fix(files): stop the collaborative editor rewriting and reflowing a document on open

Opening a file rewrote it. Binding an editor to a seeded document emits a Yjs
update of its own — ProseMirror appends an empty paragraph to any doc that does
not end in one — which the relay saw as a real edit and persisted. Every open
therefore uploaded the file under a FRESH storage key and deleted the old one,
404ing the page's own in-flight content read, bumping "Last Updated" just from
viewing, and churning a blob per open. Worse, a trailing blank line cannot
serialize, so the file never recorded that paragraph and nothing reconciled the
two: each client that seeded without seeing another's contribution stacked one
more. A real document reached 18 against the placeholder's 1 — measured as the
pane growing several hundred pixels the instant the live editor took over.

- Seed and merge through the editor's own normal form (`editorNormalForm`), so
  binding is a no-op and `canonicalizeYDoc` collapses an accumulated run back to
  one. Placed at the collab boundary, not in `parseMarkdownToDoc`: only the CRDT
  has to agree with the editor — every other consumer of the parse renders
  through a real editor that normalizes itself.
- Skip a persist whose projection already matches the durable bytes. Byte length
  is the free reject, so the compare read only happens when a no-op write is
  actually on the table.
- Revoke collaborative readiness on a fatal join. The sticky `syncedOnce` latch
  outlived the document: after a readiness timeout the provider drops `synced`
  so the gate closes, but the latch re-opened it on the offline fallback's seed
  flag — handing back an EDITABLE editor on a document the provider had
  abandoned, with client autosave gated off because collaboration is nominally
  on. Keystrokes went nowhere and vanished on reload, with no error shown.
- Recover from a superseded storage key instead of stranding the reader: a 404
  re-resolves the file record, so the read re-keys onto the current object. And
  do not focus-refetch durable bytes while the relay owns durability.
- Prefetch the workspace file list in the layout, where the sidebar already
  reads it. `HydrationBoundary` defers an already-seen query to an effect that
  SSR never runs, so a page-level prefetch of that key could not reach the
  server render — the file route rendered a spinner and disagreed with the
  client about the header's markup (a hydration mismatch).
- Load the document font with `display: block`. A swap repaints prose in
  metric-adjusted Arial first, so paragraphs re-wrap when the real face lands.

Also: a detail-route `loading.tsx` (the segment was inheriting the list chrome),
`normalize.ts` renamed to `field.ts` now that it holds only the field constant,
and the duplicate `COLLAB_DOC_FIELD` in the streaming path folded into it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: icecrasher321

apps/sim/app/_styles/fonts/season/season.ts

@@ -3,13 +3,26 @@ import localFont from 'next/font/local'
 /**
  * Season Sans variable font configuration
  * Uses variable font file to support any weight from 300-800
+ *
+ * `display: 'block'`, not `swap`: this is the document font, so a swap is not a cosmetic change of
+ * typeface — the fallback's glyph advances differ, so paragraphs re-wrap and everything below them
+ * moves. In long-form prose (the Files editor) that reads as the line and paragraph spacing visibly
+ * correcting itself a beat after the text appears, on every hard refresh (a normal reload serves the
+ * font from cache and never swaps). `swap` is the setting that says "painting the wrong font first is
+ * fine"; for a brand face it is not.
+ *
+ * The block period costs nothing here because delivery is already optimal: `preload` emits a
+ * `Link: rel=preload` RESPONSE header, so the fetch starts before the HTML is parsed, and the file is
+ * one same-origin, immutably-cached 87KB woff2. The metric-adjusted Arial below stays as the safety
+ * net for the >3s tail, where the browser gives up blocking and swaps — i.e. the worst case is
+ * today's behavior, not a regression.
  */
 export const season = localFont({
   src: [
     // Variable font - supports all weights from 300 to 800
     { path: './SeasonSansUprightsVF.woff2', weight: '300 800', style: 'normal' },
   ],
-  display: 'swap',
+  display: 'block',
   preload: true,
   variable: '--font-season',
   fallback: ['system-ui', 'Segoe UI', 'Roboto', 'Helvetica Neue', 'Arial', 'Noto Sans'],

apps/sim/app/workspace/[workspaceId]/files/[fileId]/loading.tsx

@@ -0,0 +1,35 @@
+'use client'
+
+import { File as FileIcon } from '@sim/emcn/icons'
+import { noop } from '@sim/utils/helpers'
+import {
+  type BreadcrumbItem,
+  ResourceChromeFallback,
+} from '@/app/workspace/[workspaceId]/components'
+import { FOLDERED_RESOURCE_HEADERS } from '@/app/workspace/[workspaceId]/components/folders/foldered-resources'
+
+const FILES_HEADER = FOLDERED_RESOURCE_HEADERS.file
+
+/**
+ * Transcribes the trail the loaded page shows while its record resolves (`loadingBreadcrumbs` in
+ * `files.tsx`): the root crumb plus a terminal `…`, with no icon on the leaf — so the fallback and
+ * the page paint the same two crumbs and only the label changes.
+ */
+const BREADCRUMBS: BreadcrumbItem[] = [
+  { label: FILES_HEADER.rootLabel, icon: FileIcon, onClick: noop },
+  { label: '…', terminal: true },
+]
+
+/**
+ * Fallback for the file DETAIL route. Without it the segment inherits the Files list fallback, which
+ * paints an options bar and a table header row that a document page does not have — chrome that has
+ * to be torn down a frame later. A detail page is header + body, so this is the header alone.
+ *
+ * Header actions are deliberately omitted: they are a function of the open file (a previewable
+ * non-markdown file gets a mode toggle, an editable one gets Share/Delete), which is exactly what is
+ * not yet known here. Chips appearing beside the title reads as content arriving; chips appearing
+ * and then changing reads as a glitch.
+ */
+export default function FilesFileLoading() {
+  return <ResourceChromeFallback icon={FileIcon} breadcrumbs={BREADCRUMBS} />
+}

apps/sim/app/workspace/[workspaceId]/files/[fileId]/page.tsx

@@ -1,17 +1,48 @@
 import { Suspense } from 'react'
+import { dehydrate, HydrationBoundary } from '@tanstack/react-query'
 import type { Metadata } from 'next'
+import { getSession } from '@/lib/auth'
+import { getQueryClient } from '@/app/_shell/providers/get-query-client'
+import FilesFileLoading from '@/app/workspace/[workspaceId]/files/[fileId]/loading'
 import { Files } from '@/app/workspace/[workspaceId]/files/files'
-import FilesLoading from '@/app/workspace/[workspaceId]/files/loading'
+import { prefetchFilesBrowser } from '@/app/workspace/[workspaceId]/files/prefetch'
 
 export const metadata: Metadata = {
   title: 'Files',
   robots: { index: false },
 }
 
-export default function FilesFilePage() {
+/**
+ * File detail entry. `Files` resolves the open file out of the workspace file LIST, so this route
+ * needs the same prefetch its sibling list page does — without it the server can only ever render
+ * the "resolving the record" spinner, and the real header (breadcrumbs, actions) has to pop in a
+ * frame later on the client.
+ *
+ * It also removes a whole class of hydration mismatch: which branch `Files` renders is decided by
+ * whether that list is in the cache, so a server render without it and a client render with it
+ * disagree on the header's markup (a static `…` crumb vs. the file's dropdown crumb). Prefetching
+ * here makes both sides read the same cache and pick the same branch by construction.
+ *
+ * `Files` reads URL query params via nuqs (`useSearchParams` internally), so it must sit under a
+ * Suspense boundary; the fallback is the detail chrome, matching the route's own `loading.tsx`.
+ */
+export default async function FilesFilePage({
+  params,
+}: {
+  params: Promise<{ workspaceId: string; fileId: string }>
+}) {
+  const [{ workspaceId }, session] = await Promise.all([params, getSession()])
+
+  const queryClient = getQueryClient()
+  if (session?.user?.id) {
+    await prefetchFilesBrowser(queryClient, workspaceId, session.user.id)
+  }
+
   return (
-    <Suspense fallback={<FilesLoading />}>
-      <Files />
-    </Suspense>
+    <HydrationBoundary state={dehydrate(queryClient)}>
+      <Suspense fallback={<FilesFileLoading />}>
+        <Files />
+      </Suspense>
+    </HydrationBoundary>
   )
 }

apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/collaboration/apply-streamed-markdown.ts

@@ -2,11 +2,9 @@ import type { Editor } from '@tiptap/core'
 import { Node as PMNode } from '@tiptap/pm/model'
 import { initProseMirrorDoc, updateYFragment, ySyncPluginKey } from '@tiptap/y-tiptap'
 import * as Y from 'yjs'
+import { COLLAB_DOC_FIELD } from '@/lib/collab-doc/field'
 import { parseMarkdownToDoc } from '../markdown-parse'
 
-/** The Yjs fragment name TipTap's Collaboration extension binds to (its default `field`). */
-const COLLAB_DOC_FIELD = 'default'
-
 /**
  * Transaction origin for agent-streamed writes into a live collaborative doc. It is deliberately NOT
  * the `ySyncPluginKey` origin that local user edits use, so the Collaboration UndoManager — which

apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/collaboration/collab-streaming-integration.test.ts

@@ -164,7 +164,7 @@ describe('collab streaming integration — moving pieces', () => {
     reopened.destroy()
   })
 
-  it('EMPTY-COLLAPSE ON THE STREAM PATH: an agent body with a huge blank run does not strand empties', () => {
+  it('EMPTY-BOUND ON THE STREAM PATH: an agent body with a huge blank run does not strand empties', () => {
     const A = makeCollabEditor()
     A.editor.commands.setContent(parseMarkdownToDoc('# Title\n\nintro'), { contentType: 'json' })
     const session = beginAgentStream(A.editor)!
@@ -173,9 +173,11 @@ describe('collab streaming integration — moving pieces', () => {
     endAgentStream(session)
 
     console.log(
-      `\n[STREAM-COLLAPSE] text=${JSON.stringify(A.editor.state.doc.textContent)} empty=${emptyParas(A.editor)}`
+      `\n[STREAM-BOUND] text=${JSON.stringify(A.editor.state.doc.textContent)} empty=${emptyParas(A.editor)}`
     )
-    expect(emptyParas(A.editor)).toBe(0) // collapse protects the live streaming path, not just static open
+    // ~200 blank paragraphs' worth of run arrives; the parse bound caps what reaches the live doc, so the
+    // streaming path is protected exactly like a static open — no unbounded node explosion in the CRDT.
+    expect(emptyParas(A.editor)).toBe(20)
     expect(A.editor.state.doc.textContent).toContain('tail paragraph')
   })
 

apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/collaboration/readiness.test.ts

@@ -4,33 +4,48 @@
 import { describe, expect, it } from 'vitest'
 import { type CollabReadinessInputs, nextCollabReadiness } from './readiness'
 
+/** An observation, with the healthy defaults filled in so each case states only what it exercises. */
+const at = (input: Partial<CollabReadinessInputs>): CollabReadinessInputs => ({
+  synced: false,
+  seeded: false,
+  offlineSeed: false,
+  fatal: false,
+  ...input,
+})
+
 /** Drive a sequence of observations through the latch, returning the readiness at each step. */
-function run(steps: CollabReadinessInputs[]): boolean[] {
+function run(steps: Partial<CollabReadinessInputs>[]): boolean[] {
   let syncedOnce = false
-  return steps.map((input) => {
-    const next = nextCollabReadiness(syncedOnce, input)
+  return steps.map((step) => {
+    const next = nextCollabReadiness(syncedOnce, at(step))
     syncedOnce = next.syncedOnce
     return next.ready
   })
 }
 
 describe('nextCollabReadiness', () => {
   it('is not ready before syncing or seeding', () => {
-    const { syncedOnce, ready } = nextCollabReadiness(false, {
-      synced: false,
-      seeded: false,
-      offlineSeed: false,
-    })
+    const { syncedOnce, ready } = nextCollabReadiness(
+      false,
+      at({
+        synced: false,
+        seeded: false,
+        offlineSeed: false,
+      })
+    )
     expect(syncedOnce).toBe(false)
     expect(ready).toBe(false)
   })
 
   it('is not ready when synced but not yet seeded', () => {
-    const { syncedOnce, ready } = nextCollabReadiness(false, {
-      synced: true,
-      seeded: false,
-      offlineSeed: false,
-    })
+    const { syncedOnce, ready } = nextCollabReadiness(
+      false,
+      at({
+        synced: true,
+        seeded: false,
+        offlineSeed: false,
+      })
+    )
     expect(syncedOnce).toBe(true) // latched
     expect(ready).toBe(false) // waits for the seed
   })
@@ -50,11 +65,14 @@ describe('nextCollabReadiness', () => {
   it('opens even if the seed lands before we ever observed synced (server seed proves a sync)', () => {
     // If the flap beat our first observation, the seed flag alone (not the offline fallback) proves a
     // completed sync happened.
-    const { syncedOnce, ready } = nextCollabReadiness(false, {
-      synced: false,
-      seeded: true,
-      offlineSeed: false,
-    })
+    const { syncedOnce, ready } = nextCollabReadiness(
+      false,
+      at({
+        synced: false,
+        seeded: true,
+        offlineSeed: false,
+      })
+    )
     expect(syncedOnce).toBe(true)
     expect(ready).toBe(true)
   })
@@ -74,4 +92,33 @@ describe('nextCollabReadiness', () => {
     ])
     expect(readiness).toEqual([true, true])
   })
+  /**
+   * The reported bug. A brand-new file syncs EMPTY (latching `syncedOnce`), its server seed never
+   * lands, and the readiness deadline fires: the provider goes fatal and drops `synced` precisely so
+   * this gate closes. The offline fallback then seeds locally — and the sticky latch used to re-open
+   * the gate on that, handing back an editable editor bound to a document the provider had abandoned.
+   * Every keystroke was dropped (the provider ignores frames and never rejoins) and client autosave
+   * stayed off (collaboration is nominally on), so the edits vanished on reload with no error shown.
+   */
+  it('stays read-only after the readiness deadline goes fatal, even though a sync was latched', () => {
+    const readiness = run([
+      { synced: false },
+      { synced: true }, // initial EMPTY sync — latches syncedOnce
+      { synced: false, fatal: true }, // deadline: provider drops synced and gives up
+      { seeded: true, offlineSeed: true, fatal: true }, // fallback seeds locally
+    ])
+    expect(readiness).toEqual([false, false, false, false])
+  })
+
+  /**
+   * The same revocation on an ALREADY-ready doc: access is withdrawn mid-session, the provider goes
+   * fatal, and readiness must be taken back rather than left latched open.
+   */
+  it('revokes readiness when a live document turns fatal', () => {
+    const readiness = run([
+      { synced: true, seeded: true }, // ready
+      { synced: false, seeded: true, fatal: true }, // access revoked mid-session
+    ])
+    expect(readiness).toEqual([true, false])
+  })
 })

apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/collaboration/readiness.ts

@@ -22,16 +22,32 @@ export interface CollabReadinessInputs {
   seeded: boolean
   /** Whether the seed flag was set by the offline fallback (no server sync) rather than the server. */
   offlineSeed: boolean
+  /**
+   * Whether the provider has GIVEN UP on this document — a non-retryable rejection, an access
+   * revocation, or the readiness deadline lapsing. A fatal provider ignores every inbound frame and
+   * never rejoins, so nothing typed after this point reaches the server.
+   */
+  fatal: boolean
 }
 
 /**
  * Pure transition for the readiness latch. `syncedOnce` is the sticky prior state — pass the returned
  * `syncedOnce` back in on the next call. `ready` is whether the doc is synced-and-seeded.
+ *
+ * `fatal` overrides the latch, and that override is the whole reason it is an input. The latch is
+ * sticky on purpose, but stickiness must not outlive the document: a doc that syncs empty and never
+ * receives its server seed trips the readiness deadline, and the provider answers by dropping `synced`
+ * so this gate closes. The latch ignored that — `syncedOnce` was already set by the empty sync — so the
+ * offline fallback's seed flag re-opened the gate and handed back an EDITABLE editor on a document the
+ * provider had already abandoned. Nothing typed into it could persist: the provider drops every frame
+ * and never rejoins, and the client's own autosave stays gated off because collaboration is nominally
+ * on. The user types, sees no error, and loses the edits on reload. Revoking readiness on `fatal` is
+ * what makes the fallback what it is documented to be — a READ-ONLY view of the stored content.
  */
 export function nextCollabReadiness(
   syncedOnce: boolean,
   input: CollabReadinessInputs
 ): { syncedOnce: boolean; ready: boolean } {
   const next = syncedOnce || input.synced || (input.seeded && !input.offlineSeed)
-  return { syncedOnce: next, ready: next && input.seeded }
+  return { syncedOnce: next, ready: next && input.seeded && !input.fatal }
 }

apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/markdown-fidelity.ts

@@ -173,10 +173,11 @@ function stripEmptyListItemLines(markdown: string): string {
  * round-trip ({@link stripEmptyListItemLines}), restores callout markers the serializer
  * backslash-escapes (`> \[!NOTE\]` → `> [!NOTE]`), and collapses trailing blank lines to a single
  * newline. Interior blank runs are NOT collapsed here — blank lines inside a fenced code block (or a
- * verbatim raw-markdown-snippet) are significant, and a global collapse would corrupt them. Spurious
- * interior blank runs between top-level blocks are removed upstream instead, by
- * {@link parseMarkdownToDoc} stripping empty paragraphs, so a doc that has been through the editor
- * never serializes with an interior blank run outside code in the first place. The table serializer's
+ * verbatim raw-markdown-snippet) are significant, and a global collapse would corrupt them. An interior
+ * run between top-level blocks is significant too: it is how an empty paragraph is written, and
+ * {@link parseMarkdownToDoc} reads exactly the count back out, so collapsing it here would delete the
+ * document's spacing. Only the TRAILING run is collapsed — it can carry no paragraph (see
+ * `clampEmptyParagraphs`) and would otherwise churn the file on every save. The table serializer's
  * spurious surrounding blank lines are trimmed at the source (PipeSafeTable), so no global
  * leading-newline strip is needed here — avoiding clobbering content that legitimately begins with
  * whitespace.