| 1 | # Immediate native documents |
| 2 | |
| 3 | New reserves an account-bound window and opens a local untitled replica. The |
| 4 | initial paragraph and first editable generation are ready before the text view |
| 5 | is exposed; no server request blocks the editor. Attachment preserves the |
| 6 | window ID, text view, replica, generations, and selection. |
| 7 | |
| 8 | The draft owns a UUID creation token. POST /documents accepts creation_token; |
| 9 | migration 0008 adds a nullable token with a unique (owner_id, creation_token) |
| 10 | index. Creation and lookup run under the writer transaction. Replays return the |
| 11 | existing document and never overwrite a later title. The token is not authority: |
| 12 | creation still requires membership and derives its owner from the session. |
| 13 | |
| 14 | Drafts count as unsaved before initialization. Save/close awaits creation and |
| 15 | queued content/title writes; failure retains the draft and token for retry. |
| 16 | Discard changes the epoch so late responses cannot attach or upload discarded |
| 17 | content. A server may already have created an empty document before cancellation. |
| 18 | Local draft state is held in memory with the existing close/quit guards. |
| 19 | |
| 20 | Double-clicking the title or File > Rename document opens the same title input. |
| 21 | The model owns that buffer so Save/close also commits it; Escape cancels it. |
| 22 | Titles over 1024 UTF-8 bytes remain editable with an error. Rename uses the |
| 23 | existing document write authorization inside the authenticated, CSRF-protected |
| 24 | POST /d/{sqid}/title route. Pending titles survive capability refreshes. |
| 25 | |
| 26 | Deploy the backend migration/routes before publishing the native client. Older |
| 27 | servers do not provide idempotent creation. Tests are documented in |
| 28 | smoke/document-window/README.md. Design and implementation reviewed by GPT-6 Astra. |
| 29 | |
amadan