@1agh/maude 0.58.2 → 0.58.3

package/apps/studio/sync/migrate-flat-fallback.ts

@@ -0,0 +1,121 @@
+// One-shot quarantine of the pre-fix-5 flat fallback twins — fix 4 of the
+// 2026-08-10 sync RCA (v0.58.2's `f2a38c46` changed the fallback rule with no
+// migration of what the old rule had already written).
+//
+// Until then the no-path fallback wrote a pulled canvas FLAT at the design root
+// (`ui-welcome.tsx`); the group-aware fallback plus the stamp-race fix (phase
+// sync-2) stopped producing new ones, but whatever the old rule wrote is still
+// on disk NEXT TO the real grouped file — two files, one slug, one document
+// (DDR-064 A4's collision class), and the tree lists both.
+//
+// The rules, in migrate-seed.ts's posture (idempotent, best-effort, never
+// throws into boot):
+//
+//   - Only a flat file WITH a grouped twin of the same slug moves — the flat
+//     copy is provably the redundant one. A flat file with NO twin is a
+//     genuinely-flat canvas somebody authored; moving it would lose work, so
+//     it stays (fix 5 + a future re-sync relocates it).
+//   - Quarantine, never delete: the loser goes to `_trash/<slug>-flat-<ts>/`
+//     (the established runtime quarantine, DDR-115), `.meta.json`/`.css`
+//     siblings riding along. The `<slug>.annotations.svg` sidecar does NOT
+//     move — annotations are keyed by the flat slug at the design root and
+//     serve the surviving grouped twin.
+//   - One log line per move, so a tenant can find their bytes.
+
+import { type Dirent, existsSync, mkdirSync, readdirSync, renameSync } from 'node:fs';
+import path from 'node:path';
+
+import { canvasSlugFromRel } from '../canvas-slug.ts';
+
+export interface FlatFallbackMove {
+  slug: string;
+  /** Design-root-relative flat body that moved. */
+  from: string;
+  /** Design-root-relative grouped body that made it redundant. */
+  keptTwin: string;
+  /** Design-root-relative quarantine dir the flat set landed in. */
+  trashedTo: string;
+}
+
+/**
+ * Scan the design root, quarantine every flat body whose slug a grouped file
+ * also claims. Returns what moved (empty on a clean tree — the idempotent
+ * steady state). Never throws.
+ */
+export function migrateFlatFallback(opts: {
+  designRoot: string;
+  /** Design root relative to the repo root (`.design`) — for slug derivation. */
+  designRel: string;
+  log?: (line: string) => void;
+}): FlatFallbackMove[] {
+  const { designRoot, designRel } = opts;
+  const log = opts.log ?? ((line: string) => console.log(line));
+  const moves: FlatFallbackMove[] = [];
+  try {
+    // slug → every body path claiming it, design-root-relative.
+    const claims = new Map<string, string[]>();
+    for (const rel of walk(designRoot)) {
+      if (!/\.tsx$/i.test(rel)) continue;
+      const slug = canvasSlugFromRel(rel, designRel);
+      const list = claims.get(slug);
+      if (list) list.push(rel);
+      else claims.set(slug, [rel]);
+    }
+
+    for (const [slug, rels] of claims) {
+      const flat = rels.find((rel) => !rel.includes('/'));
+      const twin = rels.find((rel) => rel.includes('/'));
+      if (!flat || !twin) continue;
+
+      const trashedTo = `_trash/${slug}-flat-${Date.now()}`;
+      const base = flat.replace(/\.tsx$/i, '');
+      const movedLanes: string[] = [];
+      try {
+        mkdirSync(path.join(designRoot, trashedTo), { recursive: true });
+        for (const lane of [flat, `${base}.meta.json`, `${base}.css`]) {
+          const src = path.join(designRoot, lane);
+          if (!existsSync(src)) continue;
+          renameSync(src, path.join(designRoot, trashedTo, path.basename(lane)));
+          movedLanes.push(lane);
+        }
+      } catch (err) {
+        log(
+          `[sync/migrate-flat-fallback] could not quarantine ${flat}: ${(err as Error).message} — leaving it in place`
+        );
+        continue;
+      }
+      moves.push({ slug, from: flat, keptTwin: twin, trashedTo });
+      log(
+        `[sync/migrate-flat-fallback] ${flat} duplicated ${twin} (slug ${slug}) — moved ${movedLanes.join(
+          ', '
+        )} to ${trashedTo}/`
+      );
+    }
+  } catch {
+    /* best-effort — a scan failure must never cost the boot */
+  }
+  return moves;
+}
+
+/** Files under `dir`, relative to it, skipping runtime-state (`_*`) and repo
+ *  internals — the same exclusions the hub's checkout scan applies. */
+function walk(dir: string, prefix = '', out: string[] = []): string[] {
+  let entries: Dirent[];
+  try {
+    entries = readdirSync(dir, { withFileTypes: true });
+  } catch {
+    return out;
+  }
+  for (const entry of entries) {
+    const rel = prefix ? `${prefix}/${entry.name}` : entry.name;
+    if (entry.isDirectory()) {
+      if (entry.name.startsWith('_') || entry.name === '.git' || entry.name === 'node_modules') {
+        continue;
+      }
+      walk(path.join(dir, entry.name), rel, out);
+    } else if (entry.isFile()) {
+      out.push(rel);
+    }
+  }
+  return out;
+}

package/apps/studio/sync/presentation.ts

@@ -22,10 +22,22 @@ export type SyncPhase =
   | 'connecting'
   | 'syncing'
   | 'synced'
+  | 'stalled'
   | 'refused'
   | 'offline'
   | 'nothing-syncable';
 
+/**
+ * How long `connecting…` may honestly stay on screen with ZERO documents
+ * synced before it becomes a different sentence. A real handshake settles in
+ * seconds; five minutes of nothing is not a connection in progress, it is a
+ * link that needs a person (the alligators incident sat in `connecting…` for
+ * DAYS while every document was being refused). Matches the auth re-probe
+ * cadence so the claim "nothing is moving" has had at least one full retry
+ * cycle behind it.
+ */
+export const STALL_AFTER_MS = 5 * 60 * 1000;
+
 export interface SyncPresentation {
   phase: SyncPhase;
   /** Green dot — reserved for a link that is genuinely carrying edits. */
@@ -119,10 +131,39 @@ function readCounts(
  */
 export function syncPresentation(
   status: SyncStatusLike | null | undefined,
-  opts: { project?: string | null } = {}
+  opts: { project?: string | null; now?: number } = {}
 ): SyncPresentation | null {
   if (!status || status.linked === false) return null;
   const project = safeName(opts.project, 'the workspace');
+  const now = typeof opts.now === 'number' ? opts.now : Date.now();
+
+  // ZERO PROGRESS HAS A DEADLINE. Every `connecting…` below is honest for a
+  // handshake and a lie after five minutes of it — the phase reads as "in
+  // progress" while nothing is moving and nothing will. Once the link has
+  // been trying since `startedAt` with not one document synced, the sentence
+  // changes to the one that names the move. Validated like everything else
+  // read off disk; an absent/garbage stamp simply never stalls (old payloads).
+  const startedAt =
+    typeof status.startedAt === 'number' &&
+    Number.isFinite(status.startedAt) &&
+    status.startedAt > 0
+      ? status.startedAt
+      : null;
+  const stalled = (): SyncPresentation => {
+    // `?? now` rather than a cast: every call site is behind `isStalled`, which
+    // has already proved `startedAt` is a number — and a future one that isn't
+    // reads "1 minute" instead of "NaN minutes".
+    const min = Math.max(1, Math.round((now - (startedAt ?? now)) / 60_000));
+    return {
+      phase: 'stalled',
+      online: false,
+      label: 'stalled',
+      title: `Nothing has synced with ${project} in the ${min} minute${min === 1 ? '' : 's'} since Maude started trying.`,
+      next: 'Reconnect the workspace — the sign-in may have expired.',
+      names: [],
+    };
+  };
+  const isStalled = startedAt !== null && now - startedAt > STALL_AFTER_MS;
 
   if (status.notSyncable) {
     const tsx = status.tsxCount ?? 0;
@@ -203,6 +244,7 @@ export function syncPresentation(
     // Pre-DDR-102 payload: `state` is all there is. Report it as the weaker
     // evidence it is, rather than promoting it to a document-level claim.
     const online = status.state === 'online' || status.flash === 'synced';
+    if (!online && isStalled) return stalled();
     return {
       phase: online ? 'synced' : 'connecting',
       online,
@@ -218,6 +260,7 @@ export function syncPresentation(
   const total = docs.synced + docs.pending + docs.rejected;
 
   if (total === 0) {
+    if (isStalled) return stalled();
     return {
       phase: 'connecting',
       online: false,
@@ -232,6 +275,7 @@ export function syncPresentation(
     // Zero settled yet is a different fact from some settled: one is a
     // handshake in flight, the other is visible progress.
     const started = docs.synced > 0;
+    if (!started && isStalled) return stalled();
     return {
       phase: started ? 'syncing' : 'connecting',
       online: false,

package/apps/studio/sync/supervisor.ts

@@ -52,8 +52,11 @@ export interface SyncSupervisor {
   /**
    * Adopt a just-authorized link and cycle the runtime. `linkedHub` is passed
    * BY VALUE from the attach lane on purpose — never re-read from disk.
+   * `null` is the detach lane: clear the in-memory link (the config write on
+   * disk is invisible to a cfg captured at boot) and cycle back to solo.
+   * `undefined` keeps whatever the config already holds.
    */
-  restart(linkedHub?: LinkedHub): Promise<SyncStartOutcome>;
+  restart(linkedHub?: LinkedHub | null): Promise<SyncStartOutcome>;
   stop(): Promise<void>;
   /** The live runtime, or null in solo mode. Test/inspection surface. */
   current(): SyncRuntime | null;
@@ -166,6 +169,7 @@ export function createSyncSupervisor(
         }
         runtime = null;
         if (linkedHub) adoptLinkedHub(ctx, linkedHub);
+        else if (linkedHub === null) delete ctx.cfg.linkedHub;
         return boot();
       }),
     stop: () =>

package/apps/studio/sync/workspace-signin.ts

@@ -67,7 +67,7 @@ export interface SignInInput {
 /** Injected in tests. */
 export interface SignInDeps {
   fetchImpl?: typeof fetch;
-  save?: (normUrl: string, token: string, role?: string) => void;
+  save?: (normUrl: string, token: string, role?: string, expiresAt?: number) => void;
 }
 
 /**
@@ -186,8 +186,12 @@ export async function signInToWorkspace(
   //    viewer is known to be one at BOOT. Learning it from the first refusal
   //    instead means showing somebody an editor and then taking it away.
   const vouchedRole = typeof body.user?.role === 'string' ? body.user.role : 'member';
+  //    …and WHEN it dies. The expiry was already read (it is echoed to the UI
+  //    below) — discarding it from the store is what left the sync runtime
+  //    with no deadline to renew against.
+  const expiresAt = typeof body.expiresAt === 'number' ? body.expiresAt : undefined;
   try {
-    save(norm, body.token, vouchedRole);
+    save(norm, body.token, vouchedRole, expiresAt);
   } catch {
     return fail(500, "Couldn't save the workspace connection on this computer.", 'save-failed');
   }
@@ -201,7 +205,7 @@ export async function signInToWorkspace(
         email: typeof body.user?.email === 'string' ? body.user.email : String(input.email).trim(),
         role: vouchedRole,
       },
-      expiresAt: typeof body.expiresAt === 'number' ? body.expiresAt : null,
+      expiresAt: expiresAt ?? null,
       version: probe.version,
     },
   };

package/apps/studio/test/annotations-bindings.test.ts

@@ -46,19 +46,124 @@ describe('bindCandidate', () => {
     );
   });
 
-  test('only bindable tools host (no text/pen/arrow/link)', () => {
-    const label: TextStroke = {
-      id: 't',
-      tool: 'text',
-      color: '#1a1a1a',
-      fontSize: 14,
-      text: 'x',
-      x: 0,
-      y: 0,
-    };
-    expect(isBindable(label)).toBe(false);
-    expect(bindCandidate(0, 0, [label], BIND_THRESHOLD_PX)).toBeNull();
+  test('pen / arrow / link never host', () => {
     expect(isBindable(rect('r'))).toBe(true);
+    expect(
+      isBindable({ id: 'p', tool: 'pen', color: '#000', width: 2, points: [[0, 0]] } as Stroke)
+    ).toBe(false);
+    expect(
+      isBindable({
+        id: 'l',
+        tool: 'link',
+        x: 0,
+        y: 0,
+        w: 10,
+        h: 10,
+        url: 'https://x.test',
+        title: 't',
+        domain: 'x.test',
+      } as Stroke)
+    ).toBe(false);
+  });
+});
+
+// DDR-216 D9 — the widening, and the three exclusions that keep it from
+// regressing the NATIVE whiteboard. FigJam binds connectors to anything; on the
+// only real board measured, 2/2 connectors had an endpoint Maude could not bind,
+// so an imported connector degraded to a frozen line. Widening also closes a
+// plain native gap (you could not attach an arrow to a text label or a section).
+describe('isBindable widening — text + section (DDR-216 D9)', () => {
+  const standaloneText = (over: Partial<TextStroke> = {}): TextStroke => ({
+    id: 't',
+    tool: 'text',
+    color: '#1a1a1a',
+    fontSize: 14,
+    text: 'Archetyp',
+    x: 0,
+    y: 0,
+    ...over,
+  });
+
+  const section = (id: string, x = 0, y = 0, w = 400, h = 300): Stroke =>
+    ({ id, tool: 'section', x, y, w, h, label: 'Sekce', color: '#8b8b94' }) as Stroke;
+
+  test('standalone text IS bindable, and hosts a real bind', () => {
+    const label = standaloneText();
+    expect(isBindable(label)).toBe(true);
+    const bind = bindCandidate(1, 1, [label], BIND_THRESHOLD_PX);
+    expect(bind?.hostId).toBe('t');
+  });
+
+  test('ANCHORED text is NOT bindable — its bbox is unresolvable here', () => {
+    // `strokeBBox` returns null for anchored text without the anchors map, which
+    // every caller in this module omits. Admitting it would mint a bind that can
+    // never resolve — worse than not binding, because it never self-corrects.
+    const anchored = standaloneText({ anchorId: 'some-shape' });
+    expect(isBindable(anchored)).toBe(false);
+    expect(bindCandidate(0, 0, [anchored], BIND_THRESHOLD_PX)).toBeNull();
+  });
+
+  test('oversized text is NOT offered — no board-wide bind magnet', () => {
+    // A TextStroke has no stored w/h; strokeBBox synthesizes one from content,
+    // so 5 000 chars on one line projects a ~38 500 px-wide invisible strip.
+    const huge = standaloneText({ text: 'x'.repeat(5000) });
+    expect(isBindable(huge)).toBe(false);
+    // A rect under the cursor still wins, rather than the giant text stealing it.
+    const r = rect('r', 0, 0, 100, 100);
+    expect(bindCandidate(50, 50, [r, huge], BIND_THRESHOLD_PX)?.hostId).toBe('r');
+  });
+
+  test('a section binds on its BORDER, matching strokeHitTest', () => {
+    const s = section('sec');
+    expect(isBindable(s)).toBe(true);
+    expect(bindCandidate(0, 150, [s], BIND_THRESHOLD_PX)?.hostId).toBe('sec');
+  });
+
+  test('a section does NOT swallow binds through its click-through interior', () => {
+    // The natural gesture is to draw a section AROUND existing notes, which puts
+    // it later in the array = topmost. Testing its raw bbox would make every
+    // arrow drawn between two stickies inside it bind to the section instead.
+    const inner = rect('inner', 100, 100, 60, 60);
+    const s = section('sec', 0, 0, 400, 300);
+    const strokes: Stroke[] = [inner, s]; // section topmost
+    expect(bindCandidate(130, 130, strokes, BIND_THRESHOLD_PX)?.hostId).toBe('inner');
+    // Deep interior with nothing under it binds to nothing, not to the section.
+    expect(bindCandidate(300, 200, [s], BIND_THRESHOLD_PX)).toBeNull();
+  });
+
+  test('a bind whose anchorPoint cannot resolve is STRIPPED, not frozen-but-claimed', () => {
+    // Fix 2: `applyEnd` used to `return` silently when anchorPoint was null,
+    // which kept a bind that could never be honoured. Inert before the widening,
+    // load-bearing after it.
+    const ghost = standaloneText({ id: 'ghost', anchorId: 'gone' });
+    const ar = arrow('ar', {
+      x1: 0,
+      y1: 0,
+      x2: 100,
+      y2: 100,
+      startBind: { hostId: 'ghost', nx: 0.5, ny: 0.5 },
+    });
+    const out = recomputeBoundArrows([ghost, ar]);
+    const a = out.find((s) => s.id === 'ar') as ArrowStroke;
+    expect(a.startBind).toBeUndefined();
+    expect([a.x1, a.y1]).toEqual([0, 0]); // endpoint frozen in place, honestly
+  });
+
+  test('a bound arrow follows a text host as it moves', () => {
+    const label = standaloneText({ x: 0, y: 0 });
+    const ar = arrow('ar', {
+      x1: 0,
+      y1: 0,
+      x2: 300,
+      y2: 300,
+      startBind: { hostId: 't', nx: 0, ny: 0 },
+    });
+    const moved: Stroke[] = [{ ...label, x: 40, y: 60 }, ar];
+    const out = recomputeBoundArrows(moved);
+    const a = out.find((s) => s.id === 'ar') as ArrowStroke;
+    // The exact bbox is content-derived; what matters is that it TRACKED.
+    expect(a.startBind?.hostId).toBe('t');
+    expect(a.x1).not.toBe(0);
   });
 });
 
@@ -122,3 +227,36 @@ describe('facingAnchor (AI annotate / quick-create side pick)', () => {
     expect(facingAnchor(host, 50, -900)).toEqual({ hostId: 'h', nx: 0.5, ny: 0 });
   });
 });
+
+describe('the text bind cap is PER AXIS, not an area product (review F8)', () => {
+  test('a long single line at the font-size floor is NOT a bind host', () => {
+    // The area cap it replaced was satisfiable by exactly this shape: 4 000
+    // chars at fontSize 8 gives w ≈ 17 600 × h ≈ 9.6 — area 168 960, under a
+    // 640×480 product — i.e. a 17 600 px-wide invisible magnet.
+    const strip: TextStroke = {
+      id: 'strip',
+      tool: 'text',
+      color: '#1a1a1a',
+      fontSize: 8,
+      text: 'x'.repeat(4000),
+      x: 0,
+      y: 0,
+    };
+    expect(isBindable(strip)).toBe(false);
+    const r = rect('r', 100, 0, 100, 100);
+    expect(bindCandidate(150, 50, [r, strip], BIND_THRESHOLD_PX)?.hostId).toBe('r');
+  });
+
+  test('an ordinary label is still a bind host', () => {
+    const label: TextStroke = {
+      id: 't',
+      tool: 'text',
+      color: '#1a1a1a',
+      fontSize: 14,
+      text: 'Archetyp',
+      x: 0,
+      y: 0,
+    };
+    expect(isBindable(label)).toBe(true);
+  });
+});

package/apps/studio/test/canvas-create-api.test.ts

@@ -153,7 +153,10 @@ describe('/_api/canvas — POST round-trip', () => {
       expect(j.ok).toBe(true);
       const tsx = readFileSync(join(designRoot, 'ui', 'My Reel.tsx'), 'utf8');
       expect(tsx).toContain('<VideoComp component={Comp}');
-      expect(tsx).toContain('<OffthreadVideo src="assets/a.mp4" />');
+      // <Video> from @remotion/media, not <OffthreadVideo> — the renderer
+      // rejects the latter and the export loses its audio (RCA
+      // issue-mp4-audio-export-html5audio-silent-degrade).
+      expect(tsx).toContain('<Video src="assets/a.mp4" />');
       expect(tsx).toContain('<Audio src="assets/music.mp3" />');
       expect(tsx).toContain('name="clip-1"');
       const m = JSON.parse(readFileSync(join(designRoot, 'ui', 'My Reel.meta.json'), 'utf8'));

package/apps/studio/test/canvas-origin-gate.test.ts

@@ -214,6 +214,19 @@ describe('canvas-origin gate — A1/A2 traversal + privilege containment', () =>
         '/_api/github/invite',
         '/_api/github/clone',
         '/_api/github/create-project',
+        // DDR-216 D3 — every /_api/figma/* route is MAIN-ORIGIN ONLY (absent from
+        // CANVAS_SAFE_API + startCanvasServer's `routes` map). A canvas-reachable
+        // Figma route would be a token-exfiltration primitive AND an SSRF
+        // primitive at once: `connect` stores the user's PAT, `probe` spends it,
+        // and `status` would leak whether one exists. A request from this origin
+        // 403s at the gate rather than reaching a handler. (The complementary
+        // cross-SITE guard — `isTrustedRequestHost` + `sameOriginWrite` on the
+        // MAIN origin, which allowlist omission does nothing about — lives in
+        // figma-routes.test.ts; both halves are required, neither is sufficient.)
+        '/_api/figma/status',
+        '/_api/figma/connect',
+        '/_api/figma/probe',
+        '/_api/figma/import',
         // Local-only project create (mkdir + git init + scaffold) — writes to disk,
         // no token; MAIN-ORIGIN ONLY, so the canvas origin must 403 at the gate.
         '/_api/project/create-local',

package/apps/studio/test/capture-determinism-shape.test.ts

@@ -0,0 +1,135 @@
+// Source-shape gates for capture determinism.
+//
+// These guard properties that only manifest in a browser under load, which CI
+// has no way to run — `test/exporters/pw-launch.test.ts` says as much ("the
+// launch path itself is integration-shape (needs a real browser)"), and
+// `test/export-shim-multi-capture.test.ts` exists precisely because of it. So,
+// in that same house style, the FIX SHAPE is asserted at the source level.
+//
+// Why these particular shapes: the plan's original premise was that frame-step
+// capture is "deterministic by construction" — a doc comment in video-comp.tsx
+// with nothing enforcing it. It was not true. A seek could fail silently, and
+// the capture wait could give up on a wall-clock timer and screenshot a stale
+// frame. Serially both were survivable; under any parallel capture neither is.
+// If someone deletes these guards, the resulting bug is a valid-looking video
+// with wrong frames — invisible to every other test we have.
+
+import { describe, expect, test } from 'bun:test';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+const STUDIO = join(import.meta.dir, '..');
+const read = (rel: string) => readFileSync(join(STUDIO, rel), 'utf8');
+
+describe('the seek bridge must not report a seek that did not happen', () => {
+  const src = () => read('video-comp.tsx');
+
+  test('no empty catch swallows a failed seekTo', () => {
+    // The exact regression: `catch { /* comment only */ }` around the seek.
+    const emptyCatch = /catch\s*\{\s*(?:\/\*[\s\S]*?\*\/|\/\/[^\n]*)?\s*\}/g;
+    const body = src();
+    const seekRegion = body.slice(
+      body.indexOf('__maude_seek__ = async'),
+      body.indexOf('Ordinary-artboard fallback')
+    );
+    expect(seekRegion.length).toBeGreaterThan(0);
+    expect(seekRegion.match(emptyCatch)).toBeNull();
+  });
+
+  test('an unlanded seek throws rather than resolving', () => {
+    expect(src()).toContain('refusing to report a seek that did not happen');
+  });
+
+  test('failures are counted where the shim can read them', () => {
+    expect(src()).toContain('__maude_seek_failures__');
+  });
+
+  test('a cold Player still gets bounded retries — the fix is not "fail faster"', () => {
+    expect(src()).toContain('SEEK_ATTEMPTS');
+    expect(src()).toContain('seekEntryWithRetry');
+  });
+});
+
+describe('the capture shim must refuse a capture built on stale frames', () => {
+  test('it reads the in-page failure count and throws on any', () => {
+    const shim = read('bin/_video-playwright.mjs');
+    expect(shim).toContain('__maude_seek_failures__');
+    expect(shim).toMatch(/seekFailures\s*>\s*0/);
+    expect(shim).toContain('Refusing to encode');
+  });
+
+  test('the refusal happens BEFORE the encoded output is written', () => {
+    const shim = read('bin/_video-playwright.mjs');
+    const guardAt = shim.indexOf('seekFailures');
+    const writeAt = shim.indexOf('writeFileSync(out, Buffer.from(enc.b64');
+    expect(guardAt).toBeGreaterThan(0);
+    expect(writeAt).toBeGreaterThan(0);
+    // Ordering is the whole point — a check after the write ships the bad file.
+    expect(guardAt).toBeLessThan(writeAt);
+  });
+});
+
+describe('encoder guards (unit-shape — these run without a browser)', () => {
+  const enc = () => read('exporters/video-encode-lib.ts');
+
+  test('a mismatched frame is rejected, never silently resampled', () => {
+    const src = enc();
+    expect(src).toContain('refusing to resample');
+    // The check must precede the draw, or the resample already happened.
+    const guardAt = src.indexOf('refusing to resample');
+    const drawAt = src.indexOf('vstate.ctx.drawImage(bmp, 0, 0');
+    expect(guardAt).toBeGreaterThan(0);
+    expect(guardAt).toBeLessThan(drawAt);
+  });
+
+  test("latencyMode is pinned to 'quality' — 'realtime' may drop frames", () => {
+    expect(enc()).toContain("latencyMode: 'quality'");
+  });
+
+  test('the encoder canvas is NOT cleared between frames — pinned deliberately', () => {
+    // Current behaviour: a transparent artboard ghosts the previous frame,
+    // because nothing clears the canvas before drawImage. That is a real defect
+    // for transparent comps, but changing it is a visual change to every export
+    // and belongs in its own change with its own before/after. Pinned here so
+    // the next person changes it ON PURPOSE rather than as a side effect.
+    expect(enc()).not.toContain('clearRect');
+  });
+});
+
+describe('bundle cache paths must be content-addressed', () => {
+  test('no fixed-name temp bundle two servers could race on', () => {
+    const src = read('exporters/_browser-bundles.ts');
+    expect(src).toContain('writeHashedBundle');
+    expect(src).not.toContain("'maude-video-encode-lib.mjs'");
+    expect(src).not.toContain("'maude-video-render-lib.mjs'");
+  });
+});
+
+describe('the video shim must guard its output size', () => {
+  test('it calls assertRenderOutputSizeOk like the pdf shim does', () => {
+    const shim = read('bin/_video-playwright.mjs');
+    expect(shim).toContain(
+      "assertRenderOutputSizeOk(clip.width, clip.height, deviceScaleFactor, '_video-playwright')"
+    );
+  });
+});
+
+describe('timing telemetry must not break the summary contract', () => {
+  test('MAUDE_TIMING is filtered in _runtime.ts, not in an adapter', () => {
+    const rt = read('exporters/_runtime.ts');
+    expect(rt).toContain('TIMING_LINE');
+    expect(rt).toContain('onTiming');
+    // video.ts parses stdoutLines.at(-1) as its summary JSON — an unfiltered
+    // trailing diagnostic line would break EVERY video export.
+    const video = read('exporters/video.ts');
+    expect(video).toContain('stdoutLines.at(-1)');
+    expect(video).not.toContain('MAUDE_TIMING');
+  });
+
+  test('both capture paths emit it, so they are comparable', () => {
+    const shim = read('bin/_video-playwright.mjs');
+    expect(shim).toContain("path: 'frame-step'");
+    expect(shim).toContain("path: 'renderer'");
+    expect(shim).toContain('stageMs');
+  });
+});

package/apps/studio/test/clip-addressing.test.ts

@@ -708,7 +708,12 @@ describe('assembleCompSource — refs → comp (DDR-150 P4 Task 12)', () => {
     ]);
     expect(tsx).toContain('<Audio src="assets/music.mp3" />');
     expect(tsx).toContain(`import { TransitionSeries } from '@remotion/transitions';`);
-    expect(tsx).toContain(`import { AbsoluteFill, OffthreadVideo, Audio } from 'remotion';`);
+    // Media elements MUST come from @remotion/media — importing them from
+    // 'remotion' is what made every assembled reel export muted (RCA
+    // issue-mp4-audio-export-html5audio-silent-degrade).
+    expect(tsx).toContain(`import { Video, Audio } from '@remotion/media';`);
+    expect(tsx).toContain(`import { AbsoluteFill } from 'remotion';`);
+    expect(tsx).not.toContain(`Audio } from 'remotion'`);
     // total driven by the video clip's duration (audio doesn't extend it).
     expect(enumerateClips('/abs/R.tsx', tsx, 'reel').durationInFrames).toBe(90);
   });

package/apps/studio/test/clip-ops.test.ts

@@ -755,7 +755,11 @@ describe('applyEnsureVideoComp — kind="video" artboard upgrade', () => {
     expect(r.source).toContain('<VideoComp component={VideoCut}');
     expect(r.source).toContain('width={1280} height={800}');
     expect(r.source).toMatch(/import \{[^}]*AbsoluteFill[^}]*\} from 'remotion';/);
-    expect(r.source).toContain('<OffthreadVideo src="assets/x.mp4" />');
+    // The canvas declares `export default function Video()`, so the inserted
+    // media element is ALIASED to dodge the collision — it is no longer
+    // rewritten to <OffthreadVideo>, which silently cost the audio track.
+    expect(r.source).toContain('<MaudeVideo src="assets/x.mp4" />');
+    expect(r.source).toContain(`import { Video as MaudeVideo } from '@remotion/media';`);
     const cc = enumerateClips('/abs/Video.tsx', r.source, 'brief');
     expect(cc.compName).toBe('VideoCut');
     expect(cc.clips.length).toBe(1);