Immediate native documents

New reserves an account-bound window and opens a local untitled replica. The initial paragraph and first editable generation are ready before the text view is exposed; no server request blocks the editor. Attachment preserves the window ID, text view, replica, generations, and selection.

The draft owns a UUID creation token. POST /documents accepts creationtoken; migration 0008 adds a nullable token with a unique (ownerid, creation_token) index. Creation and lookup run under the writer transaction. Replays return the existing document and never overwrite a later title. The token is not authority: creation still requires membership and derives its owner from the session.

Drafts count as unsaved before initialization. Save/close awaits creation and queued content/title writes; failure retains the draft and token for retry. Discard changes the epoch so late responses cannot attach or upload discarded content. A server may already have created an empty document before cancellation. Local draft state is held in memory with the existing close/quit guards.

Double-clicking the title or File > Rename document opens the same title input. The model owns that buffer so Save/close also commits it; Escape cancels it. Titles over 1024 UTF-8 bytes remain editable with an error. Rename uses the existing document write authorization inside the authenticated, CSRF-protected POST /d/{sqid}/title route. Pending titles survive capability refreshes.

Deploy the backend migration/routes before publishing the native client. Older servers do not provide idempotent creation. Tests are documented in smoke/document-window/README.md. Design and implementation reviewed by GPT-6 Astra.