@1agh/maude 0.58.3 → 0.60.0

package/apps/studio/sync/asset-sweep.ts

@@ -0,0 +1,262 @@
+// The parent half of the out-of-process asset sweep — feature-sync-resync-and-
+// out-of-process-sweep. The child is `asset-push-worker.ts`; read its header
+// first, it carries the protocol and the reason the boundary exists at all.
+//
+// What this module owns:
+//
+//   • spawning the child the way the packaged app can actually run it (DDR-177 —
+//     the compiled sidecar re-entered as a JS runtime, never a user-installed
+//     `bun`), reusing the sandbox's own resolver so the two cannot drift;
+//   • handing over the credential through a 0600 file that is unlinked when the
+//     sweep ends, because argv is world-readable via `ps`;
+//   • turning NDJSON lines back into the `AssetPushProgress` the panel already
+//     consumes, so `_sync.json`, the WS fanout and the Sync panel are untouched;
+//   • making a DEAD CHILD a reported failure instead of a silent stall. Before
+//     the boundary, a fault took the dev server with it; after it, the sweep is
+//     the only casualty and the panel has to say so — an asset lane frozen at
+//     "92 of 182" forever is the failure mode this whole change is about.
+
+import { mkdtempSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+import { resolveBunPath, workerEnv } from '../canvas-build-sandbox.ts';
+import { DEV_SERVER_ROOT } from '../paths.ts';
+import type { AssetPushProgress, AssetPushResult } from './asset-push.ts';
+
+/** A stray unterminated flood must not grow the parent's heap. */
+const MAX_LINE_BYTES = 1024 * 1024;
+
+/** How much of the child's stderr is kept for the failure message. */
+const STDERR_KEEP = 2000;
+
+/** Grace between SIGTERM and SIGKILL when a sweep is cancelled. */
+const KILL_GRACE_MS = 2000;
+
+/**
+ * How often the parent checks whether the credential has been renewed.
+ *
+ * A sweep can run for minutes; `scheduleRenewal` can swap the runtime's token
+ * underneath it. In-process that was free (the old call read `() => token` per
+ * request). Across the boundary the child re-reads its file per request, so the
+ * PARENT has to keep that file current or a renewal mid-sweep turns every
+ * remaining upload into a 401.
+ */
+const TOKEN_REFRESH_MS = 30_000;
+
+export interface AssetSweepHandle {
+  /** The sweep's result, or `null` when it did not finish (crash / cancel). */
+  done: Promise<AssetPushResult | null>;
+  /** Stop the sweep. Idempotent; safe after completion. */
+  cancel(): void;
+}
+
+/** Absolute path to the child entry, resolved per DDR-045 (never a bunfs path). */
+export function assetWorkerScript(): string {
+  return join(DEV_SERVER_ROOT, 'sync', 'asset-push-worker.ts');
+}
+
+export function runAssetSweep(opts: {
+  designRoot: string;
+  hubUrl: string;
+  /**
+   * Read at call time — silent renewal swaps the credential in place, exactly
+   * as the in-process sweep's `() => token` did. The value is written 0600 to a
+   * temp file the child re-reads, and re-written when it changes.
+   */
+  token: () => string;
+  onProgress?: (p: AssetPushProgress) => void;
+  env?: NodeJS.ProcessEnv;
+  log?: Pick<Console, 'log' | 'warn'>;
+  /** Test injection — the spawn and the script path. */
+  spawn?: typeof Bun.spawn;
+  script?: string;
+}): AssetSweepHandle {
+  const log = opts.log ?? console;
+  const spawn = opts.spawn ?? Bun.spawn;
+  const env = opts.env ?? process.env;
+
+  let cancelled = false;
+  let child: Bun.Subprocess<'ignore', 'pipe', 'pipe'> | null = null;
+  let killTimer: ReturnType<typeof setTimeout> | null = null;
+  // The last thing the child told us — the base for the final emit we have to
+  // synthesize ourselves when it never gets to send one.
+  let last: AssetPushProgress | null = null;
+
+  const emit = (p: AssetPushProgress): void => {
+    last = p;
+    try {
+      opts.onProgress?.(p);
+    } catch (err) {
+      log.warn(`[sync/assets] progress listener threw: ${(err as Error).message}`);
+    }
+  };
+
+  /**
+   * The sweep stopped without finishing. Say so ONCE, in the payload the panel
+   * already reads, keeping whatever counts we had — a lane that stops at "92 of
+   * 182" and stays there is the exact lie this replaces.
+   */
+  const emitStopped = (reason: string): void => {
+    const base = last;
+    const failures = (base?.failures ?? []).slice();
+    failures.push({ key: '(sweep)', reason });
+    emit({
+      total: base?.total ?? 0,
+      done: base?.done ?? 0,
+      pushed: base?.pushed ?? 0,
+      skipped: base?.skipped ?? 0,
+      failedCount: (base?.failedCount ?? 0) + 1,
+      failures,
+      active: null,
+      finished: true,
+    });
+  };
+
+  const done = (async (): Promise<AssetPushResult | null> => {
+    // A temp DIRECTORY, so the 0600 file is also inside a 0700 dir — the file
+    // mode alone is enough on every platform we ship to, but a private parent
+    // costs nothing and closes the window between create and chmod.
+    const dir = mkdtempSync(join(tmpdir(), 'maude-sweep-'));
+    const tokenFile = join(dir, 'hub-token');
+    let refresh: ReturnType<typeof setInterval> | null = null;
+    try {
+      // Temp-then-rename on every write, including the first: the child reads
+      // this file per request, and a plain overwrite can be observed half-done.
+      let written = '';
+      const putToken = (value: string): void => {
+        if (!value || value === written) return;
+        const tmp = `${tokenFile}.tmp`;
+        writeFileSync(tmp, value, { mode: 0o600 });
+        renameSync(tmp, tokenFile);
+        written = value;
+      };
+      putToken(opts.token());
+      refresh = setInterval(() => {
+        try {
+          putToken(opts.token());
+        } catch (err) {
+          log.warn(
+            `[sync/assets] could not refresh the sweep credential: ${(err as Error).message}`
+          );
+        }
+      }, TOKEN_REFRESH_MS);
+      refresh.unref?.();
+
+      const script = opts.script ?? assetWorkerScript();
+      try {
+        child = spawn([resolveBunPath(env), script, opts.designRoot, opts.hubUrl, tokenFile], {
+          env: workerEnv(env),
+          cwd: opts.designRoot,
+          stdin: 'ignore',
+          stdout: 'pipe',
+          stderr: 'pipe',
+        }) as Bun.Subprocess<'ignore', 'pipe', 'pipe'>;
+      } catch (err) {
+        // Never fall back to sweeping in-process: that is the crash this whole
+        // boundary exists to survive, and it would come back invisibly.
+        emitStopped(`the asset sweep could not start: ${(err as Error).message}`);
+        return null;
+      }
+
+      // Cancel may have been called between the handle being returned and the
+      // spawn landing — honour it rather than letting a doomed sweep run.
+      if (cancelled) child.kill('SIGTERM');
+
+      let result: AssetPushResult | null = null;
+      let childError: string | null = null;
+      let stderr = '';
+
+      const drainErr = (async () => {
+        try {
+          stderr = (await new Response(child?.stderr).text()).slice(-STDERR_KEEP);
+        } catch {
+          /* the stream died with the process — nothing to keep */
+        }
+      })();
+
+      let buf = '';
+      const decoder = new TextDecoder();
+      try {
+        for await (const chunk of child.stdout as ReadableStream<Uint8Array>) {
+          buf += decoder.decode(chunk, { stream: true });
+          let nl = buf.indexOf('\n');
+          while (nl !== -1) {
+            const line = buf.slice(0, nl);
+            buf = buf.slice(nl + 1);
+            nl = buf.indexOf('\n');
+            if (!line.trim()) continue;
+            let parsed: { t?: string; message?: unknown } & Record<string, unknown>;
+            try {
+              parsed = JSON.parse(line);
+            } catch {
+              // Defensive: a stray write from an import would land mid-stream.
+              // Dropping the line keeps the sweep readable instead of ending it.
+              continue;
+            }
+            // The tag is transport, not payload — `progress` lands in
+            // `_sync.json` and every open tab, so it goes out the way the
+            // in-process sweep used to emit it, with no extra field.
+            const { t, ...payload } = parsed;
+            if (t === 'progress') emit(payload as unknown as AssetPushProgress);
+            else if (t === 'result') result = payload as unknown as AssetPushResult;
+            else if (t === 'error') childError = String(parsed.message ?? 'unknown');
+          }
+          if (buf.length > MAX_LINE_BYTES) buf = '';
+        }
+      } catch (err) {
+        childError ??= `the sweep's output could not be read: ${(err as Error).message}`;
+      }
+
+      await child.exited;
+      await drainErr;
+      if (killTimer) clearTimeout(killTimer);
+
+      const code = child.exitCode;
+      const signal = child.signalCode;
+
+      if (cancelled) {
+        emitStopped('cancelled');
+        return null;
+      }
+      if (result && code === 0) return result;
+
+      // Everything below is a sweep that did not finish. Name WHY as concretely
+      // as the child let us — a signal is the segfault class this boundary was
+      // built for, and the panel saying "stopped unexpectedly (SIGSEGV)" is what
+      // turns an invisible stall into a bug report.
+      const why = childError
+        ? `the asset sweep failed: ${childError}`
+        : signal
+          ? `the asset sweep stopped unexpectedly (${signal})`
+          : `the asset sweep exited with code ${code}`;
+      log.warn(`[sync/assets] ${why}${stderr ? `\n${stderr.trim()}` : ''}`);
+      emitStopped(why);
+      return null;
+    } finally {
+      if (refresh) clearInterval(refresh);
+      child = null;
+      rmSync(dir, { recursive: true, force: true });
+    }
+  })();
+
+  return {
+    done,
+    cancel(): void {
+      if (cancelled) return;
+      cancelled = true;
+      if (!child) return;
+      child.kill('SIGTERM');
+      // A child wedged inside a socket read will not notice SIGTERM; the whole
+      // point of cancel is that it always ends.
+      killTimer = setTimeout(() => {
+        try {
+          child?.kill('SIGKILL');
+        } catch {
+          /* already gone */
+        }
+      }, KILL_GRACE_MS);
+      killTimer.unref?.();
+    },
+  };
+}

package/apps/studio/sync/connection-state.ts

@@ -28,6 +28,15 @@ export type SyncState = 'online' | 'connecting' | 'offline' | 'offline-long';
  *  refused auth for this documentName (scope / invalid token / rate limit). */
 export type DocSyncState = 'pending' | 'connected' | 'auth-rejected';
 
+/** feature-sync-progress-modal — one row of the per-document list the Sync
+ *  panel renders. `reason` is OUR OWN classification vocabulary (the
+ *  AuthFailureClass strings), never hub-supplied text. */
+export interface SyncDocItem {
+  slug: string;
+  state: DocSyncState;
+  reason?: string;
+}
+
 export interface SyncStatusSnapshot {
   state: SyncState;
   /** Local edits made since the hub went unreachable (replayed on reconnect). */
@@ -55,6 +64,18 @@ export interface SyncStatusSnapshot {
   /** DDR-102 — slugs currently auth-rejected, capped at 20 (see docs.rejected
    *  for the true count). Treat as text, never HTML. */
   rejectedSlugs?: string[];
+  /**
+   * feature-sync-progress-modal — the per-document list behind `docs`, so the
+   * Sync panel can render rows without a second fetch. Bounded at
+   * MAX_SYNC_ITEMS with the INTERESTING states first (rejected, then pending,
+   * then connected): the truncated tail is then always the already-summarised
+   * happy case, and `itemsTruncated` says how many rows it holds. Slugs are
+   * local canvas identifiers; `reason` is our own classification vocabulary.
+   * Absent in pre-existing payloads.
+   */
+  items?: SyncDocItem[];
+  /** Rows dropped by the MAX_SYNC_ITEMS cap (all `connected` by the sort). */
+  itemsTruncated?: number;
   /**
    * Canvases this run brought DOWN from the project — documents that existed
    * only on the hub and are now real local files.
@@ -94,8 +115,10 @@ export interface ConnectionMonitor {
   noteProviderStatus(providerId: string, status: ProviderStatus): void;
   /** A local edit happened — counts toward queuedOps while not online. */
   noteLocalEdit(): void;
-  /** DDR-102 — record a document's sync state (pending/connected/auth-rejected). */
-  noteDocState(slug: string, state: DocSyncState): void;
+  /** DDR-102 — record a document's sync state (pending/connected/auth-rejected).
+   *  `reason` (feature-sync-progress-modal) is the classification for an
+   *  auth-rejected doc — our own vocabulary, ignored for other states. */
+  noteDocState(slug: string, state: DocSyncState, reason?: string): void;
   /** DDR-102 — real sync activity for a slug (reconcile done, hub-pushed flush
    *  applied): bumps `lastSyncAt` to now. */
   noteSyncActivity(slug: string): void;
@@ -112,6 +135,21 @@ const DEFAULT_ESCALATE_MS = 24 * 60 * 60 * 1000;
 const DEFAULT_FLASH_MS = 3_000;
 /** Cap on rejectedSlugs in the snapshot (the rollup carries the true count). */
 export const MAX_REJECTED_SLUGS = 20;
+/**
+ * Cap on the per-document `items` list. Every emit synchronously writes
+ * `_sync.json` and fans out over WS, so the list must stay bounded no matter
+ * how many canvases a project grows — 200 rows ≈ a few KB, and the sort keeps
+ * everything a person must ACT on (rejected, pending) inside the cap.
+ */
+export const MAX_SYNC_ITEMS = 200;
+
+/** Sort weight: the states a person must act on come first, so the cap only
+ *  ever truncates the already-summarised happy tail. */
+const ITEM_STATE_ORDER: Record<DocSyncState, number> = {
+  'auth-rejected': 0,
+  pending: 1,
+  connected: 2,
+};
 
 export function createConnectionMonitor(opts: ConnectionMonitorOptions = {}): ConnectionMonitor {
   const graceMs = opts.graceMs ?? DEFAULT_GRACE_MS;
@@ -125,6 +163,11 @@ export function createConnectionMonitor(opts: ConnectionMonitorOptions = {}): Co
   const providerStatuses = new Map<string, ProviderStatus>();
   // DDR-102 — per-doc states (pending/connected/auth-rejected).
   const docStates = new Map<string, DocSyncState>();
+  // feature-sync-progress-modal — rejection classifications, keyed by slug.
+  // Held separately from docStates so the state machine above is untouched;
+  // dropped the moment a doc leaves auth-rejected (a re-probe that succeeds
+  // must not leave a stale reason on a connected row).
+  const docReasons = new Map<string, string>();
 
   // NOT born connected. The monitor used to start `online`, so from the instant
   // a link was created — before a socket, before a token was accepted, before a
@@ -175,6 +218,19 @@ export function createConnectionMonitor(opts: ConnectionMonitorOptions = {}): Co
         if (rejectedSlugs.length < MAX_REJECTED_SLUGS) rejectedSlugs.push(slug);
       } else docs.pending++;
     }
+    // The per-row list, actionable states first so the cap only ever drops
+    // rows the aggregate counts already describe (see MAX_SYNC_ITEMS).
+    const allItems: SyncDocItem[] = [...docStates]
+      .map(([slug, st]) => {
+        const reason = docReasons.get(slug);
+        return reason ? { slug, state: st, reason } : { slug, state: st };
+      })
+      .sort(
+        (a, b) =>
+          ITEM_STATE_ORDER[a.state] - ITEM_STATE_ORDER[b.state] || a.slug.localeCompare(b.slug)
+      );
+    const items = allItems.slice(0, MAX_SYNC_ITEMS);
+    const itemsTruncated = allItems.length - items.length;
     return {
       state,
       queuedOps,
@@ -185,6 +241,8 @@ export function createConnectionMonitor(opts: ConnectionMonitorOptions = {}): Co
       startedAt,
       docs,
       rejectedSlugs,
+      items,
+      ...(itemsTruncated > 0 ? { itemsTruncated } : {}),
       ...(pulled ? { pulled } : {}),
     };
   }
@@ -347,10 +405,20 @@ export function createConnectionMonitor(opts: ConnectionMonitorOptions = {}): Co
       emit();
     },
 
-    noteDocState(slug, docState) {
+    noteDocState(slug, docState, reason) {
       if (stopped) return;
+      // STATE-ONLY dedupe. This briefly compared `reason` too, which handed a
+      // hostile hub an amplifier: the rejection text is hub-controlled, so
+      // alternating it on an open socket forced a full emit — items rebuild +
+      // synchronous `_sync.json` write + WS fanout — per frame (security
+      // review 2026-08-11, sync-progress-modal defender). The reason is
+      // LATCHED for the life of a rejection episode instead: the first
+      // classification wins, leaving the rejected state clears the latch, and
+      // a NEW episode records a fresh reason. Repeat frames stay a no-op.
       if (docStates.get(slug) === docState) return;
       docStates.set(slug, docState);
+      if (docState !== 'auth-rejected') docReasons.delete(slug);
+      else if (reason !== undefined) docReasons.set(slug, reason);
       emit();
     },
 

package/apps/studio/sync/index.ts

@@ -29,7 +29,7 @@ import type { Context, LinkedHub } from '../context.ts';
 import { createHistory } from '../history.ts';
 import { SYNTHETIC_FS_DELAY_MS } from '../hmr-broadcast.ts';
 import { type CanvasSyncAgent, createCanvasSyncAgent } from './agent.ts';
-import { pushAssets } from './asset-push.ts';
+import { type AssetSweepHandle, runAssetSweep } from './asset-sweep.ts';
 import { atomicWrite } from './atomic-write.ts';
 import { createAutoCommit } from './autocommit.ts';
 import { type CellPairing, resolveCellPairing, sanitizeForLog } from './cell-pairing.ts';
@@ -203,6 +203,13 @@ export interface SyncRuntime {
   agentFor(slug: string): CanvasSyncAgent | undefined;
   /** Current offline/sync status payload (Task 8), or null when unlinked. */
   status(): import('./status.ts').SyncStatusPayload | null;
+  /**
+   * Stop the asset sweep child, if one is running. `false` means there was
+   * nothing to cancel — the caller reports that, rather than pretending.
+   * Scoped to the sweep on purpose: killing a reconnect mid-handshake is not a
+   * meaningful gesture, killing a multi-hundred-megabyte upload is.
+   */
+  cancelAssetSweep(): boolean;
 }
 
 export interface CreateSyncRuntimeOptions {
@@ -450,6 +457,8 @@ export function createSyncRuntime(
   let busUnsub: (() => void) | null = null;
   let started = false;
   let stopped = false;
+  /** The live asset sweep, so `stop()` can end it and the panel can cancel it. */
+  let assetSweep: AssetSweepHandle | null = null;
 
   // Task 8 — offline-mode status surface, initialized in start() once the
   // canvas count is known. The store writes `_sync.json` + broadcasts
@@ -969,7 +978,10 @@ export function createSyncRuntime(
     ): void => {
       if (stopped) return;
       const reasonClass = classifyAuthFailure(rawReason);
-      mon.noteDocState(canvas.slug, 'auth-rejected');
+      // feature-sync-progress-modal — the class rides into the per-item list so
+      // a rejected row in the Sync panel can say WHY (our vocabulary, not the
+      // hub's raw message).
+      mon.noteDocState(canvas.slug, 'auth-rejected', reasonClass);
       rejectedReasons.set(canvas.slug, reasonClass);
       // Aggregate console output: ONE debounced warn for the whole burst.
       if (!pendingAuthWarn.has(reasonClass)) pendingAuthWarn.set(reasonClass, new Set());
@@ -1542,13 +1554,24 @@ export function createSyncRuntime(
       // (they carry the canvases; assets ride behind, never in front). Not
       // under pairing: a cell's assets are already on the cell. Fire-and-forget
       // — a miss is retried on the next boot for free.
-      if (!cellPairing) {
-        void pushAssets({
+      if (!cellPairing && !stopped) {
+        // OUT OF PROCESS since feature-sync-resync-and-out-of-process-sweep:
+        // the sweep segfaults Bun when it runs alongside the dev server (proven
+        // by isolation — identical sweep, same hub, completes standalone). The
+        // child dying is now a failed sweep the panel reports, not a dead
+        // editor. See `asset-sweep.ts`.
+        assetSweep = runAssetSweep({
           designRoot: ctx.paths.designRoot,
           hubUrl: linkedHub.url,
+          // Read at call time — a silent renewal mid-sweep must reach the child
+          // (the parent re-writes its credential file when this changes).
           token: () => token,
-        }).catch((err) => {
-          console.warn(`[sync/assets] asset push failed: ${(err as Error).message}`);
+          // feature-sync-progress-modal — ride the same `sync:status` payload
+          // the doc counts use, so the Sync panel has one source. Guarded on
+          // `stopped`: a late emit must not write `_sync.json` post-teardown.
+          onProgress: (p) => {
+            if (!stopped) store.updateAssets?.(p);
+          },
         });
       }
     });
@@ -1563,6 +1586,11 @@ export function createSyncRuntime(
   async function stop(): Promise<void> {
     if (stopped) return;
     stopped = true;
+    // A sweep that outlives its runtime keeps uploading a project the person
+    // just closed — and `restart()` (the Resync button) calls stop() on every
+    // press, so without this each press would leave another sweep running.
+    assetSweep?.cancel();
+    assetSweep = null;
     // Commit whatever is still inside the quiescence window BEFORE tearing
     // anything down. Shutting down mid-window would leave the last edits on
     // disk but out of history — the one state this whole mechanism exists to
@@ -1668,6 +1696,11 @@ export function createSyncRuntime(
     size: () => agents.size + projections.size,
     agentFor: (slug) => agents.get(slug),
     status: () => statusStore?.get() ?? null,
+    cancelAssetSweep: () => {
+      if (!assetSweep) return false;
+      assetSweep.cancel();
+      return true;
+    },
   };
 }
 

package/apps/studio/sync/presentation.ts

@@ -77,6 +77,9 @@ export interface SyncStatusLike extends Partial<SyncStatusSnapshot> {
 const MAX_NAME_LEN = 60;
 const SHOWN_NAMES = 3;
 
+/** A whole sentence, not a name — the diagnose() details are up to ~90 chars. */
+const MAX_DETAIL_LEN = 160;
+
 export function safeName(raw: unknown, fallback: string): string {
   // Length alone was not enough. A name is hub-supplied (cell mode sets it from
   // `MAUDE_PROJECT_NAME`; `.design/config.json` is a committed file anyone with
@@ -97,6 +100,24 @@ export function safeName(raw: unknown, fallback: string): string {
   return s.length > MAX_NAME_LEN ? `${s.slice(0, MAX_NAME_LEN)}…` : s;
 }
 
+/**
+ * The same sanitizing, for a SENTENCE.
+ *
+ * `SyncStartOutcome.detail` is a full clause a person is meant to act on
+ * ("No sign-in for this workspace is stored on this machine yet."), and at
+ * `safeName`'s 60-character name budget the useful half is exactly what gets
+ * cut. The stripping is identical and non-negotiable — the string still passes
+ * through the server from a hub-influenced world — only the budget differs.
+ */
+export function safeDetail(raw: unknown, fallback: string): string {
+  const s = String(raw ?? '')
+    .replace(/[\p{Cc}\p{Cf}]/gu, '')
+    .replace(/\s+/g, ' ')
+    .trim();
+  if (!s) return fallback;
+  return s.length > MAX_DETAIL_LEN ? `${s.slice(0, MAX_DETAIL_LEN)}…` : s;
+}
+
 function shownNames(list: readonly string[] | undefined): string[] {
   return (list ?? []).slice(0, SHOWN_NAMES).map((n) => safeName(n, '(unnamed)'));
 }

package/apps/studio/sync/status.ts

@@ -12,6 +12,7 @@
 // git-pull divergence). Writes are best-effort + atomic-ish (tmp + rename via
 // the injected writer); a failed write never throws into the sync hot path.
 
+import type { AssetPushProgress } from './asset-push.ts';
 import type { SyncStatusSnapshot } from './connection-state.ts';
 
 // `cold-start-hub-wins` stays in the union for OLD payload readers (additive
@@ -46,6 +47,12 @@ export interface SyncStatusPayload extends SyncStatusSnapshot {
    * show which collaboration model is running. Absent/false = the two-doc path.
    */
   sharedDoc?: boolean;
+  /**
+   * feature-sync-progress-modal — the DDR-217 asset push's live progress
+   * (additive; absent until the first push emit of a boot). Rides the same
+   * payload as the doc counts so the Sync panel has one source, not two.
+   */
+  assets?: AssetPushProgress;
 }
 
 export interface SyncStatusStoreOptions {
@@ -67,6 +74,10 @@ export interface SyncStatusStore {
   update(snapshot: SyncStatusSnapshot): void;
   /** Record a conflict notification + persist + broadcast. */
   addConflict(conflict: Omit<SyncConflict, 'at'>): void;
+  /** feature-sync-progress-modal — merge asset-push progress + persist +
+   *  broadcast. Kept in the store (not the monitor): assets are a push lane,
+   *  not a connection, and the monitor's state machine must not learn them. */
+  updateAssets(progress: AssetPushProgress): void;
   /** Current payload (defensive copy). */
   get(): SyncStatusPayload;
 }
@@ -90,6 +101,8 @@ export function createSyncStatusStore(opts: SyncStatusStoreOptions): SyncStatusS
     updatedAt: now(),
   };
 
+  let assets: AssetPushProgress | undefined;
+
   function payload(): SyncStatusPayload {
     return {
       ...snapshot,
@@ -97,6 +110,7 @@ export function createSyncStatusStore(opts: SyncStatusStoreOptions): SyncStatusS
       canvases: opts.canvases,
       conflicts: conflicts.slice(),
       ...(opts.sharedDoc ? { sharedDoc: true } : {}),
+      ...(assets ? { assets } : {}),
     };
   }
 
@@ -124,6 +138,10 @@ export function createSyncStatusStore(opts: SyncStatusStoreOptions): SyncStatusS
       if (conflicts.length > maxConflicts) conflicts.splice(0, conflicts.length - maxConflicts);
       flush();
     },
+    updateAssets(progress) {
+      assets = progress;
+      flush();
+    },
     get: payload,
   };
 }

package/apps/studio/sync/supervisor.ts

@@ -57,6 +57,16 @@ export interface SyncSupervisor {
    * `undefined` keeps whatever the config already holds.
    */
   restart(linkedHub?: LinkedHub | null): Promise<SyncStartOutcome>;
+  /**
+   * Is a start/restart/stop cycle in flight?
+   *
+   * NOT a lock — `serialize()` below already guarantees ordering, and a caller
+   * must never re-implement that. This exists so the Resync button can be
+   * REFUSED EARLY (409) instead of quietly queued: a person pressing twice
+   * wants to know the first press is still working, not to buy a second full
+   * re-link of every canvas.
+   */
+  busy(): boolean;
   stop(): Promise<void>;
   /** The live runtime, or null in solo mode. Test/inspection surface. */
   current(): SyncRuntime | null;
@@ -150,16 +160,26 @@ export function createSyncSupervisor(
     return { syncing: true, canvases };
   }
 
+  let inFlight = 0;
+
   function serialize<T>(work: () => Promise<T>): Promise<T> {
+    inFlight++;
     const next = chain.then(work, work);
     // Keep the chain alive even when a link fails — the NEXT attach must still
     // be able to run. (A rejected chain would poison every later restart.)
     chain = next.catch(() => {});
+    // Settled either way — a cycle that threw is still a cycle that ended, and
+    // leaking `inFlight` would leave Resync refusing forever.
+    const settle = (): void => {
+      inFlight--;
+    };
+    next.then(settle, settle);
     return next;
   }
 
   return {
     start: () => serialize(boot),
+    busy: () => inFlight > 0,
     restart: (linkedHub) =>
       serialize(async () => {
         try {

package/apps/studio/test/canvas-origin-gate.test.ts

@@ -227,6 +227,10 @@ describe('canvas-origin gate — A1/A2 traversal + privilege containment', () =>
         '/_api/figma/connect',
         '/_api/figma/probe',
         '/_api/figma/import',
+        // DDR-219 D2 — the codegen route is privileged-origin only. From the
+        // canvas it would be a read primitive over the user's OPEN Figma
+        // document plus a write into the design root.
+        '/_api/figma/explode',
         // Local-only project create (mkdir + git init + scaffold) — writes to disk,
         // no token; MAIN-ORIGIN ONLY, so the canvas origin must 403 at the gate.
         '/_api/project/create-local',
@@ -235,6 +239,15 @@ describe('canvas-origin gate — A1/A2 traversal + privilege containment', () =>
         // the untrusted canvas origin must never reach it (it writes the global
         // ~/.config/maude/hubs.json token store).
         '/_api/hub/link',
+        // feature-sync-resync-and-out-of-process-sweep — the Resync control and
+        // the sweep cancel are MAIN-ORIGIN ONLY (absent from CANVAS_SAFE_API +
+        // startCanvasServer's routes). From the canvas origin, resync would be
+        // an amplification primitive driven by untrusted content: one request
+        // re-authenticates every document against the person's own hub and
+        // re-runs a whole-project upload, spending their DDR-102 rate-limit
+        // budget. A GET here 403s at the gate, never 405 from a reached handler.
+        '/_api/sync/resync',
+        '/_api/sync/cancel-assets',
         // ACP chat attachments (POST upload + GET thumbnail serve) are MAIN-ORIGIN
         // ONLY — absent from CANVAS_SAFE_API + startCanvasServer's routes. The
         // untrusted canvas origin must never read (or write) the user's pasted