@1agh/maude 0.56.0 → 0.58.0

package/apps/studio/test/cloud-connect-note.test.ts

@@ -0,0 +1,135 @@
+// The sentence a person reads after pressing Connect.
+//
+// It used to be computed once, from the ATTACH RESPONSE, at the instant the
+// confirm dialog closed — and never again. The attach response reports an
+// intention (`{ syncing: true }` means `runtime.start()` did not throw and one
+// local canvas qualified), so the sentence claimed success before a socket
+// existed and then sat there through every outcome, including total failure.
+//
+// These cases are one per row of the plan's states/copy table, plus the two
+// degradations that must never take the note away entirely: no live payload,
+// and a payload from a server that predates the counts.
+
+import { describe, expect, test } from 'bun:test';
+
+import { connectOutcomeNote } from '../client/panels/CloudBar.jsx';
+import type { SyncStatusLike } from '../sync/presentation.ts';
+
+const live = (over: SyncStatusLike): SyncStatusLike => ({
+  state: 'online',
+  queuedOps: 0,
+  lastSyncAt: null,
+  offlineSince: null,
+  flash: null,
+  updatedAt: 0,
+  ...over,
+});
+
+const started = { syncing: true, canvases: 75 };
+
+describe('with a live payload — the sentence moves', () => {
+  test('connecting: nothing has settled yet, and it does not pretend otherwise', () => {
+    const n = connectOutcomeNote(
+      'alligators',
+      started,
+      live({ state: 'connecting', docs: { synced: 0, pending: 75, rejected: 0 } })
+    );
+    expect(n.text).toContain('Connecting to alligators');
+    expect(n.text).not.toContain('Synced');
+  });
+
+  test('syncing: real progress, drawn from settled handshakes', () => {
+    const n = connectOutcomeNote(
+      'alligators',
+      started,
+      live({ docs: { synced: 40, pending: 35, rejected: 0 } })
+    );
+    expect(n.text).toContain('40 of 75');
+  });
+
+  test('synced: names what arrived and tells the person to go open it', () => {
+    const n = connectOutcomeNote(
+      'alligators',
+      started,
+      live({
+        docs: { synced: 75, pending: 0, rejected: 0 },
+        pulled: { names: ['ui-welcome'], count: 3 },
+      })
+    );
+    expect(n.text).toContain('Synced with alligators');
+    expect(n.text).toContain('3 came down');
+    // Deliberately not an imperative to open it: a pulled canvas is hub-authored
+    // TSX, and "open this" inside our own green success sentence is the
+    // strongest endorsement we could give content we do not vouch for.
+    expect(n.title).toContain('new to this machine');
+    expect(n.title).not.toContain('Open one');
+  });
+
+  test('refused: the state that cannot fix itself says so, and says what to do', () => {
+    // The reported shape, at its worst: the attach response says syncing, the
+    // socket is up, and every single document is going nowhere.
+    const n = connectOutcomeNote(
+      'alligators',
+      started,
+      live({ state: 'online', docs: { synced: 0, pending: 0, rejected: 75 } })
+    );
+    expect(n.text).toContain('refused');
+    expect(n.title).toContain('Reconnect');
+  });
+
+  test('unreachable: queued, not lost — and explicitly nothing to do', () => {
+    const n = connectOutcomeNote(
+      'alligators',
+      started,
+      live({ state: 'offline', queuedOps: 2, docs: { synced: 75, pending: 0, rejected: 0 } })
+    );
+    expect(n.text).toContain('Not reachable');
+    expect(n.text).toContain('queued');
+    expect(n.title).toContain('resumes by itself');
+  });
+
+  test('the live payload beats the attach response, not the other way round', () => {
+    // `sync.syncing` is true here and the link is in fact dead. Whichever wins
+    // decides whether this whole change did anything.
+    const n = connectOutcomeNote('alligators', started, live({ state: 'offline' }));
+    expect(n.text).toContain('Not reachable');
+  });
+});
+
+describe('without a live payload — degrade, never vanish', () => {
+  test('first render falls back to the attach response, phrased as in-flight', () => {
+    const n = connectOutcomeNote('alligators', started, undefined);
+    expect(n.text).toContain('Connecting to alligators');
+    expect(n.text).toContain('75 canvases');
+  });
+
+  test('an unlinked live payload does not swallow the note', () => {
+    // `syncPresentation` returns null for `{linked:false}`; the note must fall
+    // through to the attach response rather than render nothing at all.
+    const n = connectOutcomeNote('alligators', started, { linked: false });
+    expect(n.text).toContain('alligators');
+  });
+
+  test('nothing syncable keeps its own copy', () => {
+    const n = connectOutcomeNote('alligators', {
+      syncing: false,
+      reason: 'nothing-syncable',
+      detail: 'No canvases in this project are syncable yet.',
+    });
+    expect(n.text).toContain('nothing to sync yet');
+  });
+
+  test('a failed start reports the reason it was given', () => {
+    const n = connectOutcomeNote('alligators', {
+      syncing: false,
+      reason: 'error',
+      detail: 'Syncing could not start: hub refused the handshake',
+    });
+    expect(n.text).toContain('hub refused the handshake');
+  });
+
+  test('a missing project name never renders as undefined', () => {
+    const n = connectOutcomeNote(null, started, undefined);
+    expect(n.text).toContain('the workspace');
+  });
+});

package/apps/studio/test/cloud-endpoints.test.ts

@@ -324,12 +324,19 @@ describe('localIdentityHint — only an exact, corroborated agreement is silent'
 });
 
 describe('connectOutcomeNote — what the rail says after Connect', () => {
-  test('syncing: a result, and where to watch it', () => {
+  test('no live payload yet: an in-flight state, not a claimed result', () => {
+    // This used to assert "Syncing with alligators — 12 canvases." and a hover
+    // pointing at the status bar. Both were wrong: the attach response reports
+    // that `runtime.start()` did not throw, which is an INTENTION, and the slot
+    // it sent people to was itself keying off `state` alone. See DDR-214 — the
+    // sentence now derives from the live payload, and this is only the fallback
+    // for the first render (and for a server too old to send one.)
     const n = connectOutcomeNote('alligators', { syncing: true, canvases: 12 });
-    expect(n.text).toBe('Syncing with alligators — 12 canvases.');
-    expect(n.title).toContain('hub sync');
+    expect(n.text).toBe('Connecting to alligators — 12 canvases…');
+    expect(n.title).toContain('updates as they settle');
+    expect(n.text).not.toContain('hub sync');
     expect(connectOutcomeNote('alligators', { syncing: true, canvases: 1 }).text).toContain(
-      '1 canvas.'
+      '1 canvas…'
     );
   });
 

package/apps/studio/test/cloud-shell-surfaces.test.ts

@@ -64,8 +64,11 @@ describe('the cloud shell offers nothing it cannot honour', () => {
     // `=== null`, not falsiness. `cloud` is undefined until `/_config` answers,
     // and treating unknown as "not cloud" mounted this bar for one frame in
     // every cloud tab — long enough to fire the one request the cell refuses.
-    expect(APP).toContain('{cloud === null ? <CloudBar /> : null}');
-    expect(APP).not.toContain('{cloud ? null : <CloudBar />}');
+    // Matched on the GUARD rather than the whole element, so adding a prop to
+    // CloudBar (DDR-214 drilled the live sync payload in) does not read as a
+    // regression in a rule that is entirely about `=== null`.
+    expect(APP).toMatch(/\{cloud === null \? <CloudBar[^>]*\/> : null\}/);
+    expect(APP).not.toMatch(/\{cloud \? null : <CloudBar/);
   });
 
   test('the local export queue does not hydrate before the shell is known', () => {

package/apps/studio/test/config-version.test.ts

@@ -0,0 +1,88 @@
+// The running version reaches the client — feature-release-reaches-the-fleet.
+//
+// Reading which release a Maude was actually running used to mean probing
+// production by hand, and the first probe of the v0.57.0 incident was MISREAD
+// (a 401 that looked like "route exists" was the blanket answer for any unknown
+// path). The fix has three surfaces reporting one version: the hub's `/health`,
+// this `/_config`, and the status-bar chip the client draws from it.
+//
+// What is asserted here is the middle one, plus the two properties that make it
+// safe to put there: it is resolved through the SINGLE version function, and it
+// carries nothing else.
+
+import { afterAll, describe, expect, test } from 'bun:test';
+import type { Subprocess } from 'bun';
+
+import { resolveMaudeVersion } from '../whats-new.ts';
+import { bootServer, killProc, makeSandbox, nextPort } from './_helpers.ts';
+
+const procs: Subprocess[] = [];
+afterAll(async () => {
+  for (const p of procs) await killProc(p);
+});
+
+async function boot(env: Record<string, string> = {}) {
+  const { root } = makeSandbox();
+  const port = nextPort();
+  procs.push(await bootServer(root, port, env));
+  return `http://localhost:${port}`;
+}
+
+describe('/_config names the release it is running', () => {
+  test('the version is present, and is a real version', async () => {
+    const base = await boot();
+    const cfg = (await (await fetch(`${base}/_config`)).json()) as { version?: string };
+
+    expect(typeof cfg.version).toBe('string');
+    // `0.0.0` was the private-workspace placeholder these manifests carried
+    // before they joined the release line — reporting it is the bug, not a pass.
+    expect(cfg.version).not.toBe('0.0.0');
+    expect(cfg.version).toMatch(/^\d+\.\d+\.\d+/);
+  });
+
+  test('it is the SAME answer the What’s New feed uses', async () => {
+    // One resolution path (DDR-045). Two would eventually disagree, and a chip
+    // that contradicts the feed beside it is worse than no chip.
+    const base = await boot();
+    const cfg = (await (await fetch(`${base}/_config`)).json()) as { version?: string };
+    const feed = (await (await fetch(`${base}/_api/whats-new`)).json()) as { version?: string };
+
+    expect(cfg.version).toBe(resolveMaudeVersion());
+    expect(cfg.version).toBe(feed.version);
+  });
+});
+
+describe('the version rides along, and nothing else does', () => {
+  test('a cloud tab gets the version too', async () => {
+    // `/_config` reaches a browser on someone else's machine in workspace mode.
+    // A git tag is public, so the version is fine there — this pins that it
+    // actually arrives, since the chip is the cloud's only version surface.
+    const base = await boot({
+      MAUDE_WORKSPACE_MODE: '1',
+      MAUDE_WORKSPACE_ALLOW_DEV_MODULES: '1',
+      MAUDE_PROJECT_NAME: 'Alligators',
+    });
+    const cfg = (await (await fetch(`${base}/_config`)).json()) as {
+      version?: string;
+      cloud?: unknown;
+    };
+
+    expect(typeof cfg.version).toBe('string');
+    expect(cfg.cloud).toBeDefined();
+  });
+
+  test('no server path or secret came with it', async () => {
+    const base = await boot();
+    const cfg = (await (await fetch(`${base}/_config`)).json()) as Record<string, unknown>;
+
+    // The version was the one field this change added. Anything matching these
+    // shapes arriving in the browser payload is a leak, and the review that
+    // waves it through will be the one that reads "it was already there".
+    for (const key of Object.keys(cfg)) {
+      expect(key).not.toMatch(/token$/i);
+      expect(key).not.toMatch(/secret|password|apiKey/i);
+    }
+    const serialized = JSON.stringify(cfg);
+    expect(serialized).not.toMatch(/BEGIN [A-Z ]*PRIVATE KEY/);
+  });
+});

package/apps/studio/test/fixtures/mock-acp-agent-slow.mjs

@@ -0,0 +1,45 @@
+#!/usr/bin/env bun
+// A mock ACP agent that streams SEVERAL updates with a gap between them, so a
+// test can close the socket MID-turn and assert the turn still completes
+// (feature-acp-write-path-scope Addendum, Task 8 — bridges outlive their socket).
+//
+// The pacing is the whole point: `mock-acp-agent-permission.mjs` and friends
+// settle in one tick, which leaves no window in which "mid-turn" is a real
+// state. Six chunks at ~120 ms give a test room to observe the first one, yank
+// the socket, and still have the rest arrive with nobody attached.
+
+import { Readable, Writable } from 'node:stream';
+
+import * as acp from '@agentclientprotocol/sdk';
+
+const stream = acp.ndJsonStream(Writable.toWeb(process.stdout), Readable.toWeb(process.stdin));
+
+const CHUNKS = Number(process.env.MAUDE_TEST_SLOW_CHUNKS || 6);
+const GAP_MS = Number(process.env.MAUDE_TEST_SLOW_GAP_MS || 120);
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+
+let n = 0;
+
+acp
+  .agent({ name: 'mock-acp-agent-slow' })
+  .onRequest('initialize', () => ({
+    protocolVersion: acp.PROTOCOL_VERSION,
+    agentCapabilities: { loadSession: false },
+  }))
+  .onRequest('session/new', () => ({ sessionId: `mock-slow-session-${++n}` }))
+  .onRequest('session/prompt', async (ctx) => {
+    for (let i = 0; i < CHUNKS; i++) {
+      await ctx.client.notify('session/update', {
+        sessionId: ctx.params.sessionId,
+        update: {
+          sessionUpdate: 'agent_message_chunk',
+          // Numbered so a test can tell WHICH chunks it received, not just how
+          // many — the difference between "no duplicates" and "no gaps".
+          content: { type: 'text', text: `chunk-${i}\n` },
+        },
+      });
+      await sleep(GAP_MS);
+    }
+    return { stopReason: 'end_turn' };
+  })
+  .connect(stream);

package/apps/studio/test/fixtures/mock-acp-agent-write.mjs

@@ -0,0 +1,118 @@
+#!/usr/bin/env bun
+// feature-acp-write-path-scope Task 1 — the RECORDED SHAPE of a write tool's
+// permission request, replayed as a mock ACP agent.
+//
+// This is not an invented shape. It reproduces, field for field, what
+// `@agentclientprotocol/claude-agent-acp@0.57.0` actually puts on the wire for
+// `Write`/`Edit`/`NotebookEdit`, read out of its own `dist/` on 2026-08-07:
+//
+//   • `dist/acp-agent.js:2270-2286` builds the permission request's `toolCall`
+//     as `{ toolCallId, rawInput, ...toolInfoFromToolUse(name, input, id) }` —
+//     note there is NO tool NAME anywhere in that object.
+//   • `dist/tools.js` `case "Write"` / `case "Edit"` set
+//     `locations: input?.file_path ? [{ path: input.file_path }] : []` — the
+//     model's string VERBATIM. No normalization, no absolutization, despite the
+//     ACP schema (`types.gen.d.ts:568-572`) describing the field as "The
+//     absolute file path being accessed or modified".
+//   • `NotebookEdit` has NO case at all — it falls through to `case "Other"`,
+//     which emits no `locations` whatsoever. Its target lives only on
+//     `rawInput.notebook_path`.
+//   • `dist/acp-agent.js:3808-3829` (`toolCallNotification`) is the ONLY carrier
+//     of the tool name: `_meta.claudeCode.toolName` on the streamed `tool_call`.
+//   • `requestPermissionFromClient` (`:2134-2141`) AWAITS `ensureToolCallEmitted`
+//     before issuing the request, so that notification is guaranteed to be on
+//     the wire FIRST. The bridge's gate depends on exactly that ordering, so the
+//     fixture reproduces it rather than assuming it.
+//
+// Driven by env so one fixture covers every case:
+//   MAUDE_TEST_WRITE_PATH  — the `file_path` the "model" emitted (required)
+//   MAUDE_TEST_WRITE_TOOL  — Write (default) | Edit | NotebookEdit | Read
+//   MAUDE_TEST_OMIT_TOOL_CALL=1 — skip the `tool_call` notification, i.e.
+//        simulate an adapter that reorders or drops it. The gate must fail
+//        CLOSED here (prompt), never auto-approve.
+
+import { Readable, Writable } from 'node:stream';
+
+import * as acp from '@agentclientprotocol/sdk';
+
+const stream = acp.ndJsonStream(Writable.toWeb(process.stdout), Readable.toWeb(process.stdin));
+
+const TOOL = process.env.MAUDE_TEST_WRITE_TOOL || 'Write';
+const FILE_PATH = process.env.MAUDE_TEST_WRITE_PATH || '/tmp/unset';
+const OMIT_TOOL_CALL = process.env.MAUDE_TEST_OMIT_TOOL_CALL === '1';
+const TOOL_CALL_ID = 'tc-write-1';
+
+// Mirrors `toolInfoFromToolUse`'s per-tool branches. NotebookEdit deliberately
+// yields NO `locations` key — that is the adapter's real behaviour, and the case
+// that makes the rawInput fallback mandatory rather than decorative.
+function toolInfo() {
+  if (TOOL === 'NotebookEdit') {
+    return { title: 'NotebookEdit', kind: 'other', content: [] };
+  }
+  if (TOOL === 'Read') {
+    return {
+      title: `Read ${FILE_PATH}`,
+      kind: 'read',
+      content: [],
+      locations: [{ path: FILE_PATH, line: 1 }],
+    };
+  }
+  return {
+    title: `${TOOL} ${FILE_PATH}`,
+    kind: 'edit',
+    content: [],
+    locations: [{ path: FILE_PATH }],
+  };
+}
+
+function rawInput() {
+  if (TOOL === 'NotebookEdit') return { notebook_path: FILE_PATH, new_source: 'x' };
+  if (TOOL === 'Write') return { file_path: FILE_PATH, content: 'x' };
+  if (TOOL === 'Read') return { file_path: FILE_PATH };
+  return { file_path: FILE_PATH, old_string: 'a', new_string: 'b' };
+}
+
+acp
+  .agent({ name: 'mock-acp-agent-write' })
+  .onRequest('initialize', () => ({
+    protocolVersion: acp.PROTOCOL_VERSION,
+    agentCapabilities: { loadSession: false },
+  }))
+  .onRequest('session/new', () => ({ sessionId: 'mock-write-session-1' }))
+  .onRequest('session/prompt', async (ctx) => {
+    // (1) The `tool_call` notification — the tool NAME's only carrier.
+    if (!OMIT_TOOL_CALL) {
+      await ctx.client.notify('session/update', {
+        sessionId: ctx.params.sessionId,
+        update: {
+          _meta: { claudeCode: { toolName: TOOL } },
+          toolCallId: TOOL_CALL_ID,
+          sessionUpdate: 'tool_call',
+          rawInput: rawInput(),
+          status: 'pending',
+          ...toolInfo(),
+        },
+      });
+    }
+    // (2) THEN the permission request, with the adapter's real option set for a
+    //     routine tool call (`acp-agent.js:2271-2278`) — note `allow_always` is
+    //     listed FIRST, which is what Decision D's filter has to contend with.
+    const outcome = await ctx.client.request(acp.methods.client.session.requestPermission, {
+      sessionId: ctx.params.sessionId,
+      toolCall: { toolCallId: TOOL_CALL_ID, rawInput: rawInput(), ...toolInfo() },
+      options: [
+        { optionId: 'allow_always', name: 'Always Allow', kind: 'allow_always' },
+        { optionId: 'allow', name: 'Allow', kind: 'allow_once' },
+        { optionId: 'reject', name: 'Reject', kind: 'reject_once' },
+      ],
+    });
+    await ctx.client.notify('session/update', {
+      sessionId: ctx.params.sessionId,
+      update: {
+        sessionUpdate: 'agent_message_chunk',
+        content: { type: 'text', text: `outcome=${JSON.stringify(outcome.outcome)}` },
+      },
+    });
+    return { stopReason: 'end_turn' };
+  })
+  .connect(stream);

package/apps/studio/test/input-router.test.ts

@@ -10,6 +10,7 @@ import {
   isArtboardDragChrome,
   isEditableTarget,
   type Tool,
+  yieldsClickToArtboardChrome,
   yieldsToArtboardDrag,
 } from '../input-router.tsx';
 
@@ -552,6 +553,61 @@ describe('input-router / yieldsToArtboardDrag', () => {
   });
 });
 
+// issue-78 — the actual regression: the router's capture-phase `click`
+// listener claimed every bare click while in the Move tool (and every
+// Cmd/Ctrl+click from Browse/annotation tools) and called
+// `stopImmediatePropagation()` unconditionally, unlike its pointerdown/
+// mousedown siblings above. That killed the native click on any artboard-
+// chrome control BEFORE React's delegated onClick ever ran — including the
+// video-timeline badge (`.dc-artboard-video-badge`, DDR-148), which sits
+// outside `.dc-artboard-body` as chrome. Clicking it did nothing.
+// `yieldsClickToArtboardChrome` is the decision the click handler now gates
+// its suppression on, mirroring `yieldsToArtboardDrag` above.
+describe('input-router / yieldsClickToArtboardChrome', () => {
+  const chrome = (): EventTarget =>
+    ({
+      closest: (sel: string) => (sel === '[data-dc-screen]' ? {} : null),
+    }) as unknown as EventTarget;
+  const body = (): EventTarget => ({ closest: () => ({}) }) as unknown as EventTarget; // matches every selector, incl. .dc-artboard-body
+
+  test('bare click on the video-timeline badge in Move tool (the reported bug) → true', () => {
+    expect(
+      yieldsClickToArtboardChrome('select', chrome(), { metaKey: false, ctrlKey: false })
+    ).toBe(true);
+  });
+
+  test('cmd+click on artboard chrome (deep-select, not a chrome control) → false', () => {
+    expect(yieldsClickToArtboardChrome('select', chrome(), { metaKey: true, ctrlKey: false })).toBe(
+      false
+    );
+  });
+
+  test('bare click on .dc-artboard-body content (not chrome) → false', () => {
+    expect(yieldsClickToArtboardChrome('select', body(), { metaKey: false, ctrlKey: false })).toBe(
+      false
+    );
+  });
+
+  test('bare click outside any artboard → false (nothing to yield to)', () => {
+    const outside = { closest: () => null } as unknown as EventTarget;
+    expect(yieldsClickToArtboardChrome('select', outside, { metaKey: false, ctrlKey: false })).toBe(
+      false
+    );
+  });
+
+  test('non-select routed kind (e.g. context-menu) on chrome → false', () => {
+    expect(
+      yieldsClickToArtboardChrome('context-menu', chrome(), { metaKey: false, ctrlKey: false })
+    ).toBe(false);
+  });
+
+  test('null routed kind on chrome → false', () => {
+    expect(yieldsClickToArtboardChrome(null, chrome(), { metaKey: false, ctrlKey: false })).toBe(
+      false
+    );
+  });
+});
+
 // T25 — Drag-vs-click threshold. Centralized here so every drag-class gesture
 // (artboard drag, artboard marquee, element marquee, annotation pen/rect/etc.)
 // reads the same value. Microsoft Win32 SM_CXDRAG default + d3-drag convention.

package/apps/studio/test/sync-connect-honesty.test.ts

@@ -0,0 +1,114 @@
+// A connect that has not connected must never read as synced.
+//
+// THE FALSIFIER. Written against the pre-fix pipeline and expected to FAIL
+// there — that failure is the evidence that the status signal is optimistic by
+// construction, not merely rendered late. If it ever passes without the
+// monitor changing, the premise of this whole change was wrong and the fix
+// should be dropped rather than the assertion softened.
+//
+// Reported as "vyskočí modal, pak vidím jen syncing canvases, ale reálně se nic
+// nestane": the user was told the truth about an intention and read it as a
+// result.
+//
+// The two monitor-level defects it pins:
+//   1. the monitor is BORN `online` — before a socket exists, before a token is
+//      accepted, before a byte moves. Every surface keys off that value.
+//   2. `docs.synced` can only ever rise — a hub that dies leaves the last count
+//      frozen on screen forever, indistinguishable from a healthy one.
+//
+// The surface-level defects (one connected provider out of many reading green,
+// and the status bar ignoring `docs` entirely) are pinned in
+// `sync-presentation.test.ts`, because they live in the presentation rule
+// rather than in the state machine.
+
+import { describe, expect, test } from 'bun:test';
+
+import { createConnectionMonitor, type SyncStatusSnapshot } from '../sync/connection-state.ts';
+
+/**
+ * The rule the shipped status bar applies (`app.jsx` syncSlot, pre-fix):
+ * green dot and the word "synced" whenever `state` is `online`.
+ *
+ * Reproduced verbatim rather than imported, so this test measures what a USER
+ * sees and cannot be quietly satisfied by editing the surface.
+ */
+function readsAsSynced(snap: SyncStatusSnapshot): boolean {
+  return snap.state === 'online' || snap.flash === 'synced';
+}
+
+function makeMonitor() {
+  const nowMs = 1_000_000;
+  const timers = new Map<number, { fireAt: number; cb: () => void }>();
+  let nextId = 1;
+  const monitor = createConnectionMonitor({
+    now: () => nowMs,
+    setTimer: (cb, ms) => {
+      const id = nextId++;
+      timers.set(id, { fireAt: nowMs + ms, cb });
+      return id as unknown as ReturnType<typeof setTimeout>;
+    },
+    clearTimer: (h) => {
+      timers.delete(h as unknown as number);
+    },
+  });
+  return { monitor };
+}
+
+describe('a connect that has not connected', () => {
+  test('does not read as synced at t=0', () => {
+    // The instant after Connect: the runtime started, providers exist on paper,
+    // nothing has handshaken. This is precisely the moment the user is staring
+    // at the note, and the moment the old pipeline claimed success.
+    const { monitor } = makeMonitor();
+    expect(readsAsSynced(monitor.snapshot())).toBe(false);
+  });
+
+  test('does not read as synced while every document is still pending', () => {
+    const { monitor } = makeMonitor();
+    for (const slug of ['ui-home', 'ui-about', 'ui-welcome']) {
+      monitor.noteDocState(slug, 'pending');
+    }
+    const snap = monitor.snapshot();
+    expect(snap.docs).toEqual({ synced: 0, pending: 3, rejected: 0 });
+    expect(readsAsSynced(snap)).toBe(false);
+  });
+
+  test('does not read as synced when the hub refuses every document', () => {
+    // A rotated credential: providers reach the hub, the hub says no. Nothing
+    // is syncing, and the count that would say so must not claim otherwise.
+    const { monitor } = makeMonitor();
+    for (const slug of ['ui-home', 'ui-about']) {
+      monitor.noteDocState(slug, 'auth-rejected');
+    }
+    expect(monitor.snapshot().docs).toEqual({ synced: 0, pending: 0, rejected: 2 });
+  });
+});
+
+describe('a connect that stops being connected', () => {
+  test('docs.synced falls when the providers drop', () => {
+    // Today nothing demotes a connected document, so a hub that dies leaves
+    // "3 synced" on screen indefinitely — the most convincing possible lie,
+    // because it was true a moment ago.
+    const { monitor } = makeMonitor();
+    for (const slug of ['a', 'b', 'c']) {
+      monitor.noteProviderStatus(slug, 'connected');
+      monitor.noteDocState(slug, 'connected');
+    }
+    expect(monitor.snapshot().docs?.synced).toBe(3);
+
+    for (const slug of ['a', 'b', 'c']) monitor.noteProviderStatus(slug, 'disconnected');
+
+    const snap = monitor.snapshot();
+    expect(snap.docs?.synced).toBe(0);
+    expect(snap.docs?.pending).toBe(3);
+  });
+
+  test('a refusal is not transient — a dropped provider cannot launder it', () => {
+    // `auth-rejected` outranks a disconnect: the hub gave an answer, and losing
+    // the socket does not turn that answer back into "still trying".
+    const { monitor } = makeMonitor();
+    monitor.noteDocState('a', 'auth-rejected');
+    monitor.noteProviderStatus('a', 'disconnected');
+    expect(monitor.snapshot().docs).toEqual({ synced: 0, pending: 0, rejected: 1 });
+  });
+});

package/apps/studio/test/sync-connection-state.test.ts

@@ -52,12 +52,26 @@ function makeMonitor(overrides = {}) {
 }
 
 describe('connection monitor', () => {
-  test('starts online and stays online when the provider connects', () => {
+  test('starts connecting, and goes online when the provider connects', () => {
+    // The seed used to be `online` — success asserted before a socket existed.
+    // See `sync-connect-honesty.test.ts` for why that mattered to a user.
     const { monitor } = makeMonitor();
+    expect(monitor.snapshot().state).toBe('connecting');
     monitor.noteProviderStatus('p1', 'connected');
     expect(monitor.snapshot().state).toBe('online');
   });
 
+  test('a link nobody answers still escalates to offline', () => {
+    // The seed change must not create a state that waits forever: a provider
+    // that only ever reports 'connecting' has to reach the offline banner on
+    // the same grace clock as a link that dropped after being live.
+    const { clock, monitor } = makeMonitor();
+    monitor.noteProviderStatus('p1', 'connecting');
+    expect(monitor.snapshot().state).toBe('connecting');
+    clock.advance(30_000);
+    expect(monitor.snapshot().state).toBe('offline');
+  });
+
   test('disconnect → stays connecting during grace, goes offline after graceMs', () => {
     const { clock, monitor } = makeMonitor();
     monitor.noteProviderStatus('p1', 'connected');
@@ -212,3 +226,33 @@ describe('connection monitor — per-doc states (DDR-102)', () => {
     expect(monitor.snapshot().lastSyncAt).toBe((first as number) + 10_000);
   });
 });
+
+describe('what this run pulled down', () => {
+  // This field was `remoteGap`, "what the project has that this machine does
+  // not" — and it was recorded AFTER the pull, so it named exactly the
+  // canvases that had just arrived. `_sync.json` was observed listing two
+  // documents that were sitting on disk. The name now matches the fact.
+  test('records the canvases that arrived, with a true count', () => {
+    const { monitor } = makeMonitor();
+    monitor.notePulled(['ui-welcome', 'ui-how-to']);
+    expect(monitor.snapshot().pulled).toEqual({
+      names: ['ui-welcome', 'ui-how-to'],
+      count: 2,
+    });
+  });
+
+  test('a run that pulled nothing says nothing', () => {
+    const { monitor } = makeMonitor();
+    monitor.notePulled([]);
+    expect(monitor.snapshot().pulled).toBeUndefined();
+  });
+
+  test('the name list is capped but the count is not — a cap must not falsify a number', () => {
+    // Hub-controlled payload size (same reasoning as rejectedSlugs).
+    const { monitor } = makeMonitor();
+    monitor.notePulled(Array.from({ length: 50 }, (_, i) => `ui-${i}`));
+    const pulled = monitor.snapshot().pulled;
+    expect(pulled?.names).toHaveLength(20);
+    expect(pulled?.count).toBe(50);
+  });
+});