@1agh/maude 0.29.0 → 0.30.0

package/apps/studio/test/figjam-v3-model.test.ts

@@ -0,0 +1,342 @@
+// FigJam v3 — model schema extension: data-group-ids / data-author /
+// data-start-bind / data-end-bind. Three load-bearing assertions:
+//   1. the new fixture round-trips BYTE-IDENTICAL (parse → re-serialize),
+//   2. legacy strokes (no new fields) serialize WITHOUT any new attribute
+//      (the Phase-24 canary holds — covered again here from the model side),
+//   3. the sanitizer passes the new data-* attrs through (it denylists only
+//      on*/style/href) and poisoned bind values are rejected on parse.
+
+import { afterAll, beforeAll, describe, expect, test } from 'bun:test';
+import { GlobalRegistrator } from '@happy-dom/global-registrator';
+
+import {
+  type AnchorHost,
+  type ArrowStroke,
+  convertShapeKind,
+  type PolygonStroke,
+  type RectStroke,
+  type StickyStroke,
+  type Stroke,
+  shapeKindOf,
+  strokeBBox,
+  strokeHitTest,
+  strokesToSvg,
+  svgToStrokes,
+  type TextStroke,
+} from '../annotations-model.ts';
+import { sanitizeAnnotationSvg } from '../api.ts';
+
+beforeAll(() => {
+  GlobalRegistrator.register();
+});
+afterAll(async () => {
+  await GlobalRegistrator.unregister();
+});
+
+const FIXTURE_URL = new URL('./fixtures/figjam-v3-groups-bindings.svg', import.meta.url);
+
+describe('figjam-v3 fixture canary', () => {
+  test('round-trips byte-identical (groups + nested groups + binds + author)', async () => {
+    const fixture = await Bun.file(FIXTURE_URL).text();
+    expect(strokesToSvg(svgToStrokes(fixture))).toBe(fixture);
+  });
+
+  test('round-trips byte-identical THROUGH the sanitizer', async () => {
+    const fixture = await Bun.file(FIXTURE_URL).text();
+    expect(sanitizeAnnotationSvg(fixture)).toBe(fixture);
+  });
+
+  test('parse recovers the new fields exactly', async () => {
+    const strokes = svgToStrokes(await Bun.file(FIXTURE_URL).text());
+    const rect = strokes.find((s) => s.id === 's_aaa1') as RectStroke;
+    expect(rect.groupIds).toEqual(['g_team1']);
+    const sticky = strokes.find((s) => s.id === 's_aaa2') as StickyStroke;
+    expect(sticky.groupIds).toEqual(['g_inner', 'g_team1']); // deepest→shallowest order kept
+    const arrow = strokes.find((s) => s.id === 's_aaa3') as ArrowStroke;
+    expect(arrow.startBind).toEqual({ hostId: 's_aaa1', nx: 1, ny: 0.5 }); // auto
+    expect(arrow.endBind).toEqual({ hostId: 's_aaa2', nx: 0, ny: 0.5, pinned: true });
+    const note = strokes.find((s) => s.id === 's_aaa4') as TextStroke;
+    expect(note.author).toBe('ai');
+    // The ellipse carries rotation but none of the other new fields.
+    const ell = strokes.find((s) => s.id === 's_aaa5') as Stroke;
+    expect(ell.rotation).toBe(15);
+    expect('groupIds' in ell).toBe(false);
+    expect('author' in ell).toBe(false);
+  });
+});
+
+describe('serialize-only-non-default invariant for the v3 fields', () => {
+  test('a legacy stroke set emits NO v3 attribute', () => {
+    const strokes: Stroke[] = [
+      { id: 's_1', tool: 'rect', color: '#1f1f1f', width: 3, x: 0, y: 0, w: 10, h: 10 },
+      { id: 's_2', tool: 'arrow', color: '#1f1f1f', width: 3, x1: 0, y1: 0, x2: 9, y2: 0 },
+    ];
+    const svg = strokesToSvg(strokes);
+    expect(svg).not.toContain('data-group-ids');
+    expect(svg).not.toContain('data-author');
+    expect(svg).not.toContain('data-start-bind');
+    expect(svg).not.toContain('data-end-bind');
+  });
+
+  test('empty groupIds array serializes as no attribute', () => {
+    const svg = strokesToSvg([
+      {
+        id: 's_1',
+        tool: 'rect',
+        color: '#1f1f1f',
+        width: 3,
+        x: 0,
+        y: 0,
+        w: 10,
+        h: 10,
+        groupIds: [],
+      },
+    ]);
+    expect(svg).not.toContain('data-group-ids');
+  });
+});
+
+describe('poisoned input hardening', () => {
+  test('malformed / out-of-range bind values are rejected on parse', () => {
+    const bad = [
+      'data-start-bind="onlyhost"',
+      'data-start-bind="h 2 0.5"', // nx out of [0..1]
+      'data-start-bind="h NaN 0.5"',
+      'data-start-bind="h 0.5 -1"',
+    ];
+    for (const attr of bad) {
+      const svg = `<svg xmlns="http://www.w3.org/2000/svg" data-mdcc-annotations="1"><g data-id="s_x" data-tool="arrow" stroke="#1f1f1f" stroke-width="3" stroke-linecap="round" stroke-linejoin="round" vector-effect="non-scaling-stroke" fill="none" ${attr}><line x1="0" y1="0" x2="9" y2="0"/><polyline points="1,1 9,0 1,-1" fill="#1f1f1f"/></g></svg>`;
+      const arrow = svgToStrokes(svg).find((s) => s.tool === 'arrow') as ArrowStroke;
+      expect(arrow).toBeDefined();
+      expect(arrow.startBind).toBeUndefined();
+    }
+  });
+
+  test('data-author only honours the literal "ai"', () => {
+    const svg = `<svg xmlns="http://www.w3.org/2000/svg" data-mdcc-annotations="1"><rect data-id="s_x" data-tool="rect" stroke="#1f1f1f" stroke-width="3" stroke-linecap="round" stroke-linejoin="round" vector-effect="non-scaling-stroke" fill="none" x="0" y="0" width="10" height="10" data-author="evil"/></svg>`;
+    const rect = svgToStrokes(svg)[0] as RectStroke;
+    expect('author' in rect).toBe(false);
+  });
+
+  test('sanitizer still strips handlers glued next to the new attrs', () => {
+    const svg = `<svg xmlns="http://www.w3.org/2000/svg"><rect data-tool="rect" data-group-ids="g_1" onload="alert(1)" x="0" y="0" width="10" height="10"/></svg>`;
+    const clean = sanitizeAnnotationSvg(svg);
+    expect(clean).toContain('data-group-ids="g_1"');
+    expect(clean).not.toContain('onload');
+  });
+});
+
+describe('rotation (FigJam v3)', () => {
+  test('serializes data-rot + presentational transform only when non-zero; round-trips', () => {
+    const r: Stroke = {
+      id: 's_r',
+      tool: 'rect',
+      color: '#1f1f1f',
+      width: 3,
+      x: 0,
+      y: 0,
+      w: 100,
+      h: 50,
+      rotation: 30,
+    };
+    const svg = strokesToSvg([r]);
+    expect(svg).toContain('data-rot="30"');
+    expect(svg).toContain('transform="rotate(30 50 25)"');
+    const back = svgToStrokes(svg);
+    expect((back[0] as RectStroke).rotation).toBe(30);
+    expect(strokesToSvg(back)).toBe(svg);
+    expect(strokesToSvg([{ ...r, rotation: 0 }])).not.toContain('data-rot');
+    expect(sanitizeAnnotationSvg(svg)).toBe(svg);
+  });
+
+  test('hit-testing happens in the rotated frame', () => {
+    // A wide flat bar rotated 90° stands upright: a probe above the original
+    // top edge now hits; the original east tip is empty space.
+    const bar: Stroke = {
+      id: 's_b',
+      tool: 'rect',
+      color: '#000',
+      width: 2,
+      x: 0,
+      y: 0,
+      w: 100,
+      h: 10,
+      fill: '#fff',
+      rotation: 90,
+    };
+    expect(strokeHitTest(bar, 50, -40, 2)).toBe(true);
+    expect(strokeHitTest(bar, 95, 5, 2)).toBe(false);
+  });
+
+  test('pen/arrow/anchored text ignore rotation (no attr emitted)', () => {
+    const pen: Stroke = {
+      id: 's_p',
+      tool: 'pen',
+      color: '#000',
+      width: 3,
+      points: [
+        [0, 0],
+        [10, 10],
+      ],
+      rotation: 45,
+    };
+    expect(strokesToSvg([pen])).not.toContain('data-rot');
+  });
+});
+
+describe('polygon anchored text (Wave G)', () => {
+  const diamond: PolygonStroke = {
+    id: 'poly1',
+    tool: 'polygon',
+    shape: 'diamond',
+    color: '#1a1a1a',
+    width: 2,
+    x: 10,
+    y: 20,
+    w: 120,
+    h: 80,
+  };
+  const label: TextStroke = {
+    id: 'txt1',
+    tool: 'text',
+    color: '#1a1a1a',
+    fontSize: 16,
+    text: 'decision',
+    anchorId: 'poly1',
+  };
+
+  test('anchored text inherits a polygon host bbox', () => {
+    const anchors = new Map<string, AnchorHost>([[diamond.id, diamond]]);
+    expect(strokeBBox(label, anchors)).toEqual({ x: 10, y: 20, w: 120, h: 80 });
+  });
+
+  test('serialize → parse round-trips the anchor binding', () => {
+    const svg = strokesToSvg([diamond, label]);
+    expect(svg).toContain('data-anchor-id="poly1"');
+    const back = svgToStrokes(svg);
+    const txt = back.find((s) => s.tool === 'text') as TextStroke;
+    expect(txt.anchorId).toBe('poly1');
+    expect(strokesToSvg(back)).toBe(svg);
+  });
+});
+
+describe('shape-kind conversion (Wave H)', () => {
+  const base: RectStroke = {
+    id: 's_conv',
+    tool: 'rect',
+    color: '#3b82f6',
+    width: 3,
+    x: 10,
+    y: 20,
+    w: 100,
+    h: 60,
+    fill: '#e0ebfd',
+    rotation: 30,
+    groupIds: ['g_1'],
+  };
+
+  test('shapeKindOf maps every closed shape; null otherwise', () => {
+    expect(shapeKindOf(base)).toBe('square');
+    expect(shapeKindOf({ ...base, cornerRadius: 8 })).toBe('rounded');
+    expect(
+      shapeKindOf({ id: 'e', tool: 'ellipse', color: '#000', width: 2, cx: 0, cy: 0, rx: 5, ry: 5 })
+    ).toBe('circle');
+    expect(
+      shapeKindOf({
+        id: 'p',
+        tool: 'polygon',
+        shape: 'diamond',
+        color: '#000',
+        width: 2,
+        x: 0,
+        y: 0,
+        w: 10,
+        h: 10,
+      })
+    ).toBe('diamond');
+    expect(shapeKindOf({ id: 't', tool: 'text', color: '#000', fontSize: 14, text: 'x' })).toBe(
+      null
+    );
+  });
+
+  test('rect → circle preserves bbox, styling, rotation, groups, id', () => {
+    const patch = convertShapeKind(base, 'circle');
+    expect(patch).toMatchObject({ tool: 'ellipse', cx: 60, cy: 50, rx: 50, ry: 30 });
+    const converted = { ...base, ...patch } as Stroke;
+    // Styling + identity ride along via the merge; stale rect geometry cleared.
+    expect(converted.id).toBe('s_conv');
+    expect(converted.color).toBe('#3b82f6');
+    expect((converted as { fill?: string | null }).fill).toBe('#e0ebfd');
+    expect(converted.rotation).toBe(30);
+    expect(converted.groupIds).toEqual(['g_1']);
+    expect((converted as { x?: number }).x).toBeUndefined();
+  });
+
+  test('circle → diamond → square round-trips the bbox', () => {
+    const circle = {
+      id: 'e2',
+      tool: 'ellipse',
+      color: '#000',
+      width: 2,
+      cx: 60,
+      cy: 50,
+      rx: 50,
+      ry: 30,
+    } as Stroke;
+    const toDiamond = { ...circle, ...convertShapeKind(circle, 'diamond') } as Stroke;
+    expect(toDiamond).toMatchObject({
+      tool: 'polygon',
+      shape: 'diamond',
+      x: 10,
+      y: 20,
+      w: 100,
+      h: 60,
+    });
+    const toSquare = { ...toDiamond, ...convertShapeKind(toDiamond, 'square') } as Stroke;
+    expect(toSquare).toMatchObject({ tool: 'rect', x: 10, y: 20, w: 100, h: 60, cornerRadius: 0 });
+  });
+
+  test('identity + non-shape conversions return null', () => {
+    expect(convertShapeKind(base, 'square')).toBe(null);
+    expect(
+      convertShapeKind({ id: 't', tool: 'text', color: '#000', fontSize: 14, text: 'x' }, 'circle')
+    ).toBe(null);
+  });
+
+  test('converted stroke serializes cleanly and round-trips', () => {
+    const converted = { ...base, ...convertShapeKind(base, 'triangle') } as Stroke;
+    const svg = strokesToSvg([converted]);
+    expect(svg).toContain('data-shape="triangle"');
+    expect(strokesToSvg(svgToStrokes(svg))).toBe(svg);
+  });
+});
+
+describe('non-finite geometry hardening (Wave H — security F4)', () => {
+  test('Infinity / NaN / non-numeric coords clamp to 0 on parse (no off-board spoof)', () => {
+    // A poisoned/synced SVG carries x="1e999" (→ Infinity) and a non-numeric y.
+    const svg = `<svg xmlns="http://www.w3.org/2000/svg" data-mdcc-annotations="1"><rect data-id="s_evil" data-tool="rect" stroke="#1f1f1f" stroke-width="3" stroke-linecap="round" stroke-linejoin="round" vector-effect="non-scaling-stroke" fill="none" x="1e999" y="abc" width="100" height="50"/></svg>`;
+    const rect = svgToStrokes(svg)[0] as RectStroke;
+    expect(rect).toBeDefined();
+    expect(Number.isFinite(rect.x)).toBe(true);
+    expect(Number.isFinite(rect.y)).toBe(true);
+    expect(rect.x).toBe(0);
+    expect(rect.y).toBe(0);
+    // The bbox the AI reader + the renderer both consume is finite — they agree.
+    const bb = strokeBBox(rect);
+    expect(bb && Number.isFinite(bb.x) && Number.isFinite(bb.w)).toBe(true);
+  });
+
+  test('polygon with an Infinity vertex does not blow the bbox to Infinity', () => {
+    const svg = `<svg xmlns="http://www.w3.org/2000/svg" data-mdcc-annotations="1"><polygon data-id="s_p" data-tool="polygon" stroke="#1f1f1f" stroke-width="3" stroke-linecap="round" stroke-linejoin="round" vector-effect="non-scaling-stroke" fill="none" data-shape="diamond" points="50,0 1e999,25 50,50 0,25"/></svg>`;
+    const poly = svgToStrokes(svg)[0] as PolygonStroke;
+    if (poly) {
+      expect(Number.isFinite(poly.w)).toBe(true);
+      expect(Number.isFinite(poly.x)).toBe(true);
+    }
+  });
+
+  test('finite geometry is untouched (round-trip stays byte-identical)', () => {
+    const svg = `<svg xmlns="http://www.w3.org/2000/svg" data-mdcc-annotations="1"><rect data-id="s_ok" data-tool="rect" stroke="#1f1f1f" stroke-width="3" stroke-linecap="round" stroke-linejoin="round" vector-effect="non-scaling-stroke" fill="none" x="12.5" y="-3" width="100" height="50"/></svg>`;
+    expect(strokesToSvg(svgToStrokes(svg))).toBe(svg);
+  });
+});

package/apps/studio/test/fixtures/figjam-v3-groups-bindings.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" data-mdcc-annotations="1"><rect data-id="s_aaa1" data-tool="rect" stroke="#3b82f6" stroke-width="3" stroke-linecap="round" stroke-linejoin="round" vector-effect="non-scaling-stroke" fill="#e0ebfd" x="100" y="100" width="160" height="100" data-group-ids="g_team1"/><g data-id="s_aaa2" data-tool="sticky" data-r="8" data-fs="14" fill="#fce8a6" data-group-ids="g_inner g_team1"><rect x="320" y="100" width="200" height="200" rx="8" ry="8"/><text data-sticky-body="1" x="332" y="112" font-size="14" fill="#1a1a1a" dominant-baseline="hanging">flow start</text></g><g data-id="s_aaa3" data-tool="arrow" stroke="#1f1f1f" stroke-width="3" stroke-linecap="round" stroke-linejoin="round" vector-effect="non-scaling-stroke" fill="none" data-start-bind="s_aaa1 1 0.5" data-end-bind="s_aaa2 0 0.5 p"><line x1="260" y1="150" x2="320" y2="200"/><polyline points="307.1972004393032,196.78622909829892 320,200 314.5302123070536,187.9866148569984" fill="#1f1f1f"/></g><text data-id="s_aaa4" data-tool="text" x="100" y="260" data-font-size="14" fill="#1f1f1f" text-anchor="start" dominant-baseline="hanging" data-author="ai">AI note</text><ellipse data-id="s_aaa5" data-tool="ellipse" stroke="#30a46c" stroke-width="3" stroke-linecap="round" stroke-linejoin="round" vector-effect="non-scaling-stroke" fill="none" cx="700" cy="150" rx="60" ry="40" data-rot="15" transform="rotate(15 700 150)"/></svg>

package/apps/studio/test/shared-doc-migrate.test.ts

@@ -12,7 +12,8 @@ import * as Y from 'yjs';
 
 import { createPersistence, Y_TYPES } from '../collab/persistence.ts';
 import type { Context } from '../context.ts';
-import { applyCommentsToDoc, applyHtmlToDoc } from '../sync/codec.ts';
+import { applyCommentsToDoc, applyCssToDoc, applyHtmlToDoc } from '../sync/codec.ts';
+import { hashBytes } from '../sync/echo-guard.ts';
 import { docIsEmpty, migrateSeed } from '../sync/migrate-seed.ts';
 
 let dir: string;
@@ -43,28 +44,28 @@ describe('docIsEmpty', () => {
 });
 
 describe('migrateSeed — adopt (hub was empty)', () => {
-  test('seeds an empty doc from local files and reports local-adopt', () => {
+  test('seeds an empty doc from local files and reports local-adopt', async () => {
     const p = paths();
     writeFileSync(p.html, '<main>local body</main>');
     writeFileSync(p.comments, JSON.stringify([{ id: 'c1', text: 'local' }]));
 
     const doc = new Y.Doc();
-    const result = migrateSeed({ slug: 's', doc, paths: p });
+    const result = await migrateSeed({ slug: 's', doc, paths: p });
 
     expect(result).toBe('local-adopt');
     expect(doc.getText('html').toString()).toBe('<main>local body</main>');
     expect(doc.getArray(Y_TYPES.comments).toArray()).toEqual([{ id: 'c1', text: 'local' }]);
   });
 
-  test('empty doc + no local files → "empty" (nothing to seed)', () => {
+  test('empty doc + no local files → "empty" (nothing to seed)', async () => {
     const doc = new Y.Doc();
-    expect(migrateSeed({ slug: 's', doc, paths: paths() })).toBe('empty');
+    expect(await migrateSeed({ slug: 's', doc, paths: paths() })).toBe('empty');
     expect(docIsEmpty(doc)).toBe(true);
   });
 });
 
 describe('migrateSeed — idempotent (no duplication on re-run)', () => {
-  test('adopting twice leaves comments un-duplicated', () => {
+  test('adopting twice leaves comments un-duplicated', async () => {
     const p = paths();
     writeFileSync(
       p.comments,
@@ -75,12 +76,12 @@ describe('migrateSeed — idempotent (no duplication on re-run)', () => {
     );
 
     const doc = new Y.Doc();
-    expect(migrateSeed({ slug: 's', doc, paths: p })).toBe('local-adopt');
+    expect(await migrateSeed({ slug: 's', doc, paths: p })).toBe('local-adopt');
     expect(doc.getArray(Y_TYPES.comments).length).toBe(2);
 
     // Second run (e.g. server restart): the doc is now non-empty → hub-wins
     // branch → no re-adopt → still exactly 2 comments, byte-identical.
-    expect(migrateSeed({ slug: 's', doc, paths: p })).toBe('hub-wins');
+    expect(await migrateSeed({ slug: 's', doc, paths: p })).toBe('hub-wins');
     expect(doc.getArray(Y_TYPES.comments).toArray()).toEqual([
       { id: 'c1', text: 'x' },
       { id: 'c2', text: 'y' },
@@ -123,7 +124,7 @@ describe('room file-seed disable (the other half of the Risk-1 fix)', () => {
 });
 
 describe('migrateSeed — hub-wins (the duplication trap avoided)', () => {
-  test('a doc already holding hub comments is NOT merged with the local file → no dup', () => {
+  test('a doc already holding hub comments is NOT merged with the local file → no dup', async () => {
     const p = paths();
     // Local file (e.g. copied via git) holds the SAME logical comment id…
     writeFileSync(p.comments, JSON.stringify([{ id: 'c1', text: 'from disk' }]));
@@ -132,14 +133,15 @@ describe('migrateSeed — hub-wins (the duplication trap avoided)', () => {
     const doc = new Y.Doc();
     applyCommentsToDoc(doc, [{ id: 'c1', text: 'from hub' }], 'hub');
 
-    const result = migrateSeed({ slug: 's', doc, paths: p });
+    const result = await migrateSeed({ slug: 's', doc, paths: p });
 
-    // Hub wins; the local file is NOT pushed as a second item — exactly ONE c1.
+    // Hub wins; the local file is NOT pushed as a second item — exactly ONE c1
+    // (DDR-102 id-union keeps the doc's version for a shared id).
     expect(result).toBe('hub-wins');
     expect(doc.getArray(Y_TYPES.comments).toArray()).toEqual([{ id: 'c1', text: 'from hub' }]);
   });
 
-  test('snapshots divergent local files to historyDir before the hub-wins overwrite', () => {
+  test('snapshots divergent local files to historyDir before the hub-wins overwrite', async () => {
     const p = paths();
     writeFileSync(p.html, '<main>LOCAL divergent</main>');
     writeFileSync(p.comments, JSON.stringify([{ id: 'local' }]));
@@ -148,12 +150,220 @@ describe('migrateSeed — hub-wins (the duplication trap avoided)', () => {
     applyHtmlToDoc(doc, '<main>HUB</main>', 'hub'); // doc holds hub state
 
     const historyDir = join(dir, '_history', 's');
-    const result = migrateSeed({ slug: 's', doc, paths: p, historyDir });
+    // DDR-102: this divergence (no journal, no doc stamp) resolves
+    // conflict-hub-wins — the legacy whole-set safety copy still happens.
+    const result = await migrateSeed({ slug: 's', doc, paths: p, historyDir });
 
-    expect(result).toBe('hub-wins');
+    expect(result).toBe('conflict-hub-wins');
     // The pre-migration snapshot captured the local files for rollback.
     const snapped = readdirSync(join(historyDir, 'pre-shared-doc-migration'));
     expect(snapped).toContain('screen.html');
     expect(snapped).toContain('screen.comments.json');
   });
 });
+
+// ---------------------------------------------------------------------------
+// DDR-102 — the shared-doc path consumes the same cold-start decision table:
+// journal-gated fast-forward, dual snapshot + newest-wins on divergence,
+// comments id-union.
+describe('migrateSeed — DDR-102 divergence matrix', () => {
+  function makeJournal(initial: Record<string, { bodyHash: string }> = {}) {
+    const entries = new Map(Object.entries(initial));
+    return {
+      get: (slug: string) => entries.get(slug) ?? null,
+      record: (slug: string, hashes: { bodyHash?: string; cssHash?: string }) => {
+        const prev = entries.get(slug);
+        entries.set(slug, { bodyHash: hashes.bodyHash ?? prev?.bodyHash ?? '' });
+      },
+      invalidateIfHubChanged: () => {},
+      flush: () => {},
+      stop: () => {},
+      size: () => entries.size,
+    };
+  }
+
+  test('journal match → fast-forward (hub keeps), no snapshot, no conflict', async () => {
+    const p = paths();
+    writeFileSync(p.html, '<main>synced-v1</main>');
+    const doc = new Y.Doc();
+    applyHtmlToDoc(doc, '<main>hub-v2</main>', 'hub');
+
+    const journal = makeJournal({ s: { bodyHash: hashBytes('<main>synced-v1</main>') } });
+    const snapshots: string[] = [];
+    const conflicts: unknown[] = [];
+    const result = await migrateSeed({
+      slug: 's',
+      doc,
+      paths: p,
+      journal,
+      snapshot: async (_c, reason) => {
+        snapshots.push(reason);
+        return 'ts';
+      },
+      onConflict: (info) => {
+        conflicts.push(info);
+      },
+    });
+
+    expect(result).toBe('hub-wins');
+    expect(doc.getText('html').toString()).toBe('<main>hub-v2</main>'); // doc untouched
+    expect(snapshots).toHaveLength(0);
+    expect(conflicts).toHaveLength(0);
+  });
+
+  test('diverged + local newer → conflict-local-wins: doc REBUILT from local in one MIGRATION tx', async () => {
+    const p = paths();
+    writeFileSync(p.html, '<main>local-newer</main>');
+    writeFileSync(p.css, '.local{}');
+    const doc = new Y.Doc();
+    doc.transact(() => {
+      applyHtmlToDoc(doc, '<main>hub-older</main>', 'hub');
+      applyCssToDoc(doc, '.hub{}', 'hub');
+      doc.getMap('syncMeta').set('bodyEditAt', Date.now() - 60_000);
+    });
+
+    const snapshots: Array<{ content: string; reason: string }> = [];
+    const conflicts: Array<{ winner?: string; snapshots?: { local?: string; hub?: string } }> = [];
+    const result = await migrateSeed({
+      slug: 's',
+      doc,
+      paths: p,
+      journal: makeJournal(),
+      snapshot: async (content, reason) => {
+        snapshots.push({ content, reason });
+        return `ts-${snapshots.length}`;
+      },
+      onConflict: (info) => {
+        conflicts.push(info);
+      },
+    });
+
+    expect(result).toBe('conflict-local-wins');
+    expect(doc.getText('html').toString()).toBe('<main>local-newer</main>');
+    // css follows the body winner.
+    expect(doc.getText('css').toString()).toBe('.local{}');
+    // Dual snapshot captured BOTH pre-resolution versions.
+    expect(snapshots.map((s) => s.reason)).toEqual(['pre-sync-local', 'pre-sync-hub']);
+    expect(snapshots[0].content).toBe('<main>local-newer</main>');
+    expect(snapshots[1].content).toBe('<main>hub-older</main>');
+    expect(conflicts[0].winner).toBe('local');
+    expect(conflicts[0].snapshots).toEqual({ local: 'ts-1', hub: 'ts-2' });
+  });
+
+  test('diverged + hub newer (stamp) → conflict-hub-wins: doc untouched', async () => {
+    const p = paths();
+    writeFileSync(p.html, '<main>local-older</main>');
+    const doc = new Y.Doc();
+    doc.transact(() => {
+      applyHtmlToDoc(doc, '<main>hub-newer</main>', 'hub');
+      doc.getMap('syncMeta').set('bodyEditAt', Date.now() + 60_000);
+    });
+
+    const conflicts: Array<{ winner?: string }> = [];
+    const result = await migrateSeed({
+      slug: 's',
+      doc,
+      paths: p,
+      journal: makeJournal(),
+      onConflict: (info) => {
+        conflicts.push(info);
+      },
+    });
+
+    expect(result).toBe('conflict-hub-wins');
+    expect(doc.getText('html').toString()).toBe('<main>hub-newer</main>');
+    expect(conflicts[0].winner).toBe('hub');
+  });
+
+  test('doc holds comments but NO body + local body → body-seed-up (gap closed)', async () => {
+    const p = paths();
+    writeFileSync(p.html, '<main>only-local-body</main>');
+    const doc = new Y.Doc();
+    doc.getArray(Y_TYPES.comments).push([{ id: 'h1' }]); // doc non-empty, body empty
+
+    const result = await migrateSeed({ slug: 's', doc, paths: p, journal: makeJournal() });
+
+    expect(result).toBe('body-seed-up');
+    expect(doc.getText('html').toString()).toBe('<main>only-local-body</main>');
+    // Hub comments survive untouched.
+    expect(doc.getArray(Y_TYPES.comments).toArray()).toEqual([{ id: 'h1' }]);
+  });
+
+  test('comments id-union: local-only comments survive a hub-wins cutover', async () => {
+    const p = paths();
+    writeFileSync(p.html, '<main>same</main>');
+    writeFileSync(
+      p.comments,
+      JSON.stringify([
+        { id: 'c1', text: 'shared' },
+        { id: 'c3', text: 'local-only' },
+      ])
+    );
+    const doc = new Y.Doc();
+    doc.transact(() => {
+      applyHtmlToDoc(doc, '<main>same</main>', 'hub');
+      applyCommentsToDoc(
+        doc,
+        [
+          { id: 'c1', text: 'shared (hub copy wins)' },
+          { id: 'c2', text: 'hub-only' },
+        ],
+        'hub'
+      );
+    });
+
+    const result = await migrateSeed({ slug: 's', doc, paths: p });
+
+    expect(result).toBe('hub-wins');
+    expect(doc.getArray(Y_TYPES.comments).toArray()).toEqual([
+      { id: 'c1', text: 'shared (hub copy wins)' },
+      { id: 'c2', text: 'hub-only' },
+      { id: 'c3', text: 'local-only' },
+    ]);
+  });
+});
+
+// DDR-102 fail-closed (security review F1) — the shared-doc path must also
+// refuse a hub-wins cutover when the local snapshot didn't land.
+describe('migrateSeed — fail-closed on snapshot failure (DDR-102 F1)', () => {
+  function makeJournal() {
+    const entries = new Map<string, { bodyHash: string }>();
+    return {
+      get: (slug: string) => entries.get(slug) ?? null,
+      record: (slug: string, h: { bodyHash?: string; cssHash?: string }) =>
+        entries.set(slug, { bodyHash: h.bodyHash ?? entries.get(slug)?.bodyHash ?? '' }),
+      invalidateIfHubChanged: () => {},
+      flush: () => {},
+      stop: () => {},
+      size: () => entries.size,
+    };
+  }
+
+  test('hub newer BUT local snapshot null → rebuild doc from local (no overwrite), conflict-local-wins', async () => {
+    const p = paths();
+    writeFileSync(p.html, '<main>local-work</main>');
+    const doc = new Y.Doc();
+    doc.transact(() => {
+      applyHtmlToDoc(doc, '<main>hub-stale</main>', 'hub');
+      doc.getMap('syncMeta').set('bodyEditAt', Date.now() + 60_000); // hub would win
+    });
+
+    const conflicts: Array<{ winner?: string; snapshotFailed?: boolean }> = [];
+    const result = await migrateSeed({
+      slug: 's',
+      doc,
+      paths: p,
+      journal: makeJournal(),
+      snapshot: async () => null, // _history write fails
+      onConflict: (info) => {
+        conflicts.push(info);
+      },
+    });
+
+    // Doc rebuilt from local → projection would write local back (no loss).
+    expect(result).toBe('conflict-local-wins');
+    expect(doc.getText('html').toString()).toBe('<main>local-work</main>');
+    expect(conflicts[0].winner).toBe('local');
+    expect(conflicts[0].snapshotFailed).toBe(true);
+  });
+});