oficina / docs Public

Edit a document

Type into a document, reload, and the words are there — while the same
document still renders for a reader with no JavaScript.

The CRDT root moved from a Y.Text named "content" to a ProseMirror-shaped
XmlFragment named "prosemirror", which is what y-prosemirror requires.
That reaches the Rust core, the ABI (now v2), the seeded documents, the
read view and the wire gate. The core renders the fragment to text and to
HTML so the server keeps rendering documents without running JavaScript;
the browser loads a document's raw update log and POSTs edits back as Yjs
updates, validated through the same core.

Transport is plain HTTP, not a WebSocket: a socket is for live
collaboration between people, and holding one per open editor is exactly
what creates the hibernation problem in §7.3. The update-log format here
is what a socket will stream. No pagination and no toolbar — show.html
already sequenced pagination to a later layout plan. The Y.Text wire
fixtures stay: they test the update ENCODING, which is the actual §0
contract and is independent of which shared type a document holds.

The wasm sandbox stopped being a claim. §5.2 has argued it is a security
boundary because yrs calls from_utf8_unchecked on wire data; until this
branch nothing on the network could reach it. Measured: every single-byte
flip of a valid fixture (all 291) POSTed through the real router — 194
accepted, 97 rejected, zero read or render errors after any accept. One
flip triggered a genuine trap in yrs (panic_const_div_by_zero in
block_store::find_pivot) and was contained: instance discarded, 400
returned, nothing persisted, document readable, no hang.

Six bugs of consequence, all one shape — something reporting success
about work that never landed — and all six found by using the app, none
by the suite:

- EditorView appends a sibling instead of replacing its container.
- GET /updates returns concatenated updates and a single Y.applyUpdate
  decodes only the first, so a second edit vanished on reload. This
  needed TWO edits to appear; every single-edit test passed.
- A failed flush retried forever and merged later edits into the doomed
  batch, so one rejected 1.2MB paste silently took everything after it.
- Dropping a batch left the local doc diverged, so later edits returned
  204 — success — while never integrating.
- resync()'s own failure path could never retry, because a diverged doc
  produces 204s and never the 4xx that triggers one. A single transient
  failure recreated the silent loss for the whole session.
- The beforeunload keepalive fallback shares sendBeacon's ~64KB quota and
  could not carry the case its comment claimed. 100KB refused, 30KB through.

Each was reproduced before being fixed. The queue and resync state
machines are extracted into modules with regression tests in the gate.

Two defects were authored by the plan, not the implementation: a test
that asserted nothing, and copy telling a person to "copy anything
important before leaving this page" after resync had already wiped the
screen.

Known: the log grows until §4.1 snapshots land; the debounce move to 2s
buys headroom to ~2h16m of continuous typing, labelled as headroom; the
server can still 204 an update it cannot integrate; two tabs diverge
until a socket exists.

Discussion: https://amadan.net/oficina/docs/discussions/9

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011F5CivVm4CmL9ByfSSAaXA