@1agh/maude 0.60.7 → 1.0.3

package/apps/studio/test/git-safe-rel.test.ts

@@ -0,0 +1,132 @@
+// `designRel` and the rels built on it, validated before they reach git —
+// F-13 / B12 of the v1.0.0 gate set.
+//
+// The finding was NOT "argv injection": every `runGit` / `run` call that carries
+// a dynamic path already puts it after a `--` separator, so a leading `-` is a
+// filename to git rather than a flag. The finding is CONTAINMENT, which `--`
+// does nothing about. A rel carrying `..` is a perfectly well-formed pathspec
+// that names a file outside the design root — and the autocommit path feeds
+// exactly such rels into `git add -- <paths>` inside a workspace cell, with no
+// human at the keyboard to notice `.github/workflows/release.yml` acquiring a
+// commit.
+//
+// So the shapes below are the hostile ones, and the two consumers that matter
+// are pinned: the containment PREFIX (which must never silently degrade to
+// "no filter") and the staging BATCH (which must drop the poisoned rel and keep
+// committing everybody else's work).
+
+import { describe, expect, test } from 'bun:test';
+
+import { isSafeGitRel, partitionSafeGitRels, safeGitPrefix } from '../git/safe-rel.ts';
+
+const HOSTILE: [string, string][] = [
+  ['../escape', 'parent traversal — the whole point'],
+  ['a/../../b', 'traversal in the middle, where a prefix check would not see it'],
+  ['..', 'bare parent'],
+  ['.', 'bare current — a pathspec meaning "everything"'],
+  ['a/./b', 'a no-op segment that normalises differently in two places'],
+  ['/etc/passwd', 'absolute'],
+  ['C:/Windows/System32', 'Windows-absolute'],
+  ['a\\..\\b', 'backslash separators — traversal that survives a forward-slash check'],
+  ['--upload-pack=/bin/sh', 'the flag-shaped rel the `--` separator exists for'],
+  ['-rf', 'a shorter one'],
+  ['a\u0000/../../b', 'NUL — truncates at the syscall boundary, so it is two paths'],
+  ['a\u001f/b', 'other control characters'],
+  ['a /b', 'trailing space in a segment — invisible in every UI that shows it'],
+  ['', 'empty'],
+  [`${'x/'.repeat(300)}y`, 'past the length cap'],
+];
+
+const BENIGN = [
+  '.design/ui/screen.tsx',
+  '.design/system/ds/README.md',
+  '.design/assets/a1b2c3d4.png',
+  'assets/logo.svg',
+  '.design/preview/_layout.css',
+  '.design/ui/My Canvas.tsx',
+  '.design/ui/-not-leading.tsx'.replace('/-not', '/not'),
+];
+
+describe('isSafeGitRel', () => {
+  for (const [rel, why] of HOSTILE) {
+    test(`refuses ${JSON.stringify(rel)} — ${why}`, () => {
+      expect(isSafeGitRel(rel)).toBe(false);
+    });
+  }
+
+  for (const rel of BENIGN) {
+    test(`admits ${JSON.stringify(rel)}`, () => {
+      expect(isSafeGitRel(rel)).toBe(true);
+    });
+  }
+
+  test('a non-string is refused rather than coerced', () => {
+    for (const v of [null, undefined, 42, {}, ['a']]) {
+      expect(isSafeGitRel(v)).toBe(false);
+    }
+  });
+});
+
+describe('safeGitPrefix — an absent prefix and a REFUSED one are different answers', () => {
+  test('absent is the empty prefix (no containment filter), and that is legitimate', () => {
+    expect(safeGitPrefix(undefined)).toBe('');
+    expect(safeGitPrefix('')).toBe('');
+    expect(safeGitPrefix(null)).toBe('');
+  });
+
+  test('a normal design root normalises', () => {
+    expect(safeGitPrefix('.design')).toBe('.design');
+    expect(safeGitPrefix('/.design/')).toBe('.design');
+    expect(safeGitPrefix('design\\root')).toBe('design/root');
+  });
+
+  test('a hostile prefix is null — NOT the empty string', () => {
+    // This distinction is the whole reason the function returns `string | null`.
+    // Empty means "match everything", so a caller that mapped a refusal onto ''
+    // would answer a traversal attempt by WIDENING the scope to the whole
+    // repository. The caller (`normPrefix`) falls back to '.design' instead.
+    //
+    // A LEADING SLASH IS NOT HOSTILE HERE, and this is the one place the prefix
+    // reading differs from the pathspec reading. `context.ts` already strips
+    // `^/+` off `cfg.designRoot`, i.e. a configured `/.design` has always meant
+    // "`.design`, relative to the repo root" — so `/etc/passwd` reads as the
+    // prefix `etc/passwd`, which names a directory that does not exist and
+    // therefore matches nothing. Harmless as a CONTAINMENT FILTER; still
+    // refused by `isSafeGitRel` where it would be used as a PATHSPEC.
+    const rootRelative = new Set(['/etc/passwd']);
+    for (const [rel] of HOSTILE) {
+      if (rel === '') continue; // '' is the absent case, tested above
+      if (rootRelative.has(rel)) {
+        expect(safeGitPrefix(rel)).toBe('etc/passwd');
+        continue;
+      }
+      expect(safeGitPrefix(rel)).toBeNull();
+    }
+  });
+});
+
+describe('partitionSafeGitRels — one poisoned rel must not wedge the batch', () => {
+  test('splits a mixed batch, keeping the order of each side', () => {
+    const { safe, refused } = partitionSafeGitRels([
+      '.design/ui/a.tsx',
+      '../../.github/workflows/release.yml',
+      '.design/ui/b.tsx',
+      '-rf',
+      '.design/system/ds/README.md',
+    ]);
+    expect(safe).toEqual(['.design/ui/a.tsx', '.design/ui/b.tsx', '.design/system/ds/README.md']);
+    expect(refused).toEqual(['../../.github/workflows/release.yml', '-rf']);
+  });
+
+  test('an all-clean batch is unchanged', () => {
+    const { safe, refused } = partitionSafeGitRels(BENIGN);
+    expect(safe).toEqual(BENIGN);
+    expect(refused).toEqual([]);
+  });
+
+  test('an all-hostile batch stages nothing rather than throwing', () => {
+    const { safe, refused } = partitionSafeGitRels(['../a', '/b', '..']);
+    expect(safe).toEqual([]);
+    expect(refused).toHaveLength(3);
+  });
+});

package/apps/studio/test/hmr-broadcast.test.ts

@@ -4,6 +4,7 @@ import { describe, expect, test } from 'bun:test';
 
 import { type Context, createBus } from '../context.ts';
 import {
+  classifyChange,
   createContainerWriteBridge,
   createHmrBroadcaster,
   HMR_DEBOUNCE_MS,
@@ -208,3 +209,28 @@ describe('container write bridge — synthesises fs:any the container fs.watch m
     expect(got).toHaveLength(0);
   });
 });
+
+describe('the PhotoEdit sidecar reaches open canvases', () => {
+  // `assets/<sha8>.photo.json` changing on disk is a peer's photo adjustment
+  // arriving. It used to classify as null — no message, no re-bake, and the
+  // edit appeared only after a manual reload.
+  const noSibling = () => false;
+
+  test('a photo sidecar classifies as an asset heal', () => {
+    const msg = classifyChange('assets/3631ac58.photo.json', noSibling);
+    expect(msg?.mode).toBe('asset');
+    expect(msg?.file).toBe('assets/3631ac58.photo.json');
+  });
+
+  test('a DS-tree photo sidecar too', () => {
+    expect(classifyChange('system/brand/assets/aabbccdd.photo.json', noSibling)?.mode).toBe(
+      'asset'
+    );
+  });
+
+  test('an ordinary json outside assets/ still classifies as before', () => {
+    // .meta.json keeps its dedicated lane; other json (module-ish) unchanged.
+    expect(classifyChange('ui/home.meta.json', noSibling)?.mode).toBe('meta');
+    expect(classifyChange('notes/data.photo.json', noSibling)).toBe(null);
+  });
+});

package/apps/studio/test/peer-selection-follows-camera.test.tsx

@@ -0,0 +1,131 @@
+// peer-selection-follows-camera — the collaboration counterpart of the
+// annotation-resize-handle fix (9ba40b96). A peer's selection frame is measured
+// off the LOCAL DOM every render, so it only tracks a pan/zoom if the component
+// actually re-renders while the camera moves. Both halos are `memo`, and through
+// a gesture the peer's awareness is unchanged — so without a viewport prop that
+// ticks with the camera, memo bails out and the frame sits frozen in screen
+// space while the artboard it outlines slides away underneath it.
+//
+// Needs a live DOM (memo bailout + a stubbed getBoundingClientRect) — register
+// happy-dom + drive a createRoot, same convention as mode-toggle.test.tsx.
+
+import { afterAll, afterEach, beforeAll, describe, expect, test } from 'bun:test';
+import { GlobalRegistrator } from '@happy-dom/global-registrator';
+
+beforeAll(() => {
+  GlobalRegistrator.register();
+  (globalThis as unknown as { IS_REACT_ACT_ENVIRONMENT?: boolean }).IS_REACT_ACT_ENVIRONMENT = true;
+});
+afterAll(() => {
+  GlobalRegistrator.unregister();
+});
+
+import { act, type ReactNode } from 'react';
+import { createRoot, type Root } from 'react-dom/client';
+import { PeerAnnotationSelection, PeerSelection } from '../cursors-overlay.tsx';
+import type { ForeignAwareness } from '../use-collab.tsx';
+
+// The camera the stubbed measurements project through — stands in for the world
+// plane's CSS transform, which is what really moves the target under a pan.
+let camera = { x: 0, y: 0, zoom: 1 };
+
+/** A target element whose screen rect follows `camera`, like real canvas content. */
+function target(
+  attr: string,
+  value: string,
+  world: { x: number; y: number; w: number; h: number }
+) {
+  const el = document.createElement('div');
+  el.setAttribute(attr, value);
+  el.getBoundingClientRect = () =>
+    ({
+      left: world.x * camera.zoom + camera.x,
+      top: world.y * camera.zoom + camera.y,
+      width: world.w * camera.zoom,
+      height: world.h * camera.zoom,
+    }) as DOMRect;
+  document.body.appendChild(el);
+  return el;
+}
+
+let root: Root | null = null;
+let host: HTMLElement | null = null;
+
+function mount(ui: ReactNode): void {
+  host = document.createElement('div');
+  document.body.appendChild(host);
+  root = createRoot(host);
+  act(() => {
+    root?.render(ui);
+  });
+}
+
+function rerender(ui: ReactNode): void {
+  act(() => {
+    root?.render(ui);
+  });
+}
+
+function frameTransform(): string {
+  const el = host?.querySelector('.dc-peer-selection') as HTMLElement | null;
+  return el?.style.transform ?? '';
+}
+
+afterEach(() => {
+  act(() => {
+    root?.unmount();
+  });
+  host?.remove();
+  root = null;
+  host = null;
+  document.body.innerHTML = '';
+  camera = { x: 0, y: 0, zoom: 1 };
+});
+
+// One stable object across the whole test — a real pan/zoom does not touch the
+// peer's awareness, and that identity is exactly what makes memo bail out.
+const peer = {
+  clientID: 7,
+  name: 'you@local.test',
+  color: 'oklch(56% 0.17 50)',
+  cursor: null,
+  selection: { cssPath: '[data-cd-id="hero"]' },
+  annotationSelection: ['stroke-1'],
+} as unknown as ForeignAwareness;
+
+describe('cursors-overlay / PeerSelection', () => {
+  test('the frame follows a pan', () => {
+    target('data-cd-id', 'hero', { x: 100, y: 60, w: 200, h: 120 });
+    mount(<PeerSelection peer={peer} viewport={{ x: 0, y: 0, zoom: 1 }} />);
+    expect(frameTransform()).toBe('translate(100px, 60px)');
+
+    camera = { x: -40, y: -25, zoom: 1 };
+    rerender(<PeerSelection peer={peer} viewport={camera} />);
+    expect(frameTransform()).toBe('translate(60px, 35px)');
+  });
+
+  test('the frame follows a zoom (position AND size)', () => {
+    target('data-cd-id', 'hero', { x: 100, y: 60, w: 200, h: 120 });
+    mount(<PeerSelection peer={peer} viewport={{ x: 0, y: 0, zoom: 1 }} />);
+
+    camera = { x: 0, y: 0, zoom: 2 };
+    rerender(<PeerSelection peer={peer} viewport={camera} />);
+    const el = host?.querySelector('.dc-peer-selection') as HTMLElement;
+    expect(el.style.transform).toBe('translate(200px, 120px)');
+    expect(el.style.width).toBe('400px');
+    expect(el.style.height).toBe('240px');
+  });
+});
+
+describe('cursors-overlay / PeerAnnotationSelection', () => {
+  test('the stroke halo follows a pan', () => {
+    target('data-id', 'stroke-1', { x: 100, y: 60, w: 200, h: 120 });
+    mount(<PeerAnnotationSelection peer={peer} viewport={{ x: 0, y: 0, zoom: 1 }} />);
+    // Padded 3px so the halo sits OUTSIDE the stroke.
+    expect(frameTransform()).toBe('translate(97px, 57px)');
+
+    camera = { x: -40, y: -25, zoom: 1 };
+    rerender(<PeerAnnotationSelection peer={peer} viewport={camera} />);
+    expect(frameTransform()).toBe('translate(57px, 32px)');
+  });
+});

package/apps/studio/test/shared-doc-cell-pairing.test.ts

@@ -240,8 +240,11 @@ describe('Task 1 — the workspace-mode guard opens only for loopback + commit-d
     );
   });
 
-  test('refuses when shared-doc is off — pairing IS the single-doc model', () => {
-    expect(resolveCellPairing(pairingEnv({ MAUDE_SHARED_DOC: undefined })).refusal).toBe(
+  test('refuses when shared-doc is explicitly off — pairing IS the single-doc model', () => {
+    // Increment 7 flipped the default ON, so an UNSET flag now pairs; only the
+    // explicit opt-out (the rollback flip) refuses.
+    expect(resolveCellPairing(pairingEnv({ MAUDE_SHARED_DOC: undefined })).pairing).not.toBeNull();
+    expect(resolveCellPairing(pairingEnv({ MAUDE_SHARED_DOC: '0' })).refusal).toBe(
       'shared-doc-off'
     );
   });

package/apps/studio/test/sync-agent.test.ts

@@ -580,3 +580,81 @@ describe('CanvasSyncAgent — fail-closed on snapshot failure (DDR-102 F1)', ()
     expect(conflicts[0].snapshotFailed).toBeUndefined();
   });
 });
+
+describe('cold-start meta — an empty doc is not a canvas with no title', () => {
+  // A canvas created on a PEER used to reach the hub as a body with no meta:
+  // no title, no kind, no design-system binding. It stayed that way until
+  // somebody moved an artboard, because a meta EDIT was the only thing that
+  // ever pushed meta into the doc.
+  //
+  // The cloud hid it. A cell's studio child arms `activity:suppress` on create
+  // and the container write bridge turns that into an `fs:any` a quarter-second
+  // later — by which time the new canvas has an agent to receive it. A desktop
+  // has no bridge: its real `fs.watch` fires immediately, before the agent
+  // exists, and the event lands nowhere. One side won the race, the other lost
+  // it, and the gap underneath (cold-start meta was doc→file only) was
+  // invisible from the winning end.
+
+  const metaPaths = () => ({ ...paths(), meta: join(dir, 'screen.meta.json') });
+
+  function metaAgent(extra: Record<string, unknown> = {}): CanvasSyncAgent {
+    const a = createCanvasSyncAgent({
+      slug: 'screen',
+      doc: docB,
+      paths: metaPaths(),
+      echoGuard: createEchoGuard(),
+      flushMs: 0,
+      ...extra,
+    });
+    a.start();
+    return a;
+  }
+
+  test('local meta seeds the doc when the doc has none', async () => {
+    writeFileSync(
+      metaPaths().meta,
+      JSON.stringify({ title: 'Kanban', kind: 'web', designSystem: 'project' })
+    );
+    agent = metaAgent();
+    await agent.reconcile();
+
+    // The other peer must be able to SEE it — that is the whole point.
+    const seen = JSON.parse(docA.getText('meta').toString());
+    expect(seen.title).toBe('Kanban');
+    expect(seen.kind).toBe('web');
+  });
+
+  test('it does NOT overwrite meta the doc already carries', async () => {
+    // The safety property. Seeding runs only into a vacuum, so it can never be
+    // a peer quietly winning a disagreement about a shared key.
+    docA.getText('meta').insert(0, JSON.stringify({ title: 'From the hub', kind: 'web' }));
+    writeFileSync(metaPaths().meta, JSON.stringify({ title: 'From my disk', kind: 'mobile' }));
+
+    agent = metaAgent();
+    await agent.reconcile();
+
+    expect(JSON.parse(docA.getText('meta').toString()).title).toBe('From the hub');
+    // …and the hub's opinion lands on disk, which is the pre-existing behaviour.
+    expect(JSON.parse(readFileSync(metaPaths().meta, 'utf8')).title).toBe('From the hub');
+  });
+
+  test('no local meta and no doc meta is simply nothing to do', async () => {
+    agent = metaAgent();
+    await agent.reconcile();
+    expect(docA.getText('meta').toString()).toBe('');
+  });
+
+  test('per-user keys never leave the machine', async () => {
+    // `viewport` is the per-user camera (DDR-115). Seeding must go through the
+    // same shared-subset filter as every other meta write, or the fix would
+    // start syncing somebody's scroll position.
+    writeFileSync(
+      metaPaths().meta,
+      JSON.stringify({ title: 'Kanban', viewport: { x: 12, y: 34, zoom: 2 } })
+    );
+    agent = metaAgent();
+    await agent.reconcile();
+
+    expect(docA.getText('meta').toString()).not.toContain('viewport');
+  });
+});

package/apps/studio/test/sync-asset-push.test.ts

@@ -14,7 +14,6 @@ import {
   isPushableAssetRel,
   listPushableAssets,
   pushAssets,
-  pushOneAsset,
   putTimeoutMs,
 } from '../sync/asset-push.ts';
 
@@ -43,12 +42,22 @@ describe('listPushableAssets — classifier membership over the whole design roo
     mkdirSync(join(designRoot, '_history/assets'), { recursive: true });
     writeFileSync(join(designRoot, '_history/assets/old.png'), 'x');
 
-    expect(listPushableAssets(designRoot)).toEqual([
+    // `syncFiles: false` is now stated rather than assumed: the flag defaults
+    // ON from Increment 4, so a test that meant "the narrow media sweep" has
+    // to say so. What it pins is unchanged.
+    expect(listPushableAssets(designRoot, { syncFiles: false })).toEqual([
       'assets/a1b2c3d4.png',
       'system/alligators/assets/fonts/Gators-Bold.woff2',
       'system/alligators/assets/logos/horizontal-green.svg',
       'system/alligators/assets/photos/P1020428.JPG',
     ]);
+
+    // With the plane on, the photo sidecar travels too — it is the
+    // non-destructive edit state for that image, and an image whose edits stay
+    // behind arrives looking wrong rather than arriving late.
+    expect(listPushableAssets(designRoot, { syncFiles: true })).toContain(
+      'assets/a1b2c3d4.photo.json'
+    );
   });
 
   test('non-asset extensions and dotfiles are filtered; missing root is []', () => {
@@ -89,9 +98,10 @@ describe('listPushableAssets — classifier membership over the whole design roo
       'system/ds/preview/_brand-css.ts',
       'system/ds/preview/_layout.css',
     ]);
-    // Flag OFF ⇒ today's reach, byte-for-byte: none of these are binary
-    // media under an assets/ dir, so none of them move.
-    expect(listPushableAssets(designRoot)).toEqual([]);
+    // Explicitly OFF ⇒ the pre-Sync-v2 reach, byte-for-byte: none of these are
+    // binary media under an assets/ dir, so none of them move. This is the
+    // documented per-project rollback, so it keeps its own test.
+    expect(listPushableAssets(designRoot, { syncFiles: false })).toEqual([]);
   });
 
   test('declared canvasGroups decide what a canvas body IS', () => {
@@ -832,137 +842,90 @@ describe('isPushableAssetRel — the on-change trigger', () => {
 // is the half that was missing. A behavioural test needs a live runtime plus a
 // 1.5 s debounce and destabilises `sync-runtime.test.ts`'s shared fixtures, so
 // the invariant is pinned where it is cheap and unambiguous instead.
-describe('the runtime sweeps on change, not only at boot', () => {
+describe('the runtime schedules the legacy push on change, not only at boot', () => {
   const SYNC = readFileSync(join(import.meta.dir, '..', 'sync', 'index.ts'), 'utf8');
 
-  test('the fs watcher decides with isPushableAssetRel and schedules a sweep', () => {
+  test('the fs watcher decides with isPushableAssetRel and schedules a pass', () => {
     // The predicate gets the project's OWN canvas groups — with the default
     // set a custom-group project's shared module would answer canvas-owned
-    // and silently never schedule the sweep that uploads it. (Since the
-    // 2026-08-16 latency fix the same gate also feeds the fast lane; the
-    // sweep stays the reconciler.)
+    // and silently never schedule the pass that uploads it.
     expect(SYNC).toContain('if (isPushableAssetRel(rel, ctx.cfg.canvasGroups)) {');
-    expect(SYNC).toContain('scheduleAssetSweep(linkedHub.url);');
+    expect(SYNC).toContain('scheduleLegacyPush(linkedHub.url);');
   });
 
-  test('bursts coalesce, and a change DURING a sweep is not lost', () => {
-    // Dragging six images on is six events; each sweep costs a probe over the
-    // wire. And a file written while a sweep runs was not in that sweep's list.
+  test('bursts coalesce, and a change DURING a pass is not lost', () => {
+    // Dragging six images on is six events; each pass costs a probe over the
+    // wire. And a file written while a pass runs was not in that pass's list.
     expect(SYNC).toMatch(/ASSET_SWEEP_DEBOUNCE_MS = [\d_]+/);
-    expect(SYNC).toContain('assetSweepAgain');
+    expect(SYNC).toContain('legacyPushAgain');
   });
 
-  test('only one sweep runs at a time, and stop() clears the pending one', () => {
-    expect(SYNC).toMatch(/if \(stopped \|\| assetSweep\) return;/);
-    expect(SYNC).toContain('if (assetSweepTimer !== null) clearTimeout(assetSweepTimer);');
+  test('the lane is decided once by the capability probe, and a journal hub never sees the legacy client', () => {
+    // Sync v2 Increment 5 — the burn-down's one invariant: exactly ONE push
+    // lane per boot. A journal hub gets the plane; only a journal-less hub
+    // (or an unreachable/opted-out probe) gets the legacy client.
+    expect(SYNC).toContain('decidePushLane(filePlane === null);');
+    expect(SYNC).toMatch(
+      /if \(stopped \|\| cellPairing \|\| legacyLane !== true\) return; \/\/ the cell never pushes/
+    );
+    expect(SYNC).toContain(
+      'if (legacyLane === false) return; // the plane owns pushes on this hub'
+    );
   });
-});
 
-describe('pushOneAsset — the fast lane (2026-08-16 latency fix)', () => {
-  test('probes once via /_asset-probe, then PUTs the single file', async () => {
-    const designRoot = scratchDesignRoot();
-    mkdirSync(join(designRoot, 'assets'), { recursive: true });
-    writeFileSync(join(designRoot, 'assets/aaaaaaaa.png'), 'fresh sticker');
-
-    const calls: Array<{ method: string; url: string }> = [];
-    const fetchImpl = (async (input: RequestInfo | URL, init?: RequestInit) => {
-      const url = String(input);
-      const method = init?.method ?? 'GET';
-      calls.push({ method, url });
-      if (url.endsWith('/_asset-probe')) return Response.json({ present: [] });
-      return new Response('{"ok":true}', { status: 200 });
-    }) as typeof fetch;
-
-    const r = await pushOneAsset({
-      designRoot,
-      rel: 'assets/aaaaaaaa.png',
-      hubUrl: 'https://alligators.cloud.maude.sh/',
-      token: () => 'mau_tok',
-      fetchImpl,
-    });
-    expect(r).toEqual({ ok: true });
-    expect(calls.map((c) => `${c.method} ${c.url}`)).toEqual([
-      'POST https://alligators.cloud.maude.sh/_asset-probe',
-      'PUT https://alligators.cloud.maude.sh/assets/aaaaaaaa.png',
-    ]);
+  test('stop() clears the pending pass and cancels a running one', () => {
+    expect(SYNC).toContain('if (legacyPushTimer !== null) clearTimeout(legacyPushTimer);');
+    expect(SYNC).toContain('legacyPushCancel = true;');
   });
+});
 
-  test('a file the hub already holds is skipped — the pull-echo guard', async () => {
-    // The fast lane fires off fs:any, and the asset PULL writes into assets/
-    // too — without this skip the lane would upload the hub's own bytes back.
+describe('pushAssets — the cancel hook (the Sync panel button, legacy window)', () => {
+  test('cancelled() abandons the rest of the pass', async () => {
     const designRoot = scratchDesignRoot();
     mkdirSync(join(designRoot, 'assets'), { recursive: true });
-    writeFileSync(join(designRoot, 'assets/aaaaaaaa.png'), 'pulled bytes');
+    writeFileSync(join(designRoot, 'assets/aaaaaaaa.png'), 'a');
+    writeFileSync(join(designRoot, 'assets/bbbbbbbb.png'), 'b');
+    writeFileSync(join(designRoot, 'assets/cccccccc.png'), 'c');
 
     let puts = 0;
     const fetchImpl = (async (input: RequestInfo | URL, init?: RequestInit) => {
-      const url = String(input);
-      if (url.endsWith('/_asset-probe')) return Response.json({ present: ['assets/aaaaaaaa.png'] });
       if (init?.method === 'PUT') puts += 1;
-      return new Response('{"ok":true}', { status: 200 });
-    }) as typeof fetch;
+      return new Response('not found', { status: 404 });
+    }) as unknown as typeof fetch;
 
-    const r = await pushOneAsset({
+    const out = await pushAssets({
       designRoot,
-      rel: 'assets/aaaaaaaa.png',
-      hubUrl: 'https://alligators.cloud.maude.sh',
-      token: () => 'mau_tok',
-      fetchImpl,
-    });
-    expect(r).toEqual({ ok: true, skipped: true });
-    expect(puts).toBe(0);
-  });
-
-  test('DS-tree asset routes to /_asset-file/; non-pushable rels refuse; failures report', async () => {
-    const designRoot = scratchDesignRoot();
-    mkdirSync(join(designRoot, 'system/ds/assets'), { recursive: true });
-    writeFileSync(join(designRoot, 'system/ds/assets/mark.svg'), 'brand');
-
-    const urls: string[] = [];
-    const fetchImpl = (async (input: RequestInfo | URL, init?: RequestInit) => {
-      const url = String(input);
-      if (url.endsWith('/_asset-probe')) return Response.json({ present: [] });
-      if (init?.method === 'PUT') {
-        urls.push(url);
-        return new Response('refused', { status: 403 });
-      }
-      return new Response(null, { status: 404 });
-    }) as typeof fetch;
-
-    const r = await pushOneAsset({
-      designRoot,
-      rel: 'system/ds/assets/mark.svg',
       hubUrl: 'https://hub.example.com',
       token: () => 't',
       fetchImpl,
+      log: { log: () => {}, warn: () => {} },
+      // Cancel after the first upload settles.
+      cancelled: () => puts >= 1,
     });
-    expect(urls).toEqual(['https://hub.example.com/_asset-file/system/ds/assets/mark.svg']);
-    expect(r.ok).toBe(false);
-    expect(r.reason).toContain('403');
+    expect(puts).toBe(1);
+    // The rest of the set was neither pushed nor reported failed — it is the
+    // next pass's work, exactly like a budget wall.
+    expect(out.pushed.length + out.failed.length + out.skipped).toBeLessThan(3);
+  });
+});
 
-    // Runtime state / config never enter the fast lane.
-    const refused = await pushOneAsset({
-      designRoot,
-      rel: '_history/x/old.png',
-      hubUrl: 'https://hub.example.com',
-      token: () => 't',
-      fetchImpl,
-    });
-    expect(refused.ok).toBe(false);
-    expect(refused.reason).toBe('not a pushable asset');
+describe('the syncFiles default — Increment 4 flipped it ON', () => {
+  // The flip is one boolean in two places (`sync/index.ts` and here), and a
+  // drift between them means the sweep and the plane disagree about which
+  // files exist — the jurisdiction overlap Sync v2 exists to end. So the
+  // default is asserted, not assumed.
+  const designRoot = () => {
+    const root = scratchDesignRoot();
+    mkdirSync(join(root, 'system/ds'), { recursive: true });
+    writeFileSync(join(root, 'system/ds/brand.css'), 'x');
+    return root;
+  };
+
+  test('absent config ⇒ the plane is on', () => {
+    expect(listPushableAssets(designRoot())).toEqual(['system/ds/brand.css']);
   });
 
-  test('the runtime wires the fast lanes: push off fs:any, pull off reference files', () => {
-    // Same source-pin style as the sweep-trigger suite above.
-    expect(SYNC2).toContain('queueFastPush(rel');
-    expect(SYNC2).toMatch(/REFERENCE_FILE_RE\.test\(rel\)/);
-    expect(SYNC2).toContain('requestFastPull');
-    // stop() tears the lanes down.
-    expect(SYNC2).toContain('for (const t of fastPushTimers.values()) clearTimeout(t);');
-    expect(SYNC2).toContain('requestFastPull = null;');
-    // The cell never pushes — same guard as the sweep.
-    expect(SYNC2).toMatch(/if \(stopped \|\| cellPairing\) return; \/\/ the cell never pushes/);
+  test('`linkedHub.syncFiles: false` is the per-project rollback and still works', () => {
+    expect(listPushableAssets(designRoot(), { syncFiles: false })).toEqual([]);
   });
 });
-
-const SYNC2 = readFileSync(join(import.meta.dir, '..', 'sync', 'index.ts'), 'utf8');