Bring cloud sync and the web beta into main

[SunkenInTime]

This merges icarus-cloud into main, so main becomes the only branch. It brings accounts, Convex sync, sharing, presence, page trash and the web beta, plus every fix found while getting it ready. Signed-out desktop users keep local mode exactly as 4.6.3 has it.

Merge with a merge commit, not a squash, so icarus-cloud's history stays intact. Merging deploys. Deploy Web now runs from main: production Convex first, then the web beta.

Old web tabs reload after this deploy (decided)

Protocol 4 refuses web tabs opened before the deploy (cbbdadf, 75b58e1). Cloud Paranoias are now stored at payload version 2. A protocol-3 tab would read one at the old size and, on its next edit to that page, write it back so new clients correct it a second time. Protocol 4 stops old tabs reading or writing until they reload. Their unsent edits stay on the device and send after the reload. A reload during the few minutes between the server deploy and the web deploy still gets the old build.

This breaks AGENTS.md's rule that a server change keeps working with the live web build. Dara approved it on 2026-10-01: an update means a reload, as in other apps. From this build on, a refusal says so on screen (6104d28): a reload prompt on web, an update prompt on desktop, and nothing discarded.

What changed beyond the merge

Bringing main across

• Main's 7 commits. Paranoia's v104 migration now runs in StrategyMigrator. The folder grid and empty-state changes are ported to the cloud library. Defense resize was already on cloud.
• Cloud Paranoias are corrected too. Cloud strategies never run local migrations, so every Paranoia on the server would have drawn with its Omen end 3 m off. A version-1 Paranoia row is corrected as it's read; nothing is rewritten on the server.
• pubspec is now +104 to match Settings.versionNumber. bump_version.ps1 refuses a mismatch, so Release Desktop would have failed at its first step.

Rollback to 4.6.3 keeps the library whole

• The hand-written Hive adapters saved for a rollback to 3.2.3: a subset of each page, plus JSON mirrors 4.6.3 ignores. Rolled back to 4.6.3, a library would have opened without its ellipses, view-cone and circle agents, firearms, lineup graph, ability visibility and folder icons, and 4.6.3's next save would have dropped them for good. Pages, agents, abilities, folders and drawings now save byte for byte as 4.6.3 does. Libraries saved by earlier cloud builds still load whole.
• Tests decode with 4.6.3's own adapters, copied from the release tag. The Windows upgrade/rollback gate now starts from the 4.6.3 installer instead of 3.2.3.

Sync integrity

• A recovered edit landing under a held item can be overwritten by the drop #220: a recovered edit is no longer silently replaced when you drop a held item over it. Astra reviewed the fix three times; each round found a race, and the third round came back clean.
• One account's unsent work can no longer land as another account after a switch. applyBatch carries the originating account, and the queue rechecks the account after claiming.
• A cloud failure at startup no longer locks you out of the local library. Signed out, the app no longer opens a Convex connection.
• Save says "Saved" only when the save actually landed.
• Leaving a cloud strategy with work pending (Home, or the new Reload) checks again at the moment you choose "Leave anyway", and never leaves quietly while a new draft is unsaved.

Desktop

• Double-clicking an .ica while Icarus is open opens it again.

Wiring and cleanup

• Deploy Web, CI and the contract gate run from main. Web deploys now queue instead of cancelling each other, so a cancelled run can't leave production on a new server with the old web build.
• The upgrade/rollback gate gives each launch 30 seconds, not 12. A cold runner's first launch of 4.6.3 once missed 12, and the same gate runs before every desktop release.
• Removed a 13 MB music video and a bun init stub that came in with icarus-cloud.

Verification

• Local: 1491 Flutter tests pass, Convex 229/229, the contract audit passes, codegen shows no drift, and analyze reports infos only.
• CI on this PR: every lane, including windows-build, which installs the signed 4.6.3 release, upgrades to this build and rolls back.
• Real library: a copy of Dara's library (2 strategies, data version 100) upgrades to 104 and reads back whole through 4.6.3's adapters.
• Release build, isolated store: the library loads signed out; a second launch with an .ica imports into the running window; folders line up with the strategy columns at two widths; the editor opens.
• Reviews: Astra (static) reviewed every fix; findings were fixed until clean.

Known and left

• Changing a strategy's map re-derives the correction for its untouched old cloud Paranoias, a shift of under a meter that every client agrees on.
• Replayed transport mutations other than applyBatch (pages:add, folder ops, media) aren't bound to an account yet.
• Leaving a strategy doesn't wait for lineup edits live sync withholds (a lineup missing its origin or landing). They're flagged for attention already, and blocking on them would trap the user.
• During a refusal, Settings still shows "Cloud connection needs attention" with Reconnect.
• TODO.md at the root is July's cloud UX work list. Delete it if it's done.

🤖 Generated with Claude Code

Confidence Score: 2/5

Do not merge until the three outstanding issues are resolved.

Findings

1.  Start the production backfill ▶
2.  Keep shipped clients connected ▶
3.  Older upload replaces newer image ▶

Summary

The PR adds cloud accounts, sync, sharing, presence, page trash, and the web beta. The latest changes scope lineup-editing presence to the dialog’s opening page and renew presence from the current socket state. No new findings were identified, but three earlier issues remain unresolved.

_{Reviews (11) · Last reviewed commit: "Renew presence from current state; scope..."}