Echtzeit-Zusammenarbeit (CRDT, gleichzeitiges Tippen)

[usekaneo]

Zwei Leute, die gleichzeitig schreiben, werden heute über den optimistischen Lock und den Drei-Wege-Merge aufgelöst — nicht über gleichzeitiges Tippen. Bewusst so gebaut; als Ausbau in Phase 6 offen geblieben.

Aufgabe: Vorher entscheiden, ob das überhaupt gewollt ist: ein CRDT (Yjs) bringt einen zweiten, ephemeren Transportweg mit und steht quer zum Modell „jede Fassung ist eine signierte Revision". Zu klären wäre, wann und von wem eine gemeinsame Sitzung als 1818 festgeschrieben wird.

Quelle: docs/10-roadmap.md Phase 6, docs/13-editing.md „Open", docs/05-versioning-history.md

---

_{Task: r449a6kr95dws1u9v6p0y0y9}

[usekaneo]

CON-19

[usekaneo]

**** commented:

Technical refinement (decision ticket)

Status: this is an architecture decision before it is code. What follows is the decision framing, a recommendation, and the concrete design if the answer is yes.

What exists today

• Concurrent editing is resolved by optimistic lock + three-way merge: on save the head is re-fetched; if it moved, mergeThreeWay runs and the result lands in the editor (src/ui/PageEditor.tsx:234-260, src/domain/merge.ts). Nothing is published until a human reviews it.
• docs/05 sketches the intended phase-6 shape: a CRDT over ephemeral events scoped by the group's h, committed as a normal 1818 on save. docs/00 calls character-level collaboration a non-goal for the MVP; docs/13 states the document is Markdown and the merge is deliberate, not a stopgap.
• Ephemeral transport works in principle: WriteCheck already publishes kind 20817 with an h tag and gets the relay's answer (src/ui/WriteCheck.tsx); client.ts has the subscribe/publish path for it. groups_relay does not store ephemeral events and mutes them when nobody is subscribed (nak serve at least does; verify for groups_relay).

The tensions a CRDT creates in this model

1. Who signs a commit, and against what parent? Every 1818 is signed by one person and points at a head. A CRDT converges a shared doc; the commit still needs an author and a parent-rev. The only honest rule: the saver signs, parent-rev = the head they saw; if the head moved, the CRDT state still contains both changes, so the existing merge becomes a near-formality rather than a conflict.
2. Two histories. The CRDT has its own internal history; the app's history is the signed chain. Only the latter counts, so CRDT state must never be presented as version history.
3. Ephemeral means losable. A late joiner, a relay restart or a dropped socket loses in-flight updates. A page opened from a stale head can silently diverge unless there is an explicit sync handshake (state-vector request, full-state response) on join.
4. Unsigned binary from the network. Yjs updates are arbitrary binary. They are parsed client-side and are an attack surface (size, allocation, malformed payloads). The relay only checks membership, not content.
5. Editor internals. CodeMirror currently owns undo/redo (history) and a home-grown live-formatting decoration layer (src/ui/markdown-live.ts). Yjs brings its own UndoManager and injects remote transactions; the two undo stacks and the decoration reconciliation are the real engineering cost, not the transport.

Options

Option	What it gives	What it costs
A. Do nothing (status quo)	Proven model, one history, Markdown stays the document	No live typing; concurrent edits cost a merge
B. Live presence only	Cursors/selections of others, 'N people here', over ephemeral events; text still merge-based	Small and whole some; exercises the ephemeral transport without touching the data model
C. Full CRDT (Yjs)	Simultaneous typing, no merge for live sessions	All five tensions above; a second editor model; a sync protocol; new security surface

Recommendation: if this is pursued, do B first as a standalone milestone, then C. B is cheap, has no data-model impact, answers the real product question ('do people want to see each other?') and de-risks the ephemeral transport. C should be explicitly opt-in per page session, single-relay, and commit-only-on-Save.

Design if C is chosen (Yjs, single relay)

1. Kinds (in src/nostr/kinds.ts): an ephemeral collab kind for Yjs updates (e.g. 20818) and an awareness/presence kind (e.g. 20819), each with h (group), d (slug) and a session/peer id tag. No ephemeral event is ever stored; none is part of history.
2. Doc lifetime. A Yjs document per (group, slug) exists only while the editor is open. On open, load the head 1818 as the initial text. On join, send a state-vector request; a peer responds with a full update. Without this handshake, a late joiner is silently divergent.
3. Transport. client.subscribe on the ephemeral kinds filtered by h and d; publish updates as they arrive from the binding (throttled/batched, not one event per keystroke). Must be verified against groups_relay (accepts h-tagged ephemeral, delivers to live subscribers).
4. Commit. 'Save' builds a normal 1818 from the current Yjs text via the existing publishRevision, parent-rev = the head the saver last saw. If that head has moved, run the existing merge; the CRDT should normally have converged the text already, so the merge is a safety net. The CRDT's own history is discarded — the signed chain remains the only history.
5. Undo. Y.UndoManager scoped to the local origin; CodeMirror's history extension disabled while a collab session is active (otherwise two stacks fight).
6. Presence UI. Awareness payloads give author, color and cursor; render in the editor and optionally in the right rail. No presence data is persisted.
7. Safety bounds. Reject updates above a size cap; wrap Y.applyUpdate in try/catch and drop malformed payloads without breaking the session; never let a remote update trigger a publish; no eval, no HTML.
8. Offline. A collab session needs the relay. Offline editing falls back to the current single-user editor; IndexedDB (CON-8) may persist the Yjs doc locally but must not make it authoritative.
9. Failure mode. If no peer answers the sync request or the relay does not deliver ephemeral events, fall back cleanly to the normal editor and say so — never show a 'live' indicator that is not live.

Subtasks

• Decision: B then C, or status quo (record in docs/00, docs/05, docs/13)
• B: ephemeral presence kind + awareness transport + UI, no text mutation
• C.0: verify groups_relay ephemeral behaviour (delivery, size limits, mute-without-subscriber)
• C.1: Yjs doc lifecycle + sync handshake, with a two-client test
• C.2: CodeMirror binding, single undo stack, live-formatting reconciliation
• C.3: commit-to-1818 on Save with the merge safety net
• C.4: size/malformed-payload bounds and tests
• Docs: docs/05 phase 6, docs/13 'Open', docs/00 non-goal wording, NOSTR.md kinds

Acceptance criteria (if C)

• Two clients on the same page see each other's edits without a merge step.
• A third client joining mid-session converges (sync handshake), and a page opened from a stale head does not silently diverge.
• Saving publishes exactly one signed 1818 per save, signed by the saver, chained to the head they saw; the CRDT leaves no trace in history.
• A relay without ephemeral support degrades to the current editor with a clear message.
• A malformed or oversized update is dropped without breaking the session.

Risks / open decisions

• Product question first: is simultaneous typing wanted for a wiki, or is the merge model actually sufficient? This ticket is a decision, not a commitment.
• Scope creep into the data model is the biggest risk: any drift toward 'the CRDT is the source of truth' undermines signed revisions, blame and history.
• Security: untrusted binary parsed in the same context as the session key; keep updates data-only and bounded.
• No confidentiality change: the relay operator sees live updates as plainly as stored ones.

Depends on / relates to

docs/05 (phase 6), docs/13 (editor model), docs/00 (non-goal), CON-8 (local persistence), CON-4 (relay/auth in production).