id: build: durable multiplayer note checkpoints and merges

Parent: #2048 (ID Zettelkasten design). Phase 3 — depends on #3814 (stable note identity/revision graph) and Drew's explicit answer to Q2 on #2048 (shared-write authority).

Bridge the existing live ProseMirror session to durable note revisions. Key sessions by stable note ID rather than filename; keep live steps/cursors as transient transport; on save/checkpoint publish a signed immutable revision with the current note ID and parent head(s). A stale/offline edit must not overwrite another writer: retain concurrent heads and require an explicit merge revision. Do not make one web process's in-memory collaboration state the replicated source of truth.

Gate: before implementing any shared-write authorization, re-read #2048 Q2. Use the selected policy; if Drew has not answered, park without changing authorization behavior. Do not infer write permission from friendly-name resolution or the reader's writer-set projection. No cross-store resolver work (that remains #2259).

Acceptance:

Reopening a note by stable ID recovers its latest known revision and history across server restart/replica sync.
A normal live session can checkpoint to a signed revision; ephemeral steps/cursors are not emitted as permanent events.
Concurrent/offline sessions create separate heads; an explicit merge names its parents; no last-writer-wins data loss.
The chosen group/write policy is tested at the boundary and is separate from viewer-specific visibility.
Existing filename-based document editing remains compatible during migration; tests cover old and new paths.

CODE-1554

agent-note:v1 — queued, parent #2048 phase 3; queue task 5826, dedupe repo-health:v1:fix:developing-today/code:issue:3819. Resume only after #3814 lands and Drew answers shared-write authority Q2 on #2048; then persist signed checkpoints and explicit concurrent merges. Filed by repo-worker-code, OpenChamber scheduled lane, 2026-11-01T16:54Z.

🤖 Agent note · parked — claimed early; both start gates in the packet are unmet

Agent: queue worker (repo-worker-code), lane F (repo-queue-worker-shift-f)
Session / ID: queue task 5826 (small_fix, Phase 3 of id: design: Zettelkasten layer — multiplayer docs/wiki on ID #2048), claimed 2026-11-01T17:40Z, parked per the packet's own instruction ("if claimed early, park with those resume conditions")
Found via: queue claim; gate check against fresh GitHub + queue state
Gate evidence (fresh, 2026-11-01):
- Gate 1 — id: build: stable note identity and revision graph #3814 merged: NOT met. Issue id: build: stable note identity and revision graph #3814 (Phase 1: stable note identity and revision graph) is OPEN; its packet, queue task 5824, is currently claimed by another lane — work is in flight, nothing merged yet. (Phase 2's task 5825 is likewise parked behind it.)
- Gate 2 — Drew's explicit answer to Q2 on id: design: Zettelkasten layer — multiplayer docs/wiki on ID #2048: NOT met. Q2 asks who may append revisions to a shared notebook — (a) group Write members with visibility handled separately by the id: design: writer-set + view-projection spec for pkgs/id — representation, set-change semantics, discovery query (from #2030) #2238 projection (recommended), (b) a new per-note ACL/owner model, or (c) any group member. The latest comment on id: design: Zettelkasten layer — multiplayer docs/wiki on ID #2048 is the task 5733 routing note (2026-11-01T16:55Z); no answer from Drew appears there or on this issue. This task's acceptance requires shared-write authorization to follow Drew's explicit answer — proceeding on the recommendation alone would pre-empt a product authority decision that is genuinely Drew's.
Resume conditions (both required): (1) id: build: stable note identity and revision graph #3814 is merged/closed with the Phase 1 note-identity + revision-graph model landed; (2) Drew's answer to Q2 is recorded on id: design: Zettelkasten layer — multiplayer docs/wiki on ID #2048. On resume, implement per the packet: stable note IDs for collaboration sessions, signed revision checkpoints with parent heads, explicit merges for concurrent heads, transient live steps/cursors, and the access-boundary + legacy-filename tests.
Escalation note: Q2 is already surfaced on id: design: Zettelkasten layer — multiplayer docs/wiki on ID #2048 with options and a recommendation by task 5733; this park does not re-ask it — it only records that Phase 3 cannot start until the answer lands.

🤖 Agent note · parked

Agent: queue worker (repo-worker-code), lane B
Session / ID: task 5826
Found via: queue claim
Task: parked again per the packet's own gate — do not start before issue id: build: stable note identity and revision graph #3814 is merged and Drew answers Q2 on issue id: design: Zettelkasten layer — multiplayer docs/wiki on ID #2048. Fresh check this shift (2026-11-01T18:13Z): issue id: build: stable note identity and revision graph #3814 is OPEN with status/in-progress + queue/claimed (task 5824, another lane is actively on it; no PR or merge yet), and issue id: design: Zettelkasten layer — multiplayer docs/wiki on ID #2048 still has exactly one comment mentioning Q2 — the design record that posed it; no answer has been posted.
Expectation: resume when both conditions hold: issue id: build: stable note identity and revision graph #3814 merged, and an explicit Q2 answer (shared-write authorization boundary) on issue id: design: Zettelkasten layer — multiplayer docs/wiki on ID #2048. Parked 4h.
Links: issues id: build: durable multiplayer note checkpoints and merges #3819 / id: build: stable note identity and revision graph #3814 / id: design: Zettelkasten layer — multiplayer docs/wiki on ID #2048

agent-note:v1 — state: blocked (task 5826, OpenChamber scheduled lane)

Agent: repo-worker-code; lane: 9aca43b4-5439-4939-9f71-323f5d32521b; origin=openchamber-scheduled-lane.
Gate update: id: build: stable note identity and revision graph #3814 is CLOSED; Drew's Q2 ruling #6599898441 allows write-grant members to append attributed revisions. The prior parent design PR design(id): #2048 Zettelkasten layer #3885 is MERGED and untouched.
New blocker: Q3 (who may read shared notes) remains unanswered in id: design: Zettelkasten layer — multiplayer docs/wiki on ID #2048, latest design summary #6561462943. Options are group Read grant, per-note ACL, or public-by-default; the design says keep multiplayer sharing disabled until the read policy is decided and enforced. This is an owner/product decision, so I have escalated it rather than inferring a policy.
Current-main implementation evidence at f8e356f: permits anonymous/display-only WebSocket identities and accepts steps without a role check; does not link these client IDs to member signing keys. signs with the server node key; records no group. does not enforce a Write grant on event application. has an open sync gate, and reads blobs without group authorization. A route-only check would not protect replicated events or blob visibility.
Disposition: blocked as ; no source changes. Resume after Drew decides the reader policy and the member-key signing/authorization design is settled. The clean pushed branch/worktree are preserved: , .

agent-note:v1 — state: blocked (task 5826, OpenChamber scheduled lane; evidence correction)

Agent: repo-worker-code; lane: 9aca43b4-5439-4939-9f71-323f5d32521b; origin=openchamber-scheduled-lane.
Gate update: id: build: stable note identity and revision graph #3814 is CLOSED; Drew's Q2 ruling #6599898441 allows write-grant members to append attributed revisions. Parent design PR design(id): #2048 Zettelkasten layer #3885 is MERGED and untouched.
New blocker: Q3 (who may read shared notes) remains unanswered in id: design: Zettelkasten layer — multiplayer docs/wiki on ID #2048, latest design summary #6561462943. Options are group Read grant, per-note ACL, or public-by-default; the design says keep multiplayer sharing disabled until the read policy is decided and enforced. This is an owner/product decision, so it is escalated rather than inferred.
Current-main evidence at f8e356f: pkgs/id/src/web/collab.rs:792-855,1083-1118 permits anonymous/display-only WebSocket identities and accepts steps without a role check; pkgs/id/src/web/identity.rs:140-175,280-363,540-545 does not link these client IDs to member signing keys. pkgs/id/src/local_events.rs:212-229,699-731 signs with the server node key; local_events.rs:704-726 records no group. pkgs/id/src/event_store/resolve.rs:382-399 does not enforce a Write grant on event application. pkgs/id/src/event_sync.rs:24-27,72-75 has an open sync gate, and pkgs/id/src/web/routes.rs:727-781 reads blobs without group authorization. A route-only check would not protect replicated events or blob visibility.
Disposition: blocked as escalated-to-user; no source changes. Resume after Drew decides the reader policy and the member-key signing/authorization design is settled. The clean pushed branch/worktree are preserved: queue/5826-3819-durable-notes, /home/user/git/fleet/5826.

agent-note:v1 — gate update (triage task 6823)

Agent: repo-worker-code (OpenChamber scheduled lane)
Fresh gate evidence (2026-11-04): parent design PR design(id): #2048 Zettelkasten layer #3885 is MERGED; friendly-name prerequisite id: investigate: friendly-name references — @/# phrase resolution via cross-service search (zettelkasten / Mnote model) #2047 is CLOSED; Drew’s Q2 ruling #6599898441 allows members with a write grant to append attributed revisions. The write-authority gate has moved.
Remaining gate: Q3 read authority is still unresolved in id: design: Zettelkasten layer — multiplayer docs/wiki on ID #2048, so id: build: durable multiplayer note checkpoints and merges #3819 remains blocked/escalated; do not infer read access or change authorization behavior. Resume only after the read policy and enforcement boundary are decided.
This records the gate movement requested by id: design: Zettelkasten layer — multiplayer docs/wiki on ID #2048’s triage task; no implementation or label/state changes were made to id: build: durable multiplayer note checkpoints and merges #3819.

Gate update: Q3 read-authority is DECIDED — this issue's read-policy gate is cleared (2026-11-04)

Drew's ruling on design #2048 question Q3 (main chat, 2026-11-04 ~10:32 CST), verbatim:

"default read but able to choose any number of groups or users. default public unless user or server config different defaults"

What this means for this phase: read access defaults to public read; the owner can scope/grant read to any number of groups or users (arbitrary ACL, not a single fixed group); the public default yields to a user's own default or the server config default. Default resolution order: object setting → user default → server config default → public. Enforce and test this read policy at the event/blob gates per this issue's acceptance criteria.

Full ruling comment: #5535 (comment) (also cross-referenced on design issue #2048). Note this settles Q3 (read) only; Q2 shared-write authority was already ruled on 2026-11-03.

🤖 Agent note · gate cleared — unblocked (label repair)

Agent: queue worker (repo-worker-code), lane code-g — FALLBACK MODE, working the id: design: Zettelkasten layer — multiplayer docs/wiki on ID #2048 triage (this issue is its Phase 3 child).
Both gates this issue waited on are decided: Q2 (shared-write authority) ruled 2026-11-03 on issue id: design: Zettelkasten layer — multiplayer docs/wiki on ID #2048 — members holding a write grant may append attributed revisions; owner retains grant/revoke. Q3 (read authority) decided by Drew 2026-11-04 and recorded on this issue 2026-11-04T16:34:13Z — default public read, owner-scoped ACL, resolution order object → user default → server config → public.
The user/escalated + status/blocked + queue/blocked labels were never updated after the Q3 ruling landed — stale state, repaired here: this issue is claimable again (queue/queued + status/needs-triage). Phase 1 (id: build: stable note identity and revision graph #3814) and Phase 2 (id: build: local topic links and backlink projection #3816) are CLOSED/merged, so its dependencies are met.
Note for the claimant: the sibling implementation tracker issue id: implement Zettelkasten layer - multiplayer docs/wiki on ID (design #2048) #5535 carries the same stale blocked/escalated labels after the same two rulings; reconcile the pair when Phase 3 starts so the work is not duplicated.

Navigation Menu

Repository navigation

id: build: durable multiplayer note checkpoints and merges #3819

45 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

id: build: durable multiplayer note checkpoints and merges #3819

Description

Activity

developing-today commented on Nov 1, 2026

dezren39 commented on Nov 1, 2026

dezren39 commented on Nov 1, 2026

dezren39 commented on Nov 1, 2026

45 remaining items

dezren39 commented on Nov 3, 2026

dezren39 commented on Nov 3, 2026

dezren39 commented on Nov 4, 2026

dezren39 commented on Nov 4, 2026

developing-today commented on Nov 7, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions