@1agh/maude 0.30.0 → 0.31.0

package/apps/studio/test/canvas-list-watch.test.ts

@@ -0,0 +1,322 @@
+// canvas-list-watch — external-canvas list watcher. Emits `canvas-list-update`
+// when a canvas file appears/disappears on disk from OUTSIDE the dev-server
+// (the ACP agent's `/design:new`, agent Write, git checkout), so the browser
+// file tree refreshes without a reload.
+// RCA: .ai/logs/rca/issue-acp-new-canvas-not-in-filetree.md
+
+import { describe, expect, test } from 'bun:test';
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+import {
+  CANVAS_LIST_DEBOUNCE_MS,
+  createCanvasListWatch,
+  isCanvasCandidate,
+} from '../canvas-list-watch.ts';
+import { type Context, createBus } from '../context.ts';
+import { createFsWatch } from '../fs-watch.ts';
+
+const GROUPS = [
+  { label: 'System', path: 'system' },
+  { label: 'UI', path: 'ui' },
+];
+
+function sandbox(): { root: string; designRoot: string } {
+  const root = mkdtempSync(join(tmpdir(), 'clw-test-'));
+  const designRoot = join(root, '.design');
+  mkdirSync(join(designRoot, 'ui'), { recursive: true });
+  return { root, designRoot };
+}
+
+function mkCtx(designRoot: string): Context {
+  return {
+    cfg: { canvasGroups: GROUPS } as Context['cfg'],
+    projectLabel: '',
+    paths: { designRoot, designRel: '.design' } as Context['paths'],
+    bus: createBus(),
+  };
+}
+
+const TSX = 'export default function C(){return null}';
+
+interface Update {
+  action?: string;
+  rel?: string;
+  slug?: string;
+}
+
+function collect(ctx: Context): Update[] {
+  const got: Update[] = [];
+  ctx.bus.on('canvas-list-update', (p) => got.push(p as Update));
+  return got;
+}
+
+describe('canvas-list-watch / isCanvasCandidate (pure gate)', () => {
+  const groups = ['system', 'ui'];
+  test('accepts openable canvases under a configured group', () => {
+    expect(isCanvasCandidate('ui/Pricing.tsx', groups)).toBe(true);
+    expect(isCanvasCandidate('ui/project/Pricing.tsx', groups)).toBe(true);
+    expect(isCanvasCandidate('ui/Smoke.html', groups)).toBe(true);
+    // DS preview specimens DO show in the tree, so they must trigger a refresh.
+    expect(isCanvasCandidate('system/project/preview/colors.tsx', groups)).toBe(true);
+  });
+
+  test('rejects non-canvas extensions (sidecars, tokens, docs)', () => {
+    expect(isCanvasCandidate('ui/Pricing.meta.json', groups)).toBe(false);
+    expect(isCanvasCandidate('ui/Pricing.css', groups)).toBe(false);
+    expect(isCanvasCandidate('system/project/README.md', groups)).toBe(false);
+  });
+
+  test('rejects runtime-state (`_`-prefixed segment) + SKIP_DIRS', () => {
+    expect(isCanvasCandidate('_history/ui-x/00-screen.tsx', groups)).toBe(false);
+    expect(isCanvasCandidate('ui/_draft.tsx', groups)).toBe(false);
+    expect(isCanvasCandidate('_active.json', groups)).toBe(false);
+    expect(isCanvasCandidate('node_modules/pkg/index.tsx', groups)).toBe(false);
+  });
+
+  test('rejects canvases outside any configured group', () => {
+    expect(isCanvasCandidate('docs/Thing.tsx', groups)).toBe(false);
+    expect(isCanvasCandidate('Thing.tsx', groups)).toBe(false);
+  });
+
+  test('non-string / empty input is rejected, not thrown', () => {
+    expect(isCanvasCandidate('', groups)).toBe(false);
+    expect(isCanvasCandidate(undefined as unknown as string, groups)).toBe(false);
+  });
+});
+
+describe('canvas-list-watch / diff + emit', () => {
+  test('seeding existing canvases emits nothing', async () => {
+    const { root, designRoot } = sandbox();
+    writeFileSync(join(designRoot, 'ui', 'Existing.tsx'), TSX);
+    const ctx = mkCtx(designRoot);
+    const got = collect(ctx);
+    const w = createCanvasListWatch(ctx, { debounceMs: 10 });
+    await w.ready;
+    try {
+      expect(got).toHaveLength(0);
+      expect(w.known.has('.design/ui/Existing.tsx')).toBe(true);
+    } finally {
+      w.stop();
+      rmSync(root, { recursive: true, force: true });
+    }
+  });
+
+  test('a canvas written straight to disk emits action:added (the bug)', async () => {
+    const { root, designRoot } = sandbox();
+    const ctx = mkCtx(designRoot);
+    const got = collect(ctx);
+    const w = createCanvasListWatch(ctx, { debounceMs: 10 });
+    await w.ready;
+    try {
+      // Simulate `/design:new` writing the canvas (and its sidecar) directly —
+      // NO API call, so api.ts never emits.
+      writeFileSync(join(designRoot, 'ui', 'Pricing.tsx'), TSX);
+      writeFileSync(join(designRoot, 'ui', 'Pricing.meta.json'), '{}');
+      await w.refresh();
+      expect(got).toHaveLength(1);
+      expect(got[0]?.action).toBe('added');
+      expect(got[0]?.slug).toBe('ui-pricing');
+    } finally {
+      w.stop();
+      rmSync(root, { recursive: true, force: true });
+    }
+  });
+
+  test('deleting a canvas on disk emits action:removed', async () => {
+    const { root, designRoot } = sandbox();
+    const ctx = mkCtx(designRoot);
+    const got = collect(ctx);
+    const w = createCanvasListWatch(ctx, { debounceMs: 10 });
+    await w.ready;
+    try {
+      const abs = join(designRoot, 'ui', 'Gone.tsx');
+      writeFileSync(abs, TSX);
+      await w.refresh();
+      got.length = 0; // drop the 'added'
+      rmSync(abs);
+      await w.refresh();
+      expect(got).toHaveLength(1);
+      expect(got[0]?.action).toBe('removed');
+      expect(got[0]?.slug).toBe('ui-gone');
+    } finally {
+      w.stop();
+      rmSync(root, { recursive: true, force: true });
+    }
+  });
+
+  test('editing an existing canvas body emits nothing (no tree thrash)', async () => {
+    const { root, designRoot } = sandbox();
+    const abs = join(designRoot, 'ui', 'Edited.tsx');
+    writeFileSync(abs, TSX);
+    const ctx = mkCtx(designRoot);
+    const got = collect(ctx);
+    const w = createCanvasListWatch(ctx, { debounceMs: 10 });
+    await w.ready;
+    try {
+      writeFileSync(abs, `${TSX}\n// edited`);
+      writeFileSync(join(designRoot, 'ui', 'Edited.meta.json'), '{"x":1}');
+      await w.refresh();
+      expect(got).toHaveLength(0);
+    } finally {
+      w.stop();
+      rmSync(root, { recursive: true, force: true });
+    }
+  });
+
+  test('runtime-state + sidecar writes never emit', async () => {
+    const { root, designRoot } = sandbox();
+    const ctx = mkCtx(designRoot);
+    const got = collect(ctx);
+    const w = createCanvasListWatch(ctx, { debounceMs: 10 });
+    await w.ready;
+    try {
+      writeFileSync(join(designRoot, '_active.json'), '{}');
+      mkdirSync(join(designRoot, '_canvas-state'), { recursive: true });
+      writeFileSync(join(designRoot, '_canvas-state', 'ui-x.view.json'), '{}');
+      writeFileSync(join(designRoot, 'config.json'), '{}');
+      await w.refresh();
+      expect(got).toHaveLength(0);
+    } finally {
+      w.stop();
+      rmSync(root, { recursive: true, force: true });
+    }
+  });
+});
+
+describe('canvas-list-watch / live fs:any path', () => {
+  test('a candidate fs:any event schedules a debounced refresh that emits', async () => {
+    const { root, designRoot } = sandbox();
+    const ctx = mkCtx(designRoot);
+    const got = collect(ctx);
+    const w = createCanvasListWatch(ctx, { debounceMs: 20 });
+    await w.ready;
+    try {
+      writeFileSync(join(designRoot, 'ui', 'Live.tsx'), TSX);
+      // The fs-watch would emit this; assert the subscriber wires through.
+      ctx.bus.emit('fs:any', 'ui/Live.tsx');
+      await new Promise((r) => setTimeout(r, 20 + 80));
+      await w.refresh(); // flush the chain
+      const added = got.find((m) => m.action === 'added' && m.slug === 'ui-live');
+      expect(added).toBeTruthy();
+      // Exactly one 'added' — the timer + the explicit flush must not double-emit.
+      expect(got.filter((m) => m.action === 'added' && m.slug === 'ui-live')).toHaveLength(1);
+    } finally {
+      w.stop();
+      rmSync(root, { recursive: true, force: true });
+    }
+  });
+
+  test('a non-candidate fs:any event does not schedule a refresh', async () => {
+    const { root, designRoot } = sandbox();
+    const ctx = mkCtx(designRoot);
+    const got = collect(ctx);
+    const w = createCanvasListWatch(ctx, { debounceMs: 20 });
+    await w.ready;
+    try {
+      // Create a canvas but only announce a NON-candidate path. The gate must
+      // skip the recompute, so the new canvas stays unseen until a real event.
+      writeFileSync(join(designRoot, 'ui', 'Sneaky.tsx'), TSX);
+      ctx.bus.emit('fs:any', 'ui/Sneaky.meta.json');
+      ctx.bus.emit('fs:any', '_active.json');
+      await new Promise((r) => setTimeout(r, 20 + 80));
+      expect(got).toHaveLength(0);
+    } finally {
+      w.stop();
+      rmSync(root, { recursive: true, force: true });
+    }
+  });
+
+  test('stop() unsubscribes — later events are ignored', async () => {
+    const { root, designRoot } = sandbox();
+    const ctx = mkCtx(designRoot);
+    const got = collect(ctx);
+    const w = createCanvasListWatch(ctx, { debounceMs: 10 });
+    await w.ready;
+    w.stop();
+    try {
+      writeFileSync(join(designRoot, 'ui', 'After.tsx'), TSX);
+      ctx.bus.emit('fs:any', 'ui/After.tsx');
+      await new Promise((r) => setTimeout(r, CANVAS_LIST_DEBOUNCE_MS + 40));
+      expect(got).toHaveLength(0);
+    } finally {
+      rmSync(root, { recursive: true, force: true });
+    }
+  });
+});
+
+describe('canvas-list-watch / serialization + multi-remove', () => {
+  test('overlapping refresh() calls serialize — a create between them emits exactly once', async () => {
+    const { root, designRoot } = sandbox();
+    const ctx = mkCtx(designRoot);
+    const got = collect(ctx);
+    const w = createCanvasListWatch(ctx, { debounceMs: 10 });
+    await w.ready;
+    try {
+      writeFileSync(join(designRoot, 'ui', 'Pair.tsx'), TSX);
+      // Fire two refreshes WITHOUT awaiting the first. The promise-chain must
+      // serialize them: the first diffs the create against the pre-create set
+      // and updates `known`; the second sees no change. Without the chain both
+      // would snapshot concurrently against the stale `known` and emit twice.
+      const a = w.refresh();
+      const b = w.refresh();
+      await Promise.all([a, b]);
+      expect(got.filter((m) => m.action === 'added' && m.slug === 'ui-pair')).toHaveLength(1);
+    } finally {
+      w.stop();
+      rmSync(root, { recursive: true, force: true });
+    }
+  });
+
+  test('removing a whole group subdir emits one removed per canvas (git-checkout shape)', async () => {
+    const { root, designRoot } = sandbox();
+    mkdirSync(join(designRoot, 'ui', 'project'), { recursive: true });
+    writeFileSync(join(designRoot, 'ui', 'project', 'A.tsx'), TSX);
+    writeFileSync(join(designRoot, 'ui', 'project', 'B.tsx'), TSX);
+    const ctx = mkCtx(designRoot);
+    const got = collect(ctx);
+    const w = createCanvasListWatch(ctx, { debounceMs: 10 });
+    await w.ready;
+    try {
+      rmSync(join(designRoot, 'ui', 'project'), { recursive: true, force: true });
+      await w.refresh();
+      const removed = got.filter((m) => m.action === 'removed').map((m) => m.slug);
+      expect(removed.sort()).toEqual(['ui-project-a', 'ui-project-b']);
+    } finally {
+      w.stop();
+      rmSync(root, { recursive: true, force: true });
+    }
+  });
+});
+
+describe('canvas-list-watch / real fs-watch end-to-end', () => {
+  test('a raw disk write through createFsWatch emits added (the actual bug path)', async () => {
+    const { root, designRoot } = sandbox();
+    const ctx = mkCtx(designRoot);
+    const got = collect(ctx);
+    const fsWatch = createFsWatch(ctx);
+    const w = createCanvasListWatch(ctx, { debounceMs: 30 });
+    await w.ready;
+    fsWatch.start();
+    try {
+      // Let the OS watcher arm, then write straight to disk — NO manual bus
+      // emit. This exercises the genuine ACP-agent path: disk write →
+      // fs.watch → fs:any → gate → debounce → snapshot diff → canvas-list-update.
+      await new Promise((r) => setTimeout(r, 60));
+      writeFileSync(join(designRoot, 'ui', 'Real.tsx'), TSX);
+      const deadline = Date.now() + 3000;
+      while (
+        Date.now() < deadline &&
+        !got.some((m) => m.action === 'added' && m.slug === 'ui-real')
+      ) {
+        await new Promise((r) => setTimeout(r, 50));
+      }
+      expect(got.some((m) => m.action === 'added' && m.slug === 'ui-real')).toBe(true);
+    } finally {
+      fsWatch.stop();
+      w.stop();
+      rmSync(root, { recursive: true, force: true });
+    }
+  }, 10_000);
+});

package/apps/studio/test/canvas-meta-api.test.ts

@@ -1,15 +1,21 @@
 // Phase 4 T5 — `/_api/canvas-meta` GET/PATCH endpoint round-trip.
+// DDR-115 — per-user camera split: `viewport` lives in a gitignored per-machine
+// view file (`_canvas-state/<slug>.view.json`), NEVER inline in the versioned
+// `.meta.json`. PATCH splits the lanes; GET merges them back.
 //
 // Verifies:
-//   - PATCH merges `viewport` into an existing `<canvas>.meta.json`
-//   - PATCH preserves other top-level keys (title, sections, ai_context …)
-//   - PATCH clamps zoom to [0.1, 4.0]
-//   - PATCH rejects non-finite viewport coords (no write, returns prior)
-//   - GET returns the merged meta
-//   - Paths that escape repoRoot are 400
+//   - PATCH `viewport` leaves `.meta.json` BYTE-UNCHANGED + writes the view file
+//     (the mouse-move churn killer) — and a viewport-only patch on a meta-less
+//     canvas still succeeds
+//   - PATCH clamps zoom to [0.1, 4.0] / rejects non-finite coords (view file)
+//   - GET merges the view file's viewport into the returned meta
+//   - GET strips a stale inline viewport from a legacy meta
+//   - PATCH `layout` writes meta AND bumps `last_modified` (a real shared change)
+//   - PATCH layout persists position-only entries (DDR-027)
+//   - Paths that escape repoRoot are 404
 
 import { describe, expect, test } from 'bun:test';
-import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 
 import { bootServer, killProc, makeSandbox, nextPort } from './_helpers.ts';
@@ -29,8 +35,13 @@ function repoRel(designRoot: string, abs: string): string {
   return abs.startsWith(`${repoRoot}/`) ? abs.slice(repoRoot.length + 1) : abs;
 }
 
-describe('/_api/canvas-meta — GET/PATCH', () => {
-  test('PATCH merges viewport onto existing meta and preserves other keys', async () => {
+/** `_canvas-state/<slug>.view.json` for a `<designRoot>/ui/<Name>.tsx` canvas. */
+function viewPath(designRoot: string, slug: string): string {
+  return join(designRoot, '_canvas-state', `${slug}.view.json`);
+}
+
+describe('/_api/canvas-meta — GET/PATCH (DDR-115 camera split)', () => {
+  test('PATCH viewport leaves meta byte-unchanged + writes the view file (churn killer)', async () => {
     const { root, designRoot } = makeSandbox();
     const port = nextPort();
     const proc = await bootServer(root, port);
@@ -47,6 +58,7 @@ describe('/_api/canvas-meta — GET/PATCH', () => {
           ai_context: { pinned_decisions: ['keep dc-* classes'] },
         })
       );
+      const before = readFileSync(metaAbs, 'utf8');
       const file = repoRel(designRoot, tsxAbs);
 
       const r = await fetch(`http://localhost:${port}/_api/canvas-meta`, {
@@ -56,16 +68,48 @@ describe('/_api/canvas-meta — GET/PATCH', () => {
       });
       expect(r.status).toBe(200);
       const merged = (await r.json()) as MetaShape;
+      // The returned object is GET-shaped: shared keys + the camera merged in.
       expect(merged.title).toBe('Phase 4');
       expect(merged.sections).toBeDefined();
       expect(merged.ai_context).toBeDefined();
       expect(merged.viewport).toEqual({ x: 12, y: 34, zoom: 1.5 });
-      expect(typeof merged.last_modified).toBe('string');
 
-      // On-disk reflects the merge.
-      const onDisk = JSON.parse(readFileSync(metaAbs, 'utf8')) as MetaShape;
-      expect(onDisk.viewport?.zoom).toBe(1.5);
-      expect(onDisk.title).toBe('Phase 4');
+      // KEYSTONE — the versioned meta is byte-identical; no viewport, no
+      // last_modified bump on a viewport-only patch.
+      expect(readFileSync(metaAbs, 'utf8')).toBe(before);
+
+      // The camera landed in the gitignored per-machine view file.
+      const vAbs = viewPath(designRoot, 'ui-phase4');
+      expect(existsSync(vAbs)).toBe(true);
+      const view = JSON.parse(readFileSync(vAbs, 'utf8'));
+      expect(view.viewport).toEqual({ x: 12, y: 34, zoom: 1.5 });
+    } finally {
+      await killProc(proc);
+    }
+  });
+
+  test('PATCH viewport succeeds on a canvas with no meta yet (writes only the view file)', async () => {
+    const { root, designRoot } = makeSandbox();
+    const port = nextPort();
+    const proc = await bootServer(root, port);
+    try {
+      mkdirSync(join(designRoot, 'ui'), { recursive: true });
+      const tsxAbs = join(designRoot, 'ui', 'NoMeta.tsx');
+      writeFileSync(tsxAbs, 'export default function N(){return <main/>}\n');
+      const metaAbs = tsxAbs.replace(/\.tsx$/, '.meta.json');
+      const file = repoRel(designRoot, tsxAbs);
+
+      const r = await fetch(`http://localhost:${port}/_api/canvas-meta`, {
+        method: 'PATCH',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ file, patch: { viewport: { x: 1, y: 2, zoom: 2 } } }),
+      });
+      expect(r.status).toBe(200);
+      const merged = (await r.json()) as MetaShape;
+      expect(merged.viewport).toEqual({ x: 1, y: 2, zoom: 2 });
+      // No meta was conjured into existence.
+      expect(existsSync(metaAbs)).toBe(false);
+      expect(existsSync(viewPath(designRoot, 'ui-nometa'))).toBe(true);
     } finally {
       await killProc(proc);
     }
@@ -102,7 +146,7 @@ describe('/_api/canvas-meta — GET/PATCH', () => {
     }
   });
 
-  test('PATCH ignores non-finite viewport (NaN/Infinity)', async () => {
+  test('PATCH ignores non-finite viewport (NaN/Infinity) — keeps the prior camera', async () => {
     const { root, designRoot } = makeSandbox();
     const port = nextPort();
     const proc = await bootServer(root, port);
@@ -110,36 +154,44 @@ describe('/_api/canvas-meta — GET/PATCH', () => {
       mkdirSync(join(designRoot, 'ui'), { recursive: true });
       const tsxAbs = join(designRoot, 'ui', 'Bad.tsx');
       writeFileSync(tsxAbs, 'export default function B(){return <main/>}\n');
-      writeFileSync(
-        tsxAbs.replace(/\.tsx$/, '.meta.json'),
-        '{"title":"Bad","viewport":{"x":1,"y":2,"zoom":1}}'
-      );
+      writeFileSync(tsxAbs.replace(/\.tsx$/, '.meta.json'), '{"title":"Bad"}');
       const file = repoRel(designRoot, tsxAbs);
 
+      // Seed a valid camera (writes the view file).
+      await fetch(`http://localhost:${port}/_api/canvas-meta`, {
+        method: 'PATCH',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ file, patch: { viewport: { x: 1, y: 2, zoom: 1 } } }),
+      });
+
       const r = await fetch(`http://localhost:${port}/_api/canvas-meta`, {
         method: 'PATCH',
         headers: { 'content-type': 'application/json' },
         body: JSON.stringify({ file, patch: { viewport: { x: 'nope', y: null, zoom: 1 } } }),
       });
       const m = (await r.json()) as MetaShape;
-      // Prior value preserved.
+      // Prior valid camera preserved (the bad patch was a no-op for the view file).
       expect(m.viewport).toEqual({ x: 1, y: 2, zoom: 1 });
+      const view = JSON.parse(readFileSync(viewPath(designRoot, 'ui-bad'), 'utf8'));
+      expect(view.viewport).toEqual({ x: 1, y: 2, zoom: 1 });
     } finally {
       await killProc(proc);
     }
   });
 
-  test('GET returns the meta document', async () => {
+  test('GET merges the view file viewport into the returned meta', async () => {
     const { root, designRoot } = makeSandbox();
     const port = nextPort();
     const proc = await bootServer(root, port);
     try {
       mkdirSync(join(designRoot, 'ui'), { recursive: true });
-      const tsxAbs = join(designRoot, 'ui', 'Read.tsx');
-      writeFileSync(tsxAbs, 'export default function R(){return <main/>}\n');
+      const tsxAbs = join(designRoot, 'ui', 'Merge.tsx');
+      writeFileSync(tsxAbs, 'export default function M(){return <main/>}\n');
+      writeFileSync(tsxAbs.replace(/\.tsx$/, '.meta.json'), JSON.stringify({ title: 'Merge' }));
+      mkdirSync(join(designRoot, '_canvas-state'), { recursive: true });
       writeFileSync(
-        tsxAbs.replace(/\.tsx$/, '.meta.json'),
-        JSON.stringify({ title: 'Read', viewport: { x: 5, y: 6, zoom: 0.5 } })
+        viewPath(designRoot, 'ui-merge'),
+        JSON.stringify({ viewport: { x: 7, y: 8, zoom: 0.5 } })
       );
       const file = repoRel(designRoot, tsxAbs);
 
@@ -148,8 +200,69 @@ describe('/_api/canvas-meta — GET/PATCH', () => {
       );
       expect(r.status).toBe(200);
       const m = (await r.json()) as MetaShape;
-      expect(m.title).toBe('Read');
-      expect(m.viewport?.zoom).toBe(0.5);
+      expect(m.title).toBe('Merge');
+      expect(m.viewport).toEqual({ x: 7, y: 8, zoom: 0.5 });
+    } finally {
+      await killProc(proc);
+    }
+  });
+
+  test('GET strips a stale inline viewport from a legacy meta (no view file)', async () => {
+    const { root, designRoot } = makeSandbox();
+    const port = nextPort();
+    const proc = await bootServer(root, port);
+    try {
+      mkdirSync(join(designRoot, 'ui'), { recursive: true });
+      const tsxAbs = join(designRoot, 'ui', 'Legacy.tsx');
+      writeFileSync(tsxAbs, 'export default function L(){return <main/>}\n');
+      // A pre-DDR-115 meta with the camera baked inline + a stale last_modified.
+      writeFileSync(
+        tsxAbs.replace(/\.tsx$/, '.meta.json'),
+        JSON.stringify({
+          title: 'Legacy',
+          viewport: { x: 5, y: 6, zoom: 0.5 },
+          last_modified: '2020-01-01T00:00:00.000Z',
+        })
+      );
+      const file = repoRel(designRoot, tsxAbs);
+
+      const r = await fetch(
+        `http://localhost:${port}/_api/canvas-meta?file=${encodeURIComponent(file)}`
+      );
+      const m = (await r.json()) as MetaShape;
+      expect(m.title).toBe('Legacy');
+      // The stale inline camera + timestamp are NOT surfaced (no view file → none).
+      expect(m.viewport).toBeUndefined();
+      expect(m.last_modified).toBeUndefined();
+    } finally {
+      await killProc(proc);
+    }
+  });
+
+  test('PATCH layout writes meta AND bumps last_modified (a real shared change)', async () => {
+    const { root, designRoot } = makeSandbox();
+    const port = nextPort();
+    const proc = await bootServer(root, port);
+    try {
+      mkdirSync(join(designRoot, 'ui'), { recursive: true });
+      const tsxAbs = join(designRoot, 'ui', 'Layout.tsx');
+      writeFileSync(tsxAbs, 'export default function L(){return <main/>}\n');
+      const metaAbs = tsxAbs.replace(/\.tsx$/, '.meta.json');
+      writeFileSync(metaAbs, JSON.stringify({ title: 'L', sections: [] }));
+      const file = repoRel(designRoot, tsxAbs);
+
+      const r = await fetch(`http://localhost:${port}/_api/canvas-meta`, {
+        method: 'PATCH',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ file, patch: { layout: { artboards: [{ id: 'a', x: 0, y: 0 }] } } }),
+      });
+      expect(r.status).toBe(200);
+      const onDisk = JSON.parse(readFileSync(metaAbs, 'utf8')) as MetaShape;
+      expect(onDisk.layout?.artboards).toBeDefined();
+      expect(typeof onDisk.last_modified).toBe('string');
+      expect(onDisk.title).toBe('L');
+      // The camera never leaks into the versioned meta.
+      expect(onDisk.viewport).toBeUndefined();
     } finally {
       await killProc(proc);
     }
@@ -204,6 +317,27 @@ describe('/_api/canvas-meta — GET/PATCH', () => {
     }
   });
 
+  test('PATCH viewport on a non-existent canvas is refused (404) and mints no file (DDR-115 F-A2)', async () => {
+    const { root, designRoot } = makeSandbox();
+    const port = nextPort();
+    const proc = await bootServer(root, port);
+    try {
+      mkdirSync(join(designRoot, 'ui'), { recursive: true });
+      // No .tsx written — the canvas does not exist.
+      const file = '.design/ui/Ghost.tsx';
+      const r = await fetch(`http://localhost:${port}/_api/canvas-meta`, {
+        method: 'PATCH',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ file, patch: { viewport: { x: 1, y: 2, zoom: 1 } } }),
+      });
+      expect(r.status).toBe(404);
+      // The untrusted-origin write was refused — no per-machine file minted.
+      expect(existsSync(viewPath(designRoot, 'ui-ghost'))).toBe(false);
+    } finally {
+      await killProc(proc);
+    }
+  });
+
   test('PATCH rejects paths that escape repoRoot', async () => {
     const { root } = makeSandbox();
     const port = nextPort();

package/apps/studio/test/canvas-origin-gate.test.ts

@@ -67,6 +67,41 @@ describe('canvas-origin gate — A1/A2 traversal + privilege containment', () =>
         '/_api/edit-css',
         '/_api/edit-text',
         '/_api/edit-attr',
+        // Phase 27 (E2) — every /_api/git/* route is MAIN-ORIGIN ONLY: absent from
+        // CANVAS_SAFE_API + startCanvasServer's `routes` map. A GET from the
+        // canvas origin must 403 at the gate (not 405 from a reached handler),
+        // proving the route is unreachable on this origin. Guards the dual-
+        // allowlist invariant for the token-bearing publish/get-latest endpoints.
+        '/_api/git/status',
+        '/_api/git/log',
+        '/_api/git/diff',
+        '/_api/git/commit',
+        '/_api/git/discard',
+        '/_api/git/push',
+        '/_api/git/pull',
+        '/_api/git/resolve',
+        // Phase 29 (E4) — drafts: list + create + switch + fold are MAIN-ORIGIN ONLY.
+        '/_api/git/branches',
+        '/_api/git/branch',
+        '/_api/git/checkout',
+        '/_api/git/fold',
+        // Phase 28 (E3) — every /_api/github/* route is MAIN-ORIGIN ONLY (absent
+        // from CANVAS_SAFE_API + startCanvasServer's `routes` map) and token-bearing.
+        // The untrusted canvas iframe origin must never reach identity/create-repo/
+        // invite/repos — a request from this origin 403s at the gate. This is also
+        // the guard that the GitHub token (server-held, keychain) can never be
+        // exfiltrated to the canvas realm.
+        '/_api/github/identity',
+        '/_api/github/repos',
+        '/_api/github/create-repo',
+        '/_api/github/invite',
+        '/_api/github/clone',
+        '/_api/github/create-project',
+        '/_api/design/init',
+        // Phase 29 (E4) Door C — the hub-link credential write is MAIN-ORIGIN ONLY;
+        // the untrusted canvas origin must never reach it (it writes the global
+        // ~/.config/maude/hubs.json token store).
+        '/_api/hub/link',
         '/package.json',
       ]) {
         expect(await code(p)).toBe(403);