@1agh/maude 1.0.11 → 1.3.0

package/apps/studio/sync/action-stage.ts

@@ -0,0 +1,343 @@
+// AI and multi-file action boundaries — plan T16 (DDR-241).
+//
+// An agent turn (the in-app chat) or a `/design:edit` run changes several
+// files, one tool call at a time. Proposed as they land, the project would
+// accept a canvas edited against a module the agent has not written yet, and
+// an agent that fails half way would leave that half published. So while an
+// AI action is OPEN, the file changes it makes are STAGED here instead of
+// proposed: kept on disk, remembered with the value each was derived from,
+// and proposed together — one transaction, one history action — when the
+// action ends well.
+//
+// When it does not (the agent errors, is cancelled, stops at its token limit,
+// or its heartbeat goes silent) the stage is HELD: nothing is published and
+// nothing is thrown away. The person decides — publish it as it stands, or
+// discard it (the accepted version returns; the candidate stays in the
+// recovery slots). A held stage survives a restart (`_state/ai-stage.json`),
+// so a crash can never turn into a partial publish by the next cold start.
+//
+// What is staged is only a WATCHER change (a tool writing a file). An edit the
+// person makes in the UI is theirs and is proposed at once — unless it is made
+// on top of a staged file, in which case it carries the agent's unpublished
+// bytes and waits behind the stage (`dependents`), exactly as U2 waits on U1.
+
+import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import path from 'node:path';
+
+import type { LaneProposal, ProposalOutcome } from './projection.ts';
+import type { Operation, ProposalResult } from './transaction-client.ts';
+
+export type StageState = 'open' | 'held';
+
+export interface StagedLane {
+  slug: string;
+  doc: string;
+  lane: LaneProposal['lane'];
+  /** The value the FIRST staged change was derived from — the group's base. */
+  baseContent: string;
+  /** The latest staged value. */
+  content: string;
+  writeId?: string;
+  /** Every staged proposal's transaction id — aliased to the group's on commit. */
+  txs: string[];
+  resolvers: Array<(o: ProposalOutcome) => void>;
+}
+
+export interface StageSummary {
+  state: StageState;
+  label: string;
+  canvases: string[];
+  since: number;
+}
+
+interface Dependent {
+  send: (dependsOn: string[] | undefined) => void;
+  drop: (o: ProposalOutcome) => void;
+  dependsOn: string[];
+}
+
+export interface ActionStageOptions {
+  designRoot: string;
+  /** Send one grouped action; resolves with the final result. */
+  propose: (action: {
+    label: string;
+    kind: string;
+    operations: Operation[];
+    transactionId: string;
+  }) => Promise<ProposalResult>;
+  newTransactionId: () => string;
+  onChange?: (summary: StageSummary | null) => void;
+  log?: Pick<Console, 'log' | 'warn'>;
+  now?: () => number;
+}
+
+export function createActionStage(opts: ActionStageOptions) {
+  const log = opts.log ?? console;
+  const now = opts.now ?? Date.now;
+  const file = path.join(opts.designRoot, '_state', 'ai-stage.json');
+
+  let state: StageState | null = null;
+  let label = '';
+  let since = 0;
+  const keys = new Set<string>();
+  let failed = false;
+  const lanes = new Map<string, StagedLane>();
+  const dependents: Dependent[] = [];
+  /** A staged transaction id → the group transaction that carried it. */
+  const alias = new Map<string, string>();
+  /** Slugs a restored (held) stage covers — cold-start changes to them are staged. */
+  const restoredSlugs = new Set<string>();
+  /** Bases restored from disk after a restart: `${slug}|${lane}` → baseContent. */
+  const restoredBases = new Map<string, string>();
+
+  function summary(): StageSummary | null {
+    if (!state) return null;
+    const canvases = new Set<string>([...restoredSlugs]);
+    for (const l of lanes.values()) canvases.add(l.slug);
+    return { state, label, canvases: [...canvases].sort(), since };
+  }
+
+  function persist(): void {
+    try {
+      if (!state || (lanes.size === 0 && restoredSlugs.size === 0)) {
+        rmSync(file, { force: true });
+        return;
+      }
+      mkdirSync(path.dirname(file), { recursive: true });
+      const body = {
+        v: 1,
+        state,
+        label,
+        since,
+        lanes: [...lanes.values()].map((l) => ({
+          slug: l.slug,
+          doc: l.doc,
+          lane: l.lane,
+          baseContent: l.baseContent,
+        })),
+        restored: [...restoredBases.entries()].map(([k, baseContent]) => {
+          const [slug, lane] = k.split('|');
+          return { slug, lane, baseContent };
+        }),
+      };
+      writeFileSync(`${file}.tmp`, JSON.stringify(body));
+      renameSync(`${file}.tmp`, file);
+    } catch (err) {
+      log.warn(`[sync/ai] could not record the unfinished action: ${(err as Error).message}`);
+    }
+  }
+
+  function changed(): void {
+    persist();
+    opts.onChange?.(summary());
+  }
+
+  /** A previous process left a stage: it comes back HELD. */
+  function restore(): void {
+    if (!existsSync(file)) return;
+    try {
+      const body = JSON.parse(readFileSync(file, 'utf8')) as {
+        label?: string;
+        since?: number;
+        lanes?: { slug: string; lane: string; baseContent: string }[];
+        restored?: { slug: string; lane: string; baseContent: string }[];
+      };
+      const all = [...(body.lanes ?? []), ...(body.restored ?? [])];
+      if (all.length === 0) return;
+      state = 'held';
+      label = typeof body.label === 'string' ? body.label : 'AI edit';
+      since = typeof body.since === 'number' ? body.since : now();
+      for (const l of all) {
+        restoredSlugs.add(l.slug);
+        restoredBases.set(`${l.slug}|${l.lane}`, l.baseContent);
+      }
+      log.warn(
+        `[sync/ai] an unfinished AI edit (${label}) to ${restoredSlugs.size} canvas(es) was kept from the last session — it is not published until you choose.`
+      );
+      opts.onChange?.(summary());
+    } catch {
+      /* unreadable → nothing to restore */
+    }
+  }
+
+  function begin(key: string, nextLabel: string): void {
+    keys.add(key);
+    if (state === 'open') return;
+    if (state === 'held') {
+      // A new action on top of an unfinished one continues it: its files may
+      // already carry the held bytes. It stays one decision for the person.
+      state = 'open';
+      failed = false;
+      changed();
+      return;
+    }
+    state = 'open';
+    failed = false;
+    label = nextLabel.slice(0, 120) || 'AI edit';
+    since = now();
+    changed();
+  }
+
+  /** Should this proposal be staged instead of sent? */
+  function captures(slug: string, stageable: boolean): boolean {
+    if (!stageable || !state) return false;
+    return (
+      state === 'open' ||
+      restoredSlugs.has(slug) ||
+      [...lanes.values()].some((l) => l.slug === slug)
+    );
+  }
+
+  function capture(slug: string, doc: string, p: LaneProposal): Promise<ProposalOutcome> {
+    const k = `${slug}|${p.lane}`;
+    return new Promise((resolve) => {
+      const existing = lanes.get(k);
+      if (existing) {
+        existing.content = p.content;
+        existing.txs.push(p.transactionId);
+        existing.resolvers.push(resolve);
+        if (p.writeId) existing.writeId = p.writeId;
+      } else {
+        lanes.set(k, {
+          slug,
+          doc,
+          lane: p.lane,
+          baseContent: restoredBases.get(k) ?? p.baseContent,
+          content: p.content,
+          ...(p.writeId ? { writeId: p.writeId } : {}),
+          txs: [p.transactionId],
+          resolvers: [resolve],
+        });
+        changed();
+      }
+    });
+  }
+
+  function isStagedTx(id: string): boolean {
+    for (const l of lanes.values()) if (l.txs.includes(id)) return true;
+    return false;
+  }
+
+  /** A non-staged proposal authored on top of a staged one waits behind the stage. */
+  function holdsDependency(dependsOn: string[] | undefined): boolean {
+    return !!dependsOn?.some((id) => isStagedTx(id));
+  }
+
+  function wait(dep: Dependent): void {
+    dependents.push(dep);
+  }
+
+  /** Rewrite a dependency on a staged proposal to the group that carried it. */
+  function mapDeps(dependsOn: string[] | undefined): string[] | undefined {
+    if (!dependsOn?.length) return dependsOn;
+    return dependsOn.map((id) => alias.get(id) ?? id);
+  }
+
+  function laneOutcome(r: ProposalResult, l: StagedLane): ProposalOutcome {
+    const mine = r.doc === l.doc && r.lane === l.lane;
+    return {
+      status: r.status,
+      ...(r.code ? { code: r.code } : {}),
+      ...(mine && typeof r.head === 'string' ? { head: r.head } : {}),
+      ...(typeof r.actionId === 'string' ? { actionId: r.actionId } : {}),
+    };
+  }
+
+  function reset(): void {
+    state = null;
+    label = '';
+    since = 0;
+    keys.clear();
+    failed = false;
+    lanes.clear();
+    restoredSlugs.clear();
+    restoredBases.clear();
+    changed();
+  }
+
+  /** Propose everything staged as ONE action. */
+  async function publish(): Promise<ProposalResult | null> {
+    if (!state) return null;
+    const staged = [...lanes.values()];
+    const waiting = dependents.splice(0);
+    const groupLabel = label || 'AI edit';
+    if (staged.length === 0) {
+      reset();
+      for (const d of waiting) d.send(mapDeps(d.dependsOn));
+      return null;
+    }
+    const transactionId = opts.newTransactionId();
+    for (const l of staged) for (const tx of l.txs) alias.set(tx, transactionId);
+    const operations: Operation[] = staged.map((l) => ({
+      op: 'lane.replace',
+      doc: l.doc,
+      lane: l.lane,
+      content: l.content,
+      baseContent: l.baseContent,
+      ...(l.writeId ? { writeId: l.writeId } : {}),
+    }));
+    // The stage is closed before the answer: the next action starts clean,
+    // and the dependents go out right behind the group (same ordered outbox).
+    reset();
+    const sent = opts.propose({ label: groupLabel, kind: 'ai', operations, transactionId });
+    for (const d of waiting) d.send(mapDeps(d.dependsOn));
+    const r = await sent.catch((err: unknown) => {
+      const code = (err as { code?: string })?.code ?? 'retryable';
+      return { protocol: 1, status: 'rejected', code, transactionId } as ProposalResult;
+    });
+    for (const l of staged) for (const fn of l.resolvers) fn(laneOutcome(r, l));
+    log.log(
+      `[sync/ai] ${groupLabel}: ${staged.length} change(s) ${r.status === 'accepted' ? 'published as one action' : `refused (${r.code ?? 'rejected'})`}.`
+    );
+    return r;
+  }
+
+  /** End one participant. The last `done` publishes; any failure holds. */
+  async function end(key: string, outcome: 'done' | 'failed'): Promise<ProposalResult | null> {
+    if (!keys.has(key)) return null;
+    keys.delete(key);
+    if (outcome === 'failed') failed = true;
+    if (keys.size > 0 || state !== 'open') return null;
+    if (failed) {
+      state = 'held';
+      changed();
+      log.warn(
+        `[sync/ai] ${label}: the action did not finish — ${lanes.size} change(s) kept on this device, not published.`
+      );
+      return null;
+    }
+    return publish();
+  }
+
+  /** Throw the held changes away: every lane returns to the accepted version. */
+  function discard(): number {
+    if (state !== 'held') return 0;
+    const staged = [...lanes.values()];
+    const waiting = dependents.splice(0);
+    const slugs = new Set([...restoredSlugs, ...staged.map((l) => l.slug)]);
+    reset();
+    for (const l of staged)
+      for (const fn of l.resolvers) fn({ status: 'rejected', code: 'discarded' });
+    for (const d of waiting) d.drop({ status: 'rejected', code: 'discarded' });
+    return slugs.size;
+  }
+
+  return {
+    restore,
+    begin,
+    end,
+    publish,
+    discard,
+    captures,
+    capture,
+    holdsDependency,
+    wait,
+    mapDeps,
+    summary,
+    get state() {
+      return state;
+    },
+  };
+}
+
+export type ActionStage = ReturnType<typeof createActionStage>;

package/apps/studio/sync/agent.ts

@@ -52,12 +52,10 @@ import {
   cssFromDoc,
   htmlFromDoc,
   isEmptyAnnotationsSvg,
-  markSeeded,
   mergeSharedMetaIntoLocal,
   metaFromDoc,
   movedToFromDoc,
   repairSharedMeta,
-  seededByFromDoc,
   stampAnnotationsEdit,
   stampBodyEdit,
   Y_SYNC_TYPES,
@@ -65,12 +63,14 @@ import {
 import {
   decideAnnotationsColdStart,
   decideColdStart,
-  isExactRepeat,
+  decideCssColdStart,
   unionCommentsById,
 } from './cold-start.ts';
-import { applyColdStart } from './cold-start-apply.ts';
+import { applyColdStart, type ColdStartSnapshotReason } from './cold-start-apply.ts';
+import { dedupeCommentsById, hasDuplicateComments } from './comment-identity.ts';
 import { type EchoGuard, hashBytes } from './echo-guard.ts';
 import type { SyncJournal } from './journal.ts';
+import { rememberSeed, repairSeedDuplication } from './seed-repair.ts';
 
 export const DOC_FLUSH_MS = 800;
 
@@ -80,7 +80,7 @@ export const DOC_FLUSH_MS = 800;
  * the cold-start race — a genuine peer edit that arrives minutes later is NEVER
  * collapsed back to our original seed. Generous relative to the hub sync RTT.
  */
-export const SEED_REPAIR_WINDOW_MS = 10_000;
+export { SEED_REPAIR_WINDOW_MS } from './seed-repair.ts';
 
 export interface CanvasSyncPaths {
   /** Absolute path to <designRoot>/<canvas>.html. */
@@ -126,7 +126,7 @@ export interface CanvasSyncAgentOptions {
    * without it the conflict path still resolves newest-wins, just without the
    * recovery snapshots (test-only constructions).
    */
-  snapshot?: (content: string, reason: 'pre-sync-local' | 'pre-sync-hub') => Promise<string | null>;
+  snapshot?: (content: string, reason: ColdStartSnapshotReason) => Promise<string | null>;
   /**
    * Called when a non-adopt reconcile (cold-start / post-git-pull) found
    * divergent non-empty content on both sides (DDR-102). `winner` is the side
@@ -185,13 +185,6 @@ export function createCanvasSyncAgent(opts: CanvasSyncAgentOptions): CanvasSyncA
   let lastMeta: string | null = null;
   let lastCss: string | null = null;
 
-  // F1 — the body this agent pushed on `seed-local-up`, plus the deadline past
-  // which the de-dup repair stops firing. Set on seed; nulled only when the
-  // window lapses (after convergence the repair is a cheap no-op — the
-  // `body === seedInfo.body` guard short-circuits, so we don't bother clearing).
-  // Null = this agent never seeded (so it never repairs).
-  let seedInfo: { body: string; until: number } | null = null;
-
   function onDocUpdate(_update: Uint8Array, updateOrigin: unknown): void {
     if (stopped) return;
     // Self-applied (we just synced from disk) — disk is already current.
@@ -200,6 +193,7 @@ export function createCanvasSyncAgent(opts: CanvasSyncAgentOptions): CanvasSyncA
     // concurrent peer's identical seed onto ours. Collapse it (single elected
     // writer) BEFORE the flush below can mirror a doubled body to disk.
     maybeRepairSeedDuplication();
+    maybeCollapseCommentsDuplication();
     scheduleFlush();
   }
 
@@ -238,24 +232,53 @@ export function createCanvasSyncAgent(opts: CanvasSyncAgentOptions): CanvasSyncA
    * variant is an accepted follow-up, not handled in-flight.
    */
   function maybeRepairSeedDuplication(): void {
-    if (!seedInfo) return;
-    if (Date.now() > seedInfo.until) {
-      seedInfo = null;
-      return;
+    const repaired = repairSeedDuplication(doc, origin);
+    if (repaired.includes('body')) {
+      lastHtml = htmlFromDoc(doc);
+      opts.journal?.record(slug, { bodyHash: hashBytes(lastHtml) });
     }
-    const owner = seededByFromDoc(doc);
-    if (owner === null || owner !== doc.clientID) return; // not the elected writer
-    const body = htmlFromDoc(doc);
-    if (body === seedInfo.body) return; // already a single copy
-    if (!isExactRepeat(body, seedInfo.body)) return; // divergent edit → conflict path owns it
-    const canonical = seedInfo.body;
+    if (repaired.includes('css')) {
+      lastCss = cssFromDoc(doc);
+      if (lastCss !== null) opts.journal?.record(slug, { cssHash: hashBytes(lastCss) });
+    }
+
+    if (repaired.length > 0) {
+      console.warn(
+        `[sync/${slug}] concurrent cold-seed duplication detected in ${repaired.join(
+          ' + '
+        )} — collapsed to one copy (F1).`
+      );
+    }
+  }
+
+  /**
+   * The comments half of the same collision (issue #112) — and deliberately
+   * NOT shaped like the body's.
+   *
+   * The body repair needs the `seededBy` election and an exact-repeat proof
+   * because collapsing a Y.Text can only be justified when the discarded bytes
+   * are provably a copy. Comments carry stable ids, so "the same comment twice"
+   * is decidable per entry, not per lane: the collapse keeps one of two
+   * byte-identical-by-identity entries and discards nothing a reader could
+   * want. That makes it safe for EVERY peer to run — no election, no seed
+   * window, no snapshot (per issue #114's follow-up, a collapse that preserves
+   * zero unique bytes must not consume the `_history/` snapshot ring).
+   *
+   * It converges because `applyCommentsToDoc` emits the collapse as a pure
+   * delete of items every peer holds, and concurrent deletes of the same items
+   * are idempotent. Running it here — on the remote-update path, before the
+   * flush — is what stops a duplicated array from reaching disk and becoming
+   * the canvas's new truth.
+   */
+  function maybeCollapseCommentsDuplication(): void {
+    const current = commentsFromDoc(doc);
+    if (!hasDuplicateComments(current)) return;
+    const collapsed = dedupeCommentsById(current);
     doc.transact(() => {
-      if (applyHtmlToDoc(doc, canonical, origin)) stampBodyEdit(doc, origin);
+      applyCommentsToDoc(doc, collapsed, origin);
     }, origin);
-    lastHtml = canonical;
-    opts.journal?.record(slug, { bodyHash: hashBytes(canonical) });
     console.warn(
-      `[sync/${slug}] concurrent cold-seed duplication detected — collapsed to one copy (F1).`
+      `[sync/${slug}] comments lane held ${current.length} entries for ${collapsed.length} distinct comments — collapsed (#112).`
     );
   }
 
@@ -298,6 +321,12 @@ export function createCanvasSyncAgent(opts: CanvasSyncAgentOptions): CanvasSyncA
   }
 
   function writeCommentsIfChanged(): void {
+    // This lane writes `_comments/<slug>.json` DIRECTLY, not through the api's
+    // `saveCommentsForFile` — so it does not inherit that boundary's dedupe.
+    // Collapse first (issue #112): a duplicated array reaching disk is how the
+    // doubling outlived restarts and became the canvas's truth. Idempotent, and
+    // self-originated, so it can't re-enter `onDocUpdate`.
+    maybeCollapseCommentsDuplication();
     const next = commentsFromDoc(doc);
     const serialized = next.length > 0 ? `${JSON.stringify(next, null, 2)}\n` : '';
     if (serialized === lastComments) return;
@@ -444,9 +473,8 @@ export function createCanvasSyncAgent(opts: CanvasSyncAgentOptions): CanvasSyncA
           // F1 — adopt is also a "seed local up" (first link / fresh hub); claim
           // it + arm the repair window so two peers adopting the same draft into
           // one hub at once self-heal the same way the decision-table seed does.
-          markSeeded(doc, origin);
+          rememberSeed(doc, localHtml, localCss, origin);
         }, origin);
-        seedInfo = { body: localHtml, until: Date.now() + SEED_REPAIR_WINDOW_MS };
       }
       if (localComments !== null) {
         const parsed = tryParseJsonArray(localComments);
@@ -501,13 +529,13 @@ export function createCanvasSyncAgent(opts: CanvasSyncAgentOptions): CanvasSyncA
         if (applyHtmlToDoc(doc, body, origin)) stampBodyEdit(doc, origin);
         // F1 — claim the seed (clientID marker) in the SAME update so a
         // concurrent second seeder's merge resolves a single elected writer.
-        markSeeded(doc, origin);
+        rememberSeed(doc, body, localCss, origin);
       }, origin);
       lastHtml = body;
-      // Arm the de-dup repair window: if another peer seeded the same body at the
-      // same instant, the merged Y.Text will double — maybeRepairSeedDuplication
-      // (on the elected owner) collapses it back during this window.
-      seedInfo = { body, until: Date.now() + SEED_REPAIR_WINDOW_MS };
+      // Arm the de-dup repair window: if another peer seeded the same content at
+      // the same instant, the merged Y.Text will double — maybeRepairSeedDuplication
+      // (on the elected owner) collapses it back during this window. `localCss`
+      // is remembered too, since it collides identically (issue #114).
       opts.journal?.record(slug, { bodyHash: hashBytes(body) });
     };
 
@@ -594,23 +622,54 @@ export function createCanvasSyncAgent(opts: CanvasSyncAgentOptions): CanvasSyncA
       }
     }
 
-    // ---- css: follow the body winner (visually coupled) --------------------
-    if (bodyWinner === 'local') {
-      if (paths.css && localCss !== null && localCss !== docCss) {
+    // ---- css: PER-LANE resolution (issue #114 — was "follow the body winner")
+    // The css lane used to be the only Plane-A lane with no table and no
+    // duplication guard, which is why it was the only one that NEVER came out
+    // of a multi-peer cold start clean. decideCssColdStart owns the rows now;
+    // the two that matter are the exact-repeat collapse and the DDR-064
+    // empty-lane guard, and it finally consumes the `cssHash` checkpoint the
+    // journal has been writing since DDR-102.
+    {
+      const cssDecision = decideCssColdStart({
+        local: localCss,
+        doc: docCss,
+        journalHash: opts.journal?.get(slug)?.cssHash ?? null,
+        hash: hashBytes,
+        bodyWinner,
+      });
+      if (cssDecision.recoveredDuplication) {
+        // WARN, BUT DO NOT SNAPSHOT — symmetric with the body's
+        // `recover-seed-dup`, which deliberately doesn't either.
+        //
+        // A snapshot stood here briefly, on the reasoning that `X + X` is valid
+        // CSS (unlike a doubled body, which can't build) so the collapse might
+        // discard a real edit. The reasoning was wrong about the bytes:
+        // `isExactRepeat` is true only when the doc is EXACTLY local repeated
+        // N times, so the copies thrown away contain nothing the retained copy
+        // doesn't. The snapshot preserved zero unique bytes — and cost a slot
+        // in a per-slug ring buffer that `pruneSnapshots` evicts oldest-first
+        // at MAX_SNAPSHOTS_PER_SLUG. A hostile hub that keeps re-doubling this
+        // lane could therefore drive one worthless snapshot per reconcile and
+        // push the user's genuine `pre-sync-local` and conflict copies off the
+        // end — turning DDR-102's recovery spine into the attack surface.
+        // Adversarial review found it; the safety net was the vulnerability.
+        console.warn(`[sync/${slug}] cold-start css: ${cssDecision.reason}`);
+      }
+      if (cssDecision.winner === 'local' && paths.css && localCss !== null) {
         applyCssToDoc(doc, localCss, origin);
         lastCss = localCss;
         opts.journal?.record(slug, { cssHash: hashBytes(localCss) });
+      } else if (cssDecision.winner === 'hub') {
+        lastCss = docCss;
+        if (paths.css && docCss !== null && localCss !== docCss) {
+          const hash = hashBytes(docCss);
+          echoGuard.record(paths.css, hash);
+          writer(paths.css, docCss);
+          opts.journal?.record(slug, { cssHash: hash });
+        }
       } else {
         lastCss = docCss;
       }
-    } else {
-      lastCss = docCss;
-      if (paths.css && docCss !== null && localCss !== docCss) {
-        const hash = hashBytes(docCss);
-        echoGuard.record(paths.css, hash);
-        writer(paths.css, docCss);
-        opts.journal?.record(slug, { cssHash: hash });
-      }
     }
 
     // ---- meta: hub wins where it has an opinion, local seeds where it does not

package/apps/studio/sync/asset-push.ts

@@ -44,6 +44,7 @@ import { type Dirent, readdirSync, readFileSync, statSync } from 'node:fs';
 import path from 'node:path';
 
 import { type CanvasGroupLike, classifyProjectFile, isFilePlaneClass } from './file-membership.ts';
+import { failureReason, retryAfterMs } from './retry-after.ts';
 
 /** Max designRoot-relative depth (matches the classifier's 8-segment cap). */
 const MAX_SEGMENTS = 8;
@@ -84,27 +85,12 @@ export interface AssetPushProgress {
  *  the payload reaches `_sync.json` + every open tab, so it stays bounded). */
 export const MAX_LISTED_FAILURES = 20;
 
-/** Longest single pause the hub can ask for. Matches the hub's rate-limit
- *  window (60 s) — a `Retry-After` larger than that is either a typo or a hub
- *  we should not be blocking a boot sweep on. */
-const MAX_RETRY_DELAY_MS = 60_000;
-
-/** Where an absent/unparsable `Retry-After` lands. Old hubs (pre-fix) send a
- *  bare 429 with no header, and their window is the same 60 s. */
-const DEFAULT_RETRY_DELAY_MS = 60_000;
-
 /** Total time ONE sweep may spend waiting out 429s. The paced retry exists to
  *  keep an un-upgraded hub livable, not to turn a boot into an hour-long
  *  background stall — past this, the remaining refusals fail fast and the
  *  next-boot backstop takes them. */
 const MAX_SWEEP_BACKOFF_MS = 5 * 60_000;
 
-/** How much of an error body reaches `failed[].reason`. Enough to tell "rate
- *  limit exceeded" from a Cloudflare error page — the distinction the 2026-08-11
- *  RCA had to reconstruct from edge logs because the client kept only a status
- *  code. Hub-supplied text ⇒ bounded and stripped before it reaches the UI. */
-const ERROR_SNIPPET_CHARS = 80;
-
 /**
  * Every upload closes its connection. NOT an optimization — a correctness
  * requirement, learned the expensive way (2026-08-11, second pass).
@@ -333,38 +319,6 @@ async function probePresent(ctx: {
   }
 }
 
-/** `Retry-After: <seconds>` → ms, clamped. Only the delta-seconds form is
- *  parsed; the HTTP-date form is not something our hub emits. */
-function retryAfterMs(header: string | null): number {
-  const secs = Number(String(header ?? '').trim());
-  if (!Number.isFinite(secs) || secs <= 0) return DEFAULT_RETRY_DELAY_MS;
-  return Math.min(secs * 1000, MAX_RETRY_DELAY_MS);
-}
-
-/**
- * Why an upload was refused, in words — status PLUS a bounded snippet of the
- * body. The hub says `{"error":"rate limit exceeded"}`; an edge that never
- * reached the hub says HTML. Those are different bugs and the Sync panel should
- * not make a person read logs to tell them apart.
- *
- * The body is hub-supplied ⇒ untrusted (DDR-054): control characters stripped,
- * whitespace collapsed, hard length cap, and it only ever renders as text.
- */
-async function failureReason(res: Response): Promise<string> {
-  let snippet = '';
-  try {
-    snippet = (await res.text())
-      // biome-ignore lint/suspicious/noControlCharactersInRegex: stripping them is the point.
-      .replace(/[\u0000-\u001f\u007f]/g, ' ')
-      .replace(/\s+/g, ' ')
-      .trim()
-      .slice(0, ERROR_SNIPPET_CHARS);
-  } catch {
-    /* a body we cannot read tells us nothing — the status still does */
-  }
-  return snippet ? `HTTP ${res.status} — ${snippet}` : `HTTP ${res.status}`;
-}
-
 /**
  * One upload, with the two retries that are worth having in-boot.
  *

package/apps/studio/sync/cell-file-events.ts

@@ -89,6 +89,9 @@ export function startCellFileEvents(
     url: target.url,
     token: target.token,
     onPoke: (head) => healer.onPoke(head),
+    // The paired cell runtime does not open a second control provider. Route
+    // metadata invalidation to its bounded discovery queue, not the journal.
+    onDocuments: () => ctx.bus.emit('sync:documents-changed'),
   });
 
   // Every write this process makes surfaces here, because both synthetic-event