oficina / slides Public

Slice 2 of Slides, the browser editor and collab, is built, reviewed task by task, CI green at 0af8aaf, final whole-branch review clean after one fix wave, and deployed as the canary on slides.bds.oncarlos.com. Branch slice-2-editor contains worktree-slice-1 (slice 1) plus these commits; merging it merges both.

What is live

• The editor at /d/{sqid}/edit: slide strip of server thumbnails, a stage that is the server's own slide HTML with ProseMirror bound to every text block and the notes, inspector for deck, slide and block, add/reorder/duplicate/delete slides (drag, keyboard, buttons), canvas drag and resize with snap and full keyboard parity, the Desktop / Phone / Both switcher writing phone overrides, per-person undo, presence (avatars on the strip, outlines on blocks), image upload when a store is bound.
• Live-sync in Docs' shape: GET/POST /d/{sqid}/updates with length-framed Yjs updates and Slides-Seq, GET /d/{sqid}/stream SSE (update, presence), snapshots every 200 updates, presence in memory only.
• One op vocabulary: fixtures/ops-*.mjs mirrors core/src/ops.rs; vectors under fixtures/vectors are the contract both ways (internal/slides/core/vectors_test.go), regenerated and diffed by the gate.
• A parse gate on every posted update: bytes that would leave the deck unrenderable are refused with 422; the view is tolerant of wrong-typed leaves on both sides.
• Assets: presigned PUT, server-side sniffing and SVG sanitising, a deck_assets table of verified refs required by every serving route (session, share link, presentation).
• The gate now runs npm ci, the node tests, vector and bundle reproducibility, then make ci; CI on the runner reaches npm.

What is not

• The deployment has no object-store backend, so uploads answer 503 with a message; carlos store grant needs CARLOS_STORE_BACKEND on the platform first. Uploads also need https (crypto.subtle).
• No PDF export (slice 3), no comments, no version history. The phone-override badge lives in the inspector, not on the stage block (spec §3.2 note).
• Copy: 318 catalog keys in internal/slides/locales/en.toml, none through copy-review.

Rulings made without Paul, with the cost if wrong

1. href is stored as {href: url} and both sides read either shape; ProseMirror marks are named after the Y attributes (spec §1 row 12). Cost: a vector regeneration, already done.
2. Task 3's and Task 4's review fixes were folded into the next task in the same files rather than raced by a second writer. Cost: the next review had to verify them too; it did.
3. Font values are CSS family strings, not system|serif|mono words. Cost: none.
4. The four wrong-typed view shapes are accepted and rendered tolerantly rather than refused; the 422 gate is proven with a magnitude poison. Cost: a residual, noted below.
5. Reviews and fix rounds on lighter models after rate limits; the final review on the strongest. Cost: the final review still found one Critical, which is what it is for.

Residuals for slice 3

• A magnitude poison (phone.order = 1e300) reaching the log by any road other than appendUpdate still bricks: decode PhoneOverride.Order and Asset.Width/Height like Block.Z.
• serveAsset and /s/{token} replay the log per request: a (deck, seq) view cache.
• Presence client id is client-chosen (a colleague can be overwritten); key by (user, client).
• Assets registered before 0007 need re-registering (none exist in production).
• Tests owed: 409 on appendUpdate, stream ping/TTL, ids.mjs, nudge coalescing.

Merge is Paul's call. Slice 3 (export: layout engine, SVG thumbnails, PDF) is next unless redirected.