@atom.io/template-react-realtime-text-editor 0.0.11 → 0.0.12

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # @atom.io/template-react-realtime-text-editor
 
+## 0.0.12
+
+### Patch Changes
+
+- aa30b42: Use Mosaic Domains and the reusable Lexical adapter for collaborative Markdown editing, with optimistic drafts, logical collaborator carets and selections, renewable presence, viewport residency, atomic text/index updates, and actor-selective undo and redo. Demonstrate incremental Markdown parsing and virtualized source and preview rendering, with deterministic headless and two-browser conformance coverage.
+
+  Demonstrate consumer-owned structural CSS Modules and typed part classes for utility-compatible styling. Add automatic light and dark color schemes using component-owned Lasertag theme tokens, with a dark initial canvas and fallback theme that still follows the system's light-mode preference.
+
+  Use the standalone `@atom.io/react`, `@atom.io/realtime`, and `@atom.io/eslint-plugin` packages. Include pinned Oxlint, ESLint, TypeScript, and dprint quality checks, with TypeScript 7 for builds and TypeScript 6 for ESLint's compiler API. Pin dprint 0.64.1 to distrust the compromised eMudhra certificates when downloading formatter plugins.
+- Updated dependencies [bb1d8de]
+- Updated dependencies [aa30b42]
+- Updated dependencies [bb1d8de]
+  - atom.io@0.54.0
+  - @atom.io/realtime@0.1.0
+  - @atom.io/react@0.1.0
+
 ## 0.0.11
 
 ### Patch Changes

package/INNOVATIONS.md

@@ -1,113 +1,242 @@
-# Mosaic Reconciliation Notes
-
-This template began as an application-local experiment. The collaboration
-machinery now lives in atom.io's Mosaic module, but Mosaic is not a parallel
-state system: the document is a transceiver held by an ordinary mutable atom.
-That atom token is its network address, its read-only view feeds ordinary
-selectors and renderer hooks, and each Store owns the optimistic replica bound
-to it. The server registers the same transceiver class as the authority for that
-address. The decisions below are the places where this transceiver deliberately
-takes a different path from rigid state proxying and whole-value time travel.
-
-## Bounded Sequence Intervals
-
-A shared string is not a useful conflict unit. Mosaic Text represents Unicode
-graphemes as stable nodes and edits as insert/delete operations. Each insertion
-records both its retained left boundary and its retained right boundary. The
-second boundary matters: a predecessor-only graph can move a middle replacement
-after the old suffix merely because one author's operation ID sorts later.
-Bounded intervals preserve the user's edit location while deterministic,
-code-unit ID ordering resolves genuinely concurrent insertions.
-
-Deletes are edit-owned visibility marks. Hidden nodes remain as anchor stubs, so
-foreign descendants, late operations, and relative selections do not lose their
-position when an author undoes the edit that introduced an ancestor.
-
-The model uses the host's Unicode grapheme segmenter. A deployment with
-heterogeneous ICU versions should pin runtimes together or ship a versioned
-segmenter before claiming cross-runtime model-version equivalence.
-
-## Selective, Per-Identity History — Not a Timeline
-
-Whole-document time travel is unsafe in a shared editor: restoring yesterday's
-string can erase another person's accepted work. Mosaic records edit ownership
-and represents undo and redo as durable operations that deactivate or reactivate
-only one authenticated actor's current edit group. A foreign insertion anchored
-inside hidden local work remains visible.
-
-Atom.io's native timelines still mean local graph time travel. The Mosaic text
-transceiver is marked append-only and cannot be attached to one: rewinding its
-object would bypass the accepted operation stream and clobber collaboration.
-Its actor-scoped capability is named `historyFor`, and undo/redo append normal
-operations that every replica reduces in the same order.
-
-The server validates the actor's current history cursor through the text
-transceiver immediately before the append. A stale tab therefore fails closed
-and resnapshots. Accepted revisions
-are durable reduction metadata, so concurrent history operations have one
-canonical order; provisional client projections explicitly use no revision.
-This is exact at operation ownership and intentionally best-effort at recovering
-the prose-level intention behind arbitrary concurrent rewrites.
-
-## Relative, Ephemeral Presence
-
-Numeric caret offsets become stale after any preceding edit. Mosaic presence
-uses left/right node anchors plus an explicit affinity. The text model resolves
-those anchors against each local projection, including hidden anchors. Presence
-is schema-checked and model-checked, but never enters the durable operation log
-or a user's history. Explicit departure and disconnect both remove the exact
-actor/session record.
-
-## Durable Stream Before Fan-Out
-
-The server never acknowledges or broadcasts an operation before persistence.
-Its adapter contract atomically compares the expected revision and reserves the
-atom-stream/operation-ID receipt. A reused ID with different normalized content is
-a collision, not an idempotent retry. Receipts survive checkpoint compaction.
-
-Horizontal notifications are wake-up hints only. Every server drains a checked,
-contiguous tail from the shared linearizable store. Recovery hydrates one
-consistent checkpoint and then applies every later revision. Checkpoint
-installation, tail pruning, session watermarks, and a retention epoch form the
-compaction fence. Text model version 1 retains stable node stubs; a future model
-that removes them will need an explicit anchor-translation protocol.
-
-The template uses the in-memory adapter so it runs without infrastructure. It is
-restart-safe only while that adapter instance survives. Production should supply
-a transactional database implementation and define an offline-session retention
-policy before pruning operation bodies.
-
-## Optimistic Reconciliation and Recovery
-
-Each Atom.io Store creates stable session-scoped operation IDs, applies locally,
-and retains one causal outbox for the mutable atom token. Multiple components in
-that Store share the same replica; a second Silo gets a genuinely independent
-replica. Reconnect snapshots report which pending IDs were already accepted and
-the authoritative causal frontier; the client hydrates the transceiver
-checkpoint, removes those proposals, and replays the rest from that frontier.
-Duplicate delivery is harmless. A revision gap resnapshots.
-Structured rejection policies distinguish retryable work from stale history or
-invalid dependency chains, which are quarantined rather than left as impossible
-optimistic state.
-
-Local wall-clock time may group typing gestures. It is deliberately absent from
-accepted reduction semantics, fingerprints, and convergence decisions. Local
-signals created inside an Atom.io transaction are observed only after commit;
-aborted transaction clones are discarded before they can enter the network
-outbox.
-
-## Testing Arbitrary Protocols
-
-Mosaic is not implemented as push/pull state proxying, yet atom.io's realtime
-test harness can exercise it because the harness exposes the transport and
-lifecycle rather than assuming a particular protocol. The template's
-multi-client scenarios run independent React stores and Socket.IO sessions,
-disconnect both editors, accept simultaneous offline work, verify selective
-history, and verify presence removal. Core suites add deterministic drop,
-duplicate, reorder, restart, multi-node, checkpoint, and session-correlation
-schedules.
-
-The remaining seam is application work tracking: integrations that schedule
-work beyond transport callbacks should register that work with the harness when
-they need barrier-based quiescence. Mosaic's conformance suite otherwise uses
-the same public server, client, and renderer APIs as this application.
+# Incremental Markdown Decisions
+
+MOS-18 is the first application that composes the run-text model, bounded text
+index, partial residency, Domain history, and renderer projections as one user
+experience. Most of the implementation is application composition. One missing
+generic seam had to move into realtime core so the result could remain correct
+at every accepted revision.
+
+## One Logical Source, Bounded Resident Views
+
+The authoritative service owns one Mosaic run-text checkpoint and the MOS-15
+bounded-fanout index derived from it. The index root, nodes, aliases, and leaves
+are ordinary durable Domain members. A browser never acquires the source member:
+MOS-12 authorizes and hydrates only the root and the leaves resolved for a
+bounded UTF-16 range, and MOS-17 projects those leaves through ordinary
+selectors. Full materialization remains an explicit command.
+
+This is not application-authored paragraph or file sharding. Syntax cannot
+change storage shape, so a huge paragraph or fenced block crosses the same
+physical thresholds as ordinary prose. Presence and render keys name logical
+run positions rather than physical leaves.
+
+MOS-18 exposed a scalability flaw that small MOS-15 conformance fixtures could
+not: index composition expanded every source grapheme into a separate JavaScript
+object. The core index now streams large fragments into bounded spans, caches
+unchanged source spans on the resulting index bundle, and reuses physical leaf
+ownership. Ordinary edits scan run/span identities and touch changed leaves plus
+their bounded tree paths; they do not manufacture a document-sized unit array.
+
+The same exercise exposed that `replace-text` is the wrong input seam for a
+large editor because it materializes and diffs the entire old and new strings.
+Mosaic Text now accepts a logical `replace-selection` intent and exposes pure
+`prepare` and `preview` phases. The authoritative service can derive a bounded
+operation and its next visible run projection before proposing the atomic
+Domain batch, without mutating accepted state or asking the application to
+construct CRDT runs. Unicode chunking is streaming, preserves CRLF and complex
+grapheme boundaries, and remains core-owned rather than application sharding.
+
+## Atomic History Completion
+
+MOS-16 previously generated a correct run-text compensation but had no way to
+include the index maintenance describing that compensated text. Appending
+maintenance afterward would expose one revision whose source and range index
+disagreed.
+
+The history coordinator now accepts an optional `completeCompensation` callback.
+It runs after member policies create compensation operations and before the
+private history proposal is preflighted. Returned operations join that same
+batch only when their member policies classify them as history-free. The
+coordinator still proves that the original target set was compensated exactly;
+an appended change or second compensation fails closed. This seam is generic to
+derived durable indexes and contains no Markdown branch.
+
+## Local Input and Logical Presence
+
+The mounted Lexical plain-text editor contains only one resident source window.
+The renderer-neutral Mosaic text editor hook keeps keystrokes in an optimistic
+draft, derives minimal replacement intent, and retains that draft until a
+complete newer projection cut settles. It also publishes local selections as
+run-relative positions and resolves collaborator selections through the same
+visible text deltas, so renderers do not briefly display an absolute cursor at a
+stale offset. DOM selection, composition, scroll, and caret geometry remain
+renderer-owned.
+
+Lexical is deliberately a browser editing and geometry layer rather than a
+second collaboration authority. Its Yjs collaboration integration and history
+plugin are not mounted. Mosaic owns accepted text, convergence, logical
+positions, actor history, partial residency, and renewable presence leases. The
+core editor lifecycle projects the current bounded source, translates local
+selection offsets into Mosaic positions, and resolves foreign positions. The
+Lexical adapter only maps those offsets to DOM ranges for colored caret labels
+and selection overlays. A projection-tagged update cannot echo back as a local
+edit, while native composition remains local until it is ready for the existing
+coalesced Domain gesture.
+
+The React range hook now reacquires a failed viewport when residency transitions
+back to live. This closes the cold-start race where Vite could render before the
+realtime server accepted its first Socket.IO connection, leaving an otherwise
+healthy client permanently parked on an internal resnapshot error.
+
+An accepted edit may also shorten a document while an existing subscription
+still names the old viewport end. The Markdown range adapter therefore clamps
+that durable subscription to the new authoritative length, and command
+acknowledgements do not clear the optimistic draft until residency has settled
+the accepted revision. This prevents a valid remote replacement from stranding
+the UI on a stale projection or briefly presenting the stale text as saved.
+
+The demo deliberately coalesces an offline draft for its current viewport. It
+does not claim semantic intent recovery for arbitrary rewrites made in several
+unloaded regions. A richer product can retain several bounded draft windows and
+still submit them as one Domain gesture.
+
+The production patterns discovered while stabilizing that lifecycle no longer
+live as Markdown-specific template machinery. Core now publishes the Mosaic
+text source/index models and schemas, a server text-document coordinator for
+atomic import/edit/index/history work, a validated residency socket bridge, and
+a browser session coordinator for reconnect and accepted-revision settlement.
+The template supplies its member names, limits, authorization policy, simulated
+identities, viewport, and renderer. This keeps the correctness boundary reusable
+without pretending that editor layout or product policy is generic.
+
+## Incremental, Cancelable Semantics
+
+Parsing is not a render-time whole-document function. The headless parser caches
+input and output block state, yields after a bounded amount of UTF-16 work, and
+cancels an obsolete generation as soon as a newer projection arrives. Fence
+state propagates through following blocks only until an unchanged cached input
+state establishes a stable boundary. React mounts only semantic blocks in the
+current preview window.
+
+The included grammar is intentionally a safe illustrative Markdown subset. A
+production CommonMark/GFM worker can replace it behind the same source-block,
+cancelation, stable-state, and instrumentation contract. Sanitization remains a
+renderer responsibility; this template creates React nodes and never injects
+HTML.
+
+## Mosaic Text v3: Atomic Roots Instead of Giant Operations
+
+A 50 MB import cannot be both a bounded operation and a single giant Domain
+payload. Splitting that payload into several accepted source revisions was also
+rejected: a crash would expose a prefix, and retry could collide with the
+already-accepted prefix or duplicate it. Mosaic Text v3 takes a different path.
+It stages immutable content-addressed leaves and bounded-fanout branches while
+they are unreachable, protects the staged graph with the same atomic storage
+write, and publishes one small root operation. Before that root is accepted the
+old document remains authoritative; afterward the complete new graph is
+authoritative. Exact retry is idempotent.
+
+This required one model-neutral addition to the MOS-13 checkpoint spine:
+checkpoints may name validated external roots. Staging and its expiring proposal
+lease are atomic; the accepted append atomically promotes that lease to durable
+accepted-root protection; and checkpoint publication adopts and releases the
+protection in the same commit. Restart exposes accepted-but-not-yet-checkpointed
+roots to the coordinator, while history and outbox leases protect older roots.
+Garbage collection traces every edge behind a retention-epoch fence. Missing
+parents, stale parents, forged summaries, hash collisions, corrupt objects, and
+stage/append/checkpoint/GC races all fail closed. Abandoned proposals expire by
+time, revision, and bounded retention epochs instead of becoming perpetual
+leases.
+
+The external root stores its incremental proof separately from the root header.
+An initial import necessarily reads the whole input once. A later edit
+path-copies only the touched leaf and branch path, sends removals for superseded
+paths, and verifies its delta against the protected parent summary. Commit can
+therefore reuse authenticated subtree totals instead of rehashing a document
+manifest. Range recovery is paged and visits addressed paths rather than
+hydrating the graph.
+
+This is deliberately versioned as Mosaic Text v3 rather than silently changing
+v2's run snapshot. The generic Domain hook knows only content-addressed object
+graphs, bounds, and lifecycle dependencies; rope shape, grapheme-safe chunking,
+reference counts, range reads, and root replacement remain text-owned. That is
+where this work takes its own path beyond the original push/pull and monolithic
+checkpoint facilities.
+
+## History and Checkpoint Amplification
+
+Scale auditing also found a non-text-specific amplifier in Domain history.
+Accepted gestures were deep-cloned into every retained checkpoint-race cut, so a
+large operation could be retained many times even when text storage itself was
+segmented. History now clones and freezes accepted JSON once at its trusted
+ingress, shares those immutable gesture payloads across race cuts, replaces a
+gesture immutably when it is extended, and clones only at public or storage
+egress. Caller mutation, malicious compensation callbacks, restart hydration,
+and checkpoint observers remain isolated.
+
+Mosaic v2 compaction received a related correctness fix. It removes only retired
+runs that are provably unreachable while preserving logical positions, foreign
+descendants, undo/redo protection, checkpoints, restart, and duplicate replay.
+The scale gate keeps the v2 history/index stabilization loop because those are
+the user-facing selective-history and alias contracts, then drives more than
+100,000 operations through the real Domain receipt, checkpoint, retention, and
+garbage-collection lifecycle.
+
+## Deterministic Release Gate
+
+The MOS-20 manifest is the sole corpus authority. The gate verifies its source
+and derived digests before opening the canonical 5.6 MB source, deterministic
+50 MB repetition, huge paragraph, fenced block, heading-rich, and adversarial
+Unicode variants. A single worker owns one authoritative graph at a time. Each
+document runs multi-client disjoint and shared-boundary edits, duplicate,
+delayed and reordered delivery, rejection, disconnect/resnapshot, partial
+hydration and eviction, individualized undo/redo, and storage-plus-coordinator
+restart. The seed shuffles the client, delivery, and lifecycle fault order that
+is actually executed. Failure output includes that seed, the realized fault and
+client schedules, resident ranges, source and client revisions, and a bounded
+semantic transcript containing the exact commands needed for replay.
+
+The gate never constructs a second full-document oracle. Its independent flat
+model is a UTF-16-addressed piece table over the canonical file, and final
+verification streams source ranges directly into the digest. The same pass
+independently counts graphemes, line breaks, and UTF-16 units and reconstructs
+each client's bounded resident ranges; all are compared with the published root
+summary and client projections. Instrumentation fails the gate if any service
+read materializes a document larger than the configured residency bound;
+clients, parsing, join, and resnapshot remain bounded projections over the one
+authoritative segmented graph.
+
+Normative counters cover leaf and branch visits and writes, UTF-16 scanned,
+object reads, validation hashing and serialization, bytes persisted, checkpoint
+and batch payloads, resident and delivered bytes, selector invalidations, and
+parser work. Ordinary edits are bounded to addressed leaves and tree height;
+join and parser work are bounded to resident windows; checkpoints reuse clean
+objects. A local checkpoint may persist at most 512 KiB and a viewport transfer
+or accepted delivery at most 384 KiB. The 100,001-operation stabilization
+assertion bounds history, aliases, receipts, tail, sessions, and live checkpoint
+objects, then forces a real index split, resolves its stale leaf alias through
+the public reader, and verifies the leaves merge after contention settles.
+Elapsed time and RSS are reported observations only because runner load and
+allocator behavior are not deterministic correctness signals.
+
+Current architecture limits are explicit: text leaves target 32,768 graphemes
+and at most 65,536 UTF-16 units; import chunks are at most 262,144 UTF-16 units;
+branches contain at most 32 children; one edit inserts at most 256 KiB; a range
+read defaults to 128 objects; an external graph defaults to 64 MiB total while
+one staging call may add at most 16 MiB across 4,096 objects and 256 logical
+updates, with 4 MiB and depth 64 per object; and a coordinator defaults to 64
+roots, 256 recovery reads, and 64 MiB aggregate external bytes. Proposal
+retention defaults to 64 epochs and is limited to 1–1,024. These are safety
+contracts, not claims that arbitrarily large documents are fully resident.
+
+External staging is a trusted server composition seam, not a socket protocol.
+Client intents first cross Domain authorization and proposal limits; a product
+that derives external updates from an untrusted request must also apply its own
+per-document quota, rate limit, and deadline before hashing begins. Stage work
+is counted before content hashing, checks an abort signal and absolute deadline
+between bounded units, and becomes visible with its proposal lease only after
+the whole attempt succeeds. The pinned 50 MiB corpus gate raises the incremental
+stage budget because its input is authenticated by the MOS-20 manifest and read
+under a fixed deadline. That exception is not the default production request
+budget: it permits at most 128 MiB of cumulative authenticated staging work and
+32,768 objects while the ordinary defaults remain 16 MiB and 4,096 objects. The
+reported text-stage bytes count every immutable text or index node serialized
+and hashed at the model boundary; directory and proof staging, then storage
+verification, independently enforce the same work budget before publication.
+These cumulative work budgets are not retained bytes, resident memory, or the
+protected graph's 64 MiB value-size cap.
+
+The zero-setup editor server remains in-memory and uses simulated authorization.
+A product adapter must provide the linearizable semantics exercised by the
+in-memory conformance adapter, plus durable ACLs, rate limits, observability, and
+an offline-retention policy.

package/README.md

@@ -1,51 +1,87 @@
 # React Realtime Text Editor
 
-Mosaic is a React + atom.io multiplayer Markdown editor with a small Node and
-Socket.IO collaboration server. It ships simulated identities so the complete
-shared-editing experience can be explored locally without provisioning auth.
+Mosaic is a React + atom.io multiplayer Markdown editor with simulated
+identities. It demonstrates the scalable long-form text path: bounded Domain
+members, viewport-first residency, logical presence, selective history,
+incremental parsing, and virtualized source and preview rendering.
 
 ## Run It
 
-Run `npm run dev`, then open the displayed Vite URL. Open a second tab and use
-the avatar menu to switch identities. The Vite app runs on port 5173 and the
-collaboration service runs on port 3000. The browser always connects to its
-current origin; Vite proxies `/socket.io` and `/health` to the collaboration
-service in both development and preview modes.
+Run `npm run dev`, then open the displayed Vite URL in two tabs and choose a
+different identity in each tab. The browser connects to `window.location.origin`.
+Vite proxies `/socket.io` and `/health` to the collaboration service in both
+development and preview, so the deployment contract does not require browser
+CORS exceptions.
 
 ## What It Shows
 
-- optimistic shared text that converges after simultaneous and offline edits;
-- live identity, connection, caret, and line-level presence;
-- selection anchors that survive edits around them;
-- per-identity undo and redo that preserve other authors' work;
-- durable-stream snapshots, idempotent operation replay, and server validation;
-- a safe, dependency-free Markdown preview rendered as React nodes; and
-- structural component styling checked by Lasertag.
-
-Run `npm test` for the multi-client collaboration scenarios. Run `npm run lint`
-to enforce ESLint, type-aware Oxlint, React hook call-order correctness, TypeScript, and
-the Lasertag render-story/CSS relationship with zero warnings. Run
+- one logical Markdown document indexed by bounded-fanout ordinary Domain atom
+  families;
+- viewport hydration before full materialization, with released ranges evicted;
+- local input drafts that remain responsive while offline or while an
+  authoritative gesture settles;
+- run-relative selection, viewport, and collaborator presence across physical
+  leaf splits and merges;
+- a Lexical plain-text editing surface that renders named remote carets and
+  translucent selections without delegating convergence or history to a second
+  collaboration model;
+- actor-selective undo and redo whose text compensation and index maintenance
+  settle in one Domain revision;
+- cancelable incremental Markdown parsing that yields outside the input turn and
+  stops propagating when cached parser state reaches a stable boundary;
+- source and preview virtualization with no architecture switch at the 5.6 MB or
+  deterministic 50 MB corpus sizes; and
+- one explicitly authorized reset/import transaction rather than an effect run
+  by every joining browser.
+
+Run `npm test` for the multi-client contention, offline/reconnect, history,
+presence, import, parser, and virtualization scenarios. Run `npm run lint` to
+enforce ESLint, type-aware Oxlint, React hook call-order correctness, TypeScript,
+and the Lasertag render-story/CSS relationship with zero warnings. Run
 `npm run fmt:check` in CI and `npm run fmt` to apply the pinned dprint
-configuration locally.
+configuration locally. The scheduled repository command
+`pnpm test:large-document` verifies the pinned corpus and exercises the same
+logical editing, history, residency, and viewport/parser contracts over Mosaic
+Text v3's content-addressed storage roots. It runs sequentially with one
+authoritative document graph at a time across the canonical 5.6 MB document,
+the deterministic 50 MB repetition, huge-paragraph and fenced-block shapes, and
+the Unicode adversarial corpus.
 
 ## Start Reading
 
-- `src/collaboration/mosaic.ts` is the browser collaboration contract: one
-  mutable atom, graph-derived selectors, selective history, and model-relative
-  presence.
-- `node/mosaic-atom.ts` registers the mutable atom with Zod runtime schemas,
-  presence validation, and checkpoint cadence without entering the browser
-  bundle.
-- atom.io's Mosaic client owns optimistic edits, reconnect rebasing, causal
-  retries, and structured recovery.
-- atom.io's Mosaic server authenticates authorship, durably orders revisions,
-  checkpoints streams, and publishes ephemeral presence.
-- `src/MarkdownWorkspace.tsx` is the React editing experience.
-- `INNOVATIONS.md` records the reconciliation decisions that became Mosaic and
-  the remaining production boundaries.
-
-The template selects Mosaic's in-memory storage adapter for a zero-setup demo.
-Production deployments should provide a linearizable storage adapter, document
-ACLs, rate limits, and metrics as described in `INNOVATIONS.md`. Keep the
-same-origin contract in your deployment by forwarding `/socket.io` to the
-collaboration service at the edge.
+- `src/document-domain.ts` names the application's durable source and index
+  members plus its ephemeral collaborator shape. Core supplies the text and
+  index models, schemas, and history policy.
+- `node/service.ts` chooses persistence, authorization, presence lifetime, and
+  the app-specific Socket.IO commands. The core text document coordinator owns
+  atomic source/index proposals, range reads, and history compensation, while
+  the core residency binder owns its wire protocol.
+- `src/collaboration-client.ts` supplies browser identity, viewport policy, and
+  application commands. Core owns residency transport, reconnect
+  synchronization, accepted-revision settlement, presence renewal, and
+  selective history sequencing.
+- `@atom.io/realtime/client` owns the Store-backed range controller, preserving
+  the last complete projection while replacement residency is acquired.
+- `@atom.io/realtime/react` owns optimistic draft settlement and maps local and
+  remote selections across complete, revision-tagged projection cuts.
+- `@atom.io/realtime/react/lexical` owns projection replacement, native input
+  boundaries, DOM selection restoration, collaborator geometry, and semantic
+  structure without visual styling. The local `src/LexicalMarkdownEditor.tsx`
+  opts into Lasertag's validated render-story adoption for Atom.io's owned root.
+  Its CSS Module styles that root, while its ordinary component stylesheet uses
+  the adapter's typed `classNames` parts across Lexical's context-provider
+  boundary. Utility-CSS consumers can supply those same parts directly.
+- `src/incremental-markdown.ts` contains the renderer-neutral, cancelable parser.
+- `src/workspace-state.ts` expresses status, presence, viewport, parser output,
+  diagnostics, and derived peers as Atom state. `src/MarkdownWorkspace.tsx`
+  reads those tokens and owns only application presentation and interaction.
+- `INNOVATIONS.md` records the new core seam and the deliberate production
+  boundaries.
+
+The template uses in-memory persistence and simulated authorization for a
+zero-setup demo. A production service still needs a linearizable storage
+adapter, document ACLs, rate limits, metrics, and a durable offline-retention
+policy. The corpus gate deliberately uses the same public checkpoint adapter
+contract as production, including restart, proposal expiry, retention fences,
+and garbage collection; wall-clock and RSS readings are diagnostics rather than
+portable release thresholds.

package/eslint.config.ts

@@ -1,5 +1,5 @@
 import * as tsParser from "@typescript-eslint/parser"
-import AtomIOPlugin from "atom.io/eslint-plugin"
+import AtomIOPlugin from "@atom.io/eslint-plugin"
 import type { Linter } from "eslint"
 import LasertagPlugin from "lasertag/eslint-plugin"
 

package/index.html

@@ -3,6 +3,7 @@
 	<head>
 		<meta charset="UTF-8" />
 		<meta name="viewport" content="width=device-width, initial-scale=1.0" />
+		<meta name="color-scheme" content="dark light" />
 		<meta
 			name="description"
 			content="Mosaic, a realtime collaborative Markdown editor built with atom.io."

package/node/http-server.ts

@@ -0,0 +1,81 @@
+import { createServer } from "node:http"
+
+import { Server } from "socket.io"
+
+import { identityById } from "../src/identities.ts"
+import {
+	createMarkdownDocumentService,
+	type MarkdownDocumentService,
+} from "./service.ts"
+
+export type MarkdownCollaborationHttpServer = {
+	close(): Promise<void>
+	readonly collaboration: MarkdownDocumentService
+}
+
+export async function createMarkdownCollaborationHttpServer(options: {
+	readonly collaboration?: MarkdownDocumentService
+	readonly port: number
+}): Promise<MarkdownCollaborationHttpServer> {
+	const collaboration =
+		options.collaboration ?? (await createMarkdownDocumentService())
+	const httpServer = createServer((request, response) => {
+		if (request.url === `/health`) {
+			response.writeHead(200, { "content-type": `application/json` })
+			response.end(
+				JSON.stringify({ ok: true, revision: collaboration.revision }),
+			)
+			return
+		}
+		response.writeHead(404)
+		response.end()
+	})
+	const socketServer = new Server(httpServer)
+
+	socketServer.on(`connection`, (socket) => {
+		const requestedActor =
+			typeof socket.handshake.auth.actor === `string`
+				? socket.handshake.auth.actor
+				: undefined
+		const session =
+			typeof socket.handshake.auth.session === `string`
+				? socket.handshake.auth.session
+				: ``
+		const identity = identityById(requestedActor)
+		if (
+			identity.id !== requestedActor ||
+			session.length === 0 ||
+			session.includes(`::`)
+		) {
+			socket.disconnect(true)
+			return
+		}
+		void collaboration.bindSocket({ actor: identity.id, session, socket })
+	})
+
+	await new Promise<void>((resolve, reject) => {
+		const onError = (error: Error): void => {
+			reject(error)
+		}
+		httpServer.once(`error`, onError)
+		httpServer.listen(options.port, `127.0.0.1`, () => {
+			httpServer.off(`error`, onError)
+			resolve()
+		})
+	})
+
+	let closed = false
+	return {
+		async close() {
+			if (closed) return
+			closed = true
+			await new Promise<void>((resolve) =>
+				socketServer.close(() => {
+					resolve()
+				}),
+			)
+			collaboration[Symbol.dispose]()
+		},
+		collaboration,
+	}
+}