# TeXise full product audit — R14.28.14 Build Fix 14

Date: 2026-08-21

## Executive status

TeXise now has a coherent local-first manuscript workflow spanning Source/Visual editing, browser compilation, PDF/SyncTeX, Paper Memory, research assistance, comments/Track Changes, optional account metadata, Pro Cloud Compile and a separately isolated Linux Terminal. Build Fix 14 closes three conspicuous product gaps: visual TikZ creation, Google-Docs-style collaborator presence across both manuscript editors, and a first-party Learn LaTeX surface.

The audit found no release-blocking architecture gap after these changes. The remaining items below are improvement phases, not reasons to hold BF14.

## Implemented in BF14

### 1. TikZ Visual Editor v1 — complete

- Large native TeXise modal; no iframe and no external diagram service.
- Circle and rectangle nodes, editable labels and labeled directed connectors.
- Pointer drag plus keyboard movement for accessible diagram placement.
- Deterministic generated `tikzpicture` preview.
- Source-safe insertion through `latexSource.applyEdits(..., 'visual-structure')`.
- Uses active manuscript cursor when valid; otherwise inserts before `\end{document}`.
- Adds `\usepackage{tikz}` and `\usetikzlibrary{arrows.meta,positioning}` only when needed.
- Keeps canonical `.tex` as the only manuscript representation; no proprietary diagram state is written into the project.

### 2. Collaboration UX/presence — complete for this release

- Yjs awareness includes participant name/color, current file, Source/Visual mode, source-space cursor offset and selection range.
- Source mode continues to use the Yjs/CodeMirror collaboration extension for peer cursors/selections.
- Visual mode maps the same source-space ranges into native ProseMirror decorations, including colored selection highlights, carets and peer-name labels.
- Workspace header shows live collaborator avatars and participant count.
- Collaboration dialog shows who is editing which file and in which mode, including the local participant.
- One-click **Open** jumps to a collaborator's current file.
- Binary collaboration assets remain explicit and SHA-256 verified rather than silently transferred.
- Review/comments remain outside canonical LaTeX source.

### 3. Learn LaTeX — complete for this release

Public routes:

- `/learn`
- `/learn/first-document`
- `/learn/latex-in-30-minutes`
- `/learn/mathematics`
- `/learn/figures`
- `/learn/tables`
- `/learn/bibliography`
- `/learn/cross-references`
- `/learn/tikz`
- `/learn/thesis-projects`
- `/learn/arxiv-submission`
- `/learn/debugging`
- `/learn/collaborative-writing`

The section is integrated into navigation, footer, public search, metadata and sitemap. Completion state is stored only in browser `localStorage` (`texise:learn:completed:v1`) and does not require login.

### 4. Runtime dependency hardening — complete

The standalone Console Gateway no longer carries an older independent `ws` line. Its manifest and service lock now pin `ws 8.21.0`, matching the already-current root/trusted server runtime.

## Audit findings and next improvements

### P1 — Public/editor bootstrap and bundle separation

Current production builds report a large main browser chunk. The browser entry still statically imports both `App` and `SaasApp`, and it initializes the full editor service graph before deciding which UI surface to render. Large first-party modules include `saas-app.tsx`, `latex-visual-editor.tsx`, `native-bangle-editor.ts` and Paper Memory/AI services.

Recommended next phase:

1. Create independent public-site and editor entry modules.
2. Keep the BF13 `/ws` boot-intent snapshot synchronous and authoritative.
3. Initialize only public/account services for public routes.
4. Lazy-load editor, compiler, Paper Memory, scientific runtimes and terminal UI only for `/ws`/project-editor transitions.
5. Add build-budget tests for initial public JS and editor async chunks.

This was not forced into BF14 because changing service bootstrap immediately after fixing `/ws` deep-link selection would add disproportionate regression risk.

### P1 — Collaboration follow/reconnect/roles

BF14 now provides strong presence, but the next collaboration phase should add:

- explicit **Follow collaborator** mode that tracks file and selection changes until cancelled;
- reconnect/offline/retrying state instead of a binary connected/connecting label;
- read-only/reviewer/editor roles;
- host controls for removing a participant and rotating/replacing a room code;
- presence freshness/last-active indication;
- multi-browser E2E with simultaneous Source and Visual editors.

### P1 — TikZ Visual Editor v2

BF14 intentionally targets common diagrams. Future TikZ editing should add:

- import/edit of an existing supported `tikzpicture` rather than insertion-only;
- line/arrow style controls, dashed/dotted paths and arrowhead choice;
- Bézier curves/control points;
- alignment, snap guides, distribute and group/scope actions;
- modal undo/redo;
- reusable TikZ styles;
- matrices and basic trees;
- optional pgfplots builder as a separate tool, not mixed into the diagram editor.

Unsupported arbitrary TikZ should always remain protected source, never be destructively normalized.

### P2 — Learn v2

- Seed optional local practice projects from lessons.
- Browser-local quizzes/checkpoints and completion badges.
- Advanced lessons for custom commands, classes/packages, Beamer, algorithms, glossaries and publishing workflows.
- CMS extension for adding authored Learn courses without rebuilding the browser application.
- Link compiler errors to relevant Learn pages where mapping is deterministic.

### P2 — Maintainability

Several historical Bangle-era modules remain very large. The audit also found old TODO comments in `baby-fs` and legacy editor helper code. None are on the current TeXise release-critical path, but future refactoring should reduce large-file coupling and either retire or document unused Bangle-era abstractions.

### P2 — Performance/observability

- Add Web Vitals collection that remains privacy-minimal and opt-in/aggregate if server reporting is ever enabled.
- Add deterministic bundle budgets to release metadata.
- Measure PDF page virtualization, Visual projection and Paper Memory indexing on low-memory mobile devices.
- Keep compiler assets and AI models outside the initial application bundle and preserve lazy acquisition.

## Security/privacy review

Retained requirements:

- browser/local-first manuscript ownership;
- no mandatory cloud manuscript storage;
- Cloud Compile only when explicitly selected;
- private trusted APIs remain loopback behind Apache;
- Console Gateway token remains outside URL/query strings;
- comments/reviews never become `%` blocks in `.tex`;
- Paper Memory text/embeddings remain browser-local;
- no TeXise font binaries in source release ZIPs;
- `/texise-data` and trusted service namespaces remain denied by Apache.

## Release verification status

Dependency-free gates completed in the BF14 source tree:

- release contracts: 335/335 PASS;
- SaaS/security static audit: 43/43 PASS;
- runtime hardening: 99/99 PASS;
- combined server/deployment/regression tests: 87/87 PASS;
- R14.28.14 focused regression suite: 13/13 PASS;
- pnpm frozen-lock importer sync: 69 importers PASS;
- workspace dependency consistency: 68 packages PASS;
- public barrels: 67 entries across 68 packages PASS;
- template compiler requirements: 13/13 PASS;
- installer/upgrade/deployment shell syntax PASS;
- TypeScript parser/transpile syntax check over modified BF14 TS/TSX files PASS; whole-tree parser validation covers 954 first-party TS/TSX files.

Dependency-backed `tsgo`, Biome and Vite cannot be rerun in this isolated release workspace because `node_modules` is intentionally absent and the environment cannot resolve npm/Corepack. The next production installer remains the authoritative dependency-backed gate; BF13 production had already passed those gates for the unchanged baseline files.


## Build Fix 17 follow-through

Build Fix 17 closes two BF14 follow-up gaps. The basic TikZ builder is replaced with a locally vendored TikZ Draw workspace, and production collaboration moves from WebRTC-only propagation to a same-origin synchronized Yjs relay. Per-collaborator Source/Visual authorship, hover attribution, deterministic colors, Follow mode and review cleanup are now first-class release contracts. Remaining longer-term collaboration items are role/read-only permissions, host moderation and larger multi-user stress/load certification.