@1agh/maude 0.58.2 → 0.58.3

package/apps/studio/test/sync-migrate-flat-fallback.test.ts

@@ -0,0 +1,98 @@
+// Fix 4 of the 2026-08-10 sync RCA — the one-shot quarantine of pre-fix-5
+// flat fallback twins. The rules under test: a flat body moves ONLY when a
+// grouped twin of the same slug exists; siblings ride along; annotations stay
+// (they serve the surviving twin); a lone flat canvas is somebody's work and
+// never moves; a second run is a no-op; nothing ever throws into boot.
+
+import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
+import { existsSync, mkdirSync, mkdtempSync, readdirSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+import { migrateFlatFallback } from '../sync/migrate-flat-fallback.ts';
+
+let designRoot: string;
+
+beforeEach(() => {
+  designRoot = mkdtempSync(join(tmpdir(), 'migrate-flat-'));
+});
+
+afterEach(() => {
+  rmSync(designRoot, { recursive: true, force: true });
+});
+
+const run = () => migrateFlatFallback({ designRoot, designRel: '.design', log: () => {} });
+
+describe('migrateFlatFallback — quarantine the redundant flat copy, never work', () => {
+  test('a collision pair: the flat copy (+ siblings) moves to _trash, the grouped twin stays', () => {
+    mkdirSync(join(designRoot, 'ui'), { recursive: true });
+    writeFileSync(join(designRoot, 'ui/welcome.tsx'), 'grouped\n');
+    writeFileSync(join(designRoot, 'ui-welcome.tsx'), 'flat stub\n');
+    writeFileSync(join(designRoot, 'ui-welcome.meta.json'), '{}\n');
+    writeFileSync(join(designRoot, 'ui-welcome.css'), '.x{}\n');
+    // Annotations are keyed by the flat slug and serve the SURVIVING twin.
+    writeFileSync(join(designRoot, 'ui-welcome.annotations.svg'), '<svg/>\n');
+
+    const moves = run();
+
+    expect(moves).toHaveLength(1);
+    expect(moves[0].slug).toBe('ui-welcome');
+    expect(moves[0].from).toBe('ui-welcome.tsx');
+    expect(moves[0].keptTwin).toBe('ui/welcome.tsx');
+
+    expect(existsSync(join(designRoot, 'ui/welcome.tsx'))).toBe(true);
+    expect(existsSync(join(designRoot, 'ui-welcome.tsx'))).toBe(false);
+    expect(existsSync(join(designRoot, 'ui-welcome.meta.json'))).toBe(false);
+    expect(existsSync(join(designRoot, 'ui-welcome.css'))).toBe(false);
+    expect(existsSync(join(designRoot, 'ui-welcome.annotations.svg'))).toBe(true);
+
+    const trashed = readdirSync(join(designRoot, moves[0].trashedTo)).sort();
+    expect(trashed).toEqual(['ui-welcome.css', 'ui-welcome.meta.json', 'ui-welcome.tsx']);
+  });
+
+  test('a lone flat canvas has no twin — it is somebody’s work and stays put', () => {
+    writeFileSync(join(designRoot, 'scratch-pad.tsx'), 'mine\n');
+    expect(run()).toEqual([]);
+    expect(existsSync(join(designRoot, 'scratch-pad.tsx'))).toBe(true);
+  });
+
+  test('a grouped file with no flat twin is untouched', () => {
+    mkdirSync(join(designRoot, 'ui'), { recursive: true });
+    writeFileSync(join(designRoot, 'ui/card.tsx'), 'x\n');
+    expect(run()).toEqual([]);
+    expect(existsSync(join(designRoot, 'ui/card.tsx'))).toBe(true);
+  });
+
+  test('the second run is a no-op — the quarantine dir is runtime state the scan skips', () => {
+    mkdirSync(join(designRoot, 'ui'), { recursive: true });
+    writeFileSync(join(designRoot, 'ui/welcome.tsx'), 'grouped\n');
+    writeFileSync(join(designRoot, 'ui-welcome.tsx'), 'flat stub\n');
+
+    expect(run()).toHaveLength(1);
+    expect(run()).toEqual([]);
+    // The quarantined copy is still there — moved, never deleted.
+    const trash = readdirSync(join(designRoot, '_trash'));
+    expect(trash).toHaveLength(1);
+  });
+
+  test('nested twins at any depth count', () => {
+    mkdirSync(join(designRoot, 'ui/2026/social'), { recursive: true });
+    writeFileSync(join(designRoot, 'ui/2026/social/summer-camp.tsx'), 'deep\n');
+    writeFileSync(join(designRoot, 'ui-2026-social-summer-camp.tsx'), 'flat stub\n');
+
+    const moves = run();
+    expect(moves).toHaveLength(1);
+    expect(moves[0].keptTwin).toBe('ui/2026/social/summer-camp.tsx');
+    expect(existsSync(join(designRoot, 'ui/2026/social/summer-camp.tsx'))).toBe(true);
+  });
+
+  test('a missing design root is a quiet no-op, not a throw', () => {
+    expect(
+      migrateFlatFallback({
+        designRoot: join(designRoot, 'does-not-exist'),
+        designRel: '.design',
+        log: () => {},
+      })
+    ).toEqual([]);
+  });
+});

package/apps/studio/test/sync-path-pull.test.ts

@@ -233,6 +233,69 @@ describe('a peer with an empty design root pulls the project down whole', () =>
   });
 });
 
+describe('boot runs the flat-fallback quarantine BEFORE the scan (fix 4)', () => {
+  test('a pre-fix-5 flat twin is in _trash by the time the runtime settles', async () => {
+    const ctx = makeCtx();
+    mkdirSync(join(ctx.paths.designRoot, 'ui'), { recursive: true });
+    writeFileSync(join(ctx.paths.designRoot, 'ui/welcome.tsx'), 'grouped\n');
+    writeFileSync(join(ctx.paths.designRoot, 'ui-welcome.tsx'), 'flat stub\n');
+    hubListing([]);
+
+    const runtime = createSyncRuntime(ctx, { providerFactory: hubDocProviderFactory({}) });
+    await runtime?.start();
+    await runtime?.stop();
+
+    expect(existsSync(join(ctx.paths.designRoot, 'ui-welcome.tsx'))).toBe(false);
+    expect(existsSync(join(ctx.paths.designRoot, 'ui/welcome.tsx'))).toBe(true);
+    expect(existsSync(join(ctx.paths.designRoot, '_trash'))).toBe(true);
+  });
+});
+
+describe('the stamp race — the path is on the doc BEFORE the handshake (fix 5)', () => {
+  test('a local canvas stamps syncMeta.path before onceSynced, so the hub’s first store sees it', async () => {
+    // The RCA bug: the stamp lived only in the post-reconcile tail, so the
+    // hub's FIRST onDocumentStored saw a bare body, memoised the flat fallback
+    // in its pathIndex, and the real nested path could never win — a stub was
+    // born whose dynamic import failed forever.
+    const ctx = makeCtx();
+    const bodyAbs = join(ctx.paths.designRoot, NESTED_REL);
+    mkdirSync(join(ctx.paths.designRoot, 'ui/2026/social'), { recursive: true });
+    writeFileSync(bodyAbs, BODY);
+    hubListing([]);
+
+    let pathAtHandshake: unknown = 'never-called';
+    const runtime = createSyncRuntime(ctx, {
+      canvases: [
+        {
+          slug: NESTED_SLUG,
+          html: bodyAbs,
+          comments: join(ctx.paths.commentsDir, `${NESTED_SLUG}.json`),
+          annotations: join(ctx.paths.designRoot, `${NESTED_SLUG}.annotations.svg`),
+          meta: bodyAbs.replace(/\.tsx$/, '.meta.json'),
+          css: bodyAbs.replace(/\.tsx$/, '.css'),
+        },
+      ],
+      providerFactory: (args) => {
+        const doc = args.document ?? new Y.Doc();
+        return {
+          document: doc,
+          awareness: new Awareness(doc),
+          async onceSynced() {
+            // What the hub can see by the time the handshake settles — the
+            // stamp must ALREADY be there, not arrive with the reconcile tail.
+            pathAtHandshake = doc.getMap('syncMeta').get('path');
+          },
+          destroy() {},
+        };
+      },
+    });
+    await runtime?.start();
+    await runtime?.stop();
+
+    expect(pathAtHandshake).toBe(NESTED_REL);
+  });
+});
+
 describe("rule 7 governs a path's IDENTITY, not what already lives there", () => {
   test('a pulled canvas never lands on a file that already exists locally', async () => {
     // `scanCanvases` omits a canvas whose `.meta.json` says `syncable: false` —

package/apps/studio/test/sync-presentation.test.ts

@@ -183,3 +183,80 @@ describe('hub-supplied text is untrusted (DDR-054)', () => {
     expect(p?.names).toEqual([]);
   });
 });
+
+describe('zero progress has a deadline — the stalled phase', () => {
+  const NOW = 10 * 60_000; // 10 minutes after the epoch-zero base
+
+  test('connecting past the ceiling with nothing synced becomes stalled, with the move named', () => {
+    const p = syncPresentation(
+      { ...base, state: 'connecting', startedAt: 1, docs: { synced: 0, pending: 73, rejected: 0 } },
+      { project: 'alligators', now: NOW }
+    );
+    expect(p?.phase).toBe('stalled');
+    expect(p?.online).toBe(false);
+    expect(p?.title).toContain('Nothing has synced');
+    expect(p?.next).toContain('Reconnect');
+  });
+
+  test('a fresh connect is NOT stalled — the handshake gets its moment', () => {
+    const p = syncPresentation(
+      { ...base, state: 'connecting', startedAt: 1, docs: { synced: 0, pending: 73, rejected: 0 } },
+      { project: 'alligators', now: 30_000 }
+    );
+    expect(p?.phase).toBe('connecting');
+  });
+
+  test('any progress at all cancels the stall — syncing is not stalling', () => {
+    const p = syncPresentation(
+      { ...base, startedAt: 1, docs: { synced: 1, pending: 72, rejected: 0 } },
+      { project: 'alligators', now: NOW }
+    );
+    expect(p?.phase).toBe('syncing');
+  });
+
+  test('zero known documents past the ceiling also stalls', () => {
+    const p = syncPresentation(
+      { ...base, state: 'connecting', startedAt: 1, docs: { synced: 0, pending: 0, rejected: 0 } },
+      { project: 'alligators', now: NOW }
+    );
+    expect(p?.phase).toBe('stalled');
+  });
+
+  test('an old payload without startedAt can never stall (fail open to connecting)', () => {
+    const p = syncPresentation(
+      { ...base, state: 'connecting' },
+      { project: 'alligators', now: NOW }
+    );
+    expect(p?.phase).toBe('connecting');
+  });
+
+  test('a refusal still outranks a stall — the more specific cause wins', () => {
+    const p = syncPresentation(
+      { ...base, startedAt: 1, docs: { synced: 0, pending: 0, rejected: 73 } },
+      { project: 'alligators', now: NOW }
+    );
+    expect(p?.phase).toBe('refused');
+  });
+
+  test('an unreachable hub still outranks a stall — offline explains itself', () => {
+    const p = syncPresentation(
+      { ...base, state: 'offline', startedAt: 1, docs: { synced: 0, pending: 3, rejected: 0 } },
+      { project: 'alligators', now: NOW }
+    );
+    expect(p?.phase).toBe('offline');
+  });
+
+  test('a garbage startedAt fails open, never into a false alarm', () => {
+    const p = syncPresentation(
+      // biome-ignore lint/suspicious/noExplicitAny: hostile-payload shape test
+      {
+        ...base,
+        state: 'connecting',
+        startedAt: 'yes' as any,
+        docs: { synced: 0, pending: 1, rejected: 0 },
+      },
+      { project: 'alligators', now: NOW }
+    );
+    expect(p?.phase).toBe('connecting');
+  });
+});

package/apps/studio/test/sync-runtime.test.ts

@@ -30,11 +30,13 @@ import { createConnectionMonitor } from '../sync/connection-state.ts';
 import {
   type AwarenessRegistry,
   buildNoSyncablePayload,
+  classifyAuthFailure,
   createSyncRuntime,
   discoverCanvases,
   type SyncProvider,
   scanCanvases,
   toWsUrl,
+  validExpiry,
 } from '../sync/index.ts';
 import { createSyncStatusStore } from '../sync/status.ts';
 
@@ -1029,6 +1031,49 @@ describe('createDefaultProviderFactory — shared socket multiplexing', () => {
 
 // DDR-102 — auth-failure intelligence (classification, aggregation,
 // destroy-on-permanent + re-probe) and the honest settled boot summary.
+describe('validExpiry — a hub-reported deadline sane enough to schedule against', () => {
+  const NOW = 1_000_000_000_000;
+  test('accepts a plausible future integer', () => {
+    expect(validExpiry(NOW + 12 * 60 * 60 * 1000, NOW)).toBe(NOW + 12 * 60 * 60 * 1000);
+  });
+  test('rejects a past or present stamp (falls to the invalid-token path instead)', () => {
+    expect(validExpiry(NOW - 1, NOW)).toBeNull();
+    expect(validExpiry(NOW, NOW)).toBeNull();
+  });
+  test('rejects an absurdly far-future stamp (the setTimeout-overflow trap)', () => {
+    expect(validExpiry(NOW + 60 * 24 * 60 * 60 * 1000, NOW)).toBeNull(); // 60 days
+  });
+  test('rejects non-integers and non-numbers', () => {
+    expect(validExpiry(NOW + 1000.5, NOW)).toBeNull();
+    expect(validExpiry('soon', NOW)).toBeNull();
+    expect(validExpiry(Number.NaN, NOW)).toBeNull();
+    expect(validExpiry(Number.POSITIVE_INFINITY, NOW)).toBeNull();
+    expect(validExpiry(undefined, NOW)).toBeNull();
+  });
+});
+
+describe('classifyAuthFailure — permanent classes outrank the transient ones', () => {
+  test('the invalid-token bucket refusal classifies as invalid-token, not rate-limit', () => {
+    // The hub's invalid-token bucket says BOTH things. Filing it under
+    // rate-limit (transient) made the runtime retry into the very bucket
+    // refusing it — the alligators incident's 1840-vs-138 log ratio.
+    expect(classifyAuthFailure('invalid token — rate limited, retry in up to 60s')).toBe(
+      'invalid-token'
+    );
+  });
+
+  test('plain reasons still land in their own classes', () => {
+    expect(classifyAuthFailure('invalid token')).toBe('invalid-token');
+    expect(classifyAuthFailure('token not authorized for this documentName')).toBe(
+      'not-authorized'
+    );
+    expect(classifyAuthFailure('rate limit exceeded for this token — retry in up to 60s')).toBe(
+      'rate-limit'
+    );
+    expect(classifyAuthFailure('permission-denied')).toBe('generic');
+  });
+});
+
 describe('DDR-102 — auth-failure intelligence + boot summary', () => {
   function fakeTimerQueue() {
     let nextId = 1;
@@ -1059,15 +1104,17 @@ describe('DDR-102 — auth-failure intelligence + boot summary', () => {
   function authStubFactory() {
     const made: Array<{
       documentName: string;
+      token: string | undefined;
       destroyed: boolean;
       emitAuthFailure: (reason: string) => void;
       document: Y.Doc;
     }> = [];
-    const factory = (args: { documentName: string; document?: Y.Doc }) => {
+    const factory = (args: { documentName: string; token?: string; document?: Y.Doc }) => {
       const document = args.document ?? new Y.Doc();
       const cbs = new Set<(info: { reason: string }) => void>();
       const entry = {
         documentName: args.documentName,
+        token: args.token,
         destroyed: false,
         emitAuthFailure: (reason: string) => {
           for (const cb of cbs) cb({ reason });
@@ -1171,6 +1218,274 @@ describe('DDR-102 — auth-failure intelligence + boot summary', () => {
     }
   });
 
+  test('invalid-token triggers ONE silent renewal and an immediate re-probe with the fresh token', async () => {
+    const url = 'https://hub.example.com';
+    writeHubsConfig(url, 'mau_stale');
+    const ctx = makeCtx({ url, linkedAt: 1 });
+    writeFileSync(join(ctx.paths.designRoot, 'ui', 'a.html'), '<a/>');
+    writeFileSync(join(ctx.paths.designRoot, 'ui', 'b.html'), '<b/>');
+    writeFileSync(join(ctx.paths.designRoot, 'ui', 'c.html'), '<c/>');
+
+    const timers = fakeTimerQueue();
+    const { factory, made } = authStubFactory();
+    let renewCalls = 0;
+    const origWarn = console.warn;
+    const origLog = console.log;
+    console.warn = () => {};
+    console.log = () => {};
+    try {
+      const runtime = createSyncRuntime(ctx, {
+        providerFactory: factory,
+        auth: {
+          warnDebounceMs: 2_000,
+          reprobeMs: 300_000,
+          settleTimeoutMs: 15_000,
+          setTimer: timers.setTimer,
+          clearTimer: timers.clearTimer,
+          renewCredential: async () => {
+            renewCalls++;
+            return { token: 'mau_fresh', expiresAt: null };
+          },
+        },
+      });
+      await runtime?.start();
+      expect(made).toHaveLength(3);
+      expect(made.every((m) => m.token === 'mau_stale')).toBe(true);
+
+      // The whole burst rejects with the expired credential…
+      for (const m of made.slice(0, 3)) m.emitAuthFailure('invalid token');
+      await new Promise((res) => setTimeout(res, 10));
+
+      // …ONE renewal (single-flight), and the re-probe happened NOW — no
+      // 5-minute wait — with the fresh token on every reconnected provider.
+      expect(renewCalls).toBe(1);
+      const reprobed = made.slice(3);
+      expect(reprobed.map((m) => m.documentName).sort()).toEqual(['ui-a', 'ui-b', 'ui-c']);
+      expect(reprobed.every((m) => m.token === 'mau_fresh')).toBe(true);
+
+      await runtime?.stop();
+    } finally {
+      console.warn = origWarn;
+      console.log = origLog;
+    }
+  });
+
+  test('F1: a hub refusing on VOLUME cannot drive a renewal storm — the cap stops it', async () => {
+    // The regression this whole review turned on. A cell refusing its own
+    // clients with "invalid token — rate limited" classifies permanent →
+    // triggers renewal → renewal succeeds (token was fine) → reprobe → every
+    // reconnected doc is refused again → loop. Reproduced at 2342/s before the
+    // cap. Here every reconnected provider auto-re-rejects, so without the cap
+    // this test would spin forever; with it, renewals are bounded.
+    const url = 'https://hub.example.com';
+    writeHubsConfig(url, 'mau_stale');
+    const ctx = makeCtx({ url, linkedAt: 1 });
+    writeFileSync(join(ctx.paths.designRoot, 'ui', 'a.html'), '<a/>');
+    writeFileSync(join(ctx.paths.designRoot, 'ui', 'b.html'), '<b/>');
+
+    let renewCalls = 0;
+    let providersMade = 0;
+    const origWarn = console.warn;
+    const origLog = console.log;
+    console.warn = () => {};
+    console.log = () => {};
+    // Every provider auto-rejects with the volume-refusal string the moment a
+    // failure handler is attached — modelling a full hub bucket.
+    const factory = (args: { documentName: string; token?: string; document?: Y.Doc }) => {
+      const document = args.document ?? new Y.Doc();
+      providersMade++;
+      return {
+        document,
+        onAuthFailed(cb: (info: { reason: string }) => void) {
+          queueMicrotask(() => cb({ reason: 'invalid token — rate limited, retry in up to 60s' }));
+          return () => {};
+        },
+        onceSynced: () => new Promise<void>(() => {}),
+        destroy() {},
+      };
+    };
+    try {
+      const runtime = createSyncRuntime(ctx, {
+        providerFactory: factory,
+        auth: {
+          warnDebounceMs: 2_000,
+          reprobeMs: 300_000,
+          settleTimeoutMs: 15_000,
+          setTimer: () => 0 as unknown as ReturnType<typeof setTimeout>,
+          clearTimer: () => {},
+          renewMinIntervalMs: 0, // isolate the CAP from the floor
+          renewCredential: async () => {
+            renewCalls++;
+            return { token: `mau_fresh_${renewCalls}`, expiresAt: null };
+          },
+        },
+      });
+      await runtime?.start();
+      // Let the storm run itself out — if the cap failed, this never settles
+      // and the test times out (which is itself the failure signal).
+      for (let i = 0; i < 20; i++) await new Promise((res) => setTimeout(res, 5));
+
+      // Bounded by the cap (default 3), NOT thousands.
+      expect(renewCalls).toBeLessThanOrEqual(3);
+      expect(renewCalls).toBeGreaterThan(0);
+      // Providers created is likewise bounded — no runaway reconnect fan-out.
+      expect(providersMade).toBeLessThan(20);
+      await runtime?.stop();
+    } finally {
+      console.warn = origWarn;
+      console.log = origLog;
+    }
+  });
+
+  test('F1: the frequency floor collapses a rapid second burst to no extra renewal', async () => {
+    const url = 'https://hub.example.com';
+    writeHubsConfig(url, 'mau_stale');
+    const ctx = makeCtx({ url, linkedAt: 1 });
+    writeFileSync(join(ctx.paths.designRoot, 'ui', 'a.html'), '<a/>');
+
+    let renewCalls = 0;
+    let clock = 1_000_000;
+    const origWarn = console.warn;
+    const origLog = console.log;
+    console.warn = () => {};
+    console.log = () => {};
+    const { factory, made } = authStubFactory();
+    try {
+      const runtime = createSyncRuntime(ctx, {
+        providerFactory: factory,
+        auth: {
+          warnDebounceMs: 2_000,
+          reprobeMs: 300_000,
+          settleTimeoutMs: 15_000,
+          setTimer: () => 0 as unknown as ReturnType<typeof setTimeout>,
+          clearTimer: () => {},
+          now: () => clock,
+          renewMinIntervalMs: 60_000,
+          renewCredential: async () => {
+            renewCalls++;
+            return { token: 'mau_fresh', expiresAt: null };
+          },
+        },
+      });
+      await runtime?.start();
+      made[0]?.emitAuthFailure('invalid token');
+      await new Promise((res) => setTimeout(res, 10));
+      expect(renewCalls).toBe(1);
+      // A second rejection 10 s later (inside the 60 s floor) → no new renewal.
+      clock += 10_000;
+      made[0]?.emitAuthFailure('invalid token');
+      await new Promise((res) => setTimeout(res, 10));
+      expect(renewCalls).toBe(1);
+      // Past the floor → renewal is allowed again.
+      clock += 60_000;
+      made[0]?.emitAuthFailure('invalid token');
+      await new Promise((res) => setTimeout(res, 10));
+      expect(renewCalls).toBe(2);
+      await runtime?.stop();
+    } finally {
+      console.warn = origWarn;
+      console.log = origLog;
+    }
+  });
+
+  test('a failed renewal changes nothing — rejected docs wait for the slow re-probe as before', async () => {
+    const url = 'https://hub.example.com';
+    writeHubsConfig(url, 'mau_stale');
+    const ctx = makeCtx({ url, linkedAt: 1 });
+    writeFileSync(join(ctx.paths.designRoot, 'ui', 'a.html'), '<a/>');
+
+    const timers = fakeTimerQueue();
+    const { factory, made } = authStubFactory();
+    const origWarn = console.warn;
+    const origLog = console.log;
+    console.warn = () => {};
+    console.log = () => {};
+    try {
+      const runtime = createSyncRuntime(ctx, {
+        providerFactory: factory,
+        auth: {
+          warnDebounceMs: 2_000,
+          reprobeMs: 300_000,
+          settleTimeoutMs: 15_000,
+          setTimer: timers.setTimer,
+          clearTimer: timers.clearTimer,
+          renewCredential: async () => null, // signed out / revoked / self-hosted
+        },
+      });
+      await runtime?.start();
+      made[0]?.emitAuthFailure('invalid token');
+      await new Promise((res) => setTimeout(res, 10));
+
+      // No immediate re-probe (the renewal failed) — the doc stays rejected…
+      expect(made).toHaveLength(1);
+      expect(runtime?.status()?.docs?.rejected).toBe(1);
+      // …until the slow re-probe fires, with the ORIGINAL token (unchanged).
+      timers.fire(300_000);
+      await new Promise((res) => setTimeout(res, 10));
+      expect(made).toHaveLength(2);
+      expect(made[1]?.token).toBe('mau_stale');
+
+      await runtime?.stop();
+    } finally {
+      console.warn = origWarn;
+      console.log = origLog;
+    }
+  });
+
+  test('a stored expiry arms a pre-expiry renewal at ~80% of the remaining life', async () => {
+    const url = 'https://hub.example.com';
+    const cfgPath = process.env.HUBS_CONFIG_PATH;
+    if (!cfgPath) throw new Error('HUBS_CONFIG_PATH not set by beforeEach');
+    writeFileSync(
+      cfgPath,
+      JSON.stringify({
+        hubs: { [url]: { token: 'mau_stale', linkedAt: 1, expiresAt: Date.now() + 100_000 } },
+      })
+    );
+    chmodSync(cfgPath, 0o600);
+    const ctx = makeCtx({ url, linkedAt: 1 });
+    writeFileSync(join(ctx.paths.designRoot, 'ui', 'a.html'), '<a/>');
+
+    const timers = fakeTimerQueue();
+    const { factory } = authStubFactory();
+    let renewCalls = 0;
+    const origWarn = console.warn;
+    const origLog = console.log;
+    console.warn = () => {};
+    console.log = () => {};
+    try {
+      const runtime = createSyncRuntime(ctx, {
+        providerFactory: factory,
+        auth: {
+          warnDebounceMs: 2_000,
+          reprobeMs: 300_000,
+          settleTimeoutMs: 15_000,
+          setTimer: timers.setTimer,
+          clearTimer: timers.clearTimer,
+          renewCredential: async () => {
+            renewCalls++;
+            return { token: 'mau_fresh', expiresAt: null };
+          },
+        },
+      });
+      await runtime?.start();
+      // 100 s of life left → the renewal timer sits at 80 s, so a 30 s sweep
+      // must not reach it (only the settle timers live down there)…
+      timers.fire(30_000);
+      await new Promise((res) => setTimeout(res, 5));
+      expect(renewCalls).toBe(0);
+      // …and the 80 s sweep fires it, once, without any rejection happening.
+      timers.fire(80_000);
+      await new Promise((res) => setTimeout(res, 5));
+      expect(renewCalls).toBe(1);
+
+      await runtime?.stop();
+    } finally {
+      console.warn = origWarn;
+      console.log = origLog;
+    }
+  });
+
   test('a successful re-probe clears the refusal, and the reconcile is a separate word', async () => {
     // A REGRESSION GUARD, not a falsifier — this already held. It is here
     // because the clear moved: it used to sit at the BOTTOM of the

package/apps/studio/test/video-comp.test.ts

@@ -151,7 +151,7 @@ describe('video-comp seek bridge', () => {
     expect(a.seeks).toEqual([42, 42]);
   });
 
-  test('a Player ref that is not yet ready (null) does not throw', async () => {
+  test('a not-yet-ready Player is resilient in UI mode but still RECORDED', async () => {
     const w = window as unknown as SeekWindow;
     installMaudeSeekBridge();
     if (!w.__maudeVideoComps) w.__maudeVideoComps = new Map();
@@ -163,6 +163,28 @@ describe('video-comp seek bridge', () => {
       height: 360,
       ref: { current: null },
     });
+    // A live scrub of a still-mounting comp must not blow up the UI...
+    const before = w.__maude_seek_failures__ ?? 0;
     await expect(w.__maude_seek__?.(10)).resolves.toBeUndefined();
+    // ...but it is no longer silent: the capture shim reads this counter and
+    // refuses to encode, because a seek that never landed means a stale frame.
+    expect(w.__maude_seek_failures__ ?? 0).toBeGreaterThan(before);
+  });
+
+  test('capture mode (strict) throws instead of pretending the seek landed', async () => {
+    const w = window as unknown as SeekWindow;
+    installMaudeSeekBridge();
+    if (!w.__maudeVideoComps) w.__maudeVideoComps = new Map();
+    w.__maudeVideoComps.set('pending-strict', {
+      id: 'pending-strict',
+      fps: 30,
+      durationInFrames: 90,
+      width: 640,
+      height: 360,
+      ref: { current: null },
+    });
+    await expect(w.__maude_seek__?.(10, { strict: true })).rejects.toThrow(
+      /refusing to report a seek that did not happen/
+    );
   });
 });

package/apps/studio/test/workspace-containment.test.ts

@@ -233,6 +233,7 @@ describe('the vocabulary itself', () => {
       '/_api/debug-bundle',
       '/_api/design',
       '/_api/export',
+      '/_api/figma',
       '/_api/generate',
       '/_api/github',
       '/_api/hub',