@1agh/maude 0.58.1 → 0.58.3

package/apps/studio/sync/migrate-flat-fallback.ts

@@ -0,0 +1,121 @@
+// One-shot quarantine of the pre-fix-5 flat fallback twins — fix 4 of the
+// 2026-08-10 sync RCA (v0.58.2's `f2a38c46` changed the fallback rule with no
+// migration of what the old rule had already written).
+//
+// Until then the no-path fallback wrote a pulled canvas FLAT at the design root
+// (`ui-welcome.tsx`); the group-aware fallback plus the stamp-race fix (phase
+// sync-2) stopped producing new ones, but whatever the old rule wrote is still
+// on disk NEXT TO the real grouped file — two files, one slug, one document
+// (DDR-064 A4's collision class), and the tree lists both.
+//
+// The rules, in migrate-seed.ts's posture (idempotent, best-effort, never
+// throws into boot):
+//
+//   - Only a flat file WITH a grouped twin of the same slug moves — the flat
+//     copy is provably the redundant one. A flat file with NO twin is a
+//     genuinely-flat canvas somebody authored; moving it would lose work, so
+//     it stays (fix 5 + a future re-sync relocates it).
+//   - Quarantine, never delete: the loser goes to `_trash/<slug>-flat-<ts>/`
+//     (the established runtime quarantine, DDR-115), `.meta.json`/`.css`
+//     siblings riding along. The `<slug>.annotations.svg` sidecar does NOT
+//     move — annotations are keyed by the flat slug at the design root and
+//     serve the surviving grouped twin.
+//   - One log line per move, so a tenant can find their bytes.
+
+import { type Dirent, existsSync, mkdirSync, readdirSync, renameSync } from 'node:fs';
+import path from 'node:path';
+
+import { canvasSlugFromRel } from '../canvas-slug.ts';
+
+export interface FlatFallbackMove {
+  slug: string;
+  /** Design-root-relative flat body that moved. */
+  from: string;
+  /** Design-root-relative grouped body that made it redundant. */
+  keptTwin: string;
+  /** Design-root-relative quarantine dir the flat set landed in. */
+  trashedTo: string;
+}
+
+/**
+ * Scan the design root, quarantine every flat body whose slug a grouped file
+ * also claims. Returns what moved (empty on a clean tree — the idempotent
+ * steady state). Never throws.
+ */
+export function migrateFlatFallback(opts: {
+  designRoot: string;
+  /** Design root relative to the repo root (`.design`) — for slug derivation. */
+  designRel: string;
+  log?: (line: string) => void;
+}): FlatFallbackMove[] {
+  const { designRoot, designRel } = opts;
+  const log = opts.log ?? ((line: string) => console.log(line));
+  const moves: FlatFallbackMove[] = [];
+  try {
+    // slug → every body path claiming it, design-root-relative.
+    const claims = new Map<string, string[]>();
+    for (const rel of walk(designRoot)) {
+      if (!/\.tsx$/i.test(rel)) continue;
+      const slug = canvasSlugFromRel(rel, designRel);
+      const list = claims.get(slug);
+      if (list) list.push(rel);
+      else claims.set(slug, [rel]);
+    }
+
+    for (const [slug, rels] of claims) {
+      const flat = rels.find((rel) => !rel.includes('/'));
+      const twin = rels.find((rel) => rel.includes('/'));
+      if (!flat || !twin) continue;
+
+      const trashedTo = `_trash/${slug}-flat-${Date.now()}`;
+      const base = flat.replace(/\.tsx$/i, '');
+      const movedLanes: string[] = [];
+      try {
+        mkdirSync(path.join(designRoot, trashedTo), { recursive: true });
+        for (const lane of [flat, `${base}.meta.json`, `${base}.css`]) {
+          const src = path.join(designRoot, lane);
+          if (!existsSync(src)) continue;
+          renameSync(src, path.join(designRoot, trashedTo, path.basename(lane)));
+          movedLanes.push(lane);
+        }
+      } catch (err) {
+        log(
+          `[sync/migrate-flat-fallback] could not quarantine ${flat}: ${(err as Error).message} — leaving it in place`
+        );
+        continue;
+      }
+      moves.push({ slug, from: flat, keptTwin: twin, trashedTo });
+      log(
+        `[sync/migrate-flat-fallback] ${flat} duplicated ${twin} (slug ${slug}) — moved ${movedLanes.join(
+          ', '
+        )} to ${trashedTo}/`
+      );
+    }
+  } catch {
+    /* best-effort — a scan failure must never cost the boot */
+  }
+  return moves;
+}
+
+/** Files under `dir`, relative to it, skipping runtime-state (`_*`) and repo
+ *  internals — the same exclusions the hub's checkout scan applies. */
+function walk(dir: string, prefix = '', out: string[] = []): string[] {
+  let entries: Dirent[];
+  try {
+    entries = readdirSync(dir, { withFileTypes: true });
+  } catch {
+    return out;
+  }
+  for (const entry of entries) {
+    const rel = prefix ? `${prefix}/${entry.name}` : entry.name;
+    if (entry.isDirectory()) {
+      if (entry.name.startsWith('_') || entry.name === '.git' || entry.name === 'node_modules') {
+        continue;
+      }
+      walk(path.join(dir, entry.name), rel, out);
+    } else if (entry.isFile()) {
+      out.push(rel);
+    }
+  }
+  return out;
+}

package/apps/studio/sync/presentation.ts

@@ -22,10 +22,22 @@ export type SyncPhase =
   | 'connecting'
   | 'syncing'
   | 'synced'
+  | 'stalled'
   | 'refused'
   | 'offline'
   | 'nothing-syncable';
 
+/**
+ * How long `connecting…` may honestly stay on screen with ZERO documents
+ * synced before it becomes a different sentence. A real handshake settles in
+ * seconds; five minutes of nothing is not a connection in progress, it is a
+ * link that needs a person (the alligators incident sat in `connecting…` for
+ * DAYS while every document was being refused). Matches the auth re-probe
+ * cadence so the claim "nothing is moving" has had at least one full retry
+ * cycle behind it.
+ */
+export const STALL_AFTER_MS = 5 * 60 * 1000;
+
 export interface SyncPresentation {
   phase: SyncPhase;
   /** Green dot — reserved for a link that is genuinely carrying edits. */
@@ -119,10 +131,39 @@ function readCounts(
  */
 export function syncPresentation(
   status: SyncStatusLike | null | undefined,
-  opts: { project?: string | null } = {}
+  opts: { project?: string | null; now?: number } = {}
 ): SyncPresentation | null {
   if (!status || status.linked === false) return null;
   const project = safeName(opts.project, 'the workspace');
+  const now = typeof opts.now === 'number' ? opts.now : Date.now();
+
+  // ZERO PROGRESS HAS A DEADLINE. Every `connecting…` below is honest for a
+  // handshake and a lie after five minutes of it — the phase reads as "in
+  // progress" while nothing is moving and nothing will. Once the link has
+  // been trying since `startedAt` with not one document synced, the sentence
+  // changes to the one that names the move. Validated like everything else
+  // read off disk; an absent/garbage stamp simply never stalls (old payloads).
+  const startedAt =
+    typeof status.startedAt === 'number' &&
+    Number.isFinite(status.startedAt) &&
+    status.startedAt > 0
+      ? status.startedAt
+      : null;
+  const stalled = (): SyncPresentation => {
+    // `?? now` rather than a cast: every call site is behind `isStalled`, which
+    // has already proved `startedAt` is a number — and a future one that isn't
+    // reads "1 minute" instead of "NaN minutes".
+    const min = Math.max(1, Math.round((now - (startedAt ?? now)) / 60_000));
+    return {
+      phase: 'stalled',
+      online: false,
+      label: 'stalled',
+      title: `Nothing has synced with ${project} in the ${min} minute${min === 1 ? '' : 's'} since Maude started trying.`,
+      next: 'Reconnect the workspace — the sign-in may have expired.',
+      names: [],
+    };
+  };
+  const isStalled = startedAt !== null && now - startedAt > STALL_AFTER_MS;
 
   if (status.notSyncable) {
     const tsx = status.tsxCount ?? 0;
@@ -203,6 +244,7 @@ export function syncPresentation(
     // Pre-DDR-102 payload: `state` is all there is. Report it as the weaker
     // evidence it is, rather than promoting it to a document-level claim.
     const online = status.state === 'online' || status.flash === 'synced';
+    if (!online && isStalled) return stalled();
     return {
       phase: online ? 'synced' : 'connecting',
       online,
@@ -218,6 +260,7 @@ export function syncPresentation(
   const total = docs.synced + docs.pending + docs.rejected;
 
   if (total === 0) {
+    if (isStalled) return stalled();
     return {
       phase: 'connecting',
       online: false,
@@ -232,6 +275,7 @@ export function syncPresentation(
     // Zero settled yet is a different fact from some settled: one is a
     // handshake in flight, the other is visible progress.
     const started = docs.synced > 0;
+    if (!started && isStalled) return stalled();
     return {
       phase: started ? 'syncing' : 'connecting',
       online: false,

package/apps/studio/sync/projection.ts

@@ -144,7 +144,17 @@ export function createDocProjection(opts: DocProjectionOptions): DocProjection {
     if (stopped) return;
     // Skip our own file→doc import — the file is already current, re-projecting
     // would be a redundant write. (Migration seed is on disk already too.)
-    if (origin === ORIGINS.FILE_IMPORT || origin === ORIGINS.MIGRATION) return;
+    // DISK_PROJECTION is the `syncMeta.path` stamp — bookkeeping ABOUT the
+    // file, derived from where the file already is, so it can never make the
+    // file stale. (Its own doc comment promised this filterability; this is the
+    // step that needed it.)
+    if (
+      origin === ORIGINS.FILE_IMPORT ||
+      origin === ORIGINS.MIGRATION ||
+      origin === ORIGINS.DISK_PROJECTION
+    ) {
+      return;
+    }
     scheduleFlush();
   }
 

package/apps/studio/sync/remote-docs.ts

@@ -24,6 +24,8 @@
 // file outside the design root. That is not policy filtering, it is the
 // difference between writing your project and writing your filesystem.
 
+import { type CanvasGroupLike, resolveCanvasBodyRel } from './canvas-path.ts';
+
 /** One document as the hub reports it. */
 export interface RemoteDoc {
   name: string;
@@ -147,31 +149,66 @@ export function slugFromDocName(docName: string): string | null {
 export interface PullTarget {
   slug: string;
   docName: string;
-  /** Absolute path the body will be written to, flat under the design root. */
+  /** Absolute path the body will be written to. */
   bodyAbs: string;
+  /** True when the path came from the document's own `syncMeta.path` and was
+   *  accepted — false when it was absent or refused and the fallback applied. */
+  fromPath: boolean;
+}
+
+export interface PullTargetOptions {
+  /** Design root, relative to the repo root. Rule 7 of the path check. */
+  designRel?: string;
+  /** Declared canvas groups — the fallback places the body inside one. */
+  canvasGroups?: readonly CanvasGroupLike[];
+  /** Fresh-link relaxation — see `validateCanvasPath`. */
+  allowUndeclaredGroup?: boolean;
+  /**
+   * The document's own `syncMeta.path`, if it is already known.
+   *
+   * USUALLY NULL AT THIS POINT, and that is not an oversight. The listing
+   * (`GET /api/documents`) carries names and byte counts only — the path lives
+   * INSIDE the document, so it cannot be resolved until that document has
+   * synced. The runtime therefore calls this to get a provisional target, then
+   * `resolvePulledTarget` again per document once its doc is populated (see
+   * sync/index.ts). Tests pass it directly, which is the whole reason it is a
+   * parameter rather than a fetch.
+   */
+  pathFor?: (docName: string, slug: string) => string | null | undefined;
+  /** See `resolvePulledTarget`. */
+  realpath?: (p: string) => string;
+  /** Called with (slug, reason) when a PRESENT path is refused. */
+  onRefused?: (slug: string, reason: string) => void;
 }
 
 /**
  * Where a hub-only document lands on disk.
  *
- * FLAT, directly under the design root — the same convention the hub applies in
- * the mirror direction (`workspace-files.mjs defaultBodyPath`) and for the same
- * reason: a slug is lossy, `ui-card` cannot be un-flattened into `ui/Card.tsx`
- * without guessing, and guessing wrong scatters files into directories the user
- * never made. A flat file is trivially moved; an invented tree is not. Moving it
- * later does not break sync — both paths slug to the same document.
+ * It used to be FLAT, directly under the design root, because a slug is lossy —
+ * `ui-card` cannot be un-flattened into `ui/Card.tsx` without guessing, and
+ * guessing wrong scatters files into directories the user never made. The
+ * comment here said a flat file "is trivially moved"; the hub's twin said a
+ * desktop peer "will move it on its next sync". Neither was a mechanism, and
+ * nothing moved it — and a file at the design root is inside no canvas group,
+ * so the tree never listed it and `scanCanvases` never synced it onward.
+ *
+ * So the path now travels with the document (`syncMeta.path`) and is checked
+ * rather than trusted — see `sync/canvas-path.ts` for the eight rules and for
+ * why rule 7 is the one that makes it safe. Absent or refused, the fallback
+ * still applies, but inside a canvas group.
  *
- * Returns only targets that resolve INSIDE the design root. A document name is
- * hub-controlled input, and this is the last point before a create.
+ * Returns only targets that resolve INSIDE the design root. A document name and
+ * a document's path are both hub-controlled input, and this is the last point
+ * before a create — so the containment check stays even for a validated path.
  */
 export function pullTargets(
   hubOnly: readonly RemoteDoc[],
   designRoot: string,
   join: (...parts: string[]) => string,
   resolve: (p: string) => string,
-  sep: string
+  sep: string,
+  opts: PullTargetOptions = {}
 ): PullTarget[] {
-  const rootResolved = resolve(designRoot);
   const out: PullTarget[] = [];
   // One slug, one target. `slugFromDocName` lowercases, so a hub advertising
   // `Foo`, `foo` and `ws/w/main/foo` yields three targets for ONE file — three
@@ -182,10 +219,80 @@ export function pullTargets(
     const slug = slugFromDocName(doc.name);
     if (!slug || seen.has(slug)) continue;
     seen.add(slug);
-    const bodyAbs = join(designRoot, `${slug}.tsx`);
-    const target = resolve(bodyAbs);
-    if (target !== rootResolved && !target.startsWith(rootResolved + sep)) continue;
-    out.push({ slug, docName: doc.name, bodyAbs });
+    const target = resolvePulledTarget({
+      slug,
+      path: opts.pathFor?.(doc.name, slug) ?? null,
+      designRoot,
+      designRel: opts.designRel,
+      canvasGroups: opts.canvasGroups,
+      allowUndeclaredGroup: opts.allowUndeclaredGroup,
+      join,
+      resolve,
+      sep,
+      realpath: opts.realpath,
+      onRefused: opts.onRefused ? (reason) => opts.onRefused?.(slug, reason) : undefined,
+    });
+    if (!target) continue;
+    out.push({ slug, docName: doc.name, ...target });
   }
   return out;
 }
+
+/**
+ * One document's body path — the whole receiver-side decision, in one call.
+ *
+ * Separate from `pullTargets` because the runtime needs it TWICE: once from the
+ * listing (where no path is known yet, so every target is a fallback) and again
+ * per document once that document has synced and its `syncMeta.path` is
+ * readable. Both hops go through the same function, so "where does this canvas
+ * go" cannot have two answers.
+ *
+ * Returns null when even the containment check refuses — the only case in which
+ * a canvas is dropped rather than degraded.
+ */
+export function resolvePulledTarget(args: {
+  slug: string;
+  path: unknown;
+  designRoot: string;
+  designRel?: string;
+  canvasGroups?: readonly CanvasGroupLike[];
+  allowUndeclaredGroup?: boolean;
+  join: (...parts: string[]) => string;
+  resolve: (p: string) => string;
+  sep: string;
+  /**
+   * Resolve symlinks on the deepest EXISTING ancestor of a path.
+   *
+   * `resolve()` is purely lexical — it never follows a symlink — and the
+   * receivers create parent directories with `mkdirSync(recursive: true)`, which
+   * happily traverses one that already exists. While the only reachable target
+   * was `<designRoot>/<slug>.tsx` that only mattered for a symlinked design root
+   * (operator-controlled); now the sender picks the directory, so any symlink
+   * committed anywhere under a canvas group is a write-outside primitive.
+   * Injected rather than imported because this module is dependency-free.
+   */
+  realpath?: (p: string) => string;
+  onRefused?: (reason: string) => void;
+}): { bodyAbs: string; fromPath: boolean } | null {
+  const { rel, fromPath } = resolveCanvasBodyRel({
+    path: args.path,
+    slug: args.slug,
+    designRel: args.designRel,
+    canvasGroups: args.canvasGroups,
+    allowUndeclaredGroup: args.allowUndeclaredGroup,
+    onRefused: args.onRefused,
+  });
+  const bodyAbs = args.join(args.designRoot, rel);
+  // Belt and braces at a create. The validator already refuses everything that
+  // could escape lexically; this catches whatever a platform's own `resolve`
+  // makes of a string neither of us anticipated.
+  const rootResolved = args.resolve(args.designRoot);
+  const target = args.resolve(bodyAbs);
+  if (target !== rootResolved && !target.startsWith(rootResolved + args.sep)) return null;
+  if (args.realpath) {
+    const realRoot = args.realpath(rootResolved);
+    const realTarget = args.realpath(target);
+    if (realTarget !== realRoot && !realTarget.startsWith(realRoot + args.sep)) return null;
+  }
+  return { bodyAbs, fromPath };
+}

package/apps/studio/sync/supervisor.ts

@@ -52,8 +52,11 @@ export interface SyncSupervisor {
   /**
    * Adopt a just-authorized link and cycle the runtime. `linkedHub` is passed
    * BY VALUE from the attach lane on purpose — never re-read from disk.
+   * `null` is the detach lane: clear the in-memory link (the config write on
+   * disk is invisible to a cfg captured at boot) and cycle back to solo.
+   * `undefined` keeps whatever the config already holds.
    */
-  restart(linkedHub?: LinkedHub): Promise<SyncStartOutcome>;
+  restart(linkedHub?: LinkedHub | null): Promise<SyncStartOutcome>;
   stop(): Promise<void>;
   /** The live runtime, or null in solo mode. Test/inspection surface. */
   current(): SyncRuntime | null;
@@ -166,6 +169,7 @@ export function createSyncSupervisor(
         }
         runtime = null;
         if (linkedHub) adoptLinkedHub(ctx, linkedHub);
+        else if (linkedHub === null) delete ctx.cfg.linkedHub;
         return boot();
       }),
     stop: () =>

package/apps/studio/sync/workspace-signin.ts

@@ -67,7 +67,7 @@ export interface SignInInput {
 /** Injected in tests. */
 export interface SignInDeps {
   fetchImpl?: typeof fetch;
-  save?: (normUrl: string, token: string, role?: string) => void;
+  save?: (normUrl: string, token: string, role?: string, expiresAt?: number) => void;
 }
 
 /**
@@ -186,8 +186,12 @@ export async function signInToWorkspace(
   //    viewer is known to be one at BOOT. Learning it from the first refusal
   //    instead means showing somebody an editor and then taking it away.
   const vouchedRole = typeof body.user?.role === 'string' ? body.user.role : 'member';
+  //    …and WHEN it dies. The expiry was already read (it is echoed to the UI
+  //    below) — discarding it from the store is what left the sync runtime
+  //    with no deadline to renew against.
+  const expiresAt = typeof body.expiresAt === 'number' ? body.expiresAt : undefined;
   try {
-    save(norm, body.token, vouchedRole);
+    save(norm, body.token, vouchedRole, expiresAt);
   } catch {
     return fail(500, "Couldn't save the workspace connection on this computer.", 'save-failed');
   }
@@ -201,7 +205,7 @@ export async function signInToWorkspace(
         email: typeof body.user?.email === 'string' ? body.user.email : String(input.email).trim(),
         role: vouchedRole,
       },
-      expiresAt: typeof body.expiresAt === 'number' ? body.expiresAt : null,
+      expiresAt: expiresAt ?? null,
       version: probe.version,
     },
   };

package/apps/studio/test/acp-bridge-lifetime.test.ts

@@ -28,6 +28,7 @@ import type { WsData } from '../ws.ts';
 
 const FIXTURE_SLOW = join(import.meta.dir, 'fixtures', 'mock-acp-agent-slow.mjs');
 const FIXTURE_PERM = join(import.meta.dir, 'fixtures', 'mock-acp-agent-permission.mjs');
+const FIXTURE_WEDGED = join(import.meta.dir, 'fixtures', 'mock-acp-agent-wedged.mjs');
 const TEST_ENV_KEYS = ['MAUDE_ACP_ADAPTER_ENTRY', 'MAUDE_ACP_RUNTIME', 'MAUDE_CLAUDE_BIN'];
 
 function useMockAgent(fixture: string) {
@@ -333,6 +334,111 @@ describe('bridge lifetime — the attach seq is client-supplied and must be boun
   }, 30000);
 });
 
+describe('cancel() must not hang forever on a non-cooperating agent (issue-82)', () => {
+  // The reported bug: "I clicked STOP and nothing happened. Probably stuck."
+  // The old cancel() just `await`ed the cooperative ACP `session/cancel`
+  // request with no bound — a wedged subprocess (or one that never
+  // implemented session/cancel at all, as here) left it, and the pending
+  // prompt() call, hanging forever. `bridge.cancel()` below must always
+  // return, and it must force the stuck turn to actually end.
+  test('cancel() escalates and force-ends the turn when the agent never responds', async () => {
+    useMockAgent(FIXTURE_WEDGED);
+    const ctx = freshCtx();
+    const bridge = new AcpBridge({
+      repoRoot: ctx.paths.repoRoot,
+      cancelEscalationMs: 200, // real default is 5s; keep the test fast
+      onUpdate: () => {},
+    });
+    try {
+      const promptPromise = bridge.prompt('go', 'c1');
+      // Let the turn actually reach the wedged conn.prompt() call — the same
+      // race a real Stop click lands in — before cancelling.
+      await until(() => (bridge.sessionId ? true : undefined));
+
+      // This is the assertion that matters: without the fix, this call never
+      // resolves and the test times out.
+      await bridge.cancel();
+
+      await expect(promptPromise).rejects.toThrow(/did not respond/);
+      // The subprocess was actually killed, not just the promise resolved —
+      // otherwise a "cancelled" chat could keep silently running/burning
+      // tokens in the background.
+      expect(bridge.connected).toBe(false);
+    } finally {
+      await bridge.stop();
+    }
+  }, 15000);
+
+  // Ethical-hacker finding on the first cut of this fix: `handlePrompt` has
+  // no reentrancy guard, so a duplicate/replayed `prompt` frame for the same
+  // chat can start a SECOND, overlapping turn on one bridge. A single shared
+  // "pending turn" field would be overwritten by that second turn and then
+  // nulled by whichever turn settles FIRST — even an ordinary, uncancelled
+  // completion — silently leaving an earlier, genuinely wedged turn
+  // permanently unescalatable and reopening this exact bug from a different
+  // angle. Pin that a normal turn finishing does not blind cancel() to a
+  // still-stuck one that started before it.
+  test('an overlapping turn finishing normally does not blind cancel() to an earlier wedged one', async () => {
+    useMockAgent(FIXTURE_WEDGED);
+    const ctx = freshCtx();
+    const bridge = new AcpBridge({
+      repoRoot: ctx.paths.repoRoot,
+      cancelEscalationMs: 200,
+      onUpdate: () => {},
+    });
+    try {
+      // Turn A — the fixture's FIRST session/prompt call, which wedges forever.
+      const turnA = bridge.prompt('go', 'c1');
+      await until(() => (bridge.sessionId ? true : undefined));
+
+      // Turn B — a second, overlapping call for the SAME chat while A is
+      // still in flight. The fixture resolves every call after the first
+      // quickly, so this settles normally with no cancellation involved.
+      const turnB = bridge.prompt('go again', 'c1');
+      await expect(turnB).resolves.toMatchObject({ stopReason: 'end_turn' });
+
+      // Turn B's ordinary completion must not have cleared turn A's
+      // escalation registration — cancel() must still find and force-end A.
+      await bridge.cancel();
+      await expect(turnA).rejects.toThrow(/did not respond/);
+      expect(bridge.connected).toBe(false);
+    } finally {
+      await bridge.stop();
+    }
+  }, 15000);
+
+  // A second-round ethical-hacker finding on THIS fix: cancel()'s escalation
+  // calls this.stop() directly, which does NOT go through index.ts's reap()
+  // (the only place that deletes a bridge from the `bridges` map). Without a
+  // guard, the SAME now-`stopped` instance would stay live and silently
+  // respawn a working-looking subprocess on the next prompt — except its
+  // requestPermission/unstable_createElicitation handlers auto-deny forever
+  // (the `stopped` check never resets), a silent permission-gate regression
+  // with no visible error. `ensureStarted()` must refuse to resurrect it.
+  test('after cancel() escalates and self-stops, the bridge refuses to silently respawn', async () => {
+    useMockAgent(FIXTURE_WEDGED);
+    const ctx = freshCtx();
+    const bridge = new AcpBridge({
+      repoRoot: ctx.paths.repoRoot,
+      cancelEscalationMs: 200,
+      onUpdate: () => {},
+    });
+    try {
+      const promptPromise = bridge.prompt('go', 'c1');
+      await until(() => (bridge.sessionId ? true : undefined));
+      await bridge.cancel(); // escalates → self-stop()
+      await expect(promptPromise).rejects.toThrow(/did not respond/);
+      expect(bridge.connected).toBe(false);
+
+      // The assertion that matters: a LOUD, immediate error — never a silent
+      // respawn into a permanently permission-denying session.
+      await expect(bridge.prompt('again', 'c1')).rejects.toThrow(/stopped and cannot be reused/);
+    } finally {
+      await bridge.stop();
+    }
+  }, 15000);
+});
+
 describe('set-mode is attachment-scoped too (ethical-hacker A2)', () => {
   test('a socket CANNOT flip another chat into bypassPermissions', async () => {
     // A2 was the one control frame that escaped the attachment-scoping sweep,