@1agh/maude 0.58.2 → 0.59.0

package/apps/studio/test/sync-runtime.test.ts

@@ -30,11 +30,13 @@ import { createConnectionMonitor } from '../sync/connection-state.ts';
 import {
   type AwarenessRegistry,
   buildNoSyncablePayload,
+  classifyAuthFailure,
   createSyncRuntime,
   discoverCanvases,
   type SyncProvider,
   scanCanvases,
   toWsUrl,
+  validExpiry,
 } from '../sync/index.ts';
 import { createSyncStatusStore } from '../sync/status.ts';
 
@@ -1029,6 +1031,49 @@ describe('createDefaultProviderFactory — shared socket multiplexing', () => {
 
 // DDR-102 — auth-failure intelligence (classification, aggregation,
 // destroy-on-permanent + re-probe) and the honest settled boot summary.
+describe('validExpiry — a hub-reported deadline sane enough to schedule against', () => {
+  const NOW = 1_000_000_000_000;
+  test('accepts a plausible future integer', () => {
+    expect(validExpiry(NOW + 12 * 60 * 60 * 1000, NOW)).toBe(NOW + 12 * 60 * 60 * 1000);
+  });
+  test('rejects a past or present stamp (falls to the invalid-token path instead)', () => {
+    expect(validExpiry(NOW - 1, NOW)).toBeNull();
+    expect(validExpiry(NOW, NOW)).toBeNull();
+  });
+  test('rejects an absurdly far-future stamp (the setTimeout-overflow trap)', () => {
+    expect(validExpiry(NOW + 60 * 24 * 60 * 60 * 1000, NOW)).toBeNull(); // 60 days
+  });
+  test('rejects non-integers and non-numbers', () => {
+    expect(validExpiry(NOW + 1000.5, NOW)).toBeNull();
+    expect(validExpiry('soon', NOW)).toBeNull();
+    expect(validExpiry(Number.NaN, NOW)).toBeNull();
+    expect(validExpiry(Number.POSITIVE_INFINITY, NOW)).toBeNull();
+    expect(validExpiry(undefined, NOW)).toBeNull();
+  });
+});
+
+describe('classifyAuthFailure — permanent classes outrank the transient ones', () => {
+  test('the invalid-token bucket refusal classifies as invalid-token, not rate-limit', () => {
+    // The hub's invalid-token bucket says BOTH things. Filing it under
+    // rate-limit (transient) made the runtime retry into the very bucket
+    // refusing it — the alligators incident's 1840-vs-138 log ratio.
+    expect(classifyAuthFailure('invalid token — rate limited, retry in up to 60s')).toBe(
+      'invalid-token'
+    );
+  });
+
+  test('plain reasons still land in their own classes', () => {
+    expect(classifyAuthFailure('invalid token')).toBe('invalid-token');
+    expect(classifyAuthFailure('token not authorized for this documentName')).toBe(
+      'not-authorized'
+    );
+    expect(classifyAuthFailure('rate limit exceeded for this token — retry in up to 60s')).toBe(
+      'rate-limit'
+    );
+    expect(classifyAuthFailure('permission-denied')).toBe('generic');
+  });
+});
+
 describe('DDR-102 — auth-failure intelligence + boot summary', () => {
   function fakeTimerQueue() {
     let nextId = 1;
@@ -1059,15 +1104,17 @@ describe('DDR-102 — auth-failure intelligence + boot summary', () => {
   function authStubFactory() {
     const made: Array<{
       documentName: string;
+      token: string | undefined;
       destroyed: boolean;
       emitAuthFailure: (reason: string) => void;
       document: Y.Doc;
     }> = [];
-    const factory = (args: { documentName: string; document?: Y.Doc }) => {
+    const factory = (args: { documentName: string; token?: string; document?: Y.Doc }) => {
       const document = args.document ?? new Y.Doc();
       const cbs = new Set<(info: { reason: string }) => void>();
       const entry = {
         documentName: args.documentName,
+        token: args.token,
         destroyed: false,
         emitAuthFailure: (reason: string) => {
           for (const cb of cbs) cb({ reason });
@@ -1171,6 +1218,274 @@ describe('DDR-102 — auth-failure intelligence + boot summary', () => {
     }
   });
 
+  test('invalid-token triggers ONE silent renewal and an immediate re-probe with the fresh token', async () => {
+    const url = 'https://hub.example.com';
+    writeHubsConfig(url, 'mau_stale');
+    const ctx = makeCtx({ url, linkedAt: 1 });
+    writeFileSync(join(ctx.paths.designRoot, 'ui', 'a.html'), '<a/>');
+    writeFileSync(join(ctx.paths.designRoot, 'ui', 'b.html'), '<b/>');
+    writeFileSync(join(ctx.paths.designRoot, 'ui', 'c.html'), '<c/>');
+
+    const timers = fakeTimerQueue();
+    const { factory, made } = authStubFactory();
+    let renewCalls = 0;
+    const origWarn = console.warn;
+    const origLog = console.log;
+    console.warn = () => {};
+    console.log = () => {};
+    try {
+      const runtime = createSyncRuntime(ctx, {
+        providerFactory: factory,
+        auth: {
+          warnDebounceMs: 2_000,
+          reprobeMs: 300_000,
+          settleTimeoutMs: 15_000,
+          setTimer: timers.setTimer,
+          clearTimer: timers.clearTimer,
+          renewCredential: async () => {
+            renewCalls++;
+            return { token: 'mau_fresh', expiresAt: null };
+          },
+        },
+      });
+      await runtime?.start();
+      expect(made).toHaveLength(3);
+      expect(made.every((m) => m.token === 'mau_stale')).toBe(true);
+
+      // The whole burst rejects with the expired credential…
+      for (const m of made.slice(0, 3)) m.emitAuthFailure('invalid token');
+      await new Promise((res) => setTimeout(res, 10));
+
+      // …ONE renewal (single-flight), and the re-probe happened NOW — no
+      // 5-minute wait — with the fresh token on every reconnected provider.
+      expect(renewCalls).toBe(1);
+      const reprobed = made.slice(3);
+      expect(reprobed.map((m) => m.documentName).sort()).toEqual(['ui-a', 'ui-b', 'ui-c']);
+      expect(reprobed.every((m) => m.token === 'mau_fresh')).toBe(true);
+
+      await runtime?.stop();
+    } finally {
+      console.warn = origWarn;
+      console.log = origLog;
+    }
+  });
+
+  test('F1: a hub refusing on VOLUME cannot drive a renewal storm — the cap stops it', async () => {
+    // The regression this whole review turned on. A cell refusing its own
+    // clients with "invalid token — rate limited" classifies permanent →
+    // triggers renewal → renewal succeeds (token was fine) → reprobe → every
+    // reconnected doc is refused again → loop. Reproduced at 2342/s before the
+    // cap. Here every reconnected provider auto-re-rejects, so without the cap
+    // this test would spin forever; with it, renewals are bounded.
+    const url = 'https://hub.example.com';
+    writeHubsConfig(url, 'mau_stale');
+    const ctx = makeCtx({ url, linkedAt: 1 });
+    writeFileSync(join(ctx.paths.designRoot, 'ui', 'a.html'), '<a/>');
+    writeFileSync(join(ctx.paths.designRoot, 'ui', 'b.html'), '<b/>');
+
+    let renewCalls = 0;
+    let providersMade = 0;
+    const origWarn = console.warn;
+    const origLog = console.log;
+    console.warn = () => {};
+    console.log = () => {};
+    // Every provider auto-rejects with the volume-refusal string the moment a
+    // failure handler is attached — modelling a full hub bucket.
+    const factory = (args: { documentName: string; token?: string; document?: Y.Doc }) => {
+      const document = args.document ?? new Y.Doc();
+      providersMade++;
+      return {
+        document,
+        onAuthFailed(cb: (info: { reason: string }) => void) {
+          queueMicrotask(() => cb({ reason: 'invalid token — rate limited, retry in up to 60s' }));
+          return () => {};
+        },
+        onceSynced: () => new Promise<void>(() => {}),
+        destroy() {},
+      };
+    };
+    try {
+      const runtime = createSyncRuntime(ctx, {
+        providerFactory: factory,
+        auth: {
+          warnDebounceMs: 2_000,
+          reprobeMs: 300_000,
+          settleTimeoutMs: 15_000,
+          setTimer: () => 0 as unknown as ReturnType<typeof setTimeout>,
+          clearTimer: () => {},
+          renewMinIntervalMs: 0, // isolate the CAP from the floor
+          renewCredential: async () => {
+            renewCalls++;
+            return { token: `mau_fresh_${renewCalls}`, expiresAt: null };
+          },
+        },
+      });
+      await runtime?.start();
+      // Let the storm run itself out — if the cap failed, this never settles
+      // and the test times out (which is itself the failure signal).
+      for (let i = 0; i < 20; i++) await new Promise((res) => setTimeout(res, 5));
+
+      // Bounded by the cap (default 3), NOT thousands.
+      expect(renewCalls).toBeLessThanOrEqual(3);
+      expect(renewCalls).toBeGreaterThan(0);
+      // Providers created is likewise bounded — no runaway reconnect fan-out.
+      expect(providersMade).toBeLessThan(20);
+      await runtime?.stop();
+    } finally {
+      console.warn = origWarn;
+      console.log = origLog;
+    }
+  });
+
+  test('F1: the frequency floor collapses a rapid second burst to no extra renewal', async () => {
+    const url = 'https://hub.example.com';
+    writeHubsConfig(url, 'mau_stale');
+    const ctx = makeCtx({ url, linkedAt: 1 });
+    writeFileSync(join(ctx.paths.designRoot, 'ui', 'a.html'), '<a/>');
+
+    let renewCalls = 0;
+    let clock = 1_000_000;
+    const origWarn = console.warn;
+    const origLog = console.log;
+    console.warn = () => {};
+    console.log = () => {};
+    const { factory, made } = authStubFactory();
+    try {
+      const runtime = createSyncRuntime(ctx, {
+        providerFactory: factory,
+        auth: {
+          warnDebounceMs: 2_000,
+          reprobeMs: 300_000,
+          settleTimeoutMs: 15_000,
+          setTimer: () => 0 as unknown as ReturnType<typeof setTimeout>,
+          clearTimer: () => {},
+          now: () => clock,
+          renewMinIntervalMs: 60_000,
+          renewCredential: async () => {
+            renewCalls++;
+            return { token: 'mau_fresh', expiresAt: null };
+          },
+        },
+      });
+      await runtime?.start();
+      made[0]?.emitAuthFailure('invalid token');
+      await new Promise((res) => setTimeout(res, 10));
+      expect(renewCalls).toBe(1);
+      // A second rejection 10 s later (inside the 60 s floor) → no new renewal.
+      clock += 10_000;
+      made[0]?.emitAuthFailure('invalid token');
+      await new Promise((res) => setTimeout(res, 10));
+      expect(renewCalls).toBe(1);
+      // Past the floor → renewal is allowed again.
+      clock += 60_000;
+      made[0]?.emitAuthFailure('invalid token');
+      await new Promise((res) => setTimeout(res, 10));
+      expect(renewCalls).toBe(2);
+      await runtime?.stop();
+    } finally {
+      console.warn = origWarn;
+      console.log = origLog;
+    }
+  });
+
+  test('a failed renewal changes nothing — rejected docs wait for the slow re-probe as before', async () => {
+    const url = 'https://hub.example.com';
+    writeHubsConfig(url, 'mau_stale');
+    const ctx = makeCtx({ url, linkedAt: 1 });
+    writeFileSync(join(ctx.paths.designRoot, 'ui', 'a.html'), '<a/>');
+
+    const timers = fakeTimerQueue();
+    const { factory, made } = authStubFactory();
+    const origWarn = console.warn;
+    const origLog = console.log;
+    console.warn = () => {};
+    console.log = () => {};
+    try {
+      const runtime = createSyncRuntime(ctx, {
+        providerFactory: factory,
+        auth: {
+          warnDebounceMs: 2_000,
+          reprobeMs: 300_000,
+          settleTimeoutMs: 15_000,
+          setTimer: timers.setTimer,
+          clearTimer: timers.clearTimer,
+          renewCredential: async () => null, // signed out / revoked / self-hosted
+        },
+      });
+      await runtime?.start();
+      made[0]?.emitAuthFailure('invalid token');
+      await new Promise((res) => setTimeout(res, 10));
+
+      // No immediate re-probe (the renewal failed) — the doc stays rejected…
+      expect(made).toHaveLength(1);
+      expect(runtime?.status()?.docs?.rejected).toBe(1);
+      // …until the slow re-probe fires, with the ORIGINAL token (unchanged).
+      timers.fire(300_000);
+      await new Promise((res) => setTimeout(res, 10));
+      expect(made).toHaveLength(2);
+      expect(made[1]?.token).toBe('mau_stale');
+
+      await runtime?.stop();
+    } finally {
+      console.warn = origWarn;
+      console.log = origLog;
+    }
+  });
+
+  test('a stored expiry arms a pre-expiry renewal at ~80% of the remaining life', async () => {
+    const url = 'https://hub.example.com';
+    const cfgPath = process.env.HUBS_CONFIG_PATH;
+    if (!cfgPath) throw new Error('HUBS_CONFIG_PATH not set by beforeEach');
+    writeFileSync(
+      cfgPath,
+      JSON.stringify({
+        hubs: { [url]: { token: 'mau_stale', linkedAt: 1, expiresAt: Date.now() + 100_000 } },
+      })
+    );
+    chmodSync(cfgPath, 0o600);
+    const ctx = makeCtx({ url, linkedAt: 1 });
+    writeFileSync(join(ctx.paths.designRoot, 'ui', 'a.html'), '<a/>');
+
+    const timers = fakeTimerQueue();
+    const { factory } = authStubFactory();
+    let renewCalls = 0;
+    const origWarn = console.warn;
+    const origLog = console.log;
+    console.warn = () => {};
+    console.log = () => {};
+    try {
+      const runtime = createSyncRuntime(ctx, {
+        providerFactory: factory,
+        auth: {
+          warnDebounceMs: 2_000,
+          reprobeMs: 300_000,
+          settleTimeoutMs: 15_000,
+          setTimer: timers.setTimer,
+          clearTimer: timers.clearTimer,
+          renewCredential: async () => {
+            renewCalls++;
+            return { token: 'mau_fresh', expiresAt: null };
+          },
+        },
+      });
+      await runtime?.start();
+      // 100 s of life left → the renewal timer sits at 80 s, so a 30 s sweep
+      // must not reach it (only the settle timers live down there)…
+      timers.fire(30_000);
+      await new Promise((res) => setTimeout(res, 5));
+      expect(renewCalls).toBe(0);
+      // …and the 80 s sweep fires it, once, without any rejection happening.
+      timers.fire(80_000);
+      await new Promise((res) => setTimeout(res, 5));
+      expect(renewCalls).toBe(1);
+
+      await runtime?.stop();
+    } finally {
+      console.warn = origWarn;
+      console.log = origLog;
+    }
+  });
+
   test('a successful re-probe clears the refusal, and the reconcile is a separate word', async () => {
     // A REGRESSION GUARD, not a falsifier — this already held. It is here
     // because the clear moved: it used to sit at the BOTTOM of the

package/apps/studio/test/sync-status.test.ts

@@ -144,3 +144,31 @@ describe('sync status store — DDR-102 additive fields', () => {
     expect(p.state).toBe('online');
   });
 });
+
+describe('sync status store — asset lane (feature-sync-progress-modal)', () => {
+  test('updateAssets() merges progress into the payload + flushes', () => {
+    const { store, writes, broadcasts } = makeStore();
+    const progress = {
+      total: 10,
+      done: 4,
+      pushed: 3,
+      skipped: 1,
+      failedCount: 0,
+      failures: [],
+      active: 'assets/hero.png',
+      finished: false,
+    };
+    store.updateAssets(progress);
+    expect(writes[writes.length - 1].assets).toEqual(progress);
+    expect(broadcasts[broadcasts.length - 1].assets).toEqual(progress);
+    // …and a later monitor update keeps the asset lane (separate slices).
+    store.update(snap({ state: 'online' }));
+    expect(store.get().assets).toEqual(progress);
+  });
+
+  test('payloads before the first asset emit carry no assets field', () => {
+    const { store } = makeStore();
+    store.update(snap());
+    expect('assets' in store.get()).toBe(false);
+  });
+});

package/apps/studio/test/timeline-comp-target.test.ts

@@ -0,0 +1,139 @@
+// timeline-comp-target — issue #75 regression coverage.
+//
+// The Timeline draws the rows of ONE artboard's comp but drives the transport
+// through a targeted postMessage, so "which comp id" is a real decision. The
+// old rule matched the parsed row total against `durationInFrames`; two comps
+// of equal length collapsed onto the FIRST one, so Play moved artboard #1 while
+// the panel showed artboard #2. These tests pin the artboard-first rule.
+
+import { describe, expect, test } from 'bun:test';
+
+import {
+  activeComp,
+  resolveCompTarget,
+  sanitizeArtboardText,
+} from '../client/panels/timeline-comp-target.js';
+
+const comp = (id: string, artboardId: string | null, durationInFrames: number) => ({
+  id,
+  artboardId,
+  durationInFrames,
+  fps: 30,
+  width: 1920,
+  height: 1080,
+  artboardLabel: artboardId,
+});
+
+describe('resolveCompTarget', () => {
+  test('empty / missing comps → null', () => {
+    expect(resolveCompTarget([], { artboardId: 'a' })).toBe(null);
+    // @ts-expect-error — defensive: the shell hands through canvas-origin data.
+    expect(resolveCompTarget(null, {})).toBe(null);
+  });
+
+  test('THE BUG — equal-duration comps resolve by artboard, not by order', () => {
+    const comps = [comp('videocomp-1', 'intro', 150), comp('videocomp-2', 'outro', 150)];
+    expect(resolveCompTarget(comps, { artboardId: 'outro', total: 150 })).toBe('videocomp-2');
+    expect(resolveCompTarget(comps, { artboardId: 'intro', total: 150 })).toBe('videocomp-1');
+  });
+
+  test('an author-set comp id equal to the artboard id also matches', () => {
+    const comps = [comp('intro', null, 150), comp('outro', null, 150)];
+    expect(resolveCompTarget(comps, { artboardId: 'outro', total: 150 })).toBe('outro');
+  });
+
+  test('no artboard known → an UNAMBIGUOUS duration still identifies the comp', () => {
+    const comps = [comp('videocomp-1', 'intro', 150), comp('videocomp-2', 'outro', 90)];
+    expect(resolveCompTarget(comps, { artboardId: null, total: 90 })).toBe('videocomp-2');
+  });
+
+  test('no artboard known + ambiguous duration → first comp (the only guess left)', () => {
+    const comps = [comp('videocomp-1', 'intro', 150), comp('videocomp-2', 'outro', 150)];
+    expect(resolveCompTarget(comps, { artboardId: null, total: 150 })).toBe('videocomp-1');
+  });
+
+  // Adversarial review 2026-08-12 — comp ids and artboard ids are separate
+  // author-chosen namespaces, so the weaker claim must never beat the real one.
+  test('an announced artboard OUTRANKS a comp that merely names itself after it', () => {
+    const comps = [comp('outro', 'intro', 150), comp('videocomp-2', 'outro', 150)];
+    expect(resolveCompTarget(comps, { artboardId: 'outro', total: 150 })).toBe('videocomp-2');
+  });
+
+  // The row parser derives the artboard lexically from the .tsx; canvas-lib
+  // reports the viewport one structurally. When the lexical claim names an
+  // artboard no comp is mounted in, the pan signal must still land the target.
+  test('candidate list — a stale first candidate falls through to the live one', () => {
+    const comps = [comp('videocomp-1', 'intro', 150), comp('videocomp-2', 'outro', 150)];
+    expect(resolveCompTarget(comps, { artboardId: ['ghost', 'outro'], total: 150 })).toBe(
+      'videocomp-2'
+    );
+    // First candidate wins whenever it DOES name a mounted comp.
+    expect(resolveCompTarget(comps, { artboardId: ['intro', 'outro'], total: 150 })).toBe(
+      'videocomp-1'
+    );
+    expect(resolveCompTarget(comps, { artboardId: [null, undefined, 'outro'] })).toBe(
+      'videocomp-2'
+    );
+  });
+
+  test('an artboard with no comp falls back rather than returning null', () => {
+    const comps = [comp('videocomp-1', 'intro', 150)];
+    expect(resolveCompTarget(comps, { artboardId: 'a-still-image-board', total: 150 })).toBe(
+      'videocomp-1'
+    );
+  });
+});
+
+// The artboard label is untrusted canvas-origin text rendered as shell chrome
+// (security-review 2026-08-12): a chip that can be made to read as a different
+// artboard than the transport is scoped to defeats its own purpose.
+describe('sanitizeArtboardText', () => {
+  test('strips bidi overrides + isolates', () => {
+    expect(sanitizeArtboardText('Intro\u202e')).toBe('Intro');
+    expect(sanitizeArtboardText('\u2066Outro\u2069')).toBe('Outro');
+    expect(sanitizeArtboardText('gnp\u202egpj.Hero')).toBe('gnpgpj.Hero');
+  });
+
+  test('strips zero-width, soft hyphen, BOM and C0/C1 controls', () => {
+    expect(sanitizeArtboardText('In\u200btro')).toBe('Intro');
+    expect(sanitizeArtboardText('\ufeffHero\u00ad')).toBe('Hero');
+    expect(sanitizeArtboardText('Line\nBreak\tTab')).toBe('LineBreakTab');
+    expect(sanitizeArtboardText('Bell\u0007')).toBe('Bell');
+  });
+
+  test('an all-invisible label reads as NO label, not as a blank chip', () => {
+    expect(sanitizeArtboardText('\u200b\u200b\u200b')).toBe(null);
+    expect(sanitizeArtboardText('   ')).toBe(null);
+    expect(sanitizeArtboardText('')).toBe(null);
+  });
+
+  test('non-strings are null, never coerced', () => {
+    expect(sanitizeArtboardText(undefined)).toBe(null);
+    expect(sanitizeArtboardText(null)).toBe(null);
+    expect(sanitizeArtboardText(42)).toBe(null);
+    expect(sanitizeArtboardText({ toString: () => 'nope' })).toBe(null);
+  });
+
+  test('caps length, and a cap that lands mid-space still trims', () => {
+    expect(sanitizeArtboardText('x'.repeat(500))).toHaveLength(120);
+    expect(sanitizeArtboardText(`${'x'.repeat(119)} yz`)).toBe('x'.repeat(119));
+  });
+
+  test('ordinary labels survive intact (accents, emoji, punctuation)', () => {
+    expect(sanitizeArtboardText('Přehled — 2. krok')).toBe('Přehled — 2. krok');
+    expect(sanitizeArtboardText('Hero 🎬')).toBe('Hero 🎬');
+  });
+});
+
+describe('activeComp', () => {
+  test('reads meta off the SAME comp the transport targets', () => {
+    const comps = [comp('videocomp-1', 'intro', 150), comp('videocomp-2', 'outro', 90)];
+    expect(activeComp(comps, 'videocomp-2')?.durationInFrames).toBe(90);
+  });
+
+  test('unknown id → first comp (panel still renders); empty → null', () => {
+    const comps = [comp('videocomp-1', 'intro', 150)];
+    expect(activeComp(comps, 'nope')?.id).toBe('videocomp-1');
+    expect(activeComp([], 'x')).toBe(null);
+  });
+});

package/apps/studio/test/video-comp.test.ts

@@ -11,7 +11,7 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from 'bun:test';
 import { GlobalRegistrator } from '@happy-dom/global-registrator';
 
-import { installMaudeSeekBridge } from '../video-comp.tsx';
+import { findArtboardOf, installMaudeSeekBridge } from '../video-comp.tsx';
 
 interface FakePlayer {
   seekTo: (frame: number) => void;
@@ -111,6 +111,11 @@ describe('video-comp seek bridge', () => {
       durationInFrames: 90,
       width: 640,
       height: 360,
+      // issue #75 — always present in the snapshot (null when the comp was
+      // registered outside an artboard), so the shell can key the transport
+      // target on artboard identity instead of guessing from duration.
+      artboardId: null,
+      artboardLabel: null,
     });
     // No ref/functions leak into the snapshot.
     expect(Object.keys(comps[0])).not.toContain('ref');
@@ -151,7 +156,7 @@ describe('video-comp seek bridge', () => {
     expect(a.seeks).toEqual([42, 42]);
   });
 
-  test('a Player ref that is not yet ready (null) does not throw', async () => {
+  test('a not-yet-ready Player is resilient in UI mode but still RECORDED', async () => {
     const w = window as unknown as SeekWindow;
     installMaudeSeekBridge();
     if (!w.__maudeVideoComps) w.__maudeVideoComps = new Map();
@@ -163,6 +168,103 @@ describe('video-comp seek bridge', () => {
       height: 360,
       ref: { current: null },
     });
+    // A live scrub of a still-mounting comp must not blow up the UI...
+    const before = w.__maude_seek_failures__ ?? 0;
     await expect(w.__maude_seek__?.(10)).resolves.toBeUndefined();
+    // ...but it is no longer silent: the capture shim reads this counter and
+    // refuses to encode, because a seek that never landed means a stale frame.
+    expect(w.__maude_seek_failures__ ?? 0).toBeGreaterThan(before);
+  });
+
+  test('capture mode (strict) throws instead of pretending the seek landed', async () => {
+    const w = window as unknown as SeekWindow;
+    installMaudeSeekBridge();
+    if (!w.__maudeVideoComps) w.__maudeVideoComps = new Map();
+    w.__maudeVideoComps.set('pending-strict', {
+      id: 'pending-strict',
+      fps: 30,
+      durationInFrames: 90,
+      width: 640,
+      height: 360,
+      ref: { current: null },
+    });
+    await expect(w.__maude_seek__?.(10, { strict: true })).rejects.toThrow(
+      /refusing to report a seek that did not happen/
+    );
+  });
+});
+
+// issue #75 — a comp's own id is a mount slug (`videocomp-N`) unless the author
+// set one, so the shell can only tell two comps apart by the artboard they are
+// mounted in. This is the resolution that puts that id on the wire.
+describe('findArtboardOf', () => {
+  test('resolves the enclosing artboard id + visible label', () => {
+    document.body.innerHTML = `
+      <article data-dc-screen="outro">
+        <button class="dc-artboard-label sku"><span aria-hidden="true"></span>Outro</button>
+        <div class="dc-artboard-body"><div class="dc-video-comp" data-comp-id="videocomp-2"></div></div>
+      </article>`;
+    const host = document.querySelector('.dc-video-comp');
+    expect(findArtboardOf(host)).toEqual({ artboardId: 'outro', artboardLabel: 'Outro' });
+  });
+
+  test('a comp mounted outside any artboard reports nulls, never throws', () => {
+    document.body.innerHTML = '<div class="dc-video-comp" data-comp-id="bare"></div>';
+    expect(findArtboardOf(document.querySelector('.dc-video-comp'))).toEqual({
+      artboardId: null,
+      artboardLabel: null,
+    });
+    expect(findArtboardOf(null)).toEqual({ artboardId: null, artboardLabel: null });
+  });
+
+  // Adversarial review 2026-08-12 — `.dc-artboard-label` is a class anyone can
+  // write, so the label must come from the element canvas-lib actually renders
+  // (a DIRECT header/button child), not from the first match anywhere below.
+  test('a planted label node cannot outrank the real header', () => {
+    document.body.innerHTML = `
+      <article data-dc-screen="intro">
+        <span class="dc-artboard-label" hidden>Outro</span>
+        <header class="dc-artboard-label sku">Intro</header>
+        <div class="dc-artboard-body"><div class="dc-video-comp"></div></div>
+      </article>`;
+    expect(findArtboardOf(document.querySelector('.dc-video-comp')).artboardLabel).toBe('Intro');
+  });
+
+  test('a nested artboard resolves to the NEAREST board, not the outer label', () => {
+    document.body.innerHTML = `
+      <article data-dc-screen="outer">
+        <header class="dc-artboard-label sku">Outer</header>
+        <article data-dc-screen="inner">
+          <header class="dc-artboard-label sku">Inner</header>
+          <div class="dc-video-comp"></div>
+        </article>
+      </article>`;
+    expect(findArtboardOf(document.querySelector('.dc-video-comp'))).toEqual({
+      artboardId: 'inner',
+      artboardLabel: 'Inner',
+    });
+  });
+
+  test('a label deep in the body is ignored — only a direct header/button counts', () => {
+    document.body.innerHTML = `
+      <article data-dc-screen="intro">
+        <div class="dc-artboard-body">
+          <p class="dc-artboard-label">Outro</p>
+          <div class="dc-video-comp"></div>
+        </div>
+      </article>`;
+    expect(findArtboardOf(document.querySelector('.dc-video-comp'))).toEqual({
+      artboardId: 'intro',
+      artboardLabel: null,
+    });
+  });
+
+  test('an unlabelled artboard still yields its id', () => {
+    document.body.innerHTML =
+      '<article data-dc-screen="intro"><div class="dc-video-comp"></div></article>';
+    expect(findArtboardOf(document.querySelector('.dc-video-comp'))).toEqual({
+      artboardId: 'intro',
+      artboardLabel: null,
+    });
   });
 });