@1agh/maude 0.60.6 → 1.0.2

package/apps/studio/client/panels/SyncPanel.jsx

@@ -98,6 +98,123 @@ function readFiles(raw) {
   return raw;
 }
 
+/** Consent-class notices (feature-before-first-external-users Task 1), or []
+ *  when the shape can't be trusted. Absent is the norm — the payload carries
+ *  `notices` only when a boot raised one (shared-doc ON, TSX bodies). */
+function readNotices(raw) {
+  if (!Array.isArray(raw)) return [];
+  return raw.filter((n) => n && typeof n.id === 'string' && typeof n.text === 'string');
+}
+
+/** DeliveryState → plain words for the doručenka rows (file-ledger.ts owns the
+ *  union; unknown states render verbatim so a NEWER producer stays readable). */
+const DELIVERY_WORD = {
+  conflict: 'conflict — older copy in Trash below',
+  stuck: 'stuck',
+  'referenced-but-unoffered': 'referenced, never received',
+  'local-only': 'only on this machine',
+  pushing: 'uploading…',
+  'on-hub': 'on the workspace',
+  durable: 'backed up',
+  'at-peer': 'reached a teammate',
+  'ui-healed': 'healed',
+  everywhere: 'everywhere',
+};
+
+/** States where a person has to look — always-visible rows; the rest folds. */
+const DELIVERY_ATTENTION = new Set(['conflict', 'stuck', 'referenced-but-unoffered', 'local-only']);
+
+/** The per-file doručenka map split into attention/fine [rel, state] lists,
+ *  fail-closed like every other reader here. */
+function readDelivery(raw) {
+  const attention = [];
+  const fine = [];
+  if (raw && typeof raw === 'object' && !Array.isArray(raw)) {
+    for (const [rel, state] of Object.entries(raw)) {
+      if (typeof rel !== 'string' || typeof state !== 'string') continue;
+      (DELIVERY_ATTENTION.has(state) ? attention : fine).push([rel, state]);
+    }
+    attention.sort((a, b) => a[0].localeCompare(b[0]));
+    fine.sort((a, b) => a[0].localeCompare(b[0]));
+  }
+  return { attention, fine };
+}
+
+/** TrashEntry.reason → plain words. */
+const TRASH_REASON_WORD = {
+  conflict: 'conflict loser',
+  removed: 'removed by sync',
+  moved: 'moved elsewhere',
+  deleted: 'deleted',
+  migration: 'migration backup',
+  unknown: 'parked',
+};
+
+function fmtBytes(n) {
+  if (!Number.isFinite(n) || n < 0) return '0 B';
+  if (n < 1024) return `${n} B`;
+  if (n < 1024 * 1024) return `${(n / 1024).toFixed(0)} kB`;
+  return `${(n / (1024 * 1024)).toFixed(1)} MB`;
+}
+
+function fmtAge(at) {
+  if (!Number.isFinite(at) || at <= 0) return 'unknown age';
+  const days = Math.floor((Date.now() - at) / (24 * 60 * 60 * 1000));
+  if (days <= 0) return 'today';
+  if (days === 1) return 'yesterday';
+  if (days < 30) return `${days} d ago`;
+  const months = Math.floor(days / 30);
+  return `${months} mo ago`;
+}
+
+/** Display host of a hub url ('workspace' when unparseable). */
+function hostOf(url) {
+  try {
+    return new URL(url).host;
+  } catch {
+    return 'workspace';
+  }
+}
+
+/** safeDetail's sanitation with a paragraph-sized cap — a consent notice is a
+ *  full explanation by design and `MAX_DETAIL_LEN`'s 160 chars would cut it
+ *  mid-sentence. Still bounded: the payload is read back off `_sync.json`. */
+function safeNoticeText(raw) {
+  const s = String(raw ?? '')
+    .replace(/[\p{Cc}\p{Cf}]/gu, '')
+    .replace(/\s+/g, ' ')
+    .trim();
+  return s.length > 600 ? `${s.slice(0, 600)}…` : s;
+}
+
+/**
+ * Machine-local dismiss ack, keyed per (hub url) → list of dismissed notice
+ * ids — the `mdcc-whatsnew-seen` convention. Per-hub on purpose: dismissing
+ * "shared-doc is ON for hub A" must not silence the same notice when the
+ * project is re-linked to hub B; what leaves this machine changed again.
+ */
+const NOTICE_ACK_KEY = 'maude-sync-notice-ack';
+function readNoticeAcks(url) {
+  try {
+    const all = JSON.parse(localStorage.getItem(NOTICE_ACK_KEY) || '{}');
+    const ids = all[url];
+    return Array.isArray(ids) ? ids.filter((i) => typeof i === 'string') : [];
+  } catch {
+    return [];
+  }
+}
+function writeNoticeAck(url, id) {
+  try {
+    const all = JSON.parse(localStorage.getItem(NOTICE_ACK_KEY) || '{}');
+    const ids = Array.isArray(all[url]) ? all[url] : [];
+    if (!ids.includes(id)) ids.push(id);
+    all[url] = ids;
+    localStorage.setItem(NOTICE_ACK_KEY, JSON.stringify(all));
+  } catch {
+    /* private mode etc. — the notice simply reappears next boot */
+  }
+}
+
 export default function SyncPanel({
   status, // the live `sync:status` payload (never null while mounted)
   project, // display name for the header sentence (hub-supplied → safeName'd)
@@ -161,6 +278,171 @@ export default function SyncPanel({
   const assetFailures = assets?.failures || [];
   const files = readFiles(status?.files);
 
+  const delivery = useMemo(() => readDelivery(status?.files?.delivery), [status?.files?.delivery]);
+
+  // Sync settings (Task 2) — fetched once on mount; `settings` stays null when
+  // no hub is linked, which is also the render gate for the whole section.
+  const [settings, setSettings] = useState(null);
+  const [settingsBusy, setSettingsBusy] = useState(false);
+  const [settingsNote, setSettingsNote] = useState('');
+  useEffect(() => {
+    let gone = false;
+    fetch('/_api/sync/settings')
+      .then((r) => (r.ok ? r.json() : null))
+      .then((j) => {
+        if (!gone && j && typeof j === 'object') setSettings(j.settings ?? null);
+      })
+      .catch(() => {
+        /* no server / old server — the section simply doesn't render */
+      });
+    return () => {
+      gone = true;
+    };
+  }, []);
+  const changeSetting = useCallback(async (patch) => {
+    setSettingsBusy(true);
+    setSettingsNote('');
+    let json = null;
+    try {
+      const res = await fetch('/_api/sync/settings', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(patch),
+      });
+      json = await res.json().catch(() => null);
+    } catch {
+      /* said below */
+    }
+    setSettingsBusy(false);
+    if (!json || json.ok !== true) {
+      setSettingsNote(safeDetail(json?.detail, 'The setting could not be saved.'));
+      return;
+    }
+    setSettings(json.settings);
+    // Saved is a fact; whether it took effect NOW depends on the supervisor —
+    // say which of the two happened rather than letting "saved" imply "live".
+    setSettingsNote(json.applied ? 'Saved — sync is restarting with the new setting.' : 'Saved — applies the next time sync restarts.');
+  }, []);
+
+  // Ownership (Task 2) — repo-owned vs hub-owned, previously CLI-only against
+  // DDR-177's own posture. Mutations go through an explicit two-step confirm:
+  // the confirm row IS the asking B11 found missing in non-TTY settleOwnership.
+  const [ownership, setOwnership] = useState(null);
+  const [ownershipConfirm, setOwnershipConfirm] = useState(null); // 'adopt' | 'detach' | null
+  const [ownershipBusy, setOwnershipBusy] = useState(false);
+  const [ownershipNote, setOwnershipNote] = useState('');
+  useEffect(() => {
+    let gone = false;
+    fetch('/_api/sync/ownership')
+      .then((r) => (r.ok ? r.json() : null))
+      .then((j) => {
+        if (!gone && j && typeof j.mode === 'string') setOwnership(j);
+      })
+      .catch(() => {
+        /* old server — the section doesn't render */
+      });
+    return () => {
+      gone = true;
+    };
+  }, []);
+  const changeOwnership = useCallback(async (action) => {
+    setOwnershipBusy(true);
+    setOwnershipNote('');
+    let json = null;
+    try {
+      const res = await fetch('/_api/sync/ownership', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ action }),
+      });
+      json = await res.json().catch(() => null);
+    } catch {
+      /* said below */
+    }
+    setOwnershipBusy(false);
+    setOwnershipConfirm(null);
+    if (!json || json.ok !== true) {
+      setOwnershipNote(safeDetail(json?.detail, 'The ownership change did not complete.'));
+      return;
+    }
+    setOwnershipNote(
+      action === 'adopt'
+        ? `Done — .design/ is workspace-owned now. ${json.untracked ?? 0} file(s) untracked (still on disk, staged as deletions — commit when ready).`
+        : 'Done — unlinked and repo-owned again. Commit .design/ when you are ready.'
+    );
+    // Re-read rather than guess — the server is the source for mode.
+    try {
+      const r = await fetch('/_api/sync/ownership');
+      const j = r.ok ? await r.json() : null;
+      if (j && typeof j.mode === 'string') setOwnership(j);
+    } catch {
+      /* keep the stale mode; the note already said what happened */
+    }
+  }, []);
+
+  // Trash (Task 3, F-6) — quarantine-not-delete is only safe if a person can
+  // FIND the quarantine. Until this section, the product's copy pointed at a
+  // hidden gitignored folder.
+  const [trash, setTrash] = useState(null); // { entries, total, bytes } | null
+  const [trashBusy, setTrashBusy] = useState(false);
+  const [trashNote, setTrashNote] = useState('');
+  const [pruneConfirm, setPruneConfirm] = useState(false);
+  const refreshTrash = useCallback(async () => {
+    try {
+      const r = await fetch('/_api/sync/trash');
+      const j = r.ok ? await r.json() : null;
+      if (j && Array.isArray(j.entries)) setTrash(j);
+    } catch {
+      /* old server — the section doesn't render */
+    }
+  }, []);
+  useEffect(() => {
+    refreshTrash();
+  }, [refreshTrash]);
+  const trashAction = useCallback(
+    async (body, doneNote) => {
+      setTrashBusy(true);
+      setTrashNote('');
+      let json = null;
+      try {
+        const res = await fetch('/_api/sync/trash', {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify(body),
+        });
+        json = await res.json().catch(() => null);
+      } catch {
+        /* said below */
+      }
+      setTrashBusy(false);
+      setPruneConfirm(false);
+      if (!json || json.ok !== true) {
+        setTrashNote(safeDetail(json?.detail, 'That did not complete.'));
+      } else {
+        setTrashNote(doneNote(json));
+      }
+      refreshTrash();
+    },
+    [refreshTrash]
+  );
+
+  // Consent notices minus this machine's dismissals. `ackTick` only forces the
+  // re-read after a dismiss — the acks themselves live in localStorage.
+  const hubUrl = typeof status?.url === 'string' ? status.url : '';
+  const [ackTick, setAckTick] = useState(0);
+  const notices = useMemo(() => {
+    const acked = readNoticeAcks(hubUrl);
+    return readNotices(status?.notices).filter((n) => !acked.includes(n.id));
+    // eslint-disable-next-line react-hooks/exhaustive-deps -- ackTick invalidates the localStorage read
+  }, [status?.notices, hubUrl, ackTick]);
+  const dismissNotice = useCallback(
+    (id) => {
+      writeNoticeAck(hubUrl, id);
+      setAckTick((t) => t + 1);
+    },
+    [hubUrl]
+  );
+
   const { attention, byGroup } = useMemo(() => {
     const attention = items.filter((i) => i.state === 'auth-rejected');
     const rest = items.filter((i) => i.state !== 'auth-rejected');
@@ -249,6 +531,29 @@ export default function SyncPanel({
       </div>
 
       <div className="sp-body">
+        {/* Consent-class notices come FIRST: they say what leaves this machine
+            (shared-doc buffer, TSX bodies) and used to live only in a
+            console.warn a desktop user never sees. Dismiss is per (notice,
+            hub) on this machine — a new hub resurfaces them by design. */}
+        {notices.length > 0 && (
+          <section aria-label="Notices" data-testid="sync-notices">
+            {notices.map((n) => (
+              <div key={n.id} className="sp-notice" data-testid={`sync-notice-${n.id}`}>
+                <p className="sp-notice-text">{safeNoticeText(n.text)}</p>
+                <button
+                  type="button"
+                  className="sp-notice-dismiss"
+                  data-testid={`sync-notice-dismiss-${n.id}`}
+                  onClick={() => dismissNotice(n.id)}
+                  title="Got it — don't show this again for this hub on this machine"
+                >
+                  Got it
+                </button>
+              </div>
+            ))}
+          </section>
+        )}
+
         {items.length === 0 && !assets && (
           <div className="gp-empty">
             <p>No per-file detail yet — it arrives with the first sync report after this panel shipped. If this persists, restart Maude.</p>
@@ -351,7 +656,296 @@ export default function SyncPanel({
             {files.conflicts > 0 && (
               <div className="sp-assets-retry" data-testid="sync-files-conflicts">
                 {files.conflicts} conflict{files.conflicts === 1 ? '' : 's'} — the older copies are
-                kept in _trash/.
+                kept in Trash, below.
+              </div>
+            )}
+            {/*
+              A HELD BREAKER, said out loud. These used to exist only as a
+              console.warn, which on a machine whose user never opens a
+              terminal is the same as not existing — while the release leaned
+              on them as its reason for shipping deletion without a soak.
+            */}
+            {Array.isArray(files.held) &&
+              files.held.map((h) => (
+                <div key={h.kind} className="sp-assets-retry" data-testid={`sync-held-${h.kind}`}>
+                  <strong>sync paused — nothing was removed.</strong> {h.detail}
+                  {h.paths?.length > 0 && (
+                    <details className="sp-held-paths">
+                      <summary>
+                        {h.count} file{h.count === 1 ? '' : 's'}
+                      </summary>
+                      <ul>
+                        {h.paths.slice(0, 50).map((rel) => (
+                          <li key={rel}>{rel}</li>
+                        ))}
+                        {h.paths.length > 50 && <li>…and {h.paths.length - 50} more</li>}
+                      </ul>
+                    </details>
+                  )}
+                </div>
+              ))}
+            {/* THE DORUČENKA, per file (DDR-226 §7). The counts above say how
+                many are fine; they cannot point at the one that is not — which
+                is the question three days of dogfood kept asking. Rows needing
+                a person come first and are always visible; the delivered rest
+                stays behind a fold so a healthy project reads as one line. */}
+            {delivery.attention.length > 0 && (
+              <ul className="sp-list" data-testid="sync-delivery-attention">
+                {delivery.attention.slice(0, 50).map(([rel, state]) => (
+                  <li className="sp-row is-auth-rejected" key={rel}>
+                    <span className="sp-row-dot" aria-hidden="true" />
+                    <span className="sp-row-name" title={safeName(rel, '(unnamed)')}>
+                      {safeName(rel, '(unnamed)')}
+                    </span>
+                    <span className="sp-row-state">{DELIVERY_WORD[state] || state}</span>
+                  </li>
+                ))}
+                {delivery.attention.length > 50 && (
+                  <li className="sp-truncated">…and {delivery.attention.length - 50} more</li>
+                )}
+              </ul>
+            )}
+            {delivery.fine.length > 0 && (
+              <details className="sp-held-paths" data-testid="sync-delivery-fine">
+                <summary>
+                  {delivery.fine.length} file{delivery.fine.length === 1 ? '' : 's'} delivered
+                </summary>
+                <ul>
+                  {delivery.fine.slice(0, 200).map(([rel, state]) => (
+                    <li key={rel}>
+                      {safeName(rel, '(unnamed)')} — {DELIVERY_WORD[state] || state}
+                    </li>
+                  ))}
+                  {delivery.fine.length > 200 && <li>…and {delivery.fine.length - 200} more</li>}
+                </ul>
+              </details>
+            )}
+          </section>
+        )}
+
+        {/* Trash (Task 3, F-6) — everything sync parked instead of deleting,
+            with a way back. Rendered only when something is actually parked. */}
+        {trash && trash.total > 0 && (
+          <section aria-label="Trash" data-testid="sync-trash">
+            <div className="gp-sect-label">
+              trash <span className="gp-group-count">{trash.total}</span>
+            </div>
+            <div className="sp-assets-line">
+              {trash.total} file{trash.total === 1 ? '' : 's'} kept instead of deleted (
+              {fmtBytes(trash.bytes)}) — replaced copies, conflict losers and remote deletions
+              land here, in .design/_trash/.
+            </div>
+            <ul className="sp-list" data-testid="sync-trash-list">
+              {trash.entries.slice(0, 50).map((e) => (
+                <li className="sp-row" key={e.trashRel}>
+                  <span className="sp-row-name" title={safeName(e.trashRel, '(unnamed)')}>
+                    {safeName(e.sourceRel ?? e.trashRel.replace(/^_trash\//, ''), '(unnamed)')}
+                  </span>
+                  <span className="sp-row-state">
+                    {TRASH_REASON_WORD[e.reason] || e.reason} · {fmtAge(e.at)}
+                  </span>
+                  {e.sourceRel && (
+                    <button
+                      type="button"
+                      className="sp-assets-cancel"
+                      data-testid={`sync-trash-restore-${e.sourceRel}`}
+                      disabled={trashBusy}
+                      onClick={() =>
+                        trashAction({ action: 'restore', trashRel: e.trashRel }, (j) =>
+                          j.restoredTo ? `Restored to ${j.restoredTo}.` : 'Restored.'
+                        )
+                      }
+                    >
+                      Restore
+                    </button>
+                  )}
+                </li>
+              ))}
+              {trash.total > 50 && (
+                <li className="sp-truncated">…and {trash.total - 50} more in .design/_trash/</li>
+              )}
+            </ul>
+            {!pruneConfirm ? (
+              <div className="sp-assets-line">
+                <button
+                  type="button"
+                  className="sp-assets-cancel"
+                  data-testid="sync-trash-prune"
+                  disabled={trashBusy}
+                  onClick={() => setPruneConfirm(true)}
+                >
+                  Remove copies older than 30 days…
+                </button>
+              </div>
+            ) : (
+              <div className="sp-assets-retry" data-testid="sync-trash-prune-confirm">
+                Permanently delete every parked copy older than 30 days? This cannot be undone.{' '}
+                <button
+                  type="button"
+                  className="sp-assets-cancel"
+                  data-testid="sync-trash-prune-yes"
+                  disabled={trashBusy}
+                  onClick={() =>
+                    trashAction(
+                      { action: 'prune', olderThanDays: 30 },
+                      (j) => `Removed ${j.pruned} file${j.pruned === 1 ? '' : 's'} (${fmtBytes(j.bytes)}); ${j.kept} kept.`
+                    )
+                  }
+                >
+                  {trashBusy ? 'Removing…' : 'Delete them'}
+                </button>{' '}
+                <button
+                  type="button"
+                  className="sp-assets-cancel"
+                  disabled={trashBusy}
+                  onClick={() => setPruneConfirm(false)}
+                >
+                  Cancel
+                </button>
+              </div>
+            )}
+            {trashNote && (
+              <div className="sp-resync-note" role="status" aria-live="polite">
+                {trashNote}
+              </div>
+            )}
+          </section>
+        )}
+
+        {/* Settings (feature-before-first-external-users Task 2) — the three
+            toggles every breaker remediation used to hand the user as "edit
+            linkedHub.* JSON". Rendered only when a hub is linked (the route
+            answers settings: null otherwise — dead controls teach nothing). */}
+        {settings && (
+          <section aria-label="Sync settings" data-testid="sync-settings">
+            <div className="gp-sect-label">settings</div>
+            <label className="sp-setting" data-testid="sync-setting-syncFiles">
+              <input
+                type="checkbox"
+                checked={settings.syncFiles}
+                disabled={settingsBusy}
+                onChange={(e) => changeSetting({ syncFiles: e.target.checked })}
+              />
+              <span>
+                Sync project files
+                <small>The whole design folder mirrors both ways, not just canvases.</small>
+              </span>
+            </label>
+            <label className="sp-setting" data-testid="sync-setting-propagateDeletes">
+              <input
+                type="checkbox"
+                checked={settings.propagateDeletes}
+                disabled={settingsBusy}
+                onChange={(e) => changeSetting({ propagateDeletes: e.target.checked })}
+              />
+              <span>
+                Propagate deletions
+                <small>
+                  Removing a file here removes it everywhere; replaced copies are kept in Trash.
+                </small>
+              </span>
+            </label>
+            <label className="sp-setting sp-setting-select" data-testid="sync-setting-firstAnchor">
+              <span>
+                First-link conflicts
+                <small>When both sides have content the first time a project links.</small>
+              </span>
+              <select
+                value={settings.resolveFirstAnchor}
+                disabled={settingsBusy}
+                onChange={(e) => changeSetting({ resolveFirstAnchor: e.target.value })}
+              >
+                <option value="ask">Keep asking</option>
+                <option value="keep-local">Keep this machine's</option>
+                <option value="keep-cloud">Keep the workspace's</option>
+              </select>
+            </label>
+            {settingsNote && (
+              <div className="sp-resync-note" role="status" aria-live="polite">
+                {settingsNote}
+              </div>
+            )}
+          </section>
+        )}
+
+        {/* Ownership (Task 2) — who owns .design/: this repo's git, or the
+            linked workspace. CLI parity for `maude design adopt` / `detach`,
+            behind an explicit confirm. Hidden on a cell (a member's browser
+            must not re-own the operator's checkout) and without git. */}
+        {ownership && !cloud && ownership.git && (
+          <section aria-label="Ownership" data-testid="sync-ownership">
+            <div className="gp-sect-label">ownership</div>
+            <div className="sp-assets-line" data-testid="sync-ownership-mode">
+              {ownership.mode === 'hub-owned' &&
+                'Workspace-owned — .design/ is gitignored and mirrored by the workspace.'}
+              {ownership.mode === 'repo-owned' &&
+                'Repo-owned — .design/ is committed with this repository.'}
+              {ownership.mode === 'hybrid' &&
+                `Two owners — git commits .design/ (${ownership.trackedCount} file${ownership.trackedCount === 1 ? '' : 's'}) AND a workspace mirrors it. A git pull and a sync pass can each undo the other.`}
+            </div>
+            {ownershipConfirm === null && ownership.linked && ownership.mode !== 'hub-owned' && (
+              <div className="sp-assets-line">
+                <button
+                  type="button"
+                  className="sp-assets-cancel"
+                  data-testid="sync-ownership-adopt"
+                  disabled={ownershipBusy}
+                  onClick={() => setOwnershipConfirm('adopt')}
+                >
+                  Hand .design/ to the workspace…
+                </button>
+              </div>
+            )}
+            {ownershipConfirm === null && ownership.mode === 'hub-owned' && (
+              <div className="sp-assets-line">
+                <button
+                  type="button"
+                  className="sp-assets-cancel"
+                  data-testid="sync-ownership-detach"
+                  disabled={ownershipBusy}
+                  onClick={() => setOwnershipConfirm('detach')}
+                >
+                  Take .design/ back into this repo…
+                </button>
+              </div>
+            )}
+            {ownershipConfirm && (
+              <div className="sp-assets-retry" data-testid="sync-ownership-confirm">
+                {ownershipConfirm === 'adopt' ? (
+                  <>
+                    Stop committing .design/ and let the workspace mirror it. Nothing is deleted —
+                    every file stays on disk; git stops tracking them (staged as deletions, commit
+                    when ready).
+                  </>
+                ) : (
+                  <>
+                    Disconnect from the workspace ({hostOf(ownership.hubUrl)}) and take .design/
+                    back into git. Every file is already on disk in full; commit the folder when
+                    you are ready.
+                  </>
+                )}{' '}
+                <button
+                  type="button"
+                  className="sp-assets-cancel"
+                  data-testid="sync-ownership-confirm-yes"
+                  disabled={ownershipBusy}
+                  onClick={() => changeOwnership(ownershipConfirm)}
+                >
+                  {ownershipBusy ? 'Working…' : 'Do it'}
+                </button>{' '}
+                <button
+                  type="button"
+                  className="sp-assets-cancel"
+                  disabled={ownershipBusy}
+                  onClick={() => setOwnershipConfirm(null)}
+                >
+                  Cancel
+                </button>
+              </div>
+            )}
+            {ownershipNote && (
+              <div className="sp-resync-note" role="status" aria-live="polite">
+                {ownershipNote}
               </div>
             )}
           </section>

package/apps/studio/client/styles/3-shell-maude.css

@@ -614,6 +614,10 @@
 .st-fmt { display: flex; flex-direction: column; gap: var(--space-2); align-items: flex-start; padding: var(--space-3) var(--space-4); border: 1px solid var(--border-default); border-radius: var(--radius-md); background: var(--bg-2); cursor: pointer; color: var(--fg-1); appearance: none; text-align: left; }
 .st-fmt:hover { border-color: var(--border-strong); }
 .st-fmt.is-on { border-color: var(--accent); background: var(--accent-tint); color: var(--fg-0); box-shadow: 0 0 0 2px var(--accent-tint); }
+.st-fmt:disabled { opacity: 0.45; cursor: not-allowed; }
+.st-fmt:disabled:hover { border-color: var(--border-default); }
+/* feature-cloud-export-render-workers — the "why is this disabled" line under the format grid. */
+.st-dialog-note { margin-top: var(--space-3); font-size: var(--type-xs); line-height: 1.5; color: var(--fg-2); background: var(--bg-2); border: 1px solid var(--border-default); border-radius: var(--radius-md); padding: var(--space-2) var(--space-3); }
 .st-fmt-name { font-family: var(--font-mono); font-size: var(--type-sm); font-weight: 600; }
 .st-fmt-sub { font-size: var(--type-xs); color: var(--fg-2); }
 .st-dialog-row { display: flex; align-items: center; gap: var(--space-3); }
@@ -2692,6 +2696,12 @@ body.st-scrubbing, body.st-scrubbing * { cursor: ew-resize !important; user-sele
 .sp-assets-line { padding: var(--space-1) var(--space-4); font-size: var(--type-sm); color: var(--fg-1); }
 .sp-assets-active { padding: 0 var(--space-4); font-family: var(--font-mono); font-size: var(--type-xs); color: var(--fg-2); overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
 .sp-assets-retry { padding: var(--space-1) var(--space-4); font-size: var(--type-xs); color: var(--fg-2); }
+/* A held breaker is not an error and not routine — it is waiting for a person. */
+.sp-assets-retry strong { color: var(--fg-0); }
+.sp-held-paths { margin-top: var(--space-1); }
+.sp-held-paths summary { cursor: pointer; color: var(--fg-1); }
+.sp-held-paths ul { margin: var(--space-1) 0 0; padding-left: var(--space-4); max-height: 12rem; overflow-y: auto; }
+.sp-held-paths li { font-family: var(--font-mono, monospace); word-break: break-all; }
 /* feature-sync-resync-and-out-of-process-sweep — Resync (header) re-runs the
  * whole sync; Cancel (assets line) stops only the upload sweep. */
 .sp-resync { appearance: none; flex: none; font-family: var(--font-body); font-size: var(--type-xs); color: var(--fg-1); background: var(--bg-2); border: 1px solid var(--border-default); border-radius: var(--radius-sm); padding: 2px var(--space-2); cursor: pointer; transition: color var(--dur-soft) var(--ease-out), border-color var(--dur-soft) var(--ease-out); }
@@ -2699,6 +2709,34 @@ body.st-scrubbing, body.st-scrubbing * { cursor: ew-resize !important; user-sele
 .sp-resync:focus-visible { outline: 2px solid var(--accent); outline-offset: 1px; }
 .sp-resync:disabled { color: var(--fg-3); cursor: default; }
 .sp-resync-note { padding: 0 var(--space-4) var(--space-2); font-size: var(--type-xs); color: var(--fg-2); line-height: var(--lh-base); }
+/* Consent-class notices (feature-before-first-external-users Task 1) — a warm
+   card at the top of the panel body: says what leaves this machine, dismissed
+   per (notice, hub) on this machine. */
+.sp-notice { margin: var(--space-2) var(--space-4); padding: var(--space-2) var(--space-3); border: 1px solid var(--status-warn); border-radius: var(--radius-md); background: color-mix(in oklab, var(--status-warn) 8%, transparent); }
+.sp-notice-text { margin: 0 0 var(--space-1); font-size: var(--type-xs); color: var(--fg-1); line-height: var(--lh-base); }
+.sp-notice-dismiss { appearance: none; font-family: var(--font-body); font-size: var(--type-xs); color: var(--fg-2); background: transparent; border: 0; padding: 0; cursor: pointer; text-decoration: underline; }
+.sp-notice-dismiss:hover { color: var(--fg-0); }
+.sp-notice-dismiss:focus-visible { outline: 2px solid var(--accent); outline-offset: 1px; }
+
+/* First-upgrade sync consent (feature-before-first-external-users Task 2) —
+   rides the shared .st-scrim/.st-dialog shell. */
+.st-consent .st-dialog-bd { font-size: var(--type-sm); color: var(--fg-1); line-height: var(--lh-base); }
+.st-consent .st-dialog-bd p { margin: 0 0 var(--space-2); }
+.st-consent-list { margin: 0 0 var(--space-2); padding-left: var(--space-4); display: flex; flex-direction: column; gap: var(--space-1); }
+.st-consent-fine { font-size: var(--type-xs); color: var(--fg-2); }
+.st-consent-note { font-size: var(--type-xs); color: var(--status-error); }
+.st-consent .st-dialog-ft { display: flex; justify-content: flex-end; gap: var(--space-2); }
+
+/* Sync settings (feature-before-first-external-users Task 2) — the three
+   toggles that used to mean "edit linkedHub.* JSON by hand". */
+.sp-setting { display: flex; align-items: flex-start; gap: var(--space-2); padding: var(--space-1) var(--space-4); font-size: var(--type-sm); color: var(--fg-1); cursor: pointer; }
+.sp-setting input[type='checkbox'] { margin-top: 2px; accent-color: var(--accent); flex: none; }
+.sp-setting > span { display: flex; flex-direction: column; gap: 1px; min-width: 0; }
+.sp-setting small { font-size: var(--type-xs); color: var(--fg-2); line-height: var(--lh-base); }
+.sp-setting-select { align-items: center; justify-content: space-between; }
+.sp-setting-select select { font-family: var(--font-body); font-size: var(--type-xs); color: var(--fg-1); background: var(--bg-2); border: 1px solid var(--stroke-1); border-radius: var(--radius-sm); padding: 2px var(--space-1); flex: none; }
+.sp-setting-select select:focus-visible { outline: 2px solid var(--accent); outline-offset: 1px; }
+
 .sp-assets-cancel { appearance: none; margin-left: var(--space-2); font-family: var(--font-body); font-size: var(--type-xs); color: var(--fg-2); background: transparent; border: 0; padding: 0; cursor: pointer; text-decoration: underline; }
 .sp-assets-cancel:hover { color: var(--status-error); }
 .sp-assets-cancel:focus-visible { outline: 2px solid var(--accent); outline-offset: 1px; }