Improve design workflows and app reliability

[steve8708]

Summary

• deepen Design/Figma parity across canvas primitives, layers, inspector controls, comments, drawing, auto layout, and local React visual editing
• harden local source writes with provenance-rich coding-agent handoffs, human consent, SHA-256 compare-and-swap, atomic writes, and bridge restart recovery
• improve Core background continuation recovery, collaboration reconciliation, recap capture safety, and SSR observability
• make Content Notion synchronization and live document flushing fail closed and conflict-safe
• improve Clips desktop recording/transcription behavior, Plan canvas zooming, and Slides persistence
• update localized copy, runtime/exported visual-edit instructions, generated bridge/plugin artifacts, changelogs, and package changesets

Validation

• repository formatting check
• all 20 repository guards
• Core typecheck and 660 focused tests
• Design full test suite, production build, typecheck, bridge checks, and focused regressions
• Content and Slides typechecks plus focused tests
• Clips desktop production build, transcription tests, cargo fmt/check, and 29 Rust library tests
• Plan modifier-wheel Playwright E2E
• exported skill and marketplace sync checks

[github-actions]

Visual recap — skipped

The visual recap job did not run for this pull request. This is informational only and does not block the PR.

Recap skipped for d40cdcb: PR modifies recap-control files (.claude/launch.json) — skipping so untrusted PR code never runs with secrets.

[builder-io-integration]

Builder reviewed your changes and found 1 potential issue 🟡

Review Details

This incremental update is a focused follow-up on the prior reliability findings: Content now distinguishes flush-capable collaborators from read-only viewers, and DesignCanvas adds safer slow-editor / late-ready recovery for localhost live-edit. I reviewed the latest head as standard risk because it changes collaboration/sync behavior and browser-side recovery logic, but not auth/payment/security boundaries.

The previously reported viewer-blocks-sync issue in templates/content/actions/_document-flush.ts has been addressed, and that stale thread was already resolved. The Design-side recovery changes look materially better, with explicit same-instance escalation handling and tests for late ready recovery. I did confirm one new rollout-compatibility regression in the Content fix: the server now only waits on awareness rows with canFlushDocument === true, so older editor tabs that were opened before this deploy are treated the same as viewers. During mixed-version rollouts or long-lived stale tabs, pull/push/conflict flows can skip the flush handshake and ingest stale SQL while fresher Yjs content is still open.

🧪 Browser testing: Will run after this review (PR touches UI code)

[builder-io-integration]

🟡 Legacy editor tabs are now ignored by the flush handshake

This gate now requires canFlushDocument === true, so editor tabs opened before this deploy still publishing the old awareness shape are filtered out like viewers. During mixed-version rollouts or long-lived stale tabs, pull/push/conflict flows can skip the handshake and read stale SQL while fresher Yjs state is still open.

Additional Info

Verified from current code and tests: missing `canFlushDocument` is treated as non-flush-capable, and there is no fallback path for legacy editor sessions.

[steve8708]

Fixed in fdbecb3. Modern canFlushDocument:false viewers still skip immediately. Legacy missing-capability humans now receive the bounded old-client handshake: success and explicit errors are honored, legacy-only silence/write failure falls back to SQL, while any modern canFlushDocument:true editor keeps timeout/write failures fail-closed. Added mixed-version regressions for each case.