[zeidalidiez]

HeroLink could write outside a project, apply incomplete or invalid content, lose another session's drafts, and overwrite later edits during rollback. This change repairs all 17 audit findings and the associated desktop, compatibility and verification gaps.

• Validate one complete candidate for preview, pending validation, apply and recovery. Require the reviewed revision, complete creation fields, constrained event commands and valid engine references; protect paths and object keys at public and persisted-input boundaries.
• Coordinate shared sessions with locked, revisioned staging. Use complete-path backups and a validated transaction manifest to recover files, journal, staging and model state together; refuse conflicting or corrupt rollbacks.
• Repair event semantics against the official MV interpreter and real MV/MZ exports. Make runtime IPC atomic, locked, cancellable and resistant to command replay.
• Route Electron through preload/main IPC, authenticate readiness, validate settings and stage inspector installation. Add functional editing, templates, pagination, complete field/file review, honest outage handling and keyboard/accessibility fixes.
• Share the production tool registry, update dependencies, enforce coverage and add Linux/Windows/macOS CI plus native Linux Electron E2E.

Validation on Linux (Node 26.8.1): npm run check passed 389 tests with 92.71% line / 85.08% branch coverage and all critical-directory gates; npm run build passed; native Electron E2E passed, including seven main-view accessibility scans, review-modal accessibility and keyboard focus; npm audit reported zero vulnerabilities; git diff --check passed. Original regressions and four additional independently reproduced review findings now pass, alongside successful multi-operation and multi-session controls.

Compatibility changes: public apply now requires expectedRevision; creation requires complete fields; CLI output goes to stderr; internal project symlinks are refused. Legacy pending staging and journals without post-hashes require explicit recovery. Recovery, fixture provenance and verification scope document these contracts and the unverified native Windows/macOS Electron, MZ runtime and installer paths. Original fixture data was not changed.

[greptile-apps]

Too many files changed for review (104 files, 100 file limit).

Bypass the limit by tagging @greptile-apps to review.