Investigate Editor undo and concurrent edit data loss

kayg commented

2026-09-28 13:46:53 +00:00

Owner

Evidence

The one local adversarial run reported two Editor consistency failures with seed 25608414:

The browser undo/redo round trip changed Note text. The actual body had missing spacing and omitted part of the expected text after the browser action storm.
The concurrent delete/edit probe timed out waiting for the edited block to survive. The saved Note body contained only second-target.

These are not cross-User findings. The run had heavy shared-host load, so reproduce each case before assigning a cause. Keep the existing adversarial expectations unchanged. Add minimal deterministic persistence regressions for any confirmed defect.

See the report on cross-User audit #331.

## Evidence The one local adversarial run reported two Editor consistency failures with seed `25608414`: - The browser undo/redo round trip changed Note text. The actual body had missing spacing and omitted part of the expected text after the browser action storm. - The concurrent delete/edit probe timed out waiting for the edited block to survive. The saved Note body contained only `second-target`. These are not cross-User findings. The run had heavy shared-host load, so reproduce each case before assigning a cause. Keep the existing adversarial expectations unchanged. Add minimal deterministic persistence regressions for any confirmed defect. See the report on cross-User audit #331.

kayg referenced this issue

2026-09-28 13:47:19 +00:00

SECURITY: cross-user isolation campaign — find ANY way one user can read, change, infer, slow or break another user's data #331

kayg referenced this issue

2026-09-28 14:38:25 +00:00

SECURITY: cross-user isolation campaign — find ANY way one user can read, change, infer, slow or break another user's data #331

kayg commented

2026-09-28 17:29:40 +00:00

Author

Owner

The 2026-09-28 local adversarial round reproduced two Editor consistency findings: a 10,000-block sync took 2,215 ms against a 2,000 ms budget (load-only), and an undo/redo round trip changed the editor text. A concurrent delete/edit case also timed out waiting for both peers to observe the delete conflict. Same-block concurrent writes, offline reconciliation, external-body-write propagation and restart recovery passed. Detailed output is recorded on #343; this change does not touch Editor.

kayg referenced this issue

2026-09-28 17:39:29 +00:00

FILES: atomic write fails with 'entry not found' during a reconcile/watcher storm (stress test flakes under load) #343

kayg referenced this issue

2026-09-28 23:45:44 +00:00

COLLAB: concurrent delete and edit can lose an edit to the deleted block #332

kayg commented

2026-09-28 23:45:45 +00:00

Author

Owner

Editor-integrity job final report — branch job/editor-integrity, head b824878e (pushed).

#332 and #364: fixed the Yrs conflict-shadow merge that discarded the surviving edit when another client deleted that block. Deterministic tests cover both update orders and a same-connection redo update. The real-server delete/edit probe passed.
#346: the concurrent delete/edit loss is fixed by the same change. The history-text finding is not closed by this work; see #314 and #363 below.
#225 and #262: added structure-level editor history coverage, but did not rerun the 500-step production browser ID storm after the final branch state. Persistence of unique IDs in that exact storm remains unconfirmed.
#280 and #281: the focused history test keeps one pasted image over 50 undo/redo pairs. The 500-step production browser image storm was not rerun after the final branch state, so this exact case remains unconfirmed.
#314 and #363: focused Yjs/ProseMirror structure tests pass. The fixed-seed production browser history probe remained timing-sensitive: clean runs reported a stale or mismatched mounted ProseMirror view after Ctrl+Z, while one instrumented run passed 50 paste and IME round trips. I removed the unverified key scheduling change and kept the failure evidence for follow-up.

Verification:

bun run test src/collaborationUndo.test.ts: 4 passed.
cargo fmt --check: exit 0, no output.
cargo clippy --all-targets -- -D warnings: stopped at the four-hour job limit (exit 130) while compiling workspace dependencies.
cargo test, bun run check, and bun run test for the full web workspace were not run before the time limit.

Decision: conflict-shadow merge filters each incoming Yrs update against that update's own delete set. This keeps a later text edit that follows a root deletion while avoiding replay of a duplicate root insertion from the same redo update. The issue-specific tests pass; the full gates and listed browser storms remain for follow-up. Issues remain open.

Editor-integrity job final report — branch `job/editor-integrity`, head `b824878e` (pushed). - #332 and #364: fixed the Yrs conflict-shadow merge that discarded the surviving edit when another client deleted that block. Deterministic tests cover both update orders and a same-connection redo update. The real-server delete/edit probe passed. - #346: the concurrent delete/edit loss is fixed by the same change. The history-text finding is not closed by this work; see #314 and #363 below. - #225 and #262: added structure-level editor history coverage, but did not rerun the 500-step production browser ID storm after the final branch state. Persistence of unique IDs in that exact storm remains unconfirmed. - #280 and #281: the focused history test keeps one pasted image over 50 undo/redo pairs. The 500-step production browser image storm was not rerun after the final branch state, so this exact case remains unconfirmed. - #314 and #363: focused Yjs/ProseMirror structure tests pass. The fixed-seed production browser history probe remained timing-sensitive: clean runs reported a stale or mismatched mounted ProseMirror view after Ctrl+Z, while one instrumented run passed 50 paste and IME round trips. I removed the unverified key scheduling change and kept the failure evidence for follow-up. Verification: - `bun run test src/collaborationUndo.test.ts`: 4 passed. - `cargo fmt --check`: exit 0, no output. - `cargo clippy --all-targets -- -D warnings`: stopped at the four-hour job limit (exit 130) while compiling workspace dependencies. - `cargo test`, `bun run check`, and `bun run test` for the full web workspace were not run before the time limit. Decision: conflict-shadow merge filters each incoming Yrs update against that update's own delete set. This keeps a later text edit that follows a root deletion while avoiding replay of a duplicate root insertion from the same redo update. The issue-specific tests pass; the full gates and listed browser storms remain for follow-up. Issues remain open.

kayg referenced this issue

2026-09-28 23:45:48 +00:00

Editor delete and edit conflict did not reach both peers #364

kayg referenced this issue

2026-09-28 23:45:49 +00:00

Adversarial editor undo/redo round trip loses note text #314

kayg referenced this issue

2026-09-28 23:45:50 +00:00

Regression: undo/redo storm persists duplicate Note block IDs #225

kayg referenced this issue

2026-09-28 23:45:51 +00:00

Editor history storm can persist duplicate block IDs #262