@1agh/maude 0.58.1 → 0.58.3

package/apps/studio/test/sync-runtime.test.ts

@@ -30,11 +30,13 @@ import { createConnectionMonitor } from '../sync/connection-state.ts';
 import {
   type AwarenessRegistry,
   buildNoSyncablePayload,
+  classifyAuthFailure,
   createSyncRuntime,
   discoverCanvases,
   type SyncProvider,
   scanCanvases,
   toWsUrl,
+  validExpiry,
 } from '../sync/index.ts';
 import { createSyncStatusStore } from '../sync/status.ts';
 
@@ -1029,6 +1031,49 @@ describe('createDefaultProviderFactory — shared socket multiplexing', () => {
 
 // DDR-102 — auth-failure intelligence (classification, aggregation,
 // destroy-on-permanent + re-probe) and the honest settled boot summary.
+describe('validExpiry — a hub-reported deadline sane enough to schedule against', () => {
+  const NOW = 1_000_000_000_000;
+  test('accepts a plausible future integer', () => {
+    expect(validExpiry(NOW + 12 * 60 * 60 * 1000, NOW)).toBe(NOW + 12 * 60 * 60 * 1000);
+  });
+  test('rejects a past or present stamp (falls to the invalid-token path instead)', () => {
+    expect(validExpiry(NOW - 1, NOW)).toBeNull();
+    expect(validExpiry(NOW, NOW)).toBeNull();
+  });
+  test('rejects an absurdly far-future stamp (the setTimeout-overflow trap)', () => {
+    expect(validExpiry(NOW + 60 * 24 * 60 * 60 * 1000, NOW)).toBeNull(); // 60 days
+  });
+  test('rejects non-integers and non-numbers', () => {
+    expect(validExpiry(NOW + 1000.5, NOW)).toBeNull();
+    expect(validExpiry('soon', NOW)).toBeNull();
+    expect(validExpiry(Number.NaN, NOW)).toBeNull();
+    expect(validExpiry(Number.POSITIVE_INFINITY, NOW)).toBeNull();
+    expect(validExpiry(undefined, NOW)).toBeNull();
+  });
+});
+
+describe('classifyAuthFailure — permanent classes outrank the transient ones', () => {
+  test('the invalid-token bucket refusal classifies as invalid-token, not rate-limit', () => {
+    // The hub's invalid-token bucket says BOTH things. Filing it under
+    // rate-limit (transient) made the runtime retry into the very bucket
+    // refusing it — the alligators incident's 1840-vs-138 log ratio.
+    expect(classifyAuthFailure('invalid token — rate limited, retry in up to 60s')).toBe(
+      'invalid-token'
+    );
+  });
+
+  test('plain reasons still land in their own classes', () => {
+    expect(classifyAuthFailure('invalid token')).toBe('invalid-token');
+    expect(classifyAuthFailure('token not authorized for this documentName')).toBe(
+      'not-authorized'
+    );
+    expect(classifyAuthFailure('rate limit exceeded for this token — retry in up to 60s')).toBe(
+      'rate-limit'
+    );
+    expect(classifyAuthFailure('permission-denied')).toBe('generic');
+  });
+});
+
 describe('DDR-102 — auth-failure intelligence + boot summary', () => {
   function fakeTimerQueue() {
     let nextId = 1;
@@ -1059,15 +1104,17 @@ describe('DDR-102 — auth-failure intelligence + boot summary', () => {
   function authStubFactory() {
     const made: Array<{
       documentName: string;
+      token: string | undefined;
       destroyed: boolean;
       emitAuthFailure: (reason: string) => void;
       document: Y.Doc;
     }> = [];
-    const factory = (args: { documentName: string; document?: Y.Doc }) => {
+    const factory = (args: { documentName: string; token?: string; document?: Y.Doc }) => {
       const document = args.document ?? new Y.Doc();
       const cbs = new Set<(info: { reason: string }) => void>();
       const entry = {
         documentName: args.documentName,
+        token: args.token,
         destroyed: false,
         emitAuthFailure: (reason: string) => {
           for (const cb of cbs) cb({ reason });
@@ -1171,6 +1218,392 @@ describe('DDR-102 — auth-failure intelligence + boot summary', () => {
     }
   });
 
+  test('invalid-token triggers ONE silent renewal and an immediate re-probe with the fresh token', async () => {
+    const url = 'https://hub.example.com';
+    writeHubsConfig(url, 'mau_stale');
+    const ctx = makeCtx({ url, linkedAt: 1 });
+    writeFileSync(join(ctx.paths.designRoot, 'ui', 'a.html'), '<a/>');
+    writeFileSync(join(ctx.paths.designRoot, 'ui', 'b.html'), '<b/>');
+    writeFileSync(join(ctx.paths.designRoot, 'ui', 'c.html'), '<c/>');
+
+    const timers = fakeTimerQueue();
+    const { factory, made } = authStubFactory();
+    let renewCalls = 0;
+    const origWarn = console.warn;
+    const origLog = console.log;
+    console.warn = () => {};
+    console.log = () => {};
+    try {
+      const runtime = createSyncRuntime(ctx, {
+        providerFactory: factory,
+        auth: {
+          warnDebounceMs: 2_000,
+          reprobeMs: 300_000,
+          settleTimeoutMs: 15_000,
+          setTimer: timers.setTimer,
+          clearTimer: timers.clearTimer,
+          renewCredential: async () => {
+            renewCalls++;
+            return { token: 'mau_fresh', expiresAt: null };
+          },
+        },
+      });
+      await runtime?.start();
+      expect(made).toHaveLength(3);
+      expect(made.every((m) => m.token === 'mau_stale')).toBe(true);
+
+      // The whole burst rejects with the expired credential…
+      for (const m of made.slice(0, 3)) m.emitAuthFailure('invalid token');
+      await new Promise((res) => setTimeout(res, 10));
+
+      // …ONE renewal (single-flight), and the re-probe happened NOW — no
+      // 5-minute wait — with the fresh token on every reconnected provider.
+      expect(renewCalls).toBe(1);
+      const reprobed = made.slice(3);
+      expect(reprobed.map((m) => m.documentName).sort()).toEqual(['ui-a', 'ui-b', 'ui-c']);
+      expect(reprobed.every((m) => m.token === 'mau_fresh')).toBe(true);
+
+      await runtime?.stop();
+    } finally {
+      console.warn = origWarn;
+      console.log = origLog;
+    }
+  });
+
+  test('F1: a hub refusing on VOLUME cannot drive a renewal storm — the cap stops it', async () => {
+    // The regression this whole review turned on. A cell refusing its own
+    // clients with "invalid token — rate limited" classifies permanent →
+    // triggers renewal → renewal succeeds (token was fine) → reprobe → every
+    // reconnected doc is refused again → loop. Reproduced at 2342/s before the
+    // cap. Here every reconnected provider auto-re-rejects, so without the cap
+    // this test would spin forever; with it, renewals are bounded.
+    const url = 'https://hub.example.com';
+    writeHubsConfig(url, 'mau_stale');
+    const ctx = makeCtx({ url, linkedAt: 1 });
+    writeFileSync(join(ctx.paths.designRoot, 'ui', 'a.html'), '<a/>');
+    writeFileSync(join(ctx.paths.designRoot, 'ui', 'b.html'), '<b/>');
+
+    let renewCalls = 0;
+    let providersMade = 0;
+    const origWarn = console.warn;
+    const origLog = console.log;
+    console.warn = () => {};
+    console.log = () => {};
+    // Every provider auto-rejects with the volume-refusal string the moment a
+    // failure handler is attached — modelling a full hub bucket.
+    const factory = (args: { documentName: string; token?: string; document?: Y.Doc }) => {
+      const document = args.document ?? new Y.Doc();
+      providersMade++;
+      return {
+        document,
+        onAuthFailed(cb: (info: { reason: string }) => void) {
+          queueMicrotask(() => cb({ reason: 'invalid token — rate limited, retry in up to 60s' }));
+          return () => {};
+        },
+        onceSynced: () => new Promise<void>(() => {}),
+        destroy() {},
+      };
+    };
+    try {
+      const runtime = createSyncRuntime(ctx, {
+        providerFactory: factory,
+        auth: {
+          warnDebounceMs: 2_000,
+          reprobeMs: 300_000,
+          settleTimeoutMs: 15_000,
+          setTimer: () => 0 as unknown as ReturnType<typeof setTimeout>,
+          clearTimer: () => {},
+          renewMinIntervalMs: 0, // isolate the CAP from the floor
+          renewCredential: async () => {
+            renewCalls++;
+            return { token: `mau_fresh_${renewCalls}`, expiresAt: null };
+          },
+        },
+      });
+      await runtime?.start();
+      // Let the storm run itself out — if the cap failed, this never settles
+      // and the test times out (which is itself the failure signal).
+      for (let i = 0; i < 20; i++) await new Promise((res) => setTimeout(res, 5));
+
+      // Bounded by the cap (default 3), NOT thousands.
+      expect(renewCalls).toBeLessThanOrEqual(3);
+      expect(renewCalls).toBeGreaterThan(0);
+      // Providers created is likewise bounded — no runaway reconnect fan-out.
+      expect(providersMade).toBeLessThan(20);
+      await runtime?.stop();
+    } finally {
+      console.warn = origWarn;
+      console.log = origLog;
+    }
+  });
+
+  test('F1: the frequency floor collapses a rapid second burst to no extra renewal', async () => {
+    const url = 'https://hub.example.com';
+    writeHubsConfig(url, 'mau_stale');
+    const ctx = makeCtx({ url, linkedAt: 1 });
+    writeFileSync(join(ctx.paths.designRoot, 'ui', 'a.html'), '<a/>');
+
+    let renewCalls = 0;
+    let clock = 1_000_000;
+    const origWarn = console.warn;
+    const origLog = console.log;
+    console.warn = () => {};
+    console.log = () => {};
+    const { factory, made } = authStubFactory();
+    try {
+      const runtime = createSyncRuntime(ctx, {
+        providerFactory: factory,
+        auth: {
+          warnDebounceMs: 2_000,
+          reprobeMs: 300_000,
+          settleTimeoutMs: 15_000,
+          setTimer: () => 0 as unknown as ReturnType<typeof setTimeout>,
+          clearTimer: () => {},
+          now: () => clock,
+          renewMinIntervalMs: 60_000,
+          renewCredential: async () => {
+            renewCalls++;
+            return { token: 'mau_fresh', expiresAt: null };
+          },
+        },
+      });
+      await runtime?.start();
+      made[0]?.emitAuthFailure('invalid token');
+      await new Promise((res) => setTimeout(res, 10));
+      expect(renewCalls).toBe(1);
+      // A second rejection 10 s later (inside the 60 s floor) → no new renewal.
+      clock += 10_000;
+      made[0]?.emitAuthFailure('invalid token');
+      await new Promise((res) => setTimeout(res, 10));
+      expect(renewCalls).toBe(1);
+      // Past the floor → renewal is allowed again.
+      clock += 60_000;
+      made[0]?.emitAuthFailure('invalid token');
+      await new Promise((res) => setTimeout(res, 10));
+      expect(renewCalls).toBe(2);
+      await runtime?.stop();
+    } finally {
+      console.warn = origWarn;
+      console.log = origLog;
+    }
+  });
+
+  test('a failed renewal changes nothing — rejected docs wait for the slow re-probe as before', async () => {
+    const url = 'https://hub.example.com';
+    writeHubsConfig(url, 'mau_stale');
+    const ctx = makeCtx({ url, linkedAt: 1 });
+    writeFileSync(join(ctx.paths.designRoot, 'ui', 'a.html'), '<a/>');
+
+    const timers = fakeTimerQueue();
+    const { factory, made } = authStubFactory();
+    const origWarn = console.warn;
+    const origLog = console.log;
+    console.warn = () => {};
+    console.log = () => {};
+    try {
+      const runtime = createSyncRuntime(ctx, {
+        providerFactory: factory,
+        auth: {
+          warnDebounceMs: 2_000,
+          reprobeMs: 300_000,
+          settleTimeoutMs: 15_000,
+          setTimer: timers.setTimer,
+          clearTimer: timers.clearTimer,
+          renewCredential: async () => null, // signed out / revoked / self-hosted
+        },
+      });
+      await runtime?.start();
+      made[0]?.emitAuthFailure('invalid token');
+      await new Promise((res) => setTimeout(res, 10));
+
+      // No immediate re-probe (the renewal failed) — the doc stays rejected…
+      expect(made).toHaveLength(1);
+      expect(runtime?.status()?.docs?.rejected).toBe(1);
+      // …until the slow re-probe fires, with the ORIGINAL token (unchanged).
+      timers.fire(300_000);
+      await new Promise((res) => setTimeout(res, 10));
+      expect(made).toHaveLength(2);
+      expect(made[1]?.token).toBe('mau_stale');
+
+      await runtime?.stop();
+    } finally {
+      console.warn = origWarn;
+      console.log = origLog;
+    }
+  });
+
+  test('a stored expiry arms a pre-expiry renewal at ~80% of the remaining life', async () => {
+    const url = 'https://hub.example.com';
+    const cfgPath = process.env.HUBS_CONFIG_PATH;
+    if (!cfgPath) throw new Error('HUBS_CONFIG_PATH not set by beforeEach');
+    writeFileSync(
+      cfgPath,
+      JSON.stringify({
+        hubs: { [url]: { token: 'mau_stale', linkedAt: 1, expiresAt: Date.now() + 100_000 } },
+      })
+    );
+    chmodSync(cfgPath, 0o600);
+    const ctx = makeCtx({ url, linkedAt: 1 });
+    writeFileSync(join(ctx.paths.designRoot, 'ui', 'a.html'), '<a/>');
+
+    const timers = fakeTimerQueue();
+    const { factory } = authStubFactory();
+    let renewCalls = 0;
+    const origWarn = console.warn;
+    const origLog = console.log;
+    console.warn = () => {};
+    console.log = () => {};
+    try {
+      const runtime = createSyncRuntime(ctx, {
+        providerFactory: factory,
+        auth: {
+          warnDebounceMs: 2_000,
+          reprobeMs: 300_000,
+          settleTimeoutMs: 15_000,
+          setTimer: timers.setTimer,
+          clearTimer: timers.clearTimer,
+          renewCredential: async () => {
+            renewCalls++;
+            return { token: 'mau_fresh', expiresAt: null };
+          },
+        },
+      });
+      await runtime?.start();
+      // 100 s of life left → the renewal timer sits at 80 s, so a 30 s sweep
+      // must not reach it (only the settle timers live down there)…
+      timers.fire(30_000);
+      await new Promise((res) => setTimeout(res, 5));
+      expect(renewCalls).toBe(0);
+      // …and the 80 s sweep fires it, once, without any rejection happening.
+      timers.fire(80_000);
+      await new Promise((res) => setTimeout(res, 5));
+      expect(renewCalls).toBe(1);
+
+      await runtime?.stop();
+    } finally {
+      console.warn = origWarn;
+      console.log = origLog;
+    }
+  });
+
+  test('a successful re-probe clears the refusal, and the reconcile is a separate word', async () => {
+    // A REGRESSION GUARD, not a falsifier — this already held. It is here
+    // because the clear moved: it used to sit at the BOTTOM of the
+    // post-handshake path, below a reconcile that can throw into a rejection
+    // `settleWait` swallows, so a document that reconnected fine but failed to
+    // settle on disk would have kept telling the user to go fix a credential
+    // that was never the problem. The clear now runs on the handshake, and the
+    // reconcile reports separately (`pending` vs `connected`) and loudly.
+    const url = 'https://hub.example.com';
+    writeHubsConfig(url, 'mau_test');
+    const ctx = makeCtx({ url, linkedAt: 1 });
+    writeFileSync(join(ctx.paths.designRoot, 'ui', 'a.html'), '<a/>');
+
+    const timers = fakeTimerQueue();
+    const origWarn = console.warn;
+    const origLog = console.log;
+    console.warn = () => {};
+    console.log = () => {};
+
+    let round = 0;
+    const factory = (args: { documentName: string; document?: Y.Doc }) => {
+      const document = args.document ?? new Y.Doc();
+      const first = round++ === 0;
+      return {
+        document,
+        onAuthFailed(cb: (info: { reason: string }) => void) {
+          if (first) queueMicrotask(() => cb({ reason: 'token not authorized' }));
+          return () => {};
+        },
+        onceSynced: () => (first ? new Promise<void>(() => {}) : Promise.resolve()),
+        destroy() {},
+      };
+    };
+
+    try {
+      const runtime = createSyncRuntime(ctx, {
+        providerFactory: factory,
+        auth: {
+          warnDebounceMs: 2_000,
+          reprobeMs: 300_000,
+          settleTimeoutMs: 15_000,
+          setTimer: timers.setTimer,
+          clearTimer: timers.clearTimer,
+        },
+      });
+      await runtime?.start();
+      await new Promise((res) => setTimeout(res, 10));
+      expect(runtime?.status().docs?.rejected).toBe(1);
+
+      timers.fire(300_000);
+      await new Promise((res) => setTimeout(res, 40));
+
+      expect(runtime?.status().docs?.rejected).toBe(0);
+      expect(runtime?.status().rejectedSlugs ?? []).toEqual([]);
+
+      await runtime?.stop();
+    } finally {
+      console.warn = origWarn;
+      console.log = origLog;
+    }
+  });
+
+  test('a new process never serves the previous one’s verdict, not even mid-boot', async () => {
+    // `_sync.json` is a file and `/_sync-status` returns whatever is in it. The
+    // first honest snapshot of a run is not written until every provider has
+    // been built — after a scan AND a listing fetch that waits up to 6 seconds.
+    // For that whole window the CLI and the browser banner were reading the
+    // LAST run's counters as current. So the window is what this asserts: the
+    // fetch is held open, and the file must ALREADY be clean.
+    const url = 'https://hub.example.com';
+    writeHubsConfig(url, 'mau_test');
+    const ctx = makeCtx({ url, linkedAt: 1 });
+    const statusFile = join(ctx.paths.designRoot, '_sync.json');
+    writeFileSync(
+      statusFile,
+      JSON.stringify({
+        url,
+        canvases: 76,
+        state: 'online',
+        docs: { synced: 0, pending: 3, rejected: 73 },
+        rejectedSlugs: ['ui-a', 'ui-b'],
+      })
+    );
+    writeFileSync(join(ctx.paths.designRoot, 'ui', 'a.html'), '<a/>');
+
+    const realFetch = globalThis.fetch;
+    let releaseListing: () => void = () => {};
+    const listingReached = new Promise<void>((res) => {
+      globalThis.fetch = (async () => {
+        res();
+        await new Promise<void>((r) => {
+          releaseListing = r;
+        });
+        return new Response(JSON.stringify({ documents: [] }), { status: 200 });
+      }) as typeof fetch;
+    });
+
+    try {
+      const { factory } = inMemoryProviderFactory();
+      const runtime = createSyncRuntime(ctx, { providerFactory: factory });
+      const booting = runtime?.start();
+      await listingReached;
+
+      // Mid-boot, with the listing still in flight — exactly where the stale
+      // file used to be authoritative.
+      const midBoot = JSON.parse(readFileSync(statusFile, 'utf8'));
+      expect(midBoot.docs.rejected).toBe(0);
+      expect(midBoot.rejectedSlugs ?? []).toEqual([]);
+      expect(midBoot.state).toBe('connecting');
+
+      releaseListing();
+      await booting;
+      await runtime?.stop();
+    } finally {
+      globalThis.fetch = realFetch;
+    }
+  });
+
   test('boot summary prints AFTER settle with honest counts (not the premature N/N)', async () => {
     const url = 'https://hub.example.com';
     writeHubsConfig(url, 'mau_test');

package/apps/studio/test/video-comp.test.ts

@@ -151,7 +151,7 @@ describe('video-comp seek bridge', () => {
     expect(a.seeks).toEqual([42, 42]);
   });
 
-  test('a Player ref that is not yet ready (null) does not throw', async () => {
+  test('a not-yet-ready Player is resilient in UI mode but still RECORDED', async () => {
     const w = window as unknown as SeekWindow;
     installMaudeSeekBridge();
     if (!w.__maudeVideoComps) w.__maudeVideoComps = new Map();
@@ -163,6 +163,28 @@ describe('video-comp seek bridge', () => {
       height: 360,
       ref: { current: null },
     });
+    // A live scrub of a still-mounting comp must not blow up the UI...
+    const before = w.__maude_seek_failures__ ?? 0;
     await expect(w.__maude_seek__?.(10)).resolves.toBeUndefined();
+    // ...but it is no longer silent: the capture shim reads this counter and
+    // refuses to encode, because a seek that never landed means a stale frame.
+    expect(w.__maude_seek_failures__ ?? 0).toBeGreaterThan(before);
+  });
+
+  test('capture mode (strict) throws instead of pretending the seek landed', async () => {
+    const w = window as unknown as SeekWindow;
+    installMaudeSeekBridge();
+    if (!w.__maudeVideoComps) w.__maudeVideoComps = new Map();
+    w.__maudeVideoComps.set('pending-strict', {
+      id: 'pending-strict',
+      fps: 30,
+      durationInFrames: 90,
+      width: 640,
+      height: 360,
+      ref: { current: null },
+    });
+    await expect(w.__maude_seek__?.(10, { strict: true })).rejects.toThrow(
+      /refusing to report a seek that did not happen/
+    );
   });
 });

package/apps/studio/test/workspace-containment.test.ts

@@ -233,6 +233,7 @@ describe('the vocabulary itself', () => {
       '/_api/debug-bundle',
       '/_api/design',
       '/_api/export',
+      '/_api/figma',
       '/_api/generate',
       '/_api/github',
       '/_api/hub',

package/apps/studio/video-comp.tsx

@@ -81,7 +81,20 @@ interface MaudeSeekWindow {
   __maudeVideoComps?: Map<string, CompEntry>;
   /** Seek every registered comp to `frame` (paused). Ordinary artboards fall
    *  back to a time-based WAAPI seek. Resolves once the frame has painted. */
-  __maude_seek__?: (frame: number, opts?: { fps?: number }) => Promise<void>;
+  __maude_seek__?: (
+    frame: number,
+    opts?: {
+      fps?: number;
+      /** Capture mode: throw when a seek never lands, instead of only counting it. */
+      strict?: boolean;
+    }
+  ) => Promise<void>;
+  /**
+   * Count of seeks that never landed. The capture shim reads this and refuses
+   * to ship the export rather than encoding a stale frame — a silent wrong
+   * frame is worse than a loud failure.
+   */
+  __maude_seek_failures__?: number;
   /** Serializable comp list for the capture shim / Timeline panel. */
   __maude_comps__?: () => CompSnapshot[];
   /**
@@ -140,6 +153,36 @@ function afterPaint(): Promise<void> {
   });
 }
 
+/** How many paint-spaced attempts a cold Player gets before a seek is a failure. */
+const SEEK_ATTEMPTS = 3;
+
+/**
+ * Seek one comp, giving a not-yet-mounted Player a bounded number of chances.
+ *
+ * Returns whether the seek actually landed. The retry replaces the old silent
+ * swallow: a Player that is genuinely mid-mount settles within a paint or two,
+ * and one that never settles is a real fault the caller must not paper over.
+ */
+async function seekEntryWithRetry(
+  ref: { current: { pause?: () => void; seekTo: (f: number) => void } | null },
+  frame: number
+): Promise<boolean> {
+  for (let attempt = 0; attempt < SEEK_ATTEMPTS; attempt += 1) {
+    try {
+      const player = ref.current;
+      if (player) {
+        player.pause?.();
+        player.seekTo(frame);
+        return true;
+      }
+    } catch {
+      /* fall through to the retry — the next paint may settle it */
+    }
+    if (attempt < SEEK_ATTEMPTS - 1) await afterPaint();
+  }
+  return false;
+}
+
 /**
  * Install the singleton seek bridge on `window`. Idempotent — the first
  * VideoComp to mount wins; later mounts reuse the same functions. The bridge
@@ -156,11 +199,32 @@ export function installMaudeSeekBridge(): void {
     if (entries.length > 0) {
       for (const e of entries) {
         const f = clamp(Math.round(frame), 0, Math.max(0, e.durationInFrames - 1));
-        try {
-          e.ref.current?.pause();
-          e.ref.current?.seekTo(f);
-        } catch {
-          /* Player not yet ready — a later seek settles it */
+        // This used to be a bare try/catch with an empty body and the comment
+        // "Player not yet ready — a later seek settles it". That made a seek
+        // that COMPLETELY FAILED resolve as success: `afterPaint()` proves a
+        // paint happened, not that the right content was in it. Serially it was
+        // benign — frame N+1 repaired frame N's miss, and only frame 0 was ever
+        // exposed — which is exactly why it survived. It is not benign the
+        // moment anything captures ranges in parallel: every range boundary is a
+        // first seek on a cold page, so "a later seek settles it" would be
+        // invoked once per worker instead of once per export, and a stale frame
+        // is a valid-looking file with wrong pixels, not a crash.
+        //
+        // So the hope becomes an explicit bounded retry, and exhausting it is a
+        // real failure the capture shim can see and refuse to ship.
+        if (!(await seekEntryWithRetry(e.ref, f))) {
+          // ALWAYS recorded, so the capture shim can refuse the export even on
+          // the non-strict path. Only THROWN under `strict`, which the shim
+          // passes: a live UI scrub of a still-mounting comp should stay
+          // resilient, but a capture must never proceed on a seek that did not
+          // happen. The old code did neither — it just resolved.
+          w.__maude_seek_failures__ = (w.__maude_seek_failures__ ?? 0) + 1;
+          if (opts?.strict) {
+            throw new Error(
+              `__maude_seek__: comp did not accept frame ${f} after ${SEEK_ATTEMPTS} attempts ` +
+                '(Player never became ready) — refusing to report a seek that did not happen'
+            );
+          }
         }
       }
       await afterPaint();

package/apps/studio/whats-new.json

@@ -1,6 +1,42 @@
 {
   "$schema": "./whats-new.schema.json",
   "entries": [
+    {
+      "id": "cloud-sync-matches-your-desktop",
+      "version": "0.58.3",
+      "date": "2026-08-11",
+      "kind": "fix",
+      "title": "The cloud copy matches your desktop",
+      "summary": "A project you connect to the cloud now looks exactly like it does on your machine: no duplicated files, every canvas opens instead of breaking, and your images show up instead of grey boxes. The cloud picker says \"Connected\" for the project this folder is linked to, with a Disconnect right there — and once you're connected, the cloud saves every change automatically, so there's one place your work is saved, not two.",
+      "surface": "design-ui"
+    },
+    {
+      "id": "cloud-link-self-renews",
+      "version": "0.58.3",
+      "date": "2026-08-11",
+      "kind": "fix",
+      "title": "Cloud sync keeps itself signed in",
+      "summary": "A workspace you connect to the cloud stays synced — the session refreshes itself in the background instead of quietly expiring after a few hours and stranding your canvases on \"connecting…\". If a link ever can't sync for a few minutes it now says so and points you to reconnect, instead of spinning forever.",
+      "surface": "design-ui"
+    },
+    {
+      "id": "figma-import",
+      "version": "0.58.3",
+      "date": "2026-08-11",
+      "kind": "feature",
+      "title": "Bring your Figma work in",
+      "summary": "Paste a Figma link and get the real thing, not a picture of it: design frames become editable canvases, a FigJam board becomes your whiteboard with its sticky notes and arrows still attached, and your colour and text styles become design tokens. Add a Figma access token once in Settings to get started.",
+      "surface": "design-ui"
+    },
+    {
+      "id": "sync-carries-the-path",
+      "version": "0.58.2",
+      "date": "2026-08-08",
+      "kind": "fix",
+      "title": "Canvases arrive in the folder you made",
+      "summary": "A canvas you create in a nested folder now shows up on your other machine — and in the cloud — in that same folder, instead of quietly landing somewhere the file tree never listed. Connecting a project to an empty folder brings the whole thing down with its structure intact.",
+      "surface": "design-ui"
+    },
     {
       "id": "release-version-visible",
       "version": "0.58.0",

package/apps/studio/workspace-mode.ts

@@ -66,6 +66,10 @@ export const FORBIDDEN_ROUTE_PREFIXES: ReadonlyArray<{ prefix: string; why: stri
       prefix: '/_api/generate',
       why: 'media generation runs tenant-authored prompts against a provider key held here',
     },
+    {
+      prefix: '/_api/figma',
+      why: 'the Figma lane STORES and SPENDS a user personal access token, and imports write the design root — a cell must hold no provider credential (DDR-216 D2/D3, same class as /_api/generate)',
+    },
     {
       prefix: '/_api/shell-shot',
       why: 'the shell screenshot spawns a headless browser against the studio — the same evaluation `/_api/export` is forbidden for',