@1agh/maude 1.4.4 → 1.4.5

package/apps/studio/sync/index.ts

@@ -119,6 +119,14 @@ export interface SyncProvider {
    * Optional: a provider without it is treated as writable.
    */
   isWritable?(): boolean;
+  /**
+   * The hub's own word on this connection's write right, carried by a save-mode
+   * notice (`maude.mode` with `writable`). It outranks the scope the handshake
+   * returned: a connection admitted read-only while the project took proposals
+   * is writable again the moment the project returns to legacy — the hub fences
+   * per message, not per handshake — and nothing re-authenticates it.
+   */
+  noteWritable?(writable: boolean): void;
   /** The hub authenticated this connection (again) — scope may have changed. */
   onAuthenticated?(cb: (scope: string) => void): () => void;
   /** Out-of-band messages from the hub on this document's socket. */
@@ -915,6 +923,8 @@ export function createSyncRuntime(
   // change is a proposal through the durable outbox, and the documents change
   // when the project publishes the accepted revision. Shared-doc only: the
   // two-doc agent path has no proposal lane and stays legacy.
+  /** Resolves once a previous run's outbox is drained: doc → own accepted html. */
+  let outboxDrained: Promise<Map<string, string>> = Promise.resolve(new Map());
   const acceptedLink: AcceptedLink | null = useSharedDoc
     ? createAcceptedLink({
         hubUrl: linkedHub.url,
@@ -925,7 +935,16 @@ export function createSyncRuntime(
         retryMs: opts.transactionRetryMs,
         onStats: (stats) => statusStore?.updateAccepted?.(stats),
         onStage: (summary) => statusStore?.updateAiAction?.(summary),
-        onBootstrap: (b) => noteProjectConfig(b.projectConfig),
+        onBootstrap: (b) => {
+          noteProjectConfig(b.projectConfig);
+          // F3 S17 — a save made as the socket died is held (the connection
+          // was not writable). After the reconnect the handshake re-admits the
+          // socket read-only BEFORE this peer learns the project now takes
+          // proposals, so its retry found the write still blocked and nothing
+          // retried again: the save stayed on disk, and the status said
+          // synced, until a restart. Knowing the mode, hand it back now.
+          if (b.mode === 'transactions') for (const p of projections.values()) p.retryDeferred();
+        },
       })
     : null;
   /**
@@ -2038,16 +2057,15 @@ export function createSyncRuntime(
   ): Awaited<ReturnType<typeof fetchRemoteListing>> {
     const manifest = acceptedOn() ? acceptedLink?.manifest : null;
     if (!manifest) return listing;
-    // A document the project RETIRED (moved away) is not a canvas to fetch,
-    // even while its storage row lingers — its successor is in the manifest.
-    const retired = new Set(manifest.docs.filter((d) => d.retired).map((d) => d.doc));
-    const documents = (listing?.documents ?? []).filter((d) => !retired.has(d.name));
-    const names = new Set(documents.map((d) => d.name));
-    for (const d of manifest.docs) {
-      if (d.retired || names.has(d.doc)) continue;
-      documents.push({ name: d.doc, bytes: 1 });
-      names.add(d.doc);
-    }
+    // An open Yjs room is not necessarily an accepted canvas. Its author can
+    // connect before doc.create commits; pulling that empty room would lock
+    // the receiver onto a lossy slug-derived path before the real path arrives.
+    // The accepted manifest alone names live canvases, including successors
+    // of retired documents whose transport rows may still linger.
+    const bytesByName = new Map((listing?.documents ?? []).map((d) => [d.name, d.bytes]));
+    const documents = manifest.docs
+      .filter((d) => !d.retired)
+      .map((d) => ({ name: d.doc, bytes: bytesByName.get(d.doc) ?? 1 }));
     return { ...(listing ?? { tombstones: [] }), documents, tombstones: listing?.tombstones ?? [] };
   }
 
@@ -2248,10 +2266,29 @@ export function createSyncRuntime(
         );
         // Work a previous run left unanswered goes first, in creation order —
         // before any cold start can propose something built on top of it.
-        void acceptedLink.client.drainOutbox().then((results) => {
-          if (results.length)
-            console.log(`[sync/tx] resent ${results.length} unanswered change(s).`);
-        });
+        // What each canvas's disk was last saved as, when that save was one of
+        // these: the base its cold start judges the disk against.
+        const own = new Map<string, string>();
+        outboxDrained = acceptedLink.client
+          .drainOutbox((result, operations) => {
+            for (const o of operations) {
+              const html =
+                o.op === 'lane.replace' && o.lane === 'html'
+                  ? o.content
+                  : o.op === 'doc.create'
+                    ? (o.lanes as Record<string, unknown> | undefined)?.html
+                    : undefined;
+              if (typeof o.doc !== 'string' || typeof html !== 'string') continue;
+              if (result.status === 'accepted') own.set(o.doc, html);
+              else own.delete(o.doc);
+            }
+          })
+          .then((results) => {
+            if (results.length)
+              console.log(`[sync/tx] resent ${results.length} unanswered change(s).`);
+            return own;
+          })
+          .catch(() => own);
         applyProjectDirs(acceptedLink.manifest?.dirs ?? []);
         proposeLocalFolders();
       }
@@ -2585,6 +2622,21 @@ export function createSyncRuntime(
       if (acceptedOn() && p?.op) projectionForRel(p.rel)?.noteSourceOp(p.op);
     });
     activityUnsubs.push(unsubSourceOp);
+    // Only the trusted API emits this after its write has finished. External
+    // fs events retain the quiet window; both paths use the same projection,
+    // proposal, validation and echo/deduplication rules.
+    const unsubSourceWritten = ctx.bus.on('source-written', (payload: unknown) => {
+      const p = payload as { rel?: unknown; content?: unknown } | null;
+      if (!acceptedOn() || typeof p?.content !== 'string') return;
+      const proj = projectionForRel(p.rel);
+      if (!proj) return;
+      proj.applyFromFs({
+        path: path.join(ctx.paths.designRoot, p.rel as string),
+        bytes: new TextEncoder().encode(p.content),
+        hash: hashBytes(p.content),
+      });
+    });
+    activityUnsubs.push(unsubSourceWritten);
     const unsubUnsuppress = ctx.bus.on('activity:unsuppress', (rel: unknown) => {
       projectionForRel(rel)?.cancelLocalWrite();
     });
@@ -3058,6 +3110,10 @@ export function createSyncRuntime(
           inProject = acceptedLink.manifest?.docs.some((d) => d.doc === docName && !d.retired);
         }
         const rel = path.relative(ctx.paths.designRoot, canvas.html).split(path.sep).join('/');
+        // A save a previous run left unanswered is answered first: a disk
+        // edited after it was edited ON it (F3 S14 on the cloud cell — judged
+        // against the older base, the save conflicted with itself).
+        const ownAccepted = (await outboxDrained).get(docName) ?? null;
         await acceptedColdStart({
           slug: canvas.slug,
           doc: provider.document,
@@ -3067,6 +3123,8 @@ export function createSyncRuntime(
           projection,
           historyDir: path.join(ctx.paths.historyDir, canvas.slug),
           journal: journal ?? undefined,
+          ownAccepted,
+          wasAccepted: (content) => acceptedLink.client.holdsValue(content),
           createDoc: (lanes) => acceptedLink.createDoc(canvas.slug, rel, lanes),
         });
         projection.reconcile();
@@ -3733,6 +3791,8 @@ export function createSyncRuntime(
                   }
                   if (msg?.type !== 'maude.mode') return;
                   if (msg.mode === 'transactions' || msg.mode === 'legacy') {
+                    const writable = (msg as { writable?: unknown }).writable;
+                    if (typeof writable === 'boolean') provider.noteWritable?.(writable);
                     acceptedLink.noteMode(msg.mode);
                     void refreshAcceptedMode();
                   }
@@ -5740,11 +5800,17 @@ export function createDefaultProviderFactory(
     socket.on('status', resetSyncedOnDrop);
 
     let authedThisConnection = false;
+    /** A save-mode notice's verdict on THIS connection; a new handshake supersedes it. */
+    let modeWritable: boolean | null = null;
     provider.on('authenticated', () => {
       authedThisConnection = true;
+      modeWritable = null;
     });
     const forgetAuthOnDrop = (evt: { status?: string }) => {
-      if (evt?.status !== 'connected') authedThisConnection = false;
+      if (evt?.status !== 'connected') {
+        authedThisConnection = false;
+        modeWritable = null;
+      }
     };
     socket.on('status', forgetAuthOnDrop);
     return {
@@ -5757,7 +5823,11 @@ export function createDefaultProviderFactory(
       // over from before a drop says nothing about the hub now: a project
       // switched to accepted revisions while this peer was away re-admits it
       // read-only, and anything written in between would be dropped there.
-      isWritable: () => authedThisConnection && provider.authorizedScope === 'read-write',
+      isWritable: () =>
+        authedThisConnection && (modeWritable ?? provider.authorizedScope === 'read-write'),
+      noteWritable(writable: boolean) {
+        if (authedThisConnection) modeWritable = writable;
+      },
       onAuthenticated(cb: (scope: string) => void): () => void {
         const handler = (evt: { scope?: string }) => cb(String(evt?.scope ?? ''));
         provider.on('authenticated', handler);

package/apps/studio/sync/journal-client.ts

@@ -17,6 +17,8 @@
 // it as "no changes" is exactly the shape that lets a stale peer believe it is
 // current, which is the failure DDR-214's ordering amendment exists to prevent.
 
+import { isProjectFileShape } from './file-membership.ts';
+
 /** How long to wait for a journal page. Same figure as the manifest fetch. */
 const JOURNAL_TIMEOUT_MS = 6000;
 
@@ -58,8 +60,12 @@ export interface JournalPage {
   overflowed?: true;
 }
 
-/** A designRoot-relative path shape a peer will turn into a real file. */
-const ENTRY_PATH_RE = /^[A-Za-z0-9][A-Za-z0-9._/-]{0,255}$/;
+// A designRoot-relative path a peer will turn into a real file: the SAME shape
+// rule the hub's file door admits (`isProjectFileShape`). A private, narrower
+// regex here dropped every journalled path with a space in it — `ui/Studio
+// Docs.registry.json` was accepted from its author, journalled, and then
+// silently discarded by every other peer, with no ledger row and no refusal
+// shown (F3 S14, 2026-09-23).
 
 function parseEntry(raw: unknown): JournalEntry | null {
   if (!raw || typeof raw !== 'object') return null;
@@ -67,7 +73,7 @@ function parseEntry(raw: unknown): JournalEntry | null {
   const seq = e.seq;
   const p = e.path;
   if (typeof seq !== 'number' || !Number.isInteger(seq) || seq <= 0) return null;
-  if (typeof p !== 'string' || !ENTRY_PATH_RE.test(p) || p.split('/').includes('..')) return null;
+  if (typeof p !== 'string' || !isProjectFileShape(p)) return null;
   const sha = typeof e.sha256 === 'string' && /^[0-9a-f]{64}$/.test(e.sha256) ? e.sha256 : null;
   return {
     seq,

package/apps/studio/sync/projection.ts

@@ -54,7 +54,12 @@ import type { RevisionBarrier } from './revision-barrier.ts';
 import { repairSeedDuplication } from './seed-repair.ts';
 import { mergeSource } from './source-merge.ts';
 import type { SourceOp } from './source-ops.ts';
-import { saveRecoveryBody } from './source-recovery.ts';
+import {
+  preserveRecoveryCandidate,
+  readRecoveryCandidate,
+  resolveRecoveryCandidate,
+  saveRecoveryBody,
+} from './source-recovery.ts';
 import { sourceError } from './source-validation.ts';
 import { laneHash } from './transaction-client.ts';
 
@@ -222,6 +227,13 @@ export interface DocProjection {
    * write stays blocked with a visible conflict and a later save can merge.
    */
   adoptBase(body: string): void;
+  /**
+   * Accepted mode, cold start: `value` is this disk's own html proposal that a
+   * previous run left in the outbox and the drain just had accepted. It is
+   * what the disk was saved as — the base of whatever it holds next — even
+   * while this replica still shows the value before it.
+   */
+  adoptOwnAccepted(value: string): void;
   /**
    * Accepted-revisions mode: propose one lane value that did not come through
    * the watcher (a comment/annotation API write). Resolves with the outcome;
@@ -240,8 +252,13 @@ export interface DocProjection {
    * recovery slots. Returns false when nothing is held.
    */
   takeAccepted(): boolean;
-  /** T28 — the two sides of a held source conflict (null when none). */
-  conflictSides(): { mine: string | null; theirs: string } | null;
+  /** T28 — current sides plus the first candidate and proven base (null when unknown). */
+  conflictSides(): {
+    mine: string | null;
+    theirs: string;
+    original: string | null;
+    base: string | null;
+  } | null;
   /** Re-deliver file changes held while the document was not writable. */
   retryDeferred(): void;
   /**
@@ -290,6 +307,22 @@ export function createDocProjection(opts: DocProjectionOptions): DocProjection {
   let validationCache: { body: string; error: string | null } | null = null;
 
   function recovered(): void {
+    // An older accepted proposal is not resolution of a later pending/held one.
+    if (pending.has('html') || held.has('html')) return;
+    try {
+      if (opts.historyDir) resolveRecoveryCandidate(opts.historyDir, paths.html);
+    } catch {
+      // The accepted action is real even if updating our local recovery record
+      // fails. Keep the original pinned and the storage problem visible.
+      rejectedKey ??= 'recovery-failed';
+      opts.onConflict?.({
+        slug,
+        kind: 'body-rejected',
+        reason: 'history-failed',
+        snapshotFailed: true,
+      });
+      return;
+    }
     if (rejectedKey !== null) opts.onRecovered?.();
     rejectedKey = null;
   }
@@ -325,13 +358,16 @@ export function createDocProjection(opts: DocProjectionOptions): DocProjection {
     reason: BodyRejection['reason'],
     local: string | null,
     incoming: string,
-    file = paths.html
+    file = paths.html,
+    base: string | null = lastHtml
   ): void {
     const key = `${file}:${reason}:${hashBytes(local ?? '')}:${hashBytes(incoming)}`;
     if (key === rejectedKey) return;
     rejectedKey = key;
     let snapshotFailed = false;
     try {
+      if (file === paths.html && opts.historyDir)
+        preserveRecoveryCandidate(opts.historyDir, file, local, base);
       if (file === paths.html) preserveLocal(local);
       if (opts.historyDir) {
         if (local !== null) saveRecoveryBody(opts.historyDir, file, 'local', local);
@@ -461,11 +497,29 @@ export function createDocProjection(opts: DocProjectionOptions): DocProjection {
         next = repeated.unit;
       }
     }
+    if (acceptedOwn !== null && next !== lastHtml) {
+      // The replica moved. When it moved to exactly our accepted value and the
+      // disk already holds a newer save, that save is ours on top of it: agree
+      // on the accepted value and leave the file for the watcher to propose.
+      const own = next === acceptedOwn;
+      acceptedOwn = null;
+      if (own) {
+        const local = readLocal(paths.html);
+        if (local !== null && local !== next && local !== observedBody) {
+          lastHtml = next;
+          rememberBase(next);
+          return true;
+        }
+      }
+    }
     if (next === lastHtml) return true;
     // Don't clobber a non-empty local body with an empty doc (cold-start before
     // the doc is seeded — the safe-reconcile invariant; full adopt is Phase E).
     if (next === '') {
-      lastHtml = next;
+      // Accepted mode: an empty replica is one the project's publication has
+      // not reached yet, never a value this disk agreed on — a base already
+      // known (a canvas this disk just added, adopted on acceptance) stays.
+      if (lastHtml === null || !acceptedOn()) lastHtml = next;
       return true;
     }
     if (!withinCap(paths.html, next, MAX_HTML_BYTES)) return false;
@@ -675,14 +729,29 @@ export function createDocProjection(opts: DocProjectionOptions): DocProjection {
     return lane === 'comments' ? paths.comments : paths.annotations;
   }
 
+  /**
+   * Our own html proposal the hub accepted, whose publication has not reached
+   * this replica yet. Until it does, it — not the older replica value — is
+   * what the next save on this disk was made on top of (F3 S14, 2026-09-23:
+   * a save in that window was proposed on the value before the first save and
+   * refused as a base conflict, and the echo itself read as "a local edit
+   * overlaps an incoming change").
+   */
+  let acceptedOwn: string | null = null;
+
   /** The value disk and the accepted replica last agreed on for `lane`. */
   function agreedValue(lane: ProposalLane): string {
-    if (lane === 'html') return lastHtml ?? htmlFromDoc(doc);
+    if (lane === 'html') return acceptedOwn ?? lastHtml ?? htmlFromDoc(doc);
     if (lane === 'css') return lastCss ?? cssFromDoc(doc) ?? '';
     return readLaneFromDoc(doc, lane);
   }
 
-  function onRejected(lane: ProposalLane, local: string, outcome: ProposalOutcome): void {
+  function onRejected(
+    lane: ProposalLane,
+    local: string,
+    outcome: ProposalOutcome,
+    base: string
+  ): void {
     held.add(lane);
     // The candidate stays on disk: the projection's local-edit guard protects
     // it (html), `held` blocks the lane writer (css/meta), and the recovery
@@ -704,7 +773,8 @@ export function createDocProjection(opts: DocProjectionOptions): DocProjection {
       REJECTION_REASON[outcome.code ?? ''] ?? 'local-edit',
       local,
       readLaneFromDoc(doc, lane),
-      pathOfLane(lane)
+      pathOfLane(lane),
+      base
     );
   }
 
@@ -772,6 +842,15 @@ export function createDocProjection(opts: DocProjectionOptions): DocProjection {
       }
       if (outcome.status === 'accepted') {
         if (!pending.has(lane)) held.delete(lane);
+        if (lane === 'html' && !pending.has(lane)) {
+          // Our accepted value is the base of whatever this disk holds next —
+          // whichever arrives first, the answer or the publication.
+          // Persisted too: a cold start judges the disk against this base.
+          if (readLaneFromDoc(doc, 'html') === value) {
+            lastHtml = value;
+            rememberBase(value);
+          } else acceptedOwn = value;
+        }
         if (lane === 'html') recovered();
         if (outcome.actionId) {
           try {
@@ -793,7 +872,7 @@ export function createDocProjection(opts: DocProjectionOptions): DocProjection {
           lastMeta = null;
         }
       } else {
-        onRejected(lane, local, outcome);
+        onRejected(lane, local, outcome, baseContent);
       }
       scheduleFlush();
       return outcome;
@@ -864,6 +943,14 @@ export function createDocProjection(opts: DocProjectionOptions): DocProjection {
     // 2026-09-15, L09 delete). Every edit to these lanes arrives through the
     // API with the base it was made from (`proposeLane`).
     if (lane === 'comments' || lane === 'annotations') return false;
+    // A STALE EVENT PROPOSES NOTHING. The reader took these bytes before a
+    // later write reached the file — typically this projection materializing a
+    // newer accepted value — and delivered them after. Proposing them would
+    // put an older body back over a teammate's accepted edit (F3 S15, cloud
+    // cell, 2026-09-24: v13 over v14). What the disk holds now arrives with its
+    // own event.
+    const onDisk = readLocal(evt.path);
+    if (onDisk !== null && onDisk !== str) return false;
     if (lane === 'html') {
       if (str === lastHtml && !held.has('html')) return false; // a redelivered projection
       if (!withinCap(paths.html, str, MAX_HTML_BYTES)) return false;
@@ -1127,6 +1214,17 @@ export function createDocProjection(opts: DocProjectionOptions): DocProjection {
       lastHtml = body;
       observedBody = body;
     },
+    adoptOwnAccepted(value: string) {
+      // Exactly what an answer in this process does (see `submit`): the
+      // replica either holds it already, or its publication is still coming.
+      const replica = htmlFromDoc(doc);
+      if (replica === value) lastHtml = value;
+      else {
+        lastHtml = replica;
+        acceptedOwn = value;
+      }
+      rememberBase(value);
+    },
     hold(lane, base, local) {
       held.add(lane);
       if (lane === 'html') {
@@ -1146,12 +1244,17 @@ export function createDocProjection(opts: DocProjectionOptions): DocProjection {
       lastHtml = null;
       dirty = true;
       void flush();
-      recovered();
       return true;
     },
     conflictSides() {
       if (!held.has('html') && rejectedKey === null) return null;
-      return { mine: readLocal(paths.html), theirs: htmlFromDoc(doc) };
+      const candidate = opts.historyDir ? readRecoveryCandidate(opts.historyDir, paths.html) : null;
+      return {
+        mine: readLocal(paths.html),
+        theirs: htmlFromDoc(doc),
+        original: candidate?.original ?? null,
+        base: candidate?.base ?? null,
+      };
     },
     proposeLane(lane, value, o) {
       if (!acceptedOn() || stopped) return null;

package/apps/studio/sync/remote-docs.ts

@@ -341,8 +341,8 @@ export function pullTargets(
  * readable. Both hops go through the same function, so "where does this canvas
  * go" cannot have two answers.
  *
- * Returns null when even the containment check refuses — the only case in which
- * a canvas is dropped rather than degraded.
+ * Returns null when a present path is refused or containment fails. Only a
+ * document with no path may use the legacy slug-derived fallback.
  */
 export function resolvePulledTarget(args: {
   slug: string;
@@ -376,6 +376,7 @@ export function resolvePulledTarget(args: {
     allowUndeclaredGroup: args.allowUndeclaredGroup,
     onRefused: args.onRefused,
   });
+  if (args.path !== undefined && args.path !== null && !fromPath) return null;
   const bodyAbs = args.join(args.designRoot, rel);
   // Belt and braces at a create. The validator already refuses everything that
   // could escape lexically; this catches whatever a platform's own `resolve`

package/apps/studio/sync/source-recovery.ts

@@ -12,6 +12,73 @@ import { sourceError } from './source-validation.ts';
  */
 export type RecoverySlot = 'last-valid' | 'local' | 'incoming' | 'base';
 
+/** The first rejected draft and its proven base, not the mutable latest draft. */
+export interface RecoveryCandidate {
+  version: 1;
+  original: string | null;
+  base: string | null;
+  resolved: boolean;
+}
+
+function candidatePath(historyDir: string, file: string): string {
+  return path.join(historyDir, 'sync-recovery', `candidate${path.extname(file)}.json`);
+}
+
+function boundedBody(body: unknown): body is string | null {
+  return (
+    body === null || (typeof body === 'string' && Buffer.byteLength(body, 'utf8') <= MAX_HTML_BYTES)
+  );
+}
+
+/** Corrupt/inaccessible records fail closed: never replace an unreadable draft. */
+export function readRecoveryCandidate(historyDir: string, file: string): RecoveryCandidate | null {
+  const target = candidatePath(historyDir, file);
+  let size: number;
+  try {
+    size = statSync(target).size;
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === 'ENOENT') return null;
+    throw error;
+  }
+  // Two byte-capped strings, each potentially JSON-escaped as six bytes/char.
+  if (size > 12 * MAX_HTML_BYTES + 256) throw new Error('Recovery candidate exceeds size limit');
+  const value: unknown = JSON.parse(readFileSync(target, 'utf8'));
+  if (!value || typeof value !== 'object') throw new Error('Invalid recovery candidate');
+  const record = value as Record<string, unknown>;
+  if (
+    record.version !== 1 ||
+    typeof record.resolved !== 'boolean' ||
+    !boundedBody(record.original) ||
+    !boundedBody(record.base)
+  )
+    throw new Error('Invalid recovery candidate');
+  return { version: 1, original: record.original, base: record.base, resolved: record.resolved };
+}
+
+/** One bounded, atomic record per source file; retries/restarts cannot evict it. */
+export function preserveRecoveryCandidate(
+  historyDir: string,
+  file: string,
+  original: string | null,
+  base: string | null
+): void {
+  if (!boundedBody(original) || !boundedBody(base))
+    throw new Error('Recovery source exceeds size limit');
+  const previous = readRecoveryCandidate(historyDir, file);
+  if (previous && !previous.resolved) return;
+  atomicWrite(
+    candidatePath(historyDir, file),
+    JSON.stringify({ version: 1, original, base, resolved: false })
+  );
+}
+
+/** Retain the bytes after resolution, allowing replacement only by a new episode. */
+export function resolveRecoveryCandidate(historyDir: string, file: string): void {
+  const previous = readRecoveryCandidate(historyDir, file);
+  if (!previous || previous.resolved) return;
+  atomicWrite(candidatePath(historyDir, file), JSON.stringify({ ...previous, resolved: true }));
+}
+
 export function saveRecoveryBody(
   historyDir: string,
   file: string,

package/apps/studio/sync/status.ts

@@ -447,9 +447,17 @@ export function createSyncStatusStore(opts: SyncStatusStoreOptions): SyncStatusS
     clearSourceConflict(slug) {
       const id = `source-conflict-${slug}`;
       const index = notices.findIndex((n) => n.id === id);
-      if (index < 0) return;
-      notices.splice(index, 1);
-      flush(true);
+      let changed = index >= 0;
+      if (index >= 0) notices.splice(index, 1);
+      // The presentation reads these facts, not the dismissible notice. Clear
+      // every rejection of this source while keeping other sources and notes.
+      for (let i = conflicts.length - 1; i >= 0; i--) {
+        if (conflicts[i].slug === slug && conflicts[i].kind === 'body-rejected') {
+          conflicts.splice(i, 1);
+          changed = true;
+        }
+      }
+      if (changed) flush(true);
     },
     get: payload,
   };

package/apps/studio/sync/transaction-client.ts

@@ -337,9 +337,33 @@ export function createTransactionClient(opts: TransactionClientOptions) {
    * process knew the project is bound first — it was never sent, so its bytes
    * may still change; once sent, they never do.
    */
+  /**
+   * Learn the project (id + epoch) before binding or rebasing an entry. A
+   * transport failure is WAITED OUT like an unknown delivery — a desktop that
+   * restarts offline drains its outbox before the hub is reachable, and a
+   * throw here was an unhandled rejection that ended the process (F3/S06).
+   * An answer — a legacy hub (`absent`), a refused sign-in — is still thrown.
+   */
+  async function bootstrapWhenReachable(): Promise<void> {
+    for (let attempt = 1; ; attempt++) {
+      if (stopped) throw new TransactionError('client stopped', 'stopped');
+      try {
+        await bootstrap();
+        return;
+      } catch (err) {
+        if (err instanceof TransactionError) throw err;
+        if (attempt === 1 || attempt % 10 === 0)
+          log.warn(
+            `[sync/tx] the project is not reachable yet (${(err as Error).message}); waiting`
+          );
+        await sleep(Math.min(retryMs * 2 ** Math.min(attempt - 1, 4), 30_000));
+      }
+    }
+  }
+
   async function settle(file: string, entry: OutboxEntry): Promise<ProposalResult> {
     if (entry.unbound || projectId === null) {
-      if (projectId === null) await bootstrap();
+      if (projectId === null) await bootstrapWhenReachable();
       if (entry.unbound && entry.action) {
         entry = { ...entry, bytes: envelope(entry.action, entry.transactionId) };
         delete entry.unbound;
@@ -351,7 +375,7 @@ export function createTransactionClient(opts: TransactionClientOptions) {
     if (result.status === 'rejected' && result.code === 'epoch-stale' && entry.action) {
       // A rebase is a NEW transaction under the current epoch, never a mutated
       // retry — and anything that depended on the old id now depends on this.
-      await bootstrap();
+      await bootstrapWhenReachable();
       const action = {
         ...entry.action,
         ...(entry.action.dependsOn
@@ -433,7 +457,9 @@ export function createTransactionClient(opts: TransactionClientOptions) {
    * Resend what a previous process left in the outbox — in creation order, the
    * same bytes, each resolved first in case its answer was simply lost.
    */
-  function drainOutbox(): Promise<ProposalResult[]> {
+  function drainOutbox(
+    onEach?: (result: ProposalResult, operations: Operation[]) => void
+  ): Promise<ProposalResult[]> {
     return enqueue(async () => {
       const entries = readOutbox().filter(({ file }) => !owned.has(file));
       const results: ProposalResult[] = [];
@@ -441,7 +467,9 @@ export function createTransactionClient(opts: TransactionClientOptions) {
         waiting.set(entry.transactionId, entry.createdAt);
         setPending(1);
         try {
-          results.push(await settle(file, entry));
+          const result = await settle(file, entry);
+          results.push(result);
+          onEach?.(result, entry.action?.operations ?? []);
         } finally {
           waiting.delete(entry.transactionId);
           setPending(-1);
@@ -451,6 +479,22 @@ export function createTransactionClient(opts: TransactionClientOptions) {
     });
   }
 
+  /**
+   * Is `content` a value the project store holds — i.e. one it accepted at
+   * some revision? `null` when it cannot tell (unreachable, older hub).
+   */
+  async function holdsValue(content: string): Promise<boolean | null> {
+    try {
+      if (projectId === null) await bootstrap();
+      const hash = createHash('sha256').update(content, 'utf8').digest('hex');
+      const { status, json } = await request('GET', `blobs/${hash}`);
+      if (status === 200) return (json as { body?: unknown } | null)?.body === content;
+      return status === 404 ? false : null;
+    } catch {
+      return null;
+    }
+  }
+
   /** A read route (`history`, `lane`, `revisions`) — no retry, bounded. */
   async function read(route: string, params: Record<string, string | number>): Promise<unknown> {
     if (projectId === null) await bootstrap();
@@ -468,6 +512,7 @@ export function createTransactionClient(opts: TransactionClientOptions) {
     read,
     newTransactionId,
     drainOutbox,
+    holdsValue,
     /** The epoch proposals are currently made under. */
     get epoch() {
       return epoch;