@1agh/maude 1.4.4 → 1.4.6

package/apps/studio/sync/migrate-seed.ts

@@ -58,6 +58,7 @@ import {
   unionCommentsById,
 } from './cold-start.ts';
 import { applyColdStart, type ColdStartSnapshotReason } from './cold-start-apply.ts';
+import { type CommentLedger, withoutRemotelyDeleted } from './comment-ledger.ts';
 import { hashBytes } from './echo-guard.ts';
 import type { SyncJournal } from './journal.ts';
 import { ORIGINS } from './origins.ts';
@@ -85,6 +86,8 @@ export interface MigrateSeedOptions {
   historyDir?: string;
   /** DDR-102 — per-machine journal; gates fast-forward vs conflict. */
   journal?: SyncJournal;
+  /** Issue #133 — comment ids synced from here before (sync/comment-ledger.ts). */
+  commentLedger?: CommentLedger;
   /** DDR-102 — body snapshot writer (history.ts), same contract as the agent's. */
   snapshot?: (content: string, reason: ColdStartSnapshotReason) => Promise<string | null>;
   /**
@@ -414,9 +417,13 @@ export async function migrateSeed(opts: MigrateSeedOptions): Promise<MigrateSeed
   // delete-then-insert codec — same-id entries keep the doc's version, so the
   // duplication trap stays closed; local-only comments survive.
   if (localComments) {
-    const parsed = tryParseJsonArray(localComments);
+    const docList = doc.getArray(Y_TYPES.comments).toArray();
+    const read = tryParseJsonArray(localComments);
+    // Issue #133 — never union back a comment a peer deleted while we were away.
+    const parsed = read
+      ? withoutRemotelyDeleted(read, docList, opts.commentLedger?.get(slug))
+      : null;
     if (parsed && parsed.length > 0) {
-      const docList = doc.getArray(Y_TYPES.comments).toArray();
       const merged = unionCommentsById(docList, parsed);
       if (merged.length !== docList.length) {
         doc.transact(() => {

package/apps/studio/sync/projection.ts

@@ -54,7 +54,12 @@ import type { RevisionBarrier } from './revision-barrier.ts';
 import { repairSeedDuplication } from './seed-repair.ts';
 import { mergeSource } from './source-merge.ts';
 import type { SourceOp } from './source-ops.ts';
-import { saveRecoveryBody } from './source-recovery.ts';
+import {
+  preserveRecoveryCandidate,
+  readRecoveryCandidate,
+  resolveRecoveryCandidate,
+  saveRecoveryBody,
+} from './source-recovery.ts';
 import { sourceError } from './source-validation.ts';
 import { laneHash } from './transaction-client.ts';
 
@@ -222,6 +227,13 @@ export interface DocProjection {
    * write stays blocked with a visible conflict and a later save can merge.
    */
   adoptBase(body: string): void;
+  /**
+   * Accepted mode, cold start: `value` is this disk's own html proposal that a
+   * previous run left in the outbox and the drain just had accepted. It is
+   * what the disk was saved as — the base of whatever it holds next — even
+   * while this replica still shows the value before it.
+   */
+  adoptOwnAccepted(value: string): void;
   /**
    * Accepted-revisions mode: propose one lane value that did not come through
    * the watcher (a comment/annotation API write). Resolves with the outcome;
@@ -240,8 +252,13 @@ export interface DocProjection {
    * recovery slots. Returns false when nothing is held.
    */
   takeAccepted(): boolean;
-  /** T28 — the two sides of a held source conflict (null when none). */
-  conflictSides(): { mine: string | null; theirs: string } | null;
+  /** T28 — current sides plus the first candidate and proven base (null when unknown). */
+  conflictSides(): {
+    mine: string | null;
+    theirs: string;
+    original: string | null;
+    base: string | null;
+  } | null;
   /** Re-deliver file changes held while the document was not writable. */
   retryDeferred(): void;
   /**
@@ -290,6 +307,22 @@ export function createDocProjection(opts: DocProjectionOptions): DocProjection {
   let validationCache: { body: string; error: string | null } | null = null;
 
   function recovered(): void {
+    // An older accepted proposal is not resolution of a later pending/held one.
+    if (pending.has('html') || held.has('html')) return;
+    try {
+      if (opts.historyDir) resolveRecoveryCandidate(opts.historyDir, paths.html);
+    } catch {
+      // The accepted action is real even if updating our local recovery record
+      // fails. Keep the original pinned and the storage problem visible.
+      rejectedKey ??= 'recovery-failed';
+      opts.onConflict?.({
+        slug,
+        kind: 'body-rejected',
+        reason: 'history-failed',
+        snapshotFailed: true,
+      });
+      return;
+    }
     if (rejectedKey !== null) opts.onRecovered?.();
     rejectedKey = null;
   }
@@ -325,13 +358,16 @@ export function createDocProjection(opts: DocProjectionOptions): DocProjection {
     reason: BodyRejection['reason'],
     local: string | null,
     incoming: string,
-    file = paths.html
+    file = paths.html,
+    base: string | null = lastHtml
   ): void {
     const key = `${file}:${reason}:${hashBytes(local ?? '')}:${hashBytes(incoming)}`;
     if (key === rejectedKey) return;
     rejectedKey = key;
     let snapshotFailed = false;
     try {
+      if (file === paths.html && opts.historyDir)
+        preserveRecoveryCandidate(opts.historyDir, file, local, base);
       if (file === paths.html) preserveLocal(local);
       if (opts.historyDir) {
         if (local !== null) saveRecoveryBody(opts.historyDir, file, 'local', local);
@@ -461,11 +497,29 @@ export function createDocProjection(opts: DocProjectionOptions): DocProjection {
         next = repeated.unit;
       }
     }
+    if (acceptedOwn !== null && next !== lastHtml) {
+      // The replica moved. When it moved to exactly our accepted value and the
+      // disk already holds a newer save, that save is ours on top of it: agree
+      // on the accepted value and leave the file for the watcher to propose.
+      const own = next === acceptedOwn;
+      acceptedOwn = null;
+      if (own) {
+        const local = readLocal(paths.html);
+        if (local !== null && local !== next && local !== observedBody) {
+          lastHtml = next;
+          rememberBase(next);
+          return true;
+        }
+      }
+    }
     if (next === lastHtml) return true;
     // Don't clobber a non-empty local body with an empty doc (cold-start before
     // the doc is seeded — the safe-reconcile invariant; full adopt is Phase E).
     if (next === '') {
-      lastHtml = next;
+      // Accepted mode: an empty replica is one the project's publication has
+      // not reached yet, never a value this disk agreed on — a base already
+      // known (a canvas this disk just added, adopted on acceptance) stays.
+      if (lastHtml === null || !acceptedOn()) lastHtml = next;
       return true;
     }
     if (!withinCap(paths.html, next, MAX_HTML_BYTES)) return false;
@@ -675,14 +729,29 @@ export function createDocProjection(opts: DocProjectionOptions): DocProjection {
     return lane === 'comments' ? paths.comments : paths.annotations;
   }
 
+  /**
+   * Our own html proposal the hub accepted, whose publication has not reached
+   * this replica yet. Until it does, it — not the older replica value — is
+   * what the next save on this disk was made on top of (F3 S14, 2026-09-23:
+   * a save in that window was proposed on the value before the first save and
+   * refused as a base conflict, and the echo itself read as "a local edit
+   * overlaps an incoming change").
+   */
+  let acceptedOwn: string | null = null;
+
   /** The value disk and the accepted replica last agreed on for `lane`. */
   function agreedValue(lane: ProposalLane): string {
-    if (lane === 'html') return lastHtml ?? htmlFromDoc(doc);
+    if (lane === 'html') return acceptedOwn ?? lastHtml ?? htmlFromDoc(doc);
     if (lane === 'css') return lastCss ?? cssFromDoc(doc) ?? '';
     return readLaneFromDoc(doc, lane);
   }
 
-  function onRejected(lane: ProposalLane, local: string, outcome: ProposalOutcome): void {
+  function onRejected(
+    lane: ProposalLane,
+    local: string,
+    outcome: ProposalOutcome,
+    base: string
+  ): void {
     held.add(lane);
     // The candidate stays on disk: the projection's local-edit guard protects
     // it (html), `held` blocks the lane writer (css/meta), and the recovery
@@ -704,7 +773,8 @@ export function createDocProjection(opts: DocProjectionOptions): DocProjection {
       REJECTION_REASON[outcome.code ?? ''] ?? 'local-edit',
       local,
       readLaneFromDoc(doc, lane),
-      pathOfLane(lane)
+      pathOfLane(lane),
+      base
     );
   }
 
@@ -772,6 +842,15 @@ export function createDocProjection(opts: DocProjectionOptions): DocProjection {
       }
       if (outcome.status === 'accepted') {
         if (!pending.has(lane)) held.delete(lane);
+        if (lane === 'html' && !pending.has(lane)) {
+          // Our accepted value is the base of whatever this disk holds next —
+          // whichever arrives first, the answer or the publication.
+          // Persisted too: a cold start judges the disk against this base.
+          if (readLaneFromDoc(doc, 'html') === value) {
+            lastHtml = value;
+            rememberBase(value);
+          } else acceptedOwn = value;
+        }
         if (lane === 'html') recovered();
         if (outcome.actionId) {
           try {
@@ -793,7 +872,7 @@ export function createDocProjection(opts: DocProjectionOptions): DocProjection {
           lastMeta = null;
         }
       } else {
-        onRejected(lane, local, outcome);
+        onRejected(lane, local, outcome, baseContent);
       }
       scheduleFlush();
       return outcome;
@@ -864,6 +943,14 @@ export function createDocProjection(opts: DocProjectionOptions): DocProjection {
     // 2026-09-15, L09 delete). Every edit to these lanes arrives through the
     // API with the base it was made from (`proposeLane`).
     if (lane === 'comments' || lane === 'annotations') return false;
+    // A STALE EVENT PROPOSES NOTHING. The reader took these bytes before a
+    // later write reached the file — typically this projection materializing a
+    // newer accepted value — and delivered them after. Proposing them would
+    // put an older body back over a teammate's accepted edit (F3 S15, cloud
+    // cell, 2026-09-24: v13 over v14). What the disk holds now arrives with its
+    // own event.
+    const onDisk = readLocal(evt.path);
+    if (onDisk !== null && onDisk !== str) return false;
     if (lane === 'html') {
       if (str === lastHtml && !held.has('html')) return false; // a redelivered projection
       if (!withinCap(paths.html, str, MAX_HTML_BYTES)) return false;
@@ -1127,6 +1214,17 @@ export function createDocProjection(opts: DocProjectionOptions): DocProjection {
       lastHtml = body;
       observedBody = body;
     },
+    adoptOwnAccepted(value: string) {
+      // Exactly what an answer in this process does (see `submit`): the
+      // replica either holds it already, or its publication is still coming.
+      const replica = htmlFromDoc(doc);
+      if (replica === value) lastHtml = value;
+      else {
+        lastHtml = replica;
+        acceptedOwn = value;
+      }
+      rememberBase(value);
+    },
     hold(lane, base, local) {
       held.add(lane);
       if (lane === 'html') {
@@ -1146,12 +1244,17 @@ export function createDocProjection(opts: DocProjectionOptions): DocProjection {
       lastHtml = null;
       dirty = true;
       void flush();
-      recovered();
       return true;
     },
     conflictSides() {
       if (!held.has('html') && rejectedKey === null) return null;
-      return { mine: readLocal(paths.html), theirs: htmlFromDoc(doc) };
+      const candidate = opts.historyDir ? readRecoveryCandidate(opts.historyDir, paths.html) : null;
+      return {
+        mine: readLocal(paths.html),
+        theirs: htmlFromDoc(doc),
+        original: candidate?.original ?? null,
+        base: candidate?.base ?? null,
+      };
     },
     proposeLane(lane, value, o) {
       if (!acceptedOn() || stopped) return null;

package/apps/studio/sync/remote-docs.ts

@@ -341,8 +341,8 @@ export function pullTargets(
  * readable. Both hops go through the same function, so "where does this canvas
  * go" cannot have two answers.
  *
- * Returns null when even the containment check refuses — the only case in which
- * a canvas is dropped rather than degraded.
+ * Returns null when a present path is refused or containment fails. Only a
+ * document with no path may use the legacy slug-derived fallback.
  */
 export function resolvePulledTarget(args: {
   slug: string;
@@ -376,6 +376,7 @@ export function resolvePulledTarget(args: {
     allowUndeclaredGroup: args.allowUndeclaredGroup,
     onRefused: args.onRefused,
   });
+  if (args.path !== undefined && args.path !== null && !fromPath) return null;
   const bodyAbs = args.join(args.designRoot, rel);
   // Belt and braces at a create. The validator already refuses everything that
   // could escape lexically; this catches whatever a platform's own `resolve`

package/apps/studio/sync/source-recovery.ts

@@ -12,6 +12,73 @@ import { sourceError } from './source-validation.ts';
  */
 export type RecoverySlot = 'last-valid' | 'local' | 'incoming' | 'base';
 
+/** The first rejected draft and its proven base, not the mutable latest draft. */
+export interface RecoveryCandidate {
+  version: 1;
+  original: string | null;
+  base: string | null;
+  resolved: boolean;
+}
+
+function candidatePath(historyDir: string, file: string): string {
+  return path.join(historyDir, 'sync-recovery', `candidate${path.extname(file)}.json`);
+}
+
+function boundedBody(body: unknown): body is string | null {
+  return (
+    body === null || (typeof body === 'string' && Buffer.byteLength(body, 'utf8') <= MAX_HTML_BYTES)
+  );
+}
+
+/** Corrupt/inaccessible records fail closed: never replace an unreadable draft. */
+export function readRecoveryCandidate(historyDir: string, file: string): RecoveryCandidate | null {
+  const target = candidatePath(historyDir, file);
+  let size: number;
+  try {
+    size = statSync(target).size;
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === 'ENOENT') return null;
+    throw error;
+  }
+  // Two byte-capped strings, each potentially JSON-escaped as six bytes/char.
+  if (size > 12 * MAX_HTML_BYTES + 256) throw new Error('Recovery candidate exceeds size limit');
+  const value: unknown = JSON.parse(readFileSync(target, 'utf8'));
+  if (!value || typeof value !== 'object') throw new Error('Invalid recovery candidate');
+  const record = value as Record<string, unknown>;
+  if (
+    record.version !== 1 ||
+    typeof record.resolved !== 'boolean' ||
+    !boundedBody(record.original) ||
+    !boundedBody(record.base)
+  )
+    throw new Error('Invalid recovery candidate');
+  return { version: 1, original: record.original, base: record.base, resolved: record.resolved };
+}
+
+/** One bounded, atomic record per source file; retries/restarts cannot evict it. */
+export function preserveRecoveryCandidate(
+  historyDir: string,
+  file: string,
+  original: string | null,
+  base: string | null
+): void {
+  if (!boundedBody(original) || !boundedBody(base))
+    throw new Error('Recovery source exceeds size limit');
+  const previous = readRecoveryCandidate(historyDir, file);
+  if (previous && !previous.resolved) return;
+  atomicWrite(
+    candidatePath(historyDir, file),
+    JSON.stringify({ version: 1, original, base, resolved: false })
+  );
+}
+
+/** Retain the bytes after resolution, allowing replacement only by a new episode. */
+export function resolveRecoveryCandidate(historyDir: string, file: string): void {
+  const previous = readRecoveryCandidate(historyDir, file);
+  if (!previous || previous.resolved) return;
+  atomicWrite(candidatePath(historyDir, file), JSON.stringify({ ...previous, resolved: true }));
+}
+
 export function saveRecoveryBody(
   historyDir: string,
   file: string,

package/apps/studio/sync/status.ts

@@ -447,9 +447,17 @@ export function createSyncStatusStore(opts: SyncStatusStoreOptions): SyncStatusS
     clearSourceConflict(slug) {
       const id = `source-conflict-${slug}`;
       const index = notices.findIndex((n) => n.id === id);
-      if (index < 0) return;
-      notices.splice(index, 1);
-      flush(true);
+      let changed = index >= 0;
+      if (index >= 0) notices.splice(index, 1);
+      // The presentation reads these facts, not the dismissible notice. Clear
+      // every rejection of this source while keeping other sources and notes.
+      for (let i = conflicts.length - 1; i >= 0; i--) {
+        if (conflicts[i].slug === slug && conflicts[i].kind === 'body-rejected') {
+          conflicts.splice(i, 1);
+          changed = true;
+        }
+      }
+      if (changed) flush(true);
     },
     get: payload,
   };

package/apps/studio/sync/transaction-client.ts

@@ -337,9 +337,33 @@ export function createTransactionClient(opts: TransactionClientOptions) {
    * process knew the project is bound first — it was never sent, so its bytes
    * may still change; once sent, they never do.
    */
+  /**
+   * Learn the project (id + epoch) before binding or rebasing an entry. A
+   * transport failure is WAITED OUT like an unknown delivery — a desktop that
+   * restarts offline drains its outbox before the hub is reachable, and a
+   * throw here was an unhandled rejection that ended the process (F3/S06).
+   * An answer — a legacy hub (`absent`), a refused sign-in — is still thrown.
+   */
+  async function bootstrapWhenReachable(): Promise<void> {
+    for (let attempt = 1; ; attempt++) {
+      if (stopped) throw new TransactionError('client stopped', 'stopped');
+      try {
+        await bootstrap();
+        return;
+      } catch (err) {
+        if (err instanceof TransactionError) throw err;
+        if (attempt === 1 || attempt % 10 === 0)
+          log.warn(
+            `[sync/tx] the project is not reachable yet (${(err as Error).message}); waiting`
+          );
+        await sleep(Math.min(retryMs * 2 ** Math.min(attempt - 1, 4), 30_000));
+      }
+    }
+  }
+
   async function settle(file: string, entry: OutboxEntry): Promise<ProposalResult> {
     if (entry.unbound || projectId === null) {
-      if (projectId === null) await bootstrap();
+      if (projectId === null) await bootstrapWhenReachable();
       if (entry.unbound && entry.action) {
         entry = { ...entry, bytes: envelope(entry.action, entry.transactionId) };
         delete entry.unbound;
@@ -351,7 +375,7 @@ export function createTransactionClient(opts: TransactionClientOptions) {
     if (result.status === 'rejected' && result.code === 'epoch-stale' && entry.action) {
       // A rebase is a NEW transaction under the current epoch, never a mutated
       // retry — and anything that depended on the old id now depends on this.
-      await bootstrap();
+      await bootstrapWhenReachable();
       const action = {
         ...entry.action,
         ...(entry.action.dependsOn
@@ -433,7 +457,9 @@ export function createTransactionClient(opts: TransactionClientOptions) {
    * Resend what a previous process left in the outbox — in creation order, the
    * same bytes, each resolved first in case its answer was simply lost.
    */
-  function drainOutbox(): Promise<ProposalResult[]> {
+  function drainOutbox(
+    onEach?: (result: ProposalResult, operations: Operation[]) => void
+  ): Promise<ProposalResult[]> {
     return enqueue(async () => {
       const entries = readOutbox().filter(({ file }) => !owned.has(file));
       const results: ProposalResult[] = [];
@@ -441,7 +467,9 @@ export function createTransactionClient(opts: TransactionClientOptions) {
         waiting.set(entry.transactionId, entry.createdAt);
         setPending(1);
         try {
-          results.push(await settle(file, entry));
+          const result = await settle(file, entry);
+          results.push(result);
+          onEach?.(result, entry.action?.operations ?? []);
         } finally {
           waiting.delete(entry.transactionId);
           setPending(-1);
@@ -451,6 +479,22 @@ export function createTransactionClient(opts: TransactionClientOptions) {
     });
   }
 
+  /**
+   * Is `content` a value the project store holds — i.e. one it accepted at
+   * some revision? `null` when it cannot tell (unreachable, older hub).
+   */
+  async function holdsValue(content: string): Promise<boolean | null> {
+    try {
+      if (projectId === null) await bootstrap();
+      const hash = createHash('sha256').update(content, 'utf8').digest('hex');
+      const { status, json } = await request('GET', `blobs/${hash}`);
+      if (status === 200) return (json as { body?: unknown } | null)?.body === content;
+      return status === 404 ? false : null;
+    } catch {
+      return null;
+    }
+  }
+
   /** A read route (`history`, `lane`, `revisions`) — no retry, bounded. */
   async function read(route: string, params: Record<string, string | number>): Promise<unknown> {
     if (projectId === null) await bootstrap();
@@ -468,6 +512,7 @@ export function createTransactionClient(opts: TransactionClientOptions) {
     read,
     newTransactionId,
     drainOutbox,
+    holdsValue,
     /** The epoch proposals are currently made under. */
     get epoch() {
       return epoch;

package/apps/studio/use-collab.tsx

@@ -323,6 +323,27 @@ export function useCollab(): CollabValue | null {
 // ─────────────────────────────────────────────────────────────────────────────
 // Hook: foreign awareness peers (the cursor overlay subscribes to this).
 
+export interface AwarenessChanges {
+  added: number[];
+  updated: number[];
+  removed: number[];
+}
+
+/**
+ * Could this awareness `change` alter the foreign peers we show? False only
+ * when every touched client is the local one (our own cursor publish — #131).
+ * Unknown shape → true, the safe direction.
+ */
+export function touchesForeignClient(changes: AwarenessChanges | undefined, myId: number): boolean {
+  if (!changes) return true;
+  const touched = [
+    ...(changes.added ?? []),
+    ...(changes.updated ?? []),
+    ...(changes.removed ?? []),
+  ];
+  return touched.length === 0 || touched.some((id) => id !== myId);
+}
+
 /**
  * Returns the current set of foreign peers (excludes the local client). The
  * returned array is stable-reference between awareness updates — useful for
@@ -351,7 +372,13 @@ export function useForeignAwareness(): ForeignAwareness[] {
       return out;
     }
     setPeers(compute());
-    const onChange = () => setPeers(compute());
+    // Issue #131 — `change` fires for OUR OWN publishes too (the 30 Hz cursor),
+    // and each one rebuilt every peer object and re-rendered every consumer.
+    // Only a change that touches another client can change what we show.
+    const onChange = (changes?: AwarenessChanges) => {
+      if (!touchesForeignClient(changes, awareness.clientID)) return;
+      setPeers(compute());
+    };
     awareness.on('change', onChange);
     return () => {
       awareness.off('change', onChange);

package/apps/studio/use-selection-set.tsx

@@ -67,6 +67,10 @@ export interface Selection {
   worldW?: number;
   worldH?: number;
   html?: string;
+  /** Comment drops only — the annotation the click landed on, and the click's
+   *  world point (comment-anchor.ts). */
+  annotationId?: string;
+  world?: { x: number; y: number };
   /** Phase 12.2 — authored inline-style values (knob pre-fill) + resolved computed (placeholder hint). */
   authored?: Record<string, string>;
   computed?: Record<string, string>;
@@ -152,12 +156,14 @@ export function SelectionSetProvider({
 }) {
   const [selected, setSelected] = useState<Selection[]>([]);
   const timerRef = useRef<ReturnType<typeof setTimeout> | null>(null);
+  const pendingPostRef = useRef<(() => void) | null>(null);
 
   const post = useCallback(
     (next: Selection[]) => {
       if (timerRef.current) clearTimeout(timerRef.current);
-      timerRef.current = setTimeout(() => {
+      pendingPostRef.current = () => {
         timerRef.current = null;
+        pendingPostRef.current = null;
         const target = postTarget ?? (typeof window !== 'undefined' ? window.parent : null);
         if (!target) return;
         // Wire shape: single object for N=1 (back-compat), array for N>1, null for empty.
@@ -168,15 +174,19 @@ export function SelectionSetProvider({
         } catch {
           /* iframe likely cross-origin or detached */
         }
-      }, POST_DEBOUNCE_MS);
+      };
+      timerRef.current = setTimeout(() => pendingPostRef.current?.(), POST_DEBOUNCE_MS);
     },
     [postTarget]
   );
 
-  // Cleanup the debounce timer on unmount.
+  // Soft HMR replaces this provider too. Deliver the last local selection
+  // before the replacement's loaded handshake, so the shell can reselect it.
+  // Cancelling silently loses a click made inside the 50 ms debounce window.
   useEffect(
     () => () => {
       if (timerRef.current) clearTimeout(timerRef.current);
+      pendingPostRef.current?.();
     },
     []
   );

package/apps/studio/use-undo-stack.tsx

@@ -99,6 +99,11 @@ const UndoSinksContext = createContext<UndoSinksValue | null>(null);
 
 const NOOP_SINKS: UndoSinksValue = { setSink: () => {} };
 
+// The iframe survives a soft HMR swap, but its Provider does not. Keep pending
+// operations serialized across that handoff; remove idle queues so this map
+// retains neither closed canvases nor completed command closures.
+const canvasFlights = new Map<string, Promise<void>>();
+
 // ─────────────────────────────────────────────────────────────────────────────
 // Provider
 
@@ -185,10 +190,25 @@ export function UndoStackProvider({
   }, []);
 
   const enqueue = useCallback((task: () => Promise<void>): Promise<void> => {
-    const next = inFlightRef.current.then(task, task);
-    inFlightRef.current = next.catch(() => {
+    const file = fileRef.current;
+    const previous = (file && canvasFlights.get(file)) || inFlightRef.current;
+    const run = async () => {
+      // The previous mount may have persisted its ACK after this mount read
+      // the initial state. Re-read only at the serialized operation boundary.
+      if (file) stateRef.current = loadStackState(file);
+      await task();
+    };
+    const next = previous.then(run, run);
+    const settled = next.catch(() => {
       /* swallow — per-op error already reported */
     });
+    inFlightRef.current = settled;
+    if (file) {
+      canvasFlights.set(file, settled);
+      void settled.then(() => {
+        if (canvasFlights.get(file) === settled) canvasFlights.delete(file);
+      });
+    }
     return next;
   }, []);
 

package/apps/studio/whats-new.json

@@ -1,6 +1,51 @@
 {
   "$schema": "./whats-new.schema.json",
   "entries": [
+    {
+      "id": "comments-stay-where-you-put-them",
+      "version": "1.4.6",
+      "date": "2026-09-30",
+      "kind": "fix",
+      "title": "Comments stay where you put them",
+      "summary": "A comment on a sticky, a drawing or empty canvas no longer disappears a few seconds after you save it. A comment on a sticky moves with it, and if the thing it points at is deleted the comment stays, marked as detached, until you remove it.",
+      "surface": "design-ui"
+    },
+    {
+      "id": "comments-reach-every-peer",
+      "version": "1.4.6",
+      "date": "2026-09-30",
+      "kind": "fix",
+      "title": "Web comments reach the desktop app",
+      "summary": "Comments added on the web while your desktop app was closed now show up when you reopen it, and a comment deleted elsewhere no longer comes back.",
+      "surface": "design-ui"
+    },
+    {
+      "id": "large-boards-pan-smoothly",
+      "version": "1.4.6",
+      "date": "2026-09-30",
+      "kind": "improvement",
+      "title": "Large boards pan smoothly again",
+      "summary": "Panning a board with many artboards stays smooth while something is selected or a teammate is on the canvas — on the desktop app it could drop to a frame a second.",
+      "surface": "design-ui"
+    },
+    {
+      "id": "sync-no-phantom-waiting-files",
+      "version": "1.4.6",
+      "date": "2026-09-30",
+      "kind": "fix",
+      "title": "Sync stops counting files that are done",
+      "summary": "The Sync panel no longer shows files as waiting or stuck when there is nothing left to deliver, and Resync now brings down a file the project changed while you were uploading it.",
+      "surface": "design-ui"
+    },
+    {
+      "id": "team-projects-hold-up",
+      "version": "1.4.5",
+      "date": "2026-09-25",
+      "kind": "fix",
+      "title": "Team projects that hold up under failure",
+      "summary": "Edits made in the browser on a self-hosted workspace now reach the project, switching a project to saved revisions finishes on its own even if the connection drops for a moment, and removing a teammate ends their access at once. Cloud projects also keep work written just before a server crash.",
+      "surface": "design-ui"
+    },
     {
       "id": "steadier-team-projects",
       "version": "1.4.2",