/<slug>.tsx.');
       } else {
@@ -711,6 +740,8 @@
           diagnoseImportFailure(canvasUrl, err).then(showError);
         }
       }
+      };
+      boot().catch((err) => showError(String((err && err.stack) || err)));
     </script>
   </body>
 </html>