feat: M4/M5 features (cloud sync, share links, Yjs CRDT, M5 validators + board) + M0–M3 audit

[LayerDynamics]

Summary

Two threads of work:

1. M0–M3 doc-vs-code audit → Todo.md (evidence-based gap analysis), plus a fix to the M3-P-07/M3-C-08 plan entries (they named a non-existent agent/agents/ path; the subagents actually live in agent/subagents/__init__.py and are wired through bridge.py).
2. The five parked M4/M5 items, pulled forward and implemented (user-directed), all real + tested (no stubs).

What landed

Area	Change
KCIR	pcb.signoff (rf/ddr/bga_fanout_reviewed) + migration 0.4 → 0.5 (v0_5.rs), ts-rs regen, client store type
M5 validators	KC060 (DDR fly-by node-count + sign-off) + KC070 (BGA fanout pitch feasibility + sign-off) in kc_validate
M5 board	examples/esp32_c6_rf/ — real 4-layer board (ESP32-C6 + DDR3L BGA 4×4 ball grid + U.FL RF + GND plane + CPWG feed); round-trips byte-identical, opens via KiProject::open. New cargo run --example canonicalize authoring tool
FR-007 cloud sync	content-addressed object store (LocalFs default + lazy-boto3 S3, env-selected) + sync.py + POST /project/{id}/sync/push, POST /sync/pull
FR-080 share links	read-only, content-addressed token → POST /project/{id}/share, GET /share/{token}, GET /share/{token}/file + client #/share/<token> SharePage
FR-081 multiplayer	Yjs relay (crdt.ts room + WS /crdt/:projectId, off by default behind KICLAUDE_MULTIPLAYER) + client CrdtSession. P4 decided → Yjs (docs/ADR/0001-crdt-yjs.md)
Guard	PreToolUse hard-gate denies any Claude attempt to flip pcb.signoff.*, even in trusted mode (SPEC §11 M5: "the LLM cannot flip sign-off")

A second commit (chore:) fixes 19 pre-existing ruff findings in 9 untouched files so this PR's Python gate runs green (behaviour-preserving: import order / formatting / dead-import removal only).

Test evidence

• Rust: cargo test --workspace green (cad 199, ki 162 + golden round-trip suites); cargo fmt --check --all + clippy clean.
• Python: 466 passed, 8 skipped (pre-existing kicad-cli/kikit binary-path skips); ruff check services/ clean.
• TS: client 478, server 25 (incl. two-peer CRDT convergence); both typecheck clean.
• KCIR schema-bump gate (M1-Q-02): kcir changed + KCIR_VERSION bumped + v0_5 migration entry added — policy satisfied.

Scope / known limits

• CRDT converges at the JSON-document level, not KCIR-aware; semantic merge is post-v1 (ADR-0001). Multiplayer is off by default (FP#8). The WS /crdt route glue follows the same untested-by-unit-tests pattern as the existing /ws; the room logic is unit-tested.
• SPEC §16.2's "pending P4" row is now superseded by ADR-0001 — left for a maintainer to update per decision rule C5.
• New deps: yjs (server, client); boto3 ([s3] extra) + moto (dev) in kiserver.
• The original M0–M3 gaps in Todo.md §1–§5 remain open (not part of this request).

🤖 Generated with Claude Code

[sourcery-ai]

Sorry @LayerDynamics, your pull request is larger than the review limit of 150000 diff characters

[gemini-code-assist]

Code Review

This pull request introduces several major features and enhancements across the codebase, including the implementation of the M3-R-03 push-and-shove router in Rust (compiled to WebAssembly), the M3-T-08 live distributor-priced BOM view, FR-080 read-only share links, and FR-081 Yjs-based real-time multiplayer sync. It also pulls forward M5 capabilities, adding design sign-off gates and the esp32_c6_rf reference project. The review feedback highlights critical improvement opportunities, such as resolving a room-release race condition in the CRDT hub, adding pre-check validation to prevent corrupted file restores, optimizing BGA pad pitch calculations to avoid blocking the main thread, fixing European currency parsing, and guarding against concurrent fetch race conditions in the BOM view.

[gemini-code-assist]

There is a subtle race condition in CrdtHub where a room can be deleted from the hub while a new connection is upgraded but has not yet joined the room (which happens in onOpen). This splits clients into different room instances for the same project ID. We can completely eliminate this race condition by implementing a reference-counting mechanism that tracks upgraded-but-not-yet-opened connections.

export class CrdtHub {
  private readonly rooms = new Map<string, CrdtRoom>();
  private readonly refs = new Map<string, number>();

  room(id: string): CrdtRoom {
    let room = this.rooms.get(id);
    if (!room) {
      room = new CrdtRoom(id);
      this.rooms.set(id, room);
    }
    this.refs.set(id, (this.refs.get(id) ?? 0) + 1);
    return room;
  }

  /** Drop a room once empty so an idle project doesn't pin its doc. */
  release(id: string): void {
    const count = (this.refs.get(id) ?? 0) - 1;
    if (count <= 0) {
      this.refs.delete(id);
      this.rooms.delete(id);
    } else {
      this.refs.set(id, count);
    }
  }

[gemini-code-assist]

Using string concatenation in a loop to encode a Uint8Array to a binary string can block the main thread for a significant amount of time on large Yjs updates. We can optimize this by processing the array in chunks using String.fromCharCode.apply, which is orders of magnitude faster and avoids call stack limits.

export function encodeU8(u8: Uint8Array): string {
  const len = u8.length;
  let s = "";
  const chunk = 16384;
  for (let i = 0; i < len; i += chunk) {
    s += String.fromCharCode.apply(
      null,
      u8.subarray(i, Math.min(i + chunk, len)) as unknown as number[]
    );
  }
  return btoa(s);
}

[gemini-code-assist]

Since load is an asynchronous function, if multiple requests are in flight concurrently (e.g., when the user quickly changes the quantity multiplier), a slower earlier request might resolve after a faster newer request, overwriting the state with stale data. We can prevent this race condition by using a reference to track the latest request ID and ignoring stale responses.

    async (force: boolean) => {
      const requestId = ++lastRequestId.current;
      setLoading(true);
      setError(null);
      try {
        const params = new URLSearchParams();
        params.set("qty_multiplier", String(qtyMultiplier));
        if (force) params.set("force_refresh", "true");
        const url = `${apiBase}/project/${encodeURIComponent(projectId)}/bom/price?${params}`;
        const resp = await fetchImpl(url, { method: "GET" });
        const body = (await resp.json()) as BomResponse;
        if (requestId !== lastRequestId.current) return;
        if (!resp.ok || body.ok === false) {
          throw new Error(body.error ?? body.detail ?? `${resp.status} ${resp.statusText}`);
        }
        setLines(body.bom_lines ?? []);
        setPricing(body.pricing ?? null);
      } catch (err) {
        if (requestId === lastRequestId.current) {
          setError(err instanceof Error ? err.message : String(err));
        }
      } finally {
        if (requestId === lastRequestId.current) {
          setLoading(false);
        }
      }
    },