@1agh/maude 1.0.11 → 1.2.0

package/apps/studio/sync/agent.ts

@@ -65,10 +65,12 @@ import {
 import {
   decideAnnotationsColdStart,
   decideColdStart,
+  decideCssColdStart,
   isExactRepeat,
   unionCommentsById,
 } from './cold-start.ts';
-import { applyColdStart } from './cold-start-apply.ts';
+import { applyColdStart, type ColdStartSnapshotReason } from './cold-start-apply.ts';
+import { dedupeCommentsById, hasDuplicateComments } from './comment-identity.ts';
 import { type EchoGuard, hashBytes } from './echo-guard.ts';
 import type { SyncJournal } from './journal.ts';
 
@@ -126,7 +128,7 @@ export interface CanvasSyncAgentOptions {
    * without it the conflict path still resolves newest-wins, just without the
    * recovery snapshots (test-only constructions).
    */
-  snapshot?: (content: string, reason: 'pre-sync-local' | 'pre-sync-hub') => Promise<string | null>;
+  snapshot?: (content: string, reason: ColdStartSnapshotReason) => Promise<string | null>;
   /**
    * Called when a non-adopt reconcile (cold-start / post-git-pull) found
    * divergent non-empty content on both sides (DDR-102). `winner` is the side
@@ -185,12 +187,17 @@ export function createCanvasSyncAgent(opts: CanvasSyncAgentOptions): CanvasSyncA
   let lastMeta: string | null = null;
   let lastCss: string | null = null;
 
-  // F1 — the body this agent pushed on `seed-local-up`, plus the deadline past
-  // which the de-dup repair stops firing. Set on seed; nulled only when the
+  // F1 — the content this agent pushed on `seed-local-up`, plus the deadline
+  // past which the de-dup repair stops firing. Set on seed; nulled only when the
   // window lapses (after convergence the repair is a cheap no-op — the
-  // `body === seedInfo.body` guard short-circuits, so we don't bother clearing).
+  // `=== seedInfo.x` guards short-circuit, so we don't bother clearing).
   // Null = this agent never seeded (so it never repairs).
-  let seedInfo: { body: string; until: number } | null = null;
+  //
+  // `css` rides along with the body (issue #114): a seed writes BOTH lanes in
+  // the same breath, so both can collide with a concurrent peer's identical
+  // seed, and repairing only the body left the canvas un-buildable anyway —
+  // duplicated css is as fatal to the build as a duplicated `export default`.
+  let seedInfo: { body: string; css: string | null; until: number } | null = null;
 
   function onDocUpdate(_update: Uint8Array, updateOrigin: unknown): void {
     if (stopped) return;
@@ -200,6 +207,7 @@ export function createCanvasSyncAgent(opts: CanvasSyncAgentOptions): CanvasSyncA
     // concurrent peer's identical seed onto ours. Collapse it (single elected
     // writer) BEFORE the flush below can mirror a doubled body to disk.
     maybeRepairSeedDuplication();
+    maybeCollapseCommentsDuplication();
     scheduleFlush();
   }
 
@@ -245,17 +253,77 @@ export function createCanvasSyncAgent(opts: CanvasSyncAgentOptions): CanvasSyncA
     }
     const owner = seededByFromDoc(doc);
     if (owner === null || owner !== doc.clientID) return; // not the elected writer
+    const seeded = seedInfo;
+    const repaired: string[] = [];
+
     const body = htmlFromDoc(doc);
-    if (body === seedInfo.body) return; // already a single copy
-    if (!isExactRepeat(body, seedInfo.body)) return; // divergent edit → conflict path owns it
-    const canonical = seedInfo.body;
+    // `=== seeded.body` → already a single copy; not an exact repeat → a
+    // divergent edit, which carries genuine bytes and belongs to the conflict
+    // path, not to a silent collapse.
+    if (body !== seeded.body && isExactRepeat(body, seeded.body)) {
+      const canonical = seeded.body;
+      doc.transact(() => {
+        if (applyHtmlToDoc(doc, canonical, origin)) stampBodyEdit(doc, origin);
+      }, origin);
+      lastHtml = canonical;
+      opts.journal?.record(slug, { bodyHash: hashBytes(canonical) });
+      repaired.push('body');
+    }
+
+    // The css half of the same collision (issue #114). Same proof obligation as
+    // the body — an exact integer repeat of what WE seeded — and the same
+    // idempotence: the collapse deletes the same CRDT items on every peer that
+    // runs it, so concurrent recoveries converge instead of fighting.
+    if (paths.css && seeded.css !== null) {
+      const css = cssFromDoc(doc);
+      if (css !== null && css !== seeded.css && isExactRepeat(css, seeded.css)) {
+        const canonicalCss = seeded.css;
+        doc.transact(() => {
+          applyCssToDoc(doc, canonicalCss, origin);
+        }, origin);
+        lastCss = canonicalCss;
+        opts.journal?.record(slug, { cssHash: hashBytes(canonicalCss) });
+        repaired.push('css');
+      }
+    }
+
+    if (repaired.length > 0) {
+      console.warn(
+        `[sync/${slug}] concurrent cold-seed duplication detected in ${repaired.join(
+          ' + '
+        )} — collapsed to one copy (F1).`
+      );
+    }
+  }
+
+  /**
+   * The comments half of the same collision (issue #112) — and deliberately
+   * NOT shaped like the body's.
+   *
+   * The body repair needs the `seededBy` election and an exact-repeat proof
+   * because collapsing a Y.Text can only be justified when the discarded bytes
+   * are provably a copy. Comments carry stable ids, so "the same comment twice"
+   * is decidable per entry, not per lane: the collapse keeps one of two
+   * byte-identical-by-identity entries and discards nothing a reader could
+   * want. That makes it safe for EVERY peer to run — no election, no seed
+   * window, no snapshot (per issue #114's follow-up, a collapse that preserves
+   * zero unique bytes must not consume the `_history/` snapshot ring).
+   *
+   * It converges because `applyCommentsToDoc` emits the collapse as a pure
+   * delete of items every peer holds, and concurrent deletes of the same items
+   * are idempotent. Running it here — on the remote-update path, before the
+   * flush — is what stops a duplicated array from reaching disk and becoming
+   * the canvas's new truth.
+   */
+  function maybeCollapseCommentsDuplication(): void {
+    const current = commentsFromDoc(doc);
+    if (!hasDuplicateComments(current)) return;
+    const collapsed = dedupeCommentsById(current);
     doc.transact(() => {
-      if (applyHtmlToDoc(doc, canonical, origin)) stampBodyEdit(doc, origin);
+      applyCommentsToDoc(doc, collapsed, origin);
     }, origin);
-    lastHtml = canonical;
-    opts.journal?.record(slug, { bodyHash: hashBytes(canonical) });
     console.warn(
-      `[sync/${slug}] concurrent cold-seed duplication detected — collapsed to one copy (F1).`
+      `[sync/${slug}] comments lane held ${current.length} entries for ${collapsed.length} distinct comments — collapsed (#112).`
     );
   }
 
@@ -298,6 +366,12 @@ export function createCanvasSyncAgent(opts: CanvasSyncAgentOptions): CanvasSyncA
   }
 
   function writeCommentsIfChanged(): void {
+    // This lane writes `_comments/<slug>.json` DIRECTLY, not through the api's
+    // `saveCommentsForFile` — so it does not inherit that boundary's dedupe.
+    // Collapse first (issue #112): a duplicated array reaching disk is how the
+    // doubling outlived restarts and became the canvas's truth. Idempotent, and
+    // self-originated, so it can't re-enter `onDocUpdate`.
+    maybeCollapseCommentsDuplication();
     const next = commentsFromDoc(doc);
     const serialized = next.length > 0 ? `${JSON.stringify(next, null, 2)}\n` : '';
     if (serialized === lastComments) return;
@@ -446,7 +520,7 @@ export function createCanvasSyncAgent(opts: CanvasSyncAgentOptions): CanvasSyncA
           // one hub at once self-heal the same way the decision-table seed does.
           markSeeded(doc, origin);
         }, origin);
-        seedInfo = { body: localHtml, until: Date.now() + SEED_REPAIR_WINDOW_MS };
+        seedInfo = { body: localHtml, css: localCss, until: Date.now() + SEED_REPAIR_WINDOW_MS };
       }
       if (localComments !== null) {
         const parsed = tryParseJsonArray(localComments);
@@ -504,10 +578,12 @@ export function createCanvasSyncAgent(opts: CanvasSyncAgentOptions): CanvasSyncA
         markSeeded(doc, origin);
       }, origin);
       lastHtml = body;
-      // Arm the de-dup repair window: if another peer seeded the same body at the
-      // same instant, the merged Y.Text will double — maybeRepairSeedDuplication
-      // (on the elected owner) collapses it back during this window.
-      seedInfo = { body, until: Date.now() + SEED_REPAIR_WINDOW_MS };
+      // Arm the de-dup repair window: if another peer seeded the same content at
+      // the same instant, the merged Y.Text will double — maybeRepairSeedDuplication
+      // (on the elected owner) collapses it back during this window. `localCss`
+      // is armed too: the css lane is seeded by the same cold start a few lines
+      // below and collides identically (issue #114).
+      seedInfo = { body, css: localCss, until: Date.now() + SEED_REPAIR_WINDOW_MS };
       opts.journal?.record(slug, { bodyHash: hashBytes(body) });
     };
 
@@ -594,23 +670,54 @@ export function createCanvasSyncAgent(opts: CanvasSyncAgentOptions): CanvasSyncA
       }
     }
 
-    // ---- css: follow the body winner (visually coupled) --------------------
-    if (bodyWinner === 'local') {
-      if (paths.css && localCss !== null && localCss !== docCss) {
+    // ---- css: PER-LANE resolution (issue #114 — was "follow the body winner")
+    // The css lane used to be the only Plane-A lane with no table and no
+    // duplication guard, which is why it was the only one that NEVER came out
+    // of a multi-peer cold start clean. decideCssColdStart owns the rows now;
+    // the two that matter are the exact-repeat collapse and the DDR-064
+    // empty-lane guard, and it finally consumes the `cssHash` checkpoint the
+    // journal has been writing since DDR-102.
+    {
+      const cssDecision = decideCssColdStart({
+        local: localCss,
+        doc: docCss,
+        journalHash: opts.journal?.get(slug)?.cssHash ?? null,
+        hash: hashBytes,
+        bodyWinner,
+      });
+      if (cssDecision.recoveredDuplication) {
+        // WARN, BUT DO NOT SNAPSHOT — symmetric with the body's
+        // `recover-seed-dup`, which deliberately doesn't either.
+        //
+        // A snapshot stood here briefly, on the reasoning that `X + X` is valid
+        // CSS (unlike a doubled body, which can't build) so the collapse might
+        // discard a real edit. The reasoning was wrong about the bytes:
+        // `isExactRepeat` is true only when the doc is EXACTLY local repeated
+        // N times, so the copies thrown away contain nothing the retained copy
+        // doesn't. The snapshot preserved zero unique bytes — and cost a slot
+        // in a per-slug ring buffer that `pruneSnapshots` evicts oldest-first
+        // at MAX_SNAPSHOTS_PER_SLUG. A hostile hub that keeps re-doubling this
+        // lane could therefore drive one worthless snapshot per reconcile and
+        // push the user's genuine `pre-sync-local` and conflict copies off the
+        // end — turning DDR-102's recovery spine into the attack surface.
+        // Adversarial review found it; the safety net was the vulnerability.
+        console.warn(`[sync/${slug}] cold-start css: ${cssDecision.reason}`);
+      }
+      if (cssDecision.winner === 'local' && paths.css && localCss !== null) {
         applyCssToDoc(doc, localCss, origin);
         lastCss = localCss;
         opts.journal?.record(slug, { cssHash: hashBytes(localCss) });
+      } else if (cssDecision.winner === 'hub') {
+        lastCss = docCss;
+        if (paths.css && docCss !== null && localCss !== docCss) {
+          const hash = hashBytes(docCss);
+          echoGuard.record(paths.css, hash);
+          writer(paths.css, docCss);
+          opts.journal?.record(slug, { cssHash: hash });
+        }
       } else {
         lastCss = docCss;
       }
-    } else {
-      lastCss = docCss;
-      if (paths.css && docCss !== null && localCss !== docCss) {
-        const hash = hashBytes(docCss);
-        echoGuard.record(paths.css, hash);
-        writer(paths.css, docCss);
-        opts.journal?.record(slug, { cssHash: hash });
-      }
     }
 
     // ---- meta: hub wins where it has an opinion, local seeds where it does not

package/apps/studio/sync/asset-push.ts

@@ -44,6 +44,7 @@ import { type Dirent, readdirSync, readFileSync, statSync } from 'node:fs';
 import path from 'node:path';
 
 import { type CanvasGroupLike, classifyProjectFile, isFilePlaneClass } from './file-membership.ts';
+import { failureReason, retryAfterMs } from './retry-after.ts';
 
 /** Max designRoot-relative depth (matches the classifier's 8-segment cap). */
 const MAX_SEGMENTS = 8;
@@ -84,27 +85,12 @@ export interface AssetPushProgress {
  *  the payload reaches `_sync.json` + every open tab, so it stays bounded). */
 export const MAX_LISTED_FAILURES = 20;
 
-/** Longest single pause the hub can ask for. Matches the hub's rate-limit
- *  window (60 s) — a `Retry-After` larger than that is either a typo or a hub
- *  we should not be blocking a boot sweep on. */
-const MAX_RETRY_DELAY_MS = 60_000;
-
-/** Where an absent/unparsable `Retry-After` lands. Old hubs (pre-fix) send a
- *  bare 429 with no header, and their window is the same 60 s. */
-const DEFAULT_RETRY_DELAY_MS = 60_000;
-
 /** Total time ONE sweep may spend waiting out 429s. The paced retry exists to
  *  keep an un-upgraded hub livable, not to turn a boot into an hour-long
  *  background stall — past this, the remaining refusals fail fast and the
  *  next-boot backstop takes them. */
 const MAX_SWEEP_BACKOFF_MS = 5 * 60_000;
 
-/** How much of an error body reaches `failed[].reason`. Enough to tell "rate
- *  limit exceeded" from a Cloudflare error page — the distinction the 2026-08-11
- *  RCA had to reconstruct from edge logs because the client kept only a status
- *  code. Hub-supplied text ⇒ bounded and stripped before it reaches the UI. */
-const ERROR_SNIPPET_CHARS = 80;
-
 /**
  * Every upload closes its connection. NOT an optimization — a correctness
  * requirement, learned the expensive way (2026-08-11, second pass).
@@ -333,38 +319,6 @@ async function probePresent(ctx: {
   }
 }
 
-/** `Retry-After: <seconds>` → ms, clamped. Only the delta-seconds form is
- *  parsed; the HTTP-date form is not something our hub emits. */
-function retryAfterMs(header: string | null): number {
-  const secs = Number(String(header ?? '').trim());
-  if (!Number.isFinite(secs) || secs <= 0) return DEFAULT_RETRY_DELAY_MS;
-  return Math.min(secs * 1000, MAX_RETRY_DELAY_MS);
-}
-
-/**
- * Why an upload was refused, in words — status PLUS a bounded snippet of the
- * body. The hub says `{"error":"rate limit exceeded"}`; an edge that never
- * reached the hub says HTML. Those are different bugs and the Sync panel should
- * not make a person read logs to tell them apart.
- *
- * The body is hub-supplied ⇒ untrusted (DDR-054): control characters stripped,
- * whitespace collapsed, hard length cap, and it only ever renders as text.
- */
-async function failureReason(res: Response): Promise<string> {
-  let snippet = '';
-  try {
-    snippet = (await res.text())
-      // biome-ignore lint/suspicious/noControlCharactersInRegex: stripping them is the point.
-      .replace(/[\u0000-\u001f\u007f]/g, ' ')
-      .replace(/\s+/g, ' ')
-      .trim()
-      .slice(0, ERROR_SNIPPET_CHARS);
-  } catch {
-    /* a body we cannot read tells us nothing — the status still does */
-  }
-  return snippet ? `HTTP ${res.status} — ${snippet}` : `HTTP ${res.status}`;
-}
-
 /**
  * One upload, with the two retries that are worth having in-boot.
  *

package/apps/studio/sync/codec.ts

@@ -26,6 +26,7 @@ import { hostname } from 'node:os';
 import type * as Y from 'yjs';
 
 import { Y_TYPES } from '../collab/persistence.ts';
+import { commentKey } from './comment-identity.ts';
 import {
   MAX_ANNOTATIONS_BYTES,
   MAX_COMMENTS_BYTES,
@@ -96,20 +97,27 @@ export function htmlFromDoc(doc: Y.Doc): string {
 }
 
 /**
- * Apply `next` to the Y.Text inside `doc`. Uses a minimal common-prefix /
- * common-suffix replace so peers see a small op rather than a full replace.
+ * Apply `next` to one Y.Text lane as a minimal common-prefix / common-suffix
+ * replace, so peers see a small op rather than a full replace.
+ *
+ * THIS SHAPE IS A CONVERGENCE PROPERTY, NOT AN OPTIMIZATION (issue #114).
+ * Collapsing a concurrency-duplicated lane — `X + X` back to `X` — comes out of
+ * this diff as a PURE DELETE of the trailing run: no insert at all. Two peers
+ * that independently decide to collapse therefore delete the SAME CRDT items,
+ * and deletes are idempotent, so they converge.
+ *
+ * A wholesale `delete(0, len)` + `insert(0, next)` does not have that property.
+ * Both peers' inserts are new items at the same position, and Yjs keeps both —
+ * so the "repair" re-creates exactly the duplication it was meant to undo. The
+ * css lane was written that way, which is why it was the lane that never came
+ * out of a multi-peer cold start clean (measured: 0 of 43 lanes). Any lane whose
+ * duplication is repairable MUST go through here.
  *
  * Pass `origin` as the transaction origin so a downstream observer can
  * distinguish self-originated updates from peer/remote ones.
  */
-export function applyHtmlToDoc(doc: Y.Doc, next: string, origin?: unknown): boolean {
-  if (byteLengthUtf8(next) > MAX_HTML_BYTES) {
-    console.warn(
-      `[sync/codec] refusing HTML apply > ${MAX_HTML_BYTES} bytes (got ${byteLengthUtf8(next)}). DDR-054 §2d.`
-    );
-    return false;
-  }
-  const yText = doc.getText(Y_SYNC_TYPES.html);
+function applyTextLane(doc: Y.Doc, lane: string, next: string, origin?: unknown): boolean {
+  const yText = doc.getText(lane);
   const current = yText.toString();
   if (current === next) return false;
 
@@ -140,6 +148,19 @@ export function applyHtmlToDoc(doc: Y.Doc, next: string, origin?: unknown): bool
   return true;
 }
 
+/**
+ * Apply `next` to the canvas body Y.Text inside `doc`. See `applyTextLane`.
+ */
+export function applyHtmlToDoc(doc: Y.Doc, next: string, origin?: unknown): boolean {
+  if (byteLengthUtf8(next) > MAX_HTML_BYTES) {
+    console.warn(
+      `[sync/codec] refusing HTML apply > ${MAX_HTML_BYTES} bytes (got ${byteLengthUtf8(next)}). DDR-054 §2d.`
+    );
+    return false;
+  }
+  return applyTextLane(doc, Y_SYNC_TYPES.html, next, origin);
+}
+
 /* ---------------------------------------------------------------- comments */
 
 /**
@@ -153,14 +174,41 @@ export function commentsFromDoc(doc: Y.Doc): CommentsSnapshot {
   return arr.toArray();
 }
 
+/**
+ * Apply `next` to the comments Y.Array as a MINIMAL, IDENTITY-KEYED DIFF.
+ *
+ * THIS SHAPE IS A CONVERGENCE PROPERTY, NOT AN OPTIMIZATION (issue #112) —
+ * the same law `applyTextLane` states for the text lanes, which this lane was
+ * missing. It used to be `delete(0, len)` + `push(next)`, and under concurrency
+ * that is not a replace at all: two peers delete the SAME items (idempotent)
+ * but insert two runs at the same position, and Yjs keeps both. The array
+ * becomes `list + list`, `persistJson` writes that to `_comments/<slug>.json`,
+ * the file re-imports clean, and the duplication IS the new truth. Every
+ * reconciliation round doubled it — 1 → 2 → 4 → 8, the count the #112 reporter
+ * saw — and the cold-start union repair, published through the same wholesale
+ * write, re-created the duplication it had just undone. Verbatim the css lesson
+ * from issue #114, one lane later.
+ *
+ * The diff gives the lane the property the text lanes got:
+ *
+ *   - Collapsing a duplicated array is a PURE DELETE of items every peer holds,
+ *     and concurrent deletes of the same items are idempotent — so two peers
+ *     repairing at once converge instead of re-doubling.
+ *   - Dedupe happens on EVERY apply, not only at cold start, so an array that
+ *     doubled anyway (an older peer still on the wholesale write, a genuine
+ *     concurrent edit of one entry) collapses at the next apply rather than
+ *     compounding. Duplication became self-healing instead of exponential.
+ *   - Untouched comments keep their CRDT items, so a peer replacing one entry
+ *     no longer rewrites the whole list under everyone else's feet.
+ *
+ * Ordering follows the doc for surviving entries, with genuinely new ones
+ * appended. Reordering is deliberately NOT synced: it would be a delete+insert
+ * per moved entry — churn with the one shape this fix exists to avoid — and
+ * comment order carries no meaning (pins are placed by selector, the sidebar
+ * sorts by `created`).
+ */
 export function applyCommentsToDoc(doc: Y.Doc, next: CommentsSnapshot, origin?: unknown): boolean {
-  const arr = doc.getArray(Y_TYPES.comments);
-  // Comments are LWW on the JSON file (the snapshot is the source of truth);
-  // collapse Y.Array to the new state. For v1.1 we just replace wholesale —
-  // structural comment-level merge is deferred along with structured HTML.
-  // Check whether anything actually changed to avoid no-op transactions
-  // (transactions still fire `update` events, which would re-enter the loop).
-  const before = JSON.stringify(arr.toArray());
+  const arr = doc.getArray<unknown>(Y_TYPES.comments);
   const after = JSON.stringify(next);
   if (byteLengthUtf8(after) > MAX_COMMENTS_BYTES) {
     console.warn(
@@ -168,11 +216,51 @@ export function applyCommentsToDoc(doc: Y.Doc, next: CommentsSnapshot, origin?:
     );
     return false;
   }
-  if (before === after) return false;
+
+  // Desired state, keyed by comment identity. `next` can itself arrive
+  // duplicated (a file written before this fix, a list pushed by an older
+  // peer), so it is deduped on the way in — first occurrence wins, matching
+  // `unionCommentsById` and `dedupeCommentsById`.
+  const desired = new Map<string, unknown>();
+  for (const c of next) {
+    const k = commentKey(c);
+    if (!desired.has(k)) desired.set(k, c);
+  }
+
+  // Classify every item currently in the array: keep it, replace it in place,
+  // or delete it. Duplicates of an identity we already kept are deletes — that
+  // is what makes EVERY apply a repair, not just the cold-start union.
+  const current = arr.toArray();
+  const deletes: number[] = [];
+  const replaces: { index: number; value: unknown }[] = [];
+  const kept = new Set<string>();
+  for (let i = 0; i < current.length; i++) {
+    const k = commentKey(current[i]);
+    if (!desired.has(k) || kept.has(k)) {
+      deletes.push(i);
+      continue;
+    }
+    kept.add(k);
+    const want = desired.get(k);
+    if (JSON.stringify(current[i]) !== JSON.stringify(want))
+      replaces.push({ index: i, value: want });
+  }
+  const appends: unknown[] = [];
+  for (const [k, v] of desired) if (!kept.has(k)) appends.push(v);
+
+  // No-op guard. Transactions fire `update` events even when they change
+  // nothing, and an update re-enters the file→doc→file loop.
+  if (deletes.length === 0 && replaces.length === 0 && appends.length === 0) return false;
 
   doc.transact(() => {
-    if (arr.length > 0) arr.delete(0, arr.length);
-    if (next.length > 0) arr.push(next);
+    // Replaces first, while the indices computed above are still valid.
+    for (const r of replaces) {
+      arr.delete(r.index, 1);
+      arr.insert(r.index, [r.value]);
+    }
+    // Then deletes, descending, so each index stays valid as we go.
+    for (let i = deletes.length - 1; i >= 0; i--) arr.delete(deletes[i]!, 1);
+    if (appends.length > 0) arr.push(appends);
   }, origin);
   return true;
 }
@@ -618,10 +706,19 @@ export function cssFromDoc(doc: Y.Doc): string | null {
 }
 
 /**
- * Apply the canvas's `.css` to the doc as opaque Y.Text (wholesale replace).
- * CSS round-trips byte-identically (we write exactly the doc string back), so a
- * wholesale delete+insert can't churn; the equality short-circuit keeps it quiet
- * when unchanged. Returns false on over-cap / no change.
+ * Apply the canvas's `.css` to the doc as opaque Y.Text.
+ *
+ * Goes through `applyTextLane` — the same prefix/suffix diff the body uses —
+ * and that is load-bearing, not tidiness (issue #114). This was a wholesale
+ * `delete(0, len)` + `insert(0, next)`, whose comment argued it "can't churn"
+ * because css round-trips byte-identically. True for a SINGLE writer, and the
+ * reason the lane looked fine in every single-peer test. Under concurrency it
+ * is the bug: two peers each replacing the lane keep both inserts, so the css
+ * doubled on a concurrent cold seed AND doubled again every time a peer tried
+ * to repair it. Measured in the field at 3×, 4× and 5×, while the body lane —
+ * same collision, diffing codec — never exceeded 3× and mostly self-healed.
+ *
+ * Returns false on over-cap / no change.
  */
 export function applyCssToDoc(doc: Y.Doc, next: string, origin?: unknown): boolean {
   if (byteLengthUtf8(next) > MAX_CSS_BYTES) {
@@ -630,11 +727,5 @@ export function applyCssToDoc(doc: Y.Doc, next: string, origin?: unknown): boole
     );
     return false;
   }
-  const t = doc.getText(Y_SYNC_TYPES.css);
-  if (t.toString() === next) return false;
-  doc.transact(() => {
-    if (t.length > 0) t.delete(0, t.length);
-    t.insert(0, next);
-  }, origin);
-  return true;
+  return applyTextLane(doc, Y_SYNC_TYPES.css, next, origin);
 }

package/apps/studio/sync/cold-start-apply.ts

@@ -39,6 +39,13 @@
 
 import type { ColdStartAction, ColdStartDecision } from './cold-start.ts';
 
+/** Why a cold-start snapshot was taken.
+ *
+ *  Deliberately NOT extended for the duplication collapse (issue #114). A
+ *  collapse only ever fires on an exact integer repeat, so the discarded copies
+ *  hold nothing the retained one doesn't — and `pruneSnapshots` evicts
+ *  oldest-first per slug, so a valueless snapshot on a hub-triggerable path is
+ *  an eviction lever against the copies that carry real bytes. */
 export type ColdStartSnapshotReason = 'pre-sync-local' | 'pre-sync-hub';
 
 export interface ColdStartConflictInfo {