@1agh/maude 0.59.0 → 0.60.0

package/apps/studio/sync/index.ts

@@ -29,7 +29,7 @@ import type { Context, LinkedHub } from '../context.ts';
 import { createHistory } from '../history.ts';
 import { SYNTHETIC_FS_DELAY_MS } from '../hmr-broadcast.ts';
 import { type CanvasSyncAgent, createCanvasSyncAgent } from './agent.ts';
-import { pushAssets } from './asset-push.ts';
+import { type AssetSweepHandle, runAssetSweep } from './asset-sweep.ts';
 import { atomicWrite } from './atomic-write.ts';
 import { createAutoCommit } from './autocommit.ts';
 import { type CellPairing, resolveCellPairing, sanitizeForLog } from './cell-pairing.ts';
@@ -203,6 +203,13 @@ export interface SyncRuntime {
   agentFor(slug: string): CanvasSyncAgent | undefined;
   /** Current offline/sync status payload (Task 8), or null when unlinked. */
   status(): import('./status.ts').SyncStatusPayload | null;
+  /**
+   * Stop the asset sweep child, if one is running. `false` means there was
+   * nothing to cancel — the caller reports that, rather than pretending.
+   * Scoped to the sweep on purpose: killing a reconnect mid-handshake is not a
+   * meaningful gesture, killing a multi-hundred-megabyte upload is.
+   */
+  cancelAssetSweep(): boolean;
 }
 
 export interface CreateSyncRuntimeOptions {
@@ -450,6 +457,8 @@ export function createSyncRuntime(
   let busUnsub: (() => void) | null = null;
   let started = false;
   let stopped = false;
+  /** The live asset sweep, so `stop()` can end it and the panel can cancel it. */
+  let assetSweep: AssetSweepHandle | null = null;
 
   // Task 8 — offline-mode status surface, initialized in start() once the
   // canvas count is known. The store writes `_sync.json` + broadcasts
@@ -1545,10 +1554,17 @@ export function createSyncRuntime(
       // (they carry the canvases; assets ride behind, never in front). Not
       // under pairing: a cell's assets are already on the cell. Fire-and-forget
       // — a miss is retried on the next boot for free.
-      if (!cellPairing) {
-        void pushAssets({
+      if (!cellPairing && !stopped) {
+        // OUT OF PROCESS since feature-sync-resync-and-out-of-process-sweep:
+        // the sweep segfaults Bun when it runs alongside the dev server (proven
+        // by isolation — identical sweep, same hub, completes standalone). The
+        // child dying is now a failed sweep the panel reports, not a dead
+        // editor. See `asset-sweep.ts`.
+        assetSweep = runAssetSweep({
           designRoot: ctx.paths.designRoot,
           hubUrl: linkedHub.url,
+          // Read at call time — a silent renewal mid-sweep must reach the child
+          // (the parent re-writes its credential file when this changes).
           token: () => token,
           // feature-sync-progress-modal — ride the same `sync:status` payload
           // the doc counts use, so the Sync panel has one source. Guarded on
@@ -1556,8 +1572,6 @@ export function createSyncRuntime(
           onProgress: (p) => {
             if (!stopped) store.updateAssets?.(p);
           },
-        }).catch((err) => {
-          console.warn(`[sync/assets] asset push failed: ${(err as Error).message}`);
         });
       }
     });
@@ -1572,6 +1586,11 @@ export function createSyncRuntime(
   async function stop(): Promise<void> {
     if (stopped) return;
     stopped = true;
+    // A sweep that outlives its runtime keeps uploading a project the person
+    // just closed — and `restart()` (the Resync button) calls stop() on every
+    // press, so without this each press would leave another sweep running.
+    assetSweep?.cancel();
+    assetSweep = null;
     // Commit whatever is still inside the quiescence window BEFORE tearing
     // anything down. Shutting down mid-window would leave the last edits on
     // disk but out of history — the one state this whole mechanism exists to
@@ -1677,6 +1696,11 @@ export function createSyncRuntime(
     size: () => agents.size + projections.size,
     agentFor: (slug) => agents.get(slug),
     status: () => statusStore?.get() ?? null,
+    cancelAssetSweep: () => {
+      if (!assetSweep) return false;
+      assetSweep.cancel();
+      return true;
+    },
   };
 }
 

package/apps/studio/sync/presentation.ts

@@ -77,6 +77,9 @@ export interface SyncStatusLike extends Partial<SyncStatusSnapshot> {
 const MAX_NAME_LEN = 60;
 const SHOWN_NAMES = 3;
 
+/** A whole sentence, not a name — the diagnose() details are up to ~90 chars. */
+const MAX_DETAIL_LEN = 160;
+
 export function safeName(raw: unknown, fallback: string): string {
   // Length alone was not enough. A name is hub-supplied (cell mode sets it from
   // `MAUDE_PROJECT_NAME`; `.design/config.json` is a committed file anyone with
@@ -97,6 +100,24 @@ export function safeName(raw: unknown, fallback: string): string {
   return s.length > MAX_NAME_LEN ? `${s.slice(0, MAX_NAME_LEN)}…` : s;
 }
 
+/**
+ * The same sanitizing, for a SENTENCE.
+ *
+ * `SyncStartOutcome.detail` is a full clause a person is meant to act on
+ * ("No sign-in for this workspace is stored on this machine yet."), and at
+ * `safeName`'s 60-character name budget the useful half is exactly what gets
+ * cut. The stripping is identical and non-negotiable — the string still passes
+ * through the server from a hub-influenced world — only the budget differs.
+ */
+export function safeDetail(raw: unknown, fallback: string): string {
+  const s = String(raw ?? '')
+    .replace(/[\p{Cc}\p{Cf}]/gu, '')
+    .replace(/\s+/g, ' ')
+    .trim();
+  if (!s) return fallback;
+  return s.length > MAX_DETAIL_LEN ? `${s.slice(0, MAX_DETAIL_LEN)}…` : s;
+}
+
 function shownNames(list: readonly string[] | undefined): string[] {
   return (list ?? []).slice(0, SHOWN_NAMES).map((n) => safeName(n, '(unnamed)'));
 }

package/apps/studio/sync/supervisor.ts

@@ -57,6 +57,16 @@ export interface SyncSupervisor {
    * `undefined` keeps whatever the config already holds.
    */
   restart(linkedHub?: LinkedHub | null): Promise<SyncStartOutcome>;
+  /**
+   * Is a start/restart/stop cycle in flight?
+   *
+   * NOT a lock — `serialize()` below already guarantees ordering, and a caller
+   * must never re-implement that. This exists so the Resync button can be
+   * REFUSED EARLY (409) instead of quietly queued: a person pressing twice
+   * wants to know the first press is still working, not to buy a second full
+   * re-link of every canvas.
+   */
+  busy(): boolean;
   stop(): Promise<void>;
   /** The live runtime, or null in solo mode. Test/inspection surface. */
   current(): SyncRuntime | null;
@@ -150,16 +160,26 @@ export function createSyncSupervisor(
     return { syncing: true, canvases };
   }
 
+  let inFlight = 0;
+
   function serialize<T>(work: () => Promise<T>): Promise<T> {
+    inFlight++;
     const next = chain.then(work, work);
     // Keep the chain alive even when a link fails — the NEXT attach must still
     // be able to run. (A rejected chain would poison every later restart.)
     chain = next.catch(() => {});
+    // Settled either way — a cycle that threw is still a cycle that ended, and
+    // leaking `inFlight` would leave Resync refusing forever.
+    const settle = (): void => {
+      inFlight--;
+    };
+    next.then(settle, settle);
     return next;
   }
 
   return {
     start: () => serialize(boot),
+    busy: () => inFlight > 0,
     restart: (linkedHub) =>
       serialize(async () => {
         try {

package/apps/studio/test/canvas-origin-gate.test.ts

@@ -239,6 +239,15 @@ describe('canvas-origin gate — A1/A2 traversal + privilege containment', () =>
         // the untrusted canvas origin must never reach it (it writes the global
         // ~/.config/maude/hubs.json token store).
         '/_api/hub/link',
+        // feature-sync-resync-and-out-of-process-sweep — the Resync control and
+        // the sweep cancel are MAIN-ORIGIN ONLY (absent from CANVAS_SAFE_API +
+        // startCanvasServer's routes). From the canvas origin, resync would be
+        // an amplification primitive driven by untrusted content: one request
+        // re-authenticates every document against the person's own hub and
+        // re-runs a whole-project upload, spending their DDR-102 rate-limit
+        // budget. A GET here 403s at the gate, never 405 from a reached handler.
+        '/_api/sync/resync',
+        '/_api/sync/cancel-assets',
         // ACP chat attachments (POST upload + GET thumbnail serve) are MAIN-ORIGIN
         // ONLY — absent from CANVAS_SAFE_API + startCanvasServer's routes. The
         // untrusted canvas origin must never read (or write) the user's pasted

package/apps/studio/test/sync-asset-push-worker.test.ts

@@ -0,0 +1,183 @@
+// The out-of-process asset sweep — the CHILD's half of the contract.
+//
+// These spawn the real worker against a real (local) hub, because the two
+// properties that matter here cannot be observed from inside the process that
+// would otherwise mock them: what actually reaches stdout, and what actually
+// reaches the wire's Authorization header. The parent's half (line parsing,
+// crash translation, cancel) is `sync-asset-sweep.test.ts`.
+
+import { describe, expect, test } from 'bun:test';
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+const WORKER = join(import.meta.dir, '..', 'sync', 'asset-push-worker.ts');
+
+/** A design root holding `n` DS assets — the class that pushes to `/_asset-file/`. */
+function projectWith(n: number): string {
+  const root = mkdtempSync(join(tmpdir(), 'sweep-worker-'));
+  mkdirSync(join(root, 'system/ds/assets/logos'), { recursive: true });
+  for (let i = 0; i < n; i++) {
+    writeFileSync(join(root, `system/ds/assets/logos/mark-${i}.svg`), `<svg>${i}</svg>`);
+  }
+  return root;
+}
+
+/**
+ * A hub that accepts everything, records every Authorization it saw, and lets a
+ * test react to a request (that is how the renewal case rewrites the token file
+ * mid-sweep).
+ */
+function hub(onRequest?: (req: Request, seen: number) => void) {
+  const auths: string[] = [];
+  let seen = 0;
+  const server = Bun.serve({
+    port: 0,
+    async fetch(req) {
+      const url = new URL(req.url);
+      auths.push(req.headers.get('authorization') ?? '');
+      onRequest?.(req, seen++);
+      // No batch probe here — answering 404 sends the sweep down the
+      // per-file HEAD path, which is the wider of the two code paths.
+      if (url.pathname === '/_asset-probe') return new Response('nope', { status: 404 });
+      if (req.method === 'HEAD') return new Response(null, { status: 404 });
+      await req.arrayBuffer(); // drain, or the socket desynchronizes
+      return new Response('ok', { status: 200 });
+    },
+  });
+  return {
+    url: `http://127.0.0.1:${server.port}`,
+    auths,
+    stop: () => server.stop(true),
+  };
+}
+
+/** Run the worker to completion; return its stdout lines, stderr and exit code. */
+async function run(args: string[]): Promise<{
+  lines: { t: string; [k: string]: unknown }[];
+  raw: string;
+  stderr: string;
+  code: number | null;
+}> {
+  const child = Bun.spawn([process.execPath, WORKER, ...args], {
+    stdin: 'ignore',
+    stdout: 'pipe',
+    stderr: 'pipe',
+  });
+  const [raw, stderr] = await Promise.all([
+    new Response(child.stdout).text(),
+    new Response(child.stderr).text(),
+  ]);
+  await child.exited;
+  const lines = raw
+    .split('\n')
+    .filter((l) => l.trim())
+    .map((l) => JSON.parse(l));
+  return { lines, raw, stderr, code: child.exitCode };
+}
+
+describe('the worker speaks NDJSON and nothing else', () => {
+  test('progress lines, then exactly one result line, then a clean exit', async () => {
+    const root = projectWith(3);
+    const h = hub();
+    const tokenFile = join(root, 'tok');
+    writeFileSync(tokenFile, 'secret-a', { mode: 0o600 });
+    try {
+      const { lines, raw, code } = await run([root, h.url, tokenFile]);
+
+      expect(code).toBe(0);
+      // Every line parsed — nothing unstructured reached stdout.
+      expect(raw.trimEnd().split('\n').length).toBe(lines.length);
+      const results = lines.filter((l) => l.t === 'result');
+      expect(results.length).toBe(1);
+      expect(lines.filter((l) => l.t === 'progress').length).toBeGreaterThan(0);
+      // …and the result is the LAST thing said.
+      expect(lines[lines.length - 1].t).toBe('result');
+      expect(results[0].pushed).toEqual([
+        'system/ds/assets/logos/mark-0.svg',
+        'system/ds/assets/logos/mark-1.svg',
+        'system/ds/assets/logos/mark-2.svg',
+      ]);
+      expect(results[0].failed).toEqual([]);
+    } finally {
+      h.stop();
+      rmSync(root, { recursive: true, force: true });
+    }
+  });
+
+  test('the final progress line is `finished`, so a parent never waits forever', async () => {
+    const root = projectWith(1);
+    const h = hub();
+    const tokenFile = join(root, 'tok');
+    writeFileSync(tokenFile, 'secret-a', { mode: 0o600 });
+    try {
+      const { lines } = await run([root, h.url, tokenFile]);
+      const progress = lines.filter((l) => l.t === 'progress');
+      expect(progress[progress.length - 1].finished).toBe(true);
+    } finally {
+      h.stop();
+      rmSync(root, { recursive: true, force: true });
+    }
+  });
+});
+
+describe('the credential travels in a file, not on the command line', () => {
+  test('the token reaching the hub is the FILE contents', async () => {
+    const root = projectWith(1);
+    const h = hub();
+    const tokenFile = join(root, 'tok');
+    writeFileSync(tokenFile, 'secret-from-file\n', { mode: 0o600 });
+    try {
+      await run([root, h.url, tokenFile]);
+      // Trimmed — a file written with a trailing newline must not send one.
+      expect(h.auths).toContain('Bearer secret-from-file');
+      expect(h.auths.every((a) => a === 'Bearer secret-from-file')).toBe(true);
+    } finally {
+      h.stop();
+      rmSync(root, { recursive: true, force: true });
+    }
+  });
+
+  test('a token rewritten mid-sweep is picked up (silent renewal keeps working)', async () => {
+    const root = projectWith(4);
+    const tokenFile = join(root, 'tok');
+    writeFileSync(tokenFile, 'old', { mode: 0o600 });
+    // Rotate after the hub has answered a couple of requests — exactly what
+    // `scheduleRenewal` does to the parent's in-memory token today.
+    const h = hub((_req, seen) => {
+      if (seen === 2) writeFileSync(tokenFile, 'new', { mode: 0o600 });
+    });
+    try {
+      await run([root, h.url, tokenFile]);
+      expect(h.auths).toContain('Bearer old');
+      expect(h.auths).toContain('Bearer new');
+    } finally {
+      h.stop();
+      rmSync(root, { recursive: true, force: true });
+    }
+  });
+});
+
+describe('the worker refuses what it cannot do', () => {
+  test('missing arguments is exit 2 and a structured error, not a stack trace', async () => {
+    const { lines, code } = await run([]);
+    expect(code).toBe(2);
+    expect(lines[0].t).toBe('error');
+    expect(String(lines[0].message)).toContain('usage:');
+  });
+
+  test('an unreachable hub is a finished sweep with failures — never a hang', async () => {
+    const root = projectWith(1);
+    const tokenFile = join(root, 'tok');
+    writeFileSync(tokenFile, 'secret-a', { mode: 0o600 });
+    try {
+      // Port 1 is not listening; the sweep must still terminate and report.
+      const { lines, code } = await run([root, 'http://127.0.0.1:1', tokenFile]);
+      expect(code).toBe(0);
+      const result = lines.find((l) => l.t === 'result') as { failed: unknown[] } | undefined;
+      expect(result?.failed.length).toBe(1);
+    } finally {
+      rmSync(root, { recursive: true, force: true });
+    }
+  });
+});

package/apps/studio/test/sync-asset-push.test.ts

@@ -167,7 +167,8 @@ describe('pushAssets — 429 pacing, 5xx retry, honest failure reasons (RCA 2026
     const designRoot = oneAsset();
     const slept: number[] = [];
     let puts = 0;
-    const fetchImpl = (async (_i: RequestInfo | URL, init?: RequestInit) => {
+    const fetchImpl = (async (input: RequestInfo | URL, init?: RequestInit) => {
+      if (String(input).endsWith('/_asset-probe')) return new Response(null, { status: 404 });
       if (init?.method === 'HEAD') return new Response(null, { status: 404 });
       puts += 1;
       return puts === 1
@@ -203,7 +204,8 @@ describe('pushAssets — 429 pacing, 5xx retry, honest failure reasons (RCA 2026
       const designRoot = oneAsset();
       const slept: number[] = [];
       let puts = 0;
-      const fetchImpl = (async (_i: RequestInfo | URL, init?: RequestInit) => {
+      const fetchImpl = (async (input: RequestInfo | URL, init?: RequestInit) => {
+        if (String(input).endsWith('/_asset-probe')) return new Response(null, { status: 404 });
         if (init?.method === 'HEAD') return new Response(null, { status: 404 });
         puts += 1;
         return puts === 1
@@ -231,6 +233,7 @@ describe('pushAssets — 429 pacing, 5xx retry, honest failure reasons (RCA 2026
     writeFileSync(join(designRoot, 'assets/a-limited.png'), 'x');
     writeFileSync(join(designRoot, 'assets/b-fine.png'), 'x');
     const fetchImpl = (async (input: RequestInfo | URL, init?: RequestInit) => {
+      if (String(input).endsWith('/_asset-probe')) return new Response(null, { status: 404 });
       if (init?.method === 'HEAD') return new Response(null, { status: 404 });
       return String(input).includes('a-limited')
         ? new Response('{"error":"rate limit exceeded"}', {
@@ -257,7 +260,8 @@ describe('pushAssets — 429 pacing, 5xx retry, honest failure reasons (RCA 2026
     const designRoot = oneAsset();
     const slept: number[] = [];
     let puts = 0;
-    const fetchImpl = (async (_i: RequestInfo | URL, init?: RequestInit) => {
+    const fetchImpl = (async (input: RequestInfo | URL, init?: RequestInit) => {
+      if (String(input).endsWith('/_asset-probe')) return new Response(null, { status: 404 });
       if (init?.method === 'HEAD') return new Response(null, { status: 404 });
       puts += 1;
       return new Response(null, { status: puts === 1 ? 503 : 200 });
@@ -280,7 +284,8 @@ describe('pushAssets — 429 pacing, 5xx retry, honest failure reasons (RCA 2026
   test('a 4xx that is not 429 is final — one attempt, reported as-is', async () => {
     const designRoot = oneAsset();
     let puts = 0;
-    const fetchImpl = (async (_i: RequestInfo | URL, init?: RequestInit) => {
+    const fetchImpl = (async (input: RequestInfo | URL, init?: RequestInit) => {
+      if (String(input).endsWith('/_asset-probe')) return new Response(null, { status: 404 });
       if (init?.method === 'HEAD') return new Response(null, { status: 404 });
       puts += 1;
       return new Response(null, { status: 413 });
@@ -300,7 +305,8 @@ describe('pushAssets — 429 pacing, 5xx retry, honest failure reasons (RCA 2026
   test('the failure reason carries the body — a Cloudflare page is not our 429', async () => {
     const designRoot = oneAsset();
     const page = `<html>\n  <head><title>503 Service Unavailable</title></head>\n  <body>error 1016 — origin DNS error, and a great deal more text than we keep</body>\n</html>`;
-    const fetchImpl = (async (_i: RequestInfo | URL, init?: RequestInit) => {
+    const fetchImpl = (async (input: RequestInfo | URL, init?: RequestInit) => {
+      if (String(input).endsWith('/_asset-probe')) return new Response(null, { status: 404 });
       if (init?.method === 'HEAD') return new Response(null, { status: 404 });
       return new Response(page, { status: 503 });
     }) as typeof fetch;
@@ -323,7 +329,8 @@ describe('pushAssets — 429 pacing, 5xx retry, honest failure reasons (RCA 2026
     mkdirSync(join(designRoot, 'assets'), { recursive: true });
     writeFileSync(join(designRoot, 'assets/sized.png'), 'twelve bytes');
     const lengths: string[] = [];
-    const fetchImpl = (async (_i: RequestInfo | URL, init?: RequestInit) => {
+    const fetchImpl = (async (input: RequestInfo | URL, init?: RequestInit) => {
+      if (String(input).endsWith('/_asset-probe')) return new Response(null, { status: 404 });
       if (init?.method === 'HEAD') return new Response(null, { status: 404 });
       const sent = (init?.headers ?? {}) as Record<string, string>;
       lengths.push(String(sent['content-length']));
@@ -365,6 +372,145 @@ describe('pushAssets — 429 pacing, 5xx retry, honest failure reasons (RCA 2026
   });
 });
 
+describe('pushAssets — one batch probe replaces N per-file probes (RCA 2026-08-11 part 2)', () => {
+  function twoAssets(): string {
+    const designRoot = scratchDesignRoot();
+    mkdirSync(join(designRoot, 'assets'), { recursive: true });
+    writeFileSync(join(designRoot, 'assets/there.png'), 'x');
+    mkdirSync(join(designRoot, 'system/ds/assets/logos'), { recursive: true });
+    writeFileSync(join(designRoot, 'system/ds/assets/logos/missing.svg'), '<svg/>');
+    return designRoot;
+  }
+
+  test('the probe answers once; present files are skipped without any HEAD', async () => {
+    const designRoot = twoAssets();
+    const calls: string[] = [];
+    let probedPaths: string[] = [];
+    const fetchImpl = (async (input: RequestInfo | URL, init?: RequestInit) => {
+      const method = init?.method ?? 'GET';
+      calls.push(`${method} ${new URL(String(input)).pathname}`);
+      if (String(input).endsWith('/_asset-probe')) {
+        probedPaths = JSON.parse(String(init?.body)).paths;
+        return new Response(JSON.stringify({ present: ['assets/there.png'] }), { status: 200 });
+      }
+      return new Response(null, { status: 200 });
+    }) as typeof fetch;
+
+    const r = await pushAssets({
+      designRoot,
+      hubUrl: 'https://x.example',
+      token: () => 't',
+      fetchImpl,
+      log: { log: () => {}, warn: () => {} },
+      sleep: async () => {},
+    });
+    expect(r.skipped).toBe(1);
+    expect(r.pushed).toEqual(['system/ds/assets/logos/missing.svg']);
+    expect(probedPaths.sort()).toEqual(['assets/there.png', 'system/ds/assets/logos/missing.svg']);
+    // One probe, one upload — and NOT a single HEAD.
+    expect(calls).toEqual([
+      'POST /_asset-probe',
+      'PUT /_asset-file/system/ds/assets/logos/missing.svg',
+    ]);
+  });
+
+  test('a hub that does not know the probe falls back to per-file HEAD', async () => {
+    // Old-hub interop: 404 means "ask the old way", never "it holds nothing" —
+    // reading it as an empty set would re-upload everything against every hub
+    // older than this change.
+    const designRoot = twoAssets();
+    const methods: string[] = [];
+    const fetchImpl = (async (input: RequestInfo | URL, init?: RequestInit) => {
+      const method = init?.method ?? 'GET';
+      methods.push(method);
+      if (String(input).endsWith('/_asset-probe')) return new Response(null, { status: 404 });
+      if (method === 'HEAD') {
+        return new Response(null, { status: String(input).includes('there.png') ? 200 : 404 });
+      }
+      return new Response(null, { status: 200 });
+    }) as typeof fetch;
+    const r = await pushAssets({
+      designRoot,
+      hubUrl: 'https://x.example',
+      token: () => 't',
+      fetchImpl,
+      log: { log: () => {}, warn: () => {} },
+      sleep: async () => {},
+    });
+    expect(methods.filter((m) => m === 'HEAD')).toHaveLength(2);
+    expect(r.skipped).toBe(1);
+    expect(r.pushed).toEqual(['system/ds/assets/logos/missing.svg']);
+  });
+
+  test('a 405 on the per-file probe means "cannot answer", never "absent"', async () => {
+    // The bug in one line: a cell turns our HEAD into a GET and answers 405.
+    // Treating that as a refusal would strand the file; treating it as "absent"
+    // is right — upload it — but it must not be reported as a failure.
+    const designRoot = twoAssets();
+    const fetchImpl = (async (input: RequestInfo | URL, init?: RequestInit) => {
+      if (String(input).endsWith('/_asset-probe')) return new Response(null, { status: 404 });
+      if (init?.method === 'HEAD') return new Response(null, { status: 405 });
+      return new Response(null, { status: 200 });
+    }) as typeof fetch;
+    const r = await pushAssets({
+      designRoot,
+      hubUrl: 'https://x.example',
+      token: () => 't',
+      fetchImpl,
+      log: { log: () => {}, warn: () => {} },
+      sleep: async () => {},
+    });
+    expect(r.failed).toEqual([]);
+    expect(r.pushed.sort()).toEqual(['assets/there.png', 'system/ds/assets/logos/missing.svg']);
+  });
+
+  test('a hostile probe answer cannot make the sweep skip a file it never named', async () => {
+    const designRoot = twoAssets();
+    const fetchImpl = (async (input: RequestInfo | URL) => {
+      if (String(input).endsWith('/_asset-probe')) {
+        return new Response(
+          JSON.stringify({ present: ['../../etc/passwd', 42, 'assets/never-asked.png'] }),
+          { status: 200 }
+        );
+      }
+      return new Response(null, { status: 200 });
+    }) as typeof fetch;
+    const r = await pushAssets({
+      designRoot,
+      hubUrl: 'https://x.example',
+      token: () => 't',
+      fetchImpl,
+      log: { log: () => {}, warn: () => {} },
+      sleep: async () => {},
+    });
+    expect(r.skipped).toBe(0);
+    expect(r.pushed.sort()).toEqual(['assets/there.png', 'system/ds/assets/logos/missing.svg']);
+  });
+
+  test('a probe that hangs or errors degrades to the per-file path', async () => {
+    const designRoot = twoAssets();
+    let heads = 0;
+    const fetchImpl = (async (input: RequestInfo | URL, init?: RequestInit) => {
+      if (String(input).endsWith('/_asset-probe')) throw new Error('connection reset');
+      if (init?.method === 'HEAD') {
+        heads += 1;
+        return new Response(null, { status: 404 });
+      }
+      return new Response(null, { status: 200 });
+    }) as typeof fetch;
+    const r = await pushAssets({
+      designRoot,
+      hubUrl: 'https://x.example',
+      token: () => 't',
+      fetchImpl,
+      log: { log: () => {}, warn: () => {} },
+      sleep: async () => {},
+    });
+    expect(heads).toBe(2);
+    expect(r.pushed).toHaveLength(2);
+  });
+});
+
 describe('pushAssets — a refused upload must not wedge the sweep (2026-08-11, second pass)', () => {
   test('every PUT closes its connection — the keep-alive desync that killed the sidecar', async () => {
     // A peer that refuses a PUT before reading the body leaves unread bytes in
@@ -375,7 +521,8 @@ describe('pushAssets — a refused upload must not wedge the sweep (2026-08-11,
     mkdirSync(join(designRoot, 'assets'), { recursive: true });
     writeFileSync(join(designRoot, 'assets/one.png'), 'x');
     const seen: Array<Record<string, string>> = [];
-    const fetchImpl = (async (_i: RequestInfo | URL, init?: RequestInit) => {
+    const fetchImpl = (async (input: RequestInfo | URL, init?: RequestInit) => {
+      if (String(input).endsWith('/_asset-probe')) return new Response(null, { status: 404 });
       if (init?.method === 'HEAD') return new Response(null, { status: 404 });
       seen.push((init?.headers ?? {}) as Record<string, string>);
       return new Response(null, { status: 503 }); // refused → the retry re-sends
@@ -398,6 +545,7 @@ describe('pushAssets — a refused upload must not wedge the sweep (2026-08-11,
     writeFileSync(join(designRoot, 'assets/a-hangs.png'), 'x');
     writeFileSync(join(designRoot, 'assets/b-fine.png'), 'x');
     const fetchImpl = (async (input: RequestInfo | URL, init?: RequestInit) => {
+      if (String(input).endsWith('/_asset-probe')) return new Response(null, { status: 404 });
       if (init?.method === 'HEAD') return new Response(null, { status: 404 });
       if (!String(input).includes('a-hangs')) return new Response(null, { status: 200 });
       // Wedged: answers only when the caller's own budget aborts it.
@@ -439,7 +587,8 @@ describe('pushAssets — a refused upload must not wedge the sweep (2026-08-11,
       log: { log: () => {}, warn: () => {} },
       sleep: async () => {},
     });
-    expect(methods).toEqual(['HEAD']); // no PUT at all
+    expect(methods.filter((m) => m === 'PUT')).toEqual([]); // no body streamed at it
+    expect(methods).toContain('HEAD');
     expect(r.failed).toEqual([
       {
         key: 'system/ds/assets/logos/mark.svg',