# Delivered

The default app now runs a new single-authority document core through the existing Milkdown editor, HTTP APIs and Hocuspocus protocol. This is an integrated greenfield replacement, not a separate prototype or a feature-flagged fallback. Production migration and full hosted-service parity were not delivered.

The plan was saved **before implementation** in [docs/plans/2026-10-12-collaboration-core.md](docs/plans/2026-10-12-collaboration-core.md). Implementation is in [server/core/](server/core/README.md), entered by `server/bootstrap.ts` and the unchanged `npm run serve` command. `npm run build` still builds the existing editor and MCP bundle. [preview.json](preview.json) describes startup on this sandbox's port, **55503**. Run `APPSIGNAL_LOG_PATH=$TMPDIR npm run serve`, then visit `/new` or `/library`.

The core's invariants are: one writer; binary Yjs authority; exactly one creation seed; explicit HTTP freshness; per-message role/epoch checks; isolated candidate validation; atomic snapshot/projection/revision/history/event/retry-receipt commit **before** broadcast; side-effect-free reads; and no delayed store, repair loop, live/cold authority switch or global quarantine. A separate public gateway keeps health and static pages independent of CRDT/SQLite work. Transactional PID ownership refuses accidental second authority processes on the same host. Old server modules remain for historical tests but are not imported by the new runtime.

Client changes fence durable/recent replay by document identity and access epoch, and destroy the owned Hocuspocus transport on disconnect. The latter fixes a connection-check timer leak found during verification. Shared parser typing was corrected, and authored-anchor lookup now uses binary searches rather than rescanning the whole document for every span. Browser telemetry is opt-in; the new server does not initialize external telemetry.

# Verification

**Final required gates passed:** `npm run build`, `npm run test:ci`, and `npm run test:pr:collab`. The full `npm test` and the new core's strict typecheck also passed. **The repository-wide typecheck failed**; it is not represented as passing.

Commands below include unsuccessful development attempts, not just the final successes. Telemetry was disabled for the later legacy server test runs. Logs are in `.verification/`; the individual 123-file diagnostic sweep and final dispositions are preserved in [docs/testing/core-verification-results.json](docs/testing/core-verification-results.json).

| Command executed | Result |
| --- | --- |
| `npm run build` | Passed initially and on final reruns. Includes `vite build`, the HTML transformation, `tsc -p tsconfig.mcp.json`, and `node scripts/bundle-mcp-deps.js`. Existing large-bundle warning remains. Final log: `.verification/build-final.log`. |
| `npm run test:ci` | Passed both runs. Final log: `.verification/test-ci-final.log`. |
| `npm run test:pr:collab` / `PROOF_ENABLE_TELEMETRY=0 npm run test:pr:collab` | Original gate passed. After adding integration, an early run completed assertions but retained provider timers and was interrupted (130). After fixing cleanup, expanded gate passed and exited **0**, including a final rerun after transactional ownership/publication changes. Final log: `.verification/test-pr-collab-final.log`. |
| `npm run test:collab:contracts` (invoked by the gates and broad suite) | Passed: 3 Yjs simulations, 5 Hocuspocus contracts, 4 history/anchor contracts. Both existing shutdown regression files also passed in the PR gate. |
| `npm test` | First run failed at historical `proof-mark-rehydration.test.ts`'s escaped-Markdown assertion. |
| `PROOF_ENABLE_TELEMETRY=0 npm test` | An intermediate run caught an old reconnect source assertion. Updated it to require epoch/identity fencing. Final run **passed and exited 0**, including retained original tests and 26 integrated scenarios. Final log: `.verification/npm-test-final.log`. |
| `npx tsc -p tsconfig.core.json` | Early attempts failed on a syntax error and shared parser/schema type errors. Corrected them; subsequent runs passed. |
| `npm run typecheck:core` | Passed, including the final core changes. Log: `.verification/core-typecheck-final.log`. |
| `npx tsc --noEmit` | Failed, exit 2, on both attempts. Final output contains **1,113 diagnostics**, including existing `rootDir: src` conflicts with server/scripts imports, unused declarations, and older editor/test typing errors. No diagnostics name the new `server/core` modules or integrated test. Log: `.verification/typecheck-final.log`. Full-tree type cleanup remains unfinished. |
| `npx tsx src/tests/core-integrated.test.ts` | First attempt failed while checking pathological-connection rejection; fixed the provider close assertion and numeric WebSocket error translation. Expanded development runs passed 12, 21 and 25 scenario assertions but exposed retained transport timers; those processes were interrupted. Fixed cleanup using the existing harness and fixed the actual client's transport lifecycle. |
| `npm run test:core` (invoked by final broad/PR scripts) | **26 running-app scenarios passed; process exited 0.** No forced successful exit masks open handles. Final runtime artifacts: `.verification/core-run-dKSimy/` and `.verification/core-run-RSsRyV/`. |
| `npx tsx scripts/test-retained.ts` / `PROOF_ENABLE_TELEMETRY=0 npx tsx scripts/test-retained.ts` | Diagnostic sweep, interrupted once and resumed, completed 123 distinct original test files: 115 initially passed, 8 failed. One was a stale source literal, fixed without removing assertions; seven replaced-server/browser tests were explicitly mapped and retired from aggregates. Final aggregate rerun passed. Individual commands/results are in the JSON ledger linked above. |
| `npx tsx src/tests/proof-mark-rehydration.test.ts` | Explicit rerun failed at the same historical escaped-Markdown assertion. Replacement semantics and coverage are documented below. |
| `npx tsx src/tests/collab-regression-guards-round2.test.ts` | Passed after replacing a stale literal retry-budget check with a numeric-budget check; all other assertions retained. |
| Node/Playwright browser availability probe | Failed because Chromium's executable is absent. No browser was installed or downloaded. |
| `APPSIGNAL_LOG_PATH=$TMPDIR npm run serve` | Launched manually twice, including the final implementation. Local HTTP probes succeeded. Both manual servers were shut down cleanly (exit 0). |
| `git diff --check` | Passed. `.github/workflows` has no changes. |

The inherited legacy test code initially attempted PostHog captures; the sandbox blocked those requests. Subsequent legacy runs explicitly disabled telemetry. No external results, documentation, repository copy, remote history, installation, deployment or service mutation was used. Local installed package source was used to verify protocol hook ordering. The repository's [collaboration test-author skill](.agents/skills/proof-collab-test-author/SKILL.md) guided the test layers; the benchmark override prohibited its external-docs path.

# Capabilities and regression coverage

| Capability | Delivered behavior and evidence |
| --- | --- |
| Existing editor, new documents, sharing | Same built editor served at `/d/:slug`; `/new` creates an immediately writable blank room. Real first fragment edit persists. Viewer/commenter/editor/owner tokens and access links remain. |
| Rich documents | Existing Milkdown schema retains frontmatter, tables, task lists, code blocks and authored spans. Integration checks structured state, clearing to empty, and canonical reads. Markdown whitespace/escaping is normalized semantically. |
| Live collaboration | Multiple actual providers converge under concurrent edits and offline reconnect. Passive joins/reconnect and duplicate replay do not change revision. Human awareness is ephemeral. |
| Durability | HTTP, live providers and persisted binary agree. SIGKILL/restart, fresh provider hydration and graceful shutdown retain final content and marks. Injected SQLite commit failure does not publish uncommitted content. |
| Comments and suggestions | Comment/reply, resolve/unresolve adapters; accept/reject implementation for insert/delete/replace; authored/comment preservation, ambiguous-anchor refusal, duplicate comment retries and finalized-suggestion replay protection tested. Resolve/unresolve UI interaction is not browser-tested. |
| Agent and bridge APIs | State, Markdown edits, revision-bound block snapshots/edits, operation and mark routes, rewrite, presence and bridge aliases route through the core. Agent edits reach live clients. Full compatibility with every historical response field is not claimed. |
| Title and notifications | Title commits in the document snapshot and reaches notification clients. Successful explicit agent mutations broadcast participation. Events and acknowledgements persist. |
| Identity, clone, history | Clones use new document and CRDT identities and edit independently. Last 32 revisions retained; restore changes epoch and disconnects stale rooms. |
| Access/lifecycle | Readonly protocol updates are refused. Pause/resume and restore fence old sessions; actual `CollabClient` cannot replay an earlier epoch's durable buffer into a refreshed session. Revoke/delete handlers remove access tokens and advance epoch. Revoke/delete themselves were not separately exercised in the integrated suite. |
| Library/accounts | Working browser library and owner discovery use an opaque HttpOnly cookie stored against the new core. **Changed:** local token/cookie ownership replaces Every account login and managed library synchronization. |
| Recovery | Corrupt binary never reseeds from Markdown. Open context becomes explicitly non-editable while the last committed read projection remains available. Repairs that infer lost text from row/mark metadata are removed. |
| Outage containment | Six-document stale-epoch churn leaves unrelated edits/public probes usable. Pathological provider update is rejected locally. SIGSTOP of the actual authority process leaves homepage/favicon responsive and makes health truthfully degraded; SIGCONT restores readiness. |
| Existing unrelated behavior | Original editor/mobile/marks/formatting/client/CI tests remain, apart from the explicit replacements below. The broad suite passes. Native application behavior and visual/mobile interaction were not directly exercised. |

Seven files were removed only from aggregate test scripts: `proof-mark-rehydration.test.ts`, `mutation-contract-stage-and-ws.test.ts`, `live-viewer-passive-reconnect-wiring.test.ts`, `share-new-doc-bootstrap-editability-regression.test.ts`, `share-live-viewer-rest-put-authority-regression.test.ts`, `agent-edit-fragment-base-regression.test.ts`, and `agent-mutations-imply-presence.test.ts`. **Every file, replacement, removed contract and browser limitation is named in [docs/testing/core-regression-map.md](docs/testing/core-regression-map.md).** Historical test files were not deleted. The two retained source-test updates are also described there. No workflow was edited; `test:pr:collab` now additionally runs the integrated suite.

# Direct observations and limits

I directly launched the default server, created a document, obtained an editable `pm-yjs-v1` session, fetched the built editor HTML and observed ready health. The final manual probe is saved in `.verification/manual-observation.json`; it created slug `6d9ebadc370d2e5d`. Automated clients directly exercised the running server and the existing client class, rather than hand-wiring authority maps. All intentionally launched test/manual processes were allowed to finish or explicitly stopped.

There was **no browser executable**, so I did not observe rendered editor interaction, focus/selection, cursor placement, mobile layout, popovers, or visual startup-preview removal. Existing source/contract tests do not substitute for that observation. The incident test is a mapped local regression, not proof of the exact historical cause of the March 17 outage.

Remaining limitations:

- This is a **single-host, single-authority** deployment. PID ownership is not a distributed lease. There is no production migration, horizontal routing, automatic failover/restart, or deployment validation.
- The new versioned SQLite store starts separately from the frozen database. Legacy migrations, quarantine repair workers and delayed projection reconstruction are intentionally unsupported.
- External Every OAuth/account synchronization, S3/image snapshot hosting, external bug publication and AppSignal/PostHog production monitoring are not integrated into the new server. Local health and structured process/error logs are provided. Static homepage assets and the existing editor remain.
- Limits are explicit: 512 KB content/mark JSON, 2 MB binary snapshots/messages, 2,000 blocks/marks, 128 rooms, 256 sockets, 64 in-flight gateway requests and a 5-second deadline. Full snapshots per content commit prioritize auditable durability over throughput. Retention is 32 revisions, 512 retry receipts and 1,000 events per document. Beyond those limits, requests fail rather than entering repair loops.
- Maximum-size/long-duration throughput, slow-disk saturation, adversarial protocol fuzzing, backup restoration, arbitrary nested structural suggestion combinations, complete native/SDK compatibility and all historical API response shapes remain unverified. Losing the library cookie loses its discovery list; retained document links/owner secrets still work.
- The repository-wide TypeScript check remains red, despite passing build/MCP and new-core typechecks. Many retained tests still exercise historical modules; they are not evidence of exhaustive new-core parity.