@1agh/maude 1.0.11 → 1.3.0

package/apps/studio/sync/repeated-module.ts

@@ -0,0 +1,73 @@
+// A canvas body that is one whole module written again right after itself.
+//
+// How it happens: two replicas each seed the SAME file into a shared document
+// independently (a desktop adopting its file while the hub's own copy was not
+// visible yet), and the CRDT keeps both inserts — the text concatenates. Every
+// later start that repeats the race doubles it again (2×, 4×, …), and a write
+// cut short leaves a whole copy plus a prefix of itself. Reported live on the
+// Alligators project, 2026-09-15: 38 canvases at exactly 4×, one at 1× + 879
+// characters.
+//
+// A module has ONE default export, so a body carrying the same module twice is
+// never something a person wrote. The repair keeps exactly one copy; anything
+// that is not a clean repeat (a real edit in either copy) is left alone for the
+// conflict machinery.
+
+const DEFAULT_EXPORT = /\bexport\s+default\b/g;
+
+export interface RepeatedModule {
+  /** The one copy to keep. */
+  unit: string;
+  /** Whole copies found (a trailing partial copy is counted as +0.5 → rounded up). */
+  times: number;
+  /** True when the tail was a cut-short copy (a prefix of the module). */
+  partialTail: boolean;
+}
+
+/**
+ * The single module a repeated canvas body is made of, or null when the body
+ * is not a clean repeat of one module.
+ */
+export function collapseRepeatedModule(body: string): RepeatedModule | null {
+  if (typeof body !== 'string' || body.length < 32) return null;
+  // Cheap gate: one module, one default export.
+  const exports = body.match(DEFAULT_EXPORT)?.length ?? 0;
+  if (exports < 2) return null;
+  // The second copy starts where the file's own opening appears again.
+  const probe = body.slice(0, Math.min(80, Math.floor(body.length / 2)));
+  const second = body.indexOf(probe, 1);
+  if (second <= 0) return null;
+  const unit = body.slice(0, second);
+  if ((unit.match(DEFAULT_EXPORT)?.length ?? 0) !== 1) return null;
+  let rest = body.slice(second);
+  let times = 1;
+  while (rest.startsWith(unit)) {
+    rest = rest.slice(unit.length);
+    times++;
+  }
+  if (rest === '') return times >= 2 ? { unit, times, partialTail: false } : null;
+  // A copy cut short: what is left must be the start of the module, and long
+  // enough that this is not a coincidence.
+  if (rest.length >= probe.length && unit.startsWith(rest)) {
+    return { unit, times: times + 1, partialTail: true };
+  }
+  return null;
+}
+
+/**
+ * A stylesheet written k≥2 times in a row (the same race on a canvas's CSS
+ * lane). Exact repeats only — a real stylesheet is never itself twice over.
+ */
+export function collapseRepeatedText(
+  text: string,
+  minUnit = 32
+): { unit: string; times: number } | null {
+  if (typeof text !== 'string' || text.length < minUnit * 2) return null;
+  for (let k = 8; k >= 2; k--) {
+    if (text.length % k) continue;
+    const unit = text.slice(0, text.length / k);
+    if (unit.length < minUnit || !unit.trim()) continue;
+    if (unit.repeat(k) === text) return { unit, times: k };
+  }
+  return null;
+}

package/apps/studio/sync/retry-after.ts

@@ -0,0 +1,169 @@
+// What a refusal MEANS — shared by every sync lane that talks to a hub.
+//
+// This module exists because the lesson had to be learned twice. The
+// 2026-08-11 RCA (alligators, 182 assets, ~5 moved per boot) taught the asset
+// push lane that a 429 is not a failure but an instruction: the hub says when
+// to come back, so come back then, and keep enough of the body to tell "rate
+// limit exceeded" from a Cloudflare error page. All of it lived as private
+// constants inside `asset-push.ts`.
+//
+// So when the journal file plane (DDR-226) became the ONE lane for project
+// files, it inherited none of it — `HTTP ${res.status}` and nothing else. A
+// 429 read as an ordinary error, the pass fired its remaining requests into a
+// closed door, and because the cursor only advances on a clean pass the very
+// next tick re-requested the identical set. The retries were what kept the
+// bucket empty. Issue #109: every asset of a linked project refused, forever,
+// while the status bar said `synced` and a person saw broken images.
+//
+// One copy, imported by both lanes, so there is no third time.
+
+/** Longest single pause a hub can ask for. Matches the hub's rate-limit
+ *  window (60 s) — a `Retry-After` larger than that is either a typo or a hub
+ *  we should not be blocking a boot sweep on. */
+export const MAX_RETRY_DELAY_MS = 60_000;
+
+/** Where an absent/unparsable `Retry-After` lands. Old hubs (pre-fix) send a
+ *  bare 429 with no header, and their window is the same 60 s. */
+export const DEFAULT_RETRY_DELAY_MS = 60_000;
+
+/**
+ * Shortest pause a hub can talk us into.
+ *
+ * The clamp above stops a hub asking for a pause so long it bricks the lane.
+ * This is the other end of the same argument, and it is the one that matters:
+ * the header is hub-controlled, `Retry-After: 0.001` parses as a perfectly
+ * valid millisecond, and a hold of one millisecond is not a hold. A hub that
+ * refuses everything and asks us straight back would put us into the issue-#109
+ * storm again — a refusal loop at full poll rate — with the client believing it
+ * was being obedient the whole time.
+ */
+export const MIN_RETRY_DELAY_MS = 1_000;
+
+/** How much of an error body reaches a `reason`. Enough to tell "rate limit
+ *  exceeded" from a Cloudflare error page — the distinction the 2026-08-11 RCA
+ *  had to reconstruct from edge logs because the client kept only a status. */
+export const ERROR_SNIPPET_CHARS = 80;
+
+/** How much of an error body we will READ to produce those characters.
+ *  Bounded on purpose: the body comes from a component DDR-054 calls
+ *  untrusted, and `await res.text()` on a body that never ends is a heap fill
+ *  dressed as diagnostics. */
+const MAX_SNIPPET_READ_BYTES = 8 * 1024;
+
+/**
+ * `Retry-After: <seconds>` → ms, clamped.
+ *
+ * Only the delta-seconds form is parsed; the HTTP-date form is not something
+ * our hub emits, and guessing at clock skew to support it would make the
+ * pause less predictable, not more.
+ */
+export function retryAfterMs(header: string | null | undefined): number {
+  const secs = Number(String(header ?? '').trim());
+  if (!Number.isFinite(secs) || secs <= 0) return DEFAULT_RETRY_DELAY_MS;
+  // Clamped at BOTH ends — the ceiling stops a hub bricking the lane, the
+  // floor stops one talking us out of pausing at all.
+  return Math.min(Math.max(secs * 1000, MIN_RETRY_DELAY_MS), MAX_RETRY_DELAY_MS);
+}
+
+/** Read at most `MAX_SNIPPET_READ_BYTES` of a body, then hang up. */
+async function readBounded(res: Response): Promise<string> {
+  const body = res.body;
+  if (!body?.getReader) {
+    // No stream to cap (a fixture `Response`, an older polyfill). The text is
+    // still bounded on the way out by `ERROR_SNIPPET_CHARS`.
+    try {
+      return (await res.text()).slice(0, MAX_SNIPPET_READ_BYTES);
+    } catch {
+      return '';
+    }
+  }
+  const reader = body.getReader();
+  const chunks: Uint8Array[] = [];
+  let total = 0;
+  try {
+    while (total < MAX_SNIPPET_READ_BYTES) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      if (value) {
+        chunks.push(value);
+        total += value.byteLength;
+      }
+    }
+  } catch {
+    /* a body we cannot read tells us nothing — the status still does */
+  } finally {
+    void reader.cancel().catch(() => {});
+  }
+  const joined = new Uint8Array(total);
+  let at = 0;
+  for (const c of chunks) {
+    joined.set(c, at);
+    at += c.byteLength;
+  }
+  return new TextDecoder().decode(joined);
+}
+
+/**
+ * Why a request was refused, in words — status PLUS a bounded snippet of the
+ * body. The hub says `{"error":"rate limit exceeded"}`; an edge that never
+ * reached the hub says HTML. Those are different bugs and the Sync panel
+ * should not make a person read logs to tell them apart.
+ *
+ * The body is hub-supplied ⇒ untrusted (DDR-054): control characters stripped,
+ * whitespace collapsed, hard length cap, and it only ever renders as text.
+ */
+export async function failureReason(res: Response): Promise<string> {
+  const snippet = (await readBounded(res))
+    // biome-ignore lint/suspicious/noControlCharactersInRegex: stripping them is the point.
+    .replace(/[\u0000-\u001f\u007f]/g, ' ')
+    .replace(/\s+/g, ' ')
+    .trim()
+    .slice(0, ERROR_SNIPPET_CHARS);
+  return snippet ? `HTTP ${res.status} — ${snippet}` : `HTTP ${res.status}`;
+}
+
+/** A refusal that names a WALL rather than a fault: the hub is willing, just
+ *  not now. Every lane that can hit one reports it in this shape. */
+export interface RateLimited {
+  rateLimited: true;
+  /** How long the hub asked us to wait, already clamped. */
+  retryAfterMs: number;
+}
+
+/** Is this response the hub telling us to slow down? */
+export function isRateLimited(res: Pick<Response, 'status'>): boolean {
+  return res.status === 429;
+}
+
+/**
+ * Is this response BACKPRESSURE — the peer is willing, just not right now?
+ *
+ * Wider than `isRateLimited`, and the two are deliberately both exported:
+ * a 429 has one precise meaning that other call sites depend on, while this is
+ * the question the transfer lanes actually want to ask.
+ *
+ * Two cases:
+ *   - 429, always. It has one meaning even bare, and `retryAfterMs` supplies a
+ *     sane default when the header is missing.
+ *   - 503 or 502 that CARRIES a `Retry-After`. The header is the peer saying
+ *     "come back at this time", which is precisely what distinguishes a busy
+ *     peer from a broken one.
+ *
+ * THE HEADER IS THE DISCRIMINATOR, and it is doing real work rather than being
+ * a formality. A cell that is starting answers `503 Retry-After: <n>` (see
+ * `cell-do.mjs` `#resolveStorageCredentials`), and firing this pass's whole
+ * request budget into that window is how a slow start becomes a failed one.
+ * A cell that genuinely cannot obtain storage answers a BARE 503 — a broken
+ * deployment, not a wall — and that one must stay an ordinary refusal so the
+ * request ceiling bounds it and the failure surfaces per file.
+ *
+ * Treating every 5xx as backpressure would erase exactly that distinction and
+ * make a broken hub look like a busy one, forever.
+ */
+export function isBackpressure(res: Pick<Response, 'status'> & { headers?: Headers }): boolean {
+  if (res.status === 429) return true;
+  if (res.status === 503 || res.status === 502) {
+    return Boolean(res.headers?.get?.('retry-after'));
+  }
+  return false;
+}

package/apps/studio/sync/revision-barrier.ts

@@ -0,0 +1,129 @@
+// Revision visibility — plan T14 (DDR-241).
+//
+// One accepted action can change several canvases (a folder move, an agent's
+// multi-file edit, a restore). The hub stamps every document it writes for a
+// revision with `acceptedRevision` and the number of documents in that
+// revision (`acceptedCohort`). A receiving studio must not leave its checkout —
+// which is what the renderer and the file tree read — holding half of such a
+// revision: canvas A at revision 12 importing a canvas B still at 11 is a
+// state the project never had.
+//
+// So each document's projection ARRIVES here when it is ready to write the
+// revision, and the barrier releases the whole cohort together, in one tick,
+// once every document has arrived. A document this peer does not hold yet (one
+// created in the same action arrives by pull) or will never hold (outside its
+// groups) must not wedge the others: after `timeoutMs` the barrier releases
+// what it has. A document that is already on disk at the revision (a fresh
+// projection's first write) reports `present` and holds nothing.
+
+export interface RevisionBarrier {
+  /**
+   * A projection is ready to write `revision`. Returns true when the write is
+   * HELD — `release` runs later (possibly synchronously, before this returns,
+   * when this arrival completes the cohort).
+   */
+  arrive(revision: number, cohort: number, key: string, release: () => void): boolean;
+  /** A document already on disk at `revision` — counts, holds nothing. */
+  present(revision: number, cohort: number, key: string): void;
+  /** Revisions still waiting (tests/diagnostics). */
+  waiting(): number[];
+  stop(): void;
+}
+
+interface Cohort {
+  expected: number;
+  arrived: Set<string>;
+  held: Map<string, () => void>;
+  timer: ReturnType<typeof setTimeout> | null;
+}
+
+export function createRevisionBarrier(
+  opts: { timeoutMs?: number; log?: Pick<Console, 'warn'> } = {}
+) {
+  const timeoutMs = opts.timeoutMs ?? 1500;
+  const log = opts.log ?? console;
+  const cohorts = new Map<number, Cohort>();
+  /** Revisions already released — a late arrival writes straight through. */
+  let releasedUpTo = 0;
+  const released = new Set<number>();
+  /**
+   * Documents that reported `present` before anyone waited on their revision
+   * (a pulled document can land before its sibling's update is flushed). Kept
+   * briefly so the cohort, when it opens, already counts them.
+   */
+  const early = new Map<number, Set<string>>();
+
+  function release(revision: number, reason: 'complete' | 'timeout'): void {
+    const c = cohorts.get(revision);
+    if (!c) return;
+    cohorts.delete(revision);
+    if (c.timer) clearTimeout(c.timer);
+    released.add(revision);
+    if (released.size > 512) {
+      // Bounded memory: forget the oldest half; they are long settled.
+      const sorted = [...released].sort((a, b) => a - b);
+      for (const r of sorted.slice(0, 256)) released.delete(r);
+      releasedUpTo = Math.max(releasedUpTo, sorted[255] ?? 0);
+    }
+    if (reason === 'timeout') {
+      log.warn(
+        `[sync/revision] revision ${revision}: ${c.arrived.size} of ${c.expected} documents here — showing them without the rest.`
+      );
+    }
+    // One tick: every held write runs back to back.
+    for (const fn of c.held.values()) {
+      try {
+        fn();
+      } catch (err) {
+        log.warn(`[sync/revision] a held write failed: ${(err as Error).message}`);
+      }
+    }
+  }
+
+  function cohortFor(revision: number, expected: number): Cohort | null {
+    if (released.has(revision) || revision <= releasedUpTo) return null;
+    let c = cohorts.get(revision);
+    if (!c) {
+      c = { expected, arrived: new Set(early.get(revision) ?? []), held: new Map(), timer: null };
+      early.delete(revision);
+      c.timer = setTimeout(() => release(revision, 'timeout'), timeoutMs);
+      cohorts.set(revision, c);
+    }
+    return c;
+  }
+
+  const barrier: RevisionBarrier = {
+    arrive(revision, cohort, key, fn) {
+      if (!(cohort > 1) || !Number.isInteger(revision)) return false;
+      const c = cohortFor(revision, cohort);
+      if (!c) return false;
+      c.arrived.add(key);
+      c.held.set(key, fn);
+      if (c.arrived.size >= c.expected) release(revision, 'complete');
+      return true;
+    },
+    present(revision, cohort, key) {
+      if (!(cohort > 1) || !Number.isInteger(revision)) return;
+      // Counts toward a revision somebody is waiting on; never opens one — a
+      // document already on disk has nothing to wait for.
+      const c = cohorts.get(revision);
+      if (!c) {
+        if (released.has(revision) || revision <= releasedUpTo) return;
+        const set = early.get(revision) ?? new Set<string>();
+        set.add(key);
+        early.set(revision, set);
+        if (early.size > 64) early.delete(Math.min(...early.keys()));
+        return;
+      }
+      c.arrived.add(key);
+      if (c.arrived.size >= c.expected) release(revision, 'complete');
+    },
+    waiting: () => [...cohorts.keys()],
+    stop() {
+      for (const c of cohorts.values()) if (c.timer) clearTimeout(c.timer);
+      cohorts.clear();
+      early.clear();
+    },
+  };
+  return barrier;
+}

package/apps/studio/sync/seed-progress.ts

@@ -0,0 +1,218 @@
+// How far the file plane has got — derived from the LEDGER, which is the one
+// thing that stayed correct.
+//
+// THE PROBLEM THIS SOLVES. During two real runs against an 8.8 GB project the
+// status payload reported `files: {synced: 0, pushed: 0, pulled: 0}` for twenty
+// minutes while 2 961 ledger rows changed underneath it. The counters were not
+// broken so much as mis-sourced: `sync/index.ts` derived them from PER-PASS
+// results, and a pass where nothing converges is legitimately all zeros. The
+// ledger, meanwhile, was current to within a second the whole time and nothing
+// read it.
+//
+// And even correct counters could not answer the question a seed actually
+// raises. `synced`, `pushed`, `pulled` are numerators with no denominator, so
+// no surface could say "1 412 of 2 961" — only "1 412", which is
+// indistinguishable from "1 412 and finished".
+//
+// A LEAF MODULE, like `limits.ts`, and for the same reason: `status.ts` will
+// import this, and this must never import back. It takes ledger rows and
+// returns a shape. No disk, no clock beyond what it is handed, no I/O.
+
+import type { DeliveryState, LedgerRow } from './file-ledger.ts';
+
+/** Why nothing is moving, when nothing is moving. */
+export type BlockedClass = 'too-large' | 'quota' | 'unreachable' | 'refused';
+
+export type SeedPhase =
+  /** Walking the tree; the denominator is not final yet. */
+  | 'scanning'
+  /** Moving files, with work outstanding. */
+  | 'seeding'
+  /** A wall we are waiting out — a rate limit, a quota, an unreachable peer. */
+  | 'paused'
+  /** Outstanding work that no amount of waiting will move on its own. */
+  | 'blocked'
+  /** Nothing outstanding. */
+  | 'converged';
+
+export interface SeedProgress {
+  phase: SeedPhase;
+  /** Rows in scope — THE DENOMINATOR the old counters never had. */
+  tracked: number;
+  /** Rows in a terminal-good state. */
+  delivered: number;
+  /** `tracked - delivered - blocked`, floored at 0. */
+  remaining: number;
+  /** Bytes still to move, as far as the ledger knows. Best-effort. */
+  bytesRemaining: number;
+  /** Outstanding rows no retry will clear on its own, by class. */
+  blocked: { class: BlockedClass; count: number }[];
+  /** Which ceiling ended the last pass, when one did. */
+  passCapped?: 'requests' | 'files' | 'bytes';
+  /** null until a real throughput sample exists — NEVER a guess. */
+  etaMs: number | null;
+  /** When this seed was first observed to have outstanding work. */
+  startedAt: number | null;
+}
+
+/**
+ * States that mean "this file is where it needs to be".
+ *
+ * `on-hub` counts. A stricter bar (`durable`, `everywhere`) would be more
+ * truthful about replication but would make the denominator un-completable for
+ * a project whose hub has not finished mirroring — a progress bar that never
+ * reaches the end is worse than one that reaches it slightly early, and the
+ * mirroring state has its own surface.
+ */
+const DELIVERED: ReadonlySet<DeliveryState> = new Set<DeliveryState>([
+  'on-hub',
+  'durable',
+  'at-peer',
+  'ui-healed',
+  'everywhere',
+]);
+
+/** States that will not move again without something changing. */
+const BLOCKED: ReadonlySet<DeliveryState> = new Set<DeliveryState>([
+  'refused',
+  'referenced-but-unoffered',
+]);
+
+export interface SeedProgressInput {
+  rows: Record<string, LedgerRow>;
+  now: number;
+  /** The lane is holding until this instant, if it is. */
+  pausedUntil?: number | null;
+  /** Why it is holding — carried through to the phase and the wording. */
+  pauseCause?: 'hub-asked' | 'unreachable' | 'quota' | null;
+  /** Set when the last pass stopped on a ceiling rather than on the work. */
+  passCapped?: 'requests' | 'files' | 'bytes';
+  /** True while the first scan of this boot has not finished. */
+  scanning?: boolean;
+  /** Previous result, for `startedAt` continuity and the throughput sample. */
+  previous?: SeedProgress | null;
+  /** Bytes delivered since `previous` was computed, if the caller knows. */
+  deliveredSince?: { bytes: number; ms: number } | null;
+}
+
+/**
+ * Fold the ledger into one progress shape.
+ *
+ * Total and pure. Every field is derivable from the rows plus what the caller
+ * observed; nothing is inferred from a wall clock this function reads itself.
+ */
+export function computeSeedProgress(input: SeedProgressInput): SeedProgress {
+  const { rows, now } = input;
+  let tracked = 0;
+  let delivered = 0;
+  let bytesRemaining = 0;
+  const blockedCounts = new Map<BlockedClass, number>();
+
+  for (const row of Object.values(rows)) {
+    tracked += 1;
+    const state = row.state;
+    if (state && DELIVERED.has(state)) {
+      delivered += 1;
+      continue;
+    }
+    if (state && BLOCKED.has(state)) {
+      const cls = classifyBlocked(row);
+      blockedCounts.set(cls, (blockedCounts.get(cls) ?? 0) + 1);
+      continue;
+    }
+    // Outstanding. `size` is the stat cache, so it is what we know rather than
+    // what is true — a row we have never stat'd contributes nothing, which is
+    // why `bytesRemaining` is documented as best-effort rather than exact.
+    if (Number.isFinite(row.size)) bytesRemaining += row.size as number;
+  }
+
+  const blocked = [...blockedCounts.entries()]
+    .map(([cls, count]) => ({ class: cls, count }))
+    .sort((a, b) => b.count - a.count);
+  const blockedTotal = blocked.reduce((n, b) => n + b.count, 0);
+  const remaining = Math.max(0, tracked - delivered - blockedTotal);
+
+  const paused =
+    typeof input.pausedUntil === 'number' && Number.isFinite(input.pausedUntil)
+      ? input.pausedUntil > now
+      : false;
+
+  const phase: SeedPhase = input.scanning
+    ? 'scanning'
+    : paused
+      ? 'paused'
+      : remaining > 0
+        ? 'seeding'
+        : blockedTotal > 0
+          ? 'blocked'
+          : 'converged';
+
+  return {
+    phase,
+    tracked,
+    delivered,
+    remaining,
+    bytesRemaining,
+    blocked,
+    ...(input.passCapped ? { passCapped: input.passCapped } : {}),
+    etaMs: estimateEta(bytesRemaining, input.deliveredSince ?? null),
+    startedAt: resolveStartedAt(input, remaining, now),
+  };
+}
+
+/**
+ * An ETA, or `null`.
+ *
+ * NULL UNTIL THERE IS A REAL SAMPLE, and that restraint is the point. During
+ * the 2026-09-03 investigation a two-second throughput sample read as "4 MB/s,
+ * about ten minutes left" and was reported to a person as such; the sustained
+ * rate was ~270 kB/s of retry traffic and the true answer was "never". A
+ * fabricated ETA does not merely mislead, it stops people looking.
+ *
+ * So: no sample, no number. And a sample of zero delivered bytes is not a
+ * slow rate, it is no information at all.
+ */
+function estimateEta(
+  bytesRemaining: number,
+  sample: { bytes: number; ms: number } | null
+): number | null {
+  if (!sample || sample.bytes <= 0 || sample.ms <= 0) return null;
+  const bytesPerMs = sample.bytes / sample.ms;
+  if (!Number.isFinite(bytesPerMs) || bytesPerMs <= 0) return null;
+  const ms = bytesRemaining / bytesPerMs;
+  if (!Number.isFinite(ms)) return null;
+  // A week is not an estimate, it is a way of saying we do not know.
+  return ms > 7 * 24 * 3_600_000 ? null : Math.round(ms);
+}
+
+/** Keep the original start across ticks; clear it once there is nothing left. */
+function resolveStartedAt(input: SeedProgressInput, remaining: number, now: number): number | null {
+  if (remaining <= 0) return null;
+  const prev = input.previous?.startedAt;
+  return typeof prev === 'number' && Number.isFinite(prev) ? prev : now;
+}
+
+/**
+ * Which wall this row is behind.
+ *
+ * FROM THE ROW'S OWN `blockedClass`, which the writer set at the moment it
+ * refused. The first version matched on `row.reason` and claimed in this very
+ * comment that the matching was "never on hub-supplied text" — which was wrong
+ * by one hop: `reason` can be a `failureReason()` string embedding a bounded
+ * snippet of a hub error body, so a hostile hub answering with a body
+ * containing "too big" could steer how its own refusals were labelled. Only
+ * cosmetic, and only in the panel, but a classifier a peer can influence is not
+ * a classifier.
+ *
+ * The string fallback stays for rows written before the field existed — bounded
+ * to our own sentences, and it degrades to `refused`, which is the honest
+ * answer when we do not know.
+ */
+function classifyBlocked(row: LedgerRow): BlockedClass {
+  if (row.blockedClass) return row.blockedClass;
+  const reason = (row.reason ?? '').toLowerCase();
+  if (reason.startsWith('too big')) return 'too-large';
+  if (reason.startsWith("this project's upload allowance")) return 'quota';
+  if (reason.startsWith('could not reach')) return 'unreachable';
+  return 'refused';
+}

package/apps/studio/sync/seed-repair.ts

@@ -0,0 +1,46 @@
+// Both sync handlers must repair the live seed race before projecting (#121).
+import type * as Y from 'yjs';
+import {
+  applyCssToDoc,
+  applyHtmlToDoc,
+  cssFromDoc,
+  htmlFromDoc,
+  markSeeded,
+  seededByFromDoc,
+  stampBodyEdit,
+} from './codec.ts';
+import { isExactRepeat } from './cold-start.ts';
+
+export const SEED_REPAIR_WINDOW_MS = 10_000;
+type Seed = { body: string; css: string | null; until: number };
+const seeds = new WeakMap<Y.Doc, Seed>();
+
+export function rememberSeed(doc: Y.Doc, body: string, css: string | null, origin: unknown): void {
+  seeds.set(doc, { body, css, until: Date.now() + SEED_REPAIR_WINDOW_MS });
+  markSeeded(doc, origin);
+}
+
+/** Exact repeats only; divergent seeds are preserved for conflict recovery. */
+export function repairSeedDuplication(doc: Y.Doc, origin: unknown): ('body' | 'css')[] {
+  const seed = seeds.get(doc);
+  if (!seed) return [];
+  if (Date.now() > seed.until) {
+    seeds.delete(doc);
+    return [];
+  }
+  if (seededByFromDoc(doc) !== doc.clientID) return [];
+  const repaired: ('body' | 'css')[] = [];
+  doc.transact(() => {
+    if (isExactRepeat(htmlFromDoc(doc), seed.body)) {
+      applyHtmlToDoc(doc, seed.body, origin);
+      stampBodyEdit(doc, origin);
+      repaired.push('body');
+    }
+    const css = cssFromDoc(doc);
+    if (css !== null && seed.css !== null && isExactRepeat(css, seed.css)) {
+      applyCssToDoc(doc, seed.css, origin);
+      repaired.push('css');
+    }
+  }, origin);
+  return repaired;
+}