# R14.28.20 Build Fix 44 / Hotfix10 trusted-runtime template packaging correction — 2026-08-23 **State:** BF43 is now production-verified through pinned dependency installation, custom validation, strict `tsgo`, Biome, BusyTeX provisioning, the complete 357-check static audit and Vite production browser build. Its only deployment failure occurred when the trusted API staged only `server/` and `server/template-library.mjs` attempted to import the absent sibling `scripts/generate-template-manifest.mjs`. BF44 makes the staged runtime self-contained and hardens the live template synchronization boundary. **Corrections:** reusable manifest/sync logic moved to `server/template-manifest.mjs`; build-time `scripts/generate-template-manifest.mjs` is now a thin CLI wrapper; deployment validates the exact staged server graph before activation; runtime `release.env` carries canonical source/live template paths; Admin template source and live catalog paths receive narrow systemd write access under `ProtectSystem=strict`; deployment verifies those paths with an unprivileged sandbox probe; public Assets Sync now emits only `templates.json`, `institutions.json` and `redirects.json`, never `free/` or `pro/` source trees. **Verification:** BF44 current regression **22/22**; focused SEO/template/blog/platform/deployment suite **54/54**; historical R14.28.14–19 **85/85**; runtime hardening **101/101**; native server **98/98**; SaaS audit **44/44**; release audit **357/357**; branding, lockfile, workspace-dependency, public-barrel, Bash and Node syntax checks PASS. BF44 production trusted-runtime activation remains the final deployment-specific confirmation. # R14.28.20 Build Fix 43 / Hotfix10 production Biome lint correction — 2026-08-23 **State:** BF42 production install passed pinned dependency installation, custom validation, and strict `tsgo`, then stopped at six Biome lint diagnostics. BF43 fixes those exact lint diagnostics without changing Hotfix10 behavior, rotates the release/cache identity, and adds a dedicated BF43 source/regression guard. **Corrections:** two unnecessary static template literals in Learn content were converted to string literals; the dynamic article-tag `forEach` callback now returns `void`; three empty Admin table header cells are self-closing JSX. **Verification:** BF43 current regression **21/21**; historical R14.28.14–19 combined with current release **106/106**; focused SEO/template/blog/platform subset **38/38**; runtime **101/101**; SaaS **44/44**; release audit **357/357**; branding/lock/workspace/barrel checks PASS. Production Biome/Vite re-verification remains the deployment gate. # R14.28.20 Build Fix 42 / Hotfix10 production typecheck correction — 2026-08-23 **State:** BF41 successfully installed dependencies on production but failed at strict `tsgo` with five Hotfix10 typing errors. BF42 fixes those exact diagnostics, preserves the entire Hotfix10 architecture, rotates release/cache identity, and is dependency-free certified. Exact production `tsgo`/Biome/Vite re-verification is pending redeployment of BF42. **Corrections:** runtime-safe Web Share detection; BibTeX capture narrowing to `string[]`; required template fixture metadata arrays; protected API URLs in template fixtures. **Verification:** BF42 R14.28.20 20/20; Hotfix10 40/40; historical R14.28.14–19 green; runtime 101/101; native server 98/98; SaaS 44/44; release 357/357; branding/lock/workspace/barrel checks PASS. # R14.28.20 Build Fix 41 / Hotfix10 implementation checkpoint — 2026-08-23 **State:** implementation complete; final archive packaging/certification follows the dependency-free working-tree gates. **Template platform:** the authoritative source remains `texise-templates/free/` and `texise-templates/pro/`. Admin now supports safe single/bulk ZIP upload, filesystem-backed metadata editing, Free/Pro moves, structural project validation, reusable academic-institution records, bulk classification and explicit Assets Sync. Manual `cp`/SCP into either tier followed by Assets Sync remains supported without database registration. **Template delivery/security:** raw template source trees and registry files are denied over HTTP. Generated public metadata contains API delivery URLs rather than raw filesystem paths. Pro file delivery performs server-side entitlement checks and uses private/no-store caching. The design prevents trivial anonymous scraping and entitlement bypass without pretending that source already delivered to an authorized browser can be made uncopyable. **SEO migration:** individual templates use stable `/templates/{slug}` canonicals. `/latex-templates` and legacy detail URLs receive permanent migration handling. Faceted template/blog URLs remain `noindex,follow` after React hydration; public application shells expose their noindex directives instead of being hidden behind contradictory robots.txt rules. Institution collection pages and enriched truthful template `CreativeWork` data are included. **Research acquisition:** the homepage now uses the exact requested research-editor H1/title; stale multi-competitor homepage comparison content was removed. Researcher/thesis/team/local-first/visual/terminal/Paper Memory/local-AI/Overleaf-alternative pages and four browser-local research/LaTeX tools were added. Learn examples support Copy/Try in Editor via one-time sessionStorage handoffs, isolated local projects and multi-file payloads. **Branding:** current product surfaces use TeXise Editor and TeXise Terminal where appropriate. Genuine `@texiser` social identity, third-party packages, compiler endpoints, migration compatibility keys and legally/technically necessary provenance remain intact. **Known migration dependency:** this source tree contains eight template source packages while the previous public/template-index audit identified a substantially larger historical corpus. The platform can migrate and redirect recovered templates but does not invent absent source. Historical template packages should be recovered before their indexed URLs are retired. **Working-tree verification:** Hotfix10 focused tests 40/40; R14.28.20 19/19; historical R14.28.14 22/22; R14.28.15 14/14; R14.28.16 16/16; R14.28.17 8/8; R14.28.18 14/14; R14.28.19 11/11; runtime hardening 101/101; native server 98/98; SaaS static 44/44; release audit 357/357; branding, frozen-lock, workspace dependency and public-barrel checks PASS. **Dependency-backed limitation:** this extracted source does not contain workspace `node_modules`, so the full pnpm TypeScript/Biome/Vitest/Vite/Playwright production chain is not claimed locally and remains a deployment/release-quality gate. ## BF39 Source Reveal Masking / Copy Hotfix 4 **State:** complete. Source overlay and Source preview are explicitly opaque; Visual bleed-through is structurally prevented. Requested local-first/browser-first copy swap applied. BF39 focused 14/14, release audit 356/356, SaaS 44/44, server 76/76, deployment/config 16/16. # BF39.1 Interactive Homepage Demo — Hotfix 2 **State:** implemented and source-certified. BF39 now uses restrained TeXise typography, a taller TeXise editor simulation, local Source/Visual state switching, a fake compile/PDF-refresh sequence, and a highlighted simulated Terminal. No actual editor/compiler/network/terminal runtime is initialized by the homepage. **Certification:** BF39 13/13; BF38 11/11; BF37 14/14; BF36 8/8; BF35 16/16; BF34 14/14; BF33 22/22; runtime 101/101; release audit 356/356; SaaS audit 44/44; server 76/76; deployment/config 16/16; lock/dependency/barrel/template checks PASS. # R14.28.20 Build Fix 39 implementation checkpoint — Homepage Hero — 2026-08-22 **Accessibility Lint Hotfix 1:** production strict TypeScript gates pass; Biome then exposed unsupported `aria-label` on the bare capability `div`. The capability container now declares `role="group"`, preserving its accessible name with a role that supports it. BF39 focused regression/source guards now prevent recurrence. **Objective:** simplify the public first screen and make the product itself the dominant visual, using the supplied Thetapad composition only as structural inspiration while retaining an original TeXise design and factual product claims. **Implemented:** a new `HomeHero` component owns the two-line hero heading, detailed static TeXise workspace preview, exact local-first paragraph and three circular-check capabilities. The preview models Files, Source/Visual/Navigator, Compile, PDF, Terminal, TexLab, AI and Review using presentation-only React/CSS. Responsive rules progressively hide Files and PDF as width decreases; `100svh` sizing targets the first screen; reduced-motion removes entrance motion. The existing lower home sections and header remain intact. **Brand/social:** TeXise yellow and the BF38 favicon are used throughout the hero. The floating X CTA now displays `@TeXiser` while its URL stays lowercase and unchanged. **Compatibility:** TX7.2.3, BF38 Statcounter/non-admin routing, optional Google Tag consent, cookie notice, favicon/PWA, collaboration, editor and terminal behavior are preserved. **Certification:** BF39 10/10, BF38 11/11, BF37 14/14, BF36 8/8, BF35 16/16, BF34 14/14, BF33 22/22, runtime 101/101, release audit 356/356 and SaaS audit 44/44 pass on the final source tree before packaging. Dependency-backed monorepo gates remain production-only where local `node_modules` is absent. ## R14.28.19 Build Fix 38 — Favicon, Social, Cookie & Analytics — 2026-08-22 Status: implemented and dependency-free certification complete. See `BF38-FAVICON-SOCIAL-COOKIE-ANALYTICS-IMPLEMENTATION-STATE.md`. # TeXise SaaS Implementation Ledger ## R14.28.18 Build Fix 37 / TX7.2.3 — Pro Collaboration Hosting, TexLab & Editor UI — 2026-08-22 **Security/entitlement:** new collaboration rooms require an authenticated CSRF-protected host-grant request backed by effective non-blocked Pro entitlement (Admin receives effective Pro through the existing server authority). The short-lived signed grant is bound to room key and review capability and is verified by `/collab-live` only when creating a room. Existing authorized rooms remain joinable by normal/anonymous guests. **Product/UI:** installs the newly supplied desktop logo, slightly increases Visual manuscript typography, renames the Pro server terminal to TexLab with a lab icon, shares Terminal/TexLab chrome, removes local runtime-status pills, swaps Navigator/Tools, renames Start Writing to Open Workspace, adds home-header Open, portal-renders the shared editor/home account popover, and makes Projects three-dot menus dismissible. **Regression hardening:** the old scientific-runtime Playwright suite no longer expects removed header pills and instead certifies runtime state through runtime commands. Historical BF34/SaaS/migration guards were updated only where they asserted superseded BF36 labels/source-guard ranges. **Verification:** BF37 14/14, BF36 8/8, BF35 16/16, BF34 14/14, historical BF33 22/22, runtime 101/101, release audit 354/354, SaaS static audit 43/43, native server tests 73/73, deployment/config Node tests 16/16, lock/dependency/barrel/template verification PASS. Production installer evidence confirms custom validation, strict tsgo/mobile/root typecheck, Biome, BusyTeX provisioning, Vite build, SaaS preflight, trusted API, Cloud Compile, TexLab and signaling pass; Relay Health Hotfix 2 fixes the subsequent signed-host live-relay health mismatch. Vitest/Playwright remain external runtime gates. See `docs/BF37-TX7.2.3-IMPLEMENTATION-STATE.md` for the detailed state. ## R14.28.17 Build Fix 36 / TX7.2.2 — Collaboration UX, Account Menu, Responsive Branding & Settings — 2026-08-22 **BF36 Accessibility Lint Hotfix 1:** production dependency-backed typecheck completed successfully and Biome then reported unsupported `aria-expanded` on the native account-menu ``. The redundant attribute is removed; native `
/` disclosure semantics remain controlled by `open`/`onToggle`, and BF36 regression/source guards now reject this invalid ARIA pattern. **Objective:** polish collaboration/account/settings UX while preserving BF35/TX7.2.1 manuscript and collaborative-review behavior. Google OAuth routing/configuration is deliberately unchanged. **Collaboration UX:** removes the user-facing Copy diagnostics control; host Stop collaboration is destructive and sits beside Close; guest Leave sits beside Close; Close only dismisses the modal. Authenticated hosts/joiners use trusted session id/displayName/email and are never prompted for a collaboration name, while anonymous users retain the existing name flow. **Account navigation:** a shared `TexiseAccountPopover` now powers public/SaaS and editor account controls. Authenticated users get Projects, Settings and Logout plus account identity; anonymous users get Login only. Outside-click/Escape dismissal and accessible expanded state are included; the old editor-specific popover implementation is retired. **Brand:** installs the supplied horizontal `/texise-logo.png` for desktop/tablet and square `/texise-logo-mobile.png` for compact/mobile views. The Brand component uses `` at the existing 48rem breakpoint. Old generated `texise-brand-mark` / `texise-brand-word` content is removed from active UI/CSS. **Settings:** Provider, Joined and Last sign-in move below Display name as one muted line each. Session provider is derived from trusted DB identity state. Pro entitlement removes License type, License provider and Remaining, and renames Last verified to License verified. Lifetime Deal linking is moved to a dedicated responsive card below entitlement with loading, inline-error and success states plus immediate entitlement refresh. **Verification:** BF36 8/8, BF35 16/16, BF34 14/14, historical R14.28.14 22/22, runtime hardening 101/101, release audit 353/353, SaaS static audit 43/43, native server tests 71/71, deployment/template script tests 16/16, lock/dependency/barrel validation PASS. Dependency-backed tsgo/Biome/Vitest/Vite/Playwright remain NOT RUN in the extracted source-only tree. See `docs/BF36-TX7.2.2-IMPLEMENTATION-STATE.md` for the detailed state. ## R14.28.16 Build Fix 35 / TX7.2.1 — Collaborative Review Hardening — 2026-08-22 **Objective:** harden BF34 collaborative Comments/Track Changes without changing the TX7 manuscript authority. `Y.Text` remains canonical live text; review metadata remains outside `.tex` and outside Y.Text formatting attributes. **Integrity hardening:** encoded review anchors must resolve into the exact `Y.Text` named by `filePath`; cross-file/malformed records fail closed. Coalesced metadata writes are atomic Yjs transactions. Review notifications are batched to one snapshot refresh per microtask. Deletion rejection retains contextual conflict checks rather than guessing. **Compatibility:** TX7 remains text protocol version 7. Shared review independently advertises schema/capability `shared-review-v1` version 1. Provider, payload channel, awareness, reconnect descriptors, health probes, and signaling-room partitioning carry that capability so clients lacking collaborative-review support cannot silently share a room containing pending review state. **Undo/Redo:** pending review IDs are attached to Y.UndoManager stack items; Undo snapshots/removes only the exact associated review records and Redo restores the exact snapshots. Review maintenance origins remain non-trackable. **Mutation provenance:** collaborative operations carry `source`, `semanticKind`, and `operationId`; direct typing remains observed from Y.Text transactions and programmatic AI/citation/Paper Memory/TikZ/Terminal/tooling edits use the collaboration mutation gateway. **UX:** Review adds All/Comments/Changes counts and filtering, Reject All by Author, and explicit Source conflict styling. Live Learn content now describes collaborative Source comments/Track Changes accurately. Dormant Visual-collaboration cursor/authorship code is removed; Visual remains disabled live while local Visual Review remains intact. **Bounds/lifecycle:** shared review enforces bounded fields, reply/thread/change counts, active-first snapshot budgeting, and bounded resolved-history compaction. Pending changes/unresolved comments are never silently discarded to satisfy review metadata limits. Existing Y.Doc persistence/reconnect/outbound-drain lifecycle remains the only synchronization engine. **Backend boundary:** `project-review-backend.ts` explicitly records local-projection versus collaborative-live policies without risky replacement of the working `ProjectReviewService` API. **Verification:** BF35 14/14, BF34 14/14, historical R14.28.14 22/22, runtime hardening 101/101, release audit 352/352, SaaS static audit 43/43, dependency-free Node server/script batch 88/88 PASS, template/compiler requirements 13/13, lock sync/dependency/public-barrel verification PASS. All 24 BF35-changed TS/TSX files and changed Node/shell sources are syntax-checked in the final certification step. Dependency-backed typecheck/Biome/Vitest/Vite/Playwright/browser soak/deployed relay remain external gates when `node_modules`/network are unavailable. See `docs/BF35-TX7.2.1-IMPLEMENTATION-STATE.md` for the detailed release state. ## R14.28.15 Build Fix 34 implementation checkpoint — TX7.2 Collaborative Review — 2026-08-22 **Objective:** restore supervisor-grade collaborative Comments and Track Changes around the proven TX7.1 Source CRDT without introducing a second manuscript engine. **Architecture:** CodeMirror ↔ `y-codemirror.next` ↔ `Y.Text` ↔ `y-websocket` remains unchanged and authoritative. Shared `review-comments`, `review-changes`, and `review-events` live beside Y.Text in the same project Y.Doc. Review anchors are encoded Yjs relative positions; replies are nested `Y.Array` records. `.tex` remains clean. **Dual backend:** ordinary projects keep the existing IndexedDB/SourceAnchor projection model. A live room switches ReviewService to the shared Y.Doc backend; live suggestions modify Y.Text immediately and store review metadata separately. Existing local comments/suggestions are kept private rather than automatically uploaded. On collaboration end, the last shared ReviewService snapshot is merged into normal local review storage. **Track semantics:** per-collaborator toggle; first-class insert/delete/replace changes; accept is metadata-only because the current text is already in Y.Text; reject verifies current proposed text/context before reversing it; ambiguous changes become conflicted. Coalescing groups normal typing, selected-text replacement continuation, and contiguous deletion units. Undo/Redo reconciles pending review metadata with the per-file Yjs UndoManager. **Programmatic edits:** AI, Paper Memory, citations, TikZ, Terminal, research and toolbar mutations carry review-source attribution through the collaboration mutation gateway. Maintenance/rollback edits use an explicit non-tracking origin. **UX:** live Visual remains disabled but the persistent explanatory sentence is removed; the disabled control uses `Unavailable during live collaboration`. Review sidebar keeps Review/History and existing bulk operations, adds collaboration identity/color and explicit conflict actions. `/projects` empty-state padding/height is scoped to Projects only. Link/QR joining remains the TX7 model. **Verification:** BF34 source guard PASS and rejects the BF33 baseline; BF34 regression 14/14; historical R14 regression 22/22; runtime hardening 101/101; release audit 351/351; SaaS audit 43/43; server 70/70; deployment/script 18/18; templates 13/13; lock sync 69 importers/1171 reachable snapshots; dependency consistency 68 packages; public barrels 67 entries; 20 modified TS/TSX parser/transpile checks; modified Node and shell syntax PASS. Dependency-backed `tsgo`, Biome, Vitest, Vite/build, Playwright and soak execution are NOT RUN in this extracted environment because `node_modules` is absent and Corepack cannot reach the npm registry. See `docs/BF34-TX7.2-IMPLEMENTATION-STATE.md` for the detailed release state. # R14.28.14 Build Fix 33 implementation checkpoint — 2026-08-22 **Objective:** preserve BF32/TX7's deliberately small Source collaboration core while hardening the production boundaries around it: administrator bootstrap/authentication, relay admission and binary routing, Host/session recovery, Stop semantics, shared-project rematerialisation, client persistence lifecycle and canonical Source reads. **Administrator security:** fresh startup no longer creates a known administrator password. `texise-saas admin-create` is the explicit operator provisioning/reset path. Startup detects only the exact historical `admin/admin` bcrypt credential, revokes it and its sessions, and otherwise leaves an existing secure administrator unchanged. Administrator throttling is persisted in MySQL by IP/account scope and stale sessions/throttle buckets are cleaned periodically. **Relay/security boundary:** `/collab-live` limits rooms, total/per-IP sockets, new-room creation, CRDT state size and binary-transfer resources. File channels require the same active Yjs diagnostic client ID and cannot create a room. Duplicate IDs are rejected. File requests route to one source and payload chunks only to the requester; fallback routing is explicit, stalled transfers expire, and full-Y.Doc size checks are coalesced rather than performed per keystroke. **Lifecycle:** reconnect descriptors preserve Host/Guest role and Host session identity, so Host refresh can reclaim the session. Stop writes the existing TX7 tombstone, persists, waits for WebSocket outbound drain, then disconnects. Explicit Stop/Leave clears reconnect credentials and room persistence; browser refresh retains them. Retained collaboration IndexedDB state is bounded and stale databases/baselines are garbage-collected. **Snapshot/rejoin safety:** project structure is sealed at Host readiness with a snapshot manifest. Existing supported Y.Text files remain collaboratively mutable; normal collaboration APIs cannot create new files or rewrite structural metadata after sealing. Before same-room rematerialisation, TeXise compares local files against the last collaboration snapshot baseline and copies extra/same-path-divergent content to `.texise-local-recovery//...` before applying the current shared snapshot. **Canonical Source:** `ProjectCollaborationService.getCanonicalSourceText()` returns active Y.Text while collaborative and LatexSource otherwise. Source editor operations, AI, citation workflows, TikZ and Paper Memory use this accessor (or a canonical state helper) for collaboration-sensitive text reads. Y.Text remains authoritative; LatexSource/storage are projections. Semantic refresh is debounced and final leave/compile paths flush the projection. **Security maintenance:** direct `ws` floor is 8.21.3; Nodemailer is 9.0.5. Production CSP retains required HTTPS provider access but restricts WebSocket connectivity to the canonical TeXise origin. README/current docs state that a collaboration Project link is a bearer trusted-editor capability and that Host lifecycle state is not cryptographic authorization. **Verification in this source environment:** BF33 guard PASS and includes BF32/TX7 guard; lock sync 69 importers PASS; dependency versions 68 packages PASS; public barrels 67 entries PASS; admin auth 11/11 PASS; focused R14 22/22 PASS; runtime hardening 101/101 PASS; release audit 350/350 PASS; SaaS static audit 43/43 PASS. A final parser/syntax/diff sweep is performed immediately before packaging. Full dependency-backed `tsgo`/Biome/Vitest/Vite/Playwright, the formal 10,000-edit browser soak and deployed relay certification remain mandatory external gates because dependencies/browsers are not installed in this extracted archive. **Operator upgrade action:** if startup reports that the historical default administrator credential was revoked, run `sudo texise-saas admin-create` interactively before attempting administrator login. Instances whose administrator already had a non-default secure password require no password reset. See `docs/BF33-TX7.1-IMPLEMENTATION-STATE.md` for the detailed state and release-gate ledger. # R14.28.14 Build Fix 32 implementation checkpoint — 2026-08-22 **Objective:** collapse live collaboration onto the TeXise Source core already present in the product: direct CodeMirror ↔ `y-codemirror.next` ↔ `Y.Text`, upstream `y-websocket`, `y-indexeddb`, one Awareness cursor representation, and no competing Visual/authorship/review/file-tree collaboration engine. **Implemented architecture:** TX7 is Source-only. Existing supported Source files share one project `Y.Doc`; Y.Text is authoritative and mirrors one-way into LatexSource/storage. Visual and Track Changes are disabled while live collaboration is active. Project structure and binary mutation are frozen after the join-time snapshot. Sharing uses `/join/#secret` plus QR, verified-host-before-workspace creation, same-room workspace reuse, stable collaborator identity and an explicit stopped-session tombstone. **Removed from the live path:** custom Source relative-position presence, collaboration authorship spans/decorations, Visual collaboration projection/undo/bookmarks, Follow/Open, current-mode/file peer presence, shared review/activity maps and live file/directory operation CRDT replay. **Verification state:** BF32 source guard PASS; lockfile sync 69 importers PASS; workspace dependency consistency 68 packages PASS; public barrels 67 entries PASS; focused regression 22/22 PASS; runtime hardening 101/101 PASS; release audit 350/350 PASS; SaaS static audit 43/43 PASS; all 29 modified/untracked TS/TSX syntax checks PASS; Node/shell/package JSON syntax and `git diff --check` PASS. The formal Playwright contract now includes exact named-cursor placement, compile while collaboration is active, reconnect/reuse/session-stop coverage, and a mandatory release-quality 10,000-edit soak. Dependency-backed execution remains an external gate in this source-only environment. See `docs/BF32-TX7-IMPLEMENTATION-STATE.md`. # R14.28.14 Build Fix 31 implementation checkpoint — 2026-08-21 **Objective:** make TeXise collaboration remain stable under sustained concurrent editing and approach Google Docs cursor/selection behavior in both Source and Visual modes, while fixing the overflowing collaborator modal. **Root causes confirmed:** application presence transported absolute source offsets; Visual normal keystrokes were serialized as whole-source replacements; remote Visual projection recreated `EditorState` and restored selection through stale absolute source coordinates; the canonical/Y.Text bridge could therefore erase CRDT identity or present one-frame-old source to Visual; Source also installed collaboration authorship twice; the modal forced identity, mode, path and actions into one shrinking row. **Implemented architecture:** TX6 keeps one Yjs `Y.Text` authority per collaborative text file. Published presence stores Yjs relative cursor/selection anchors and derives absolute offsets only on the receiving client. Exact canonical edit splices are forwarded into one Yjs transaction. Source remains directly bound by `y-codemirror.next` with Yjs shared undo. Visual translates each ProseMirror transaction into a minimal LaTeX splice, bookmarks its local selection with Yjs relative positions before remote transactions, and incrementally reconciles the existing ProseMirror state afterward. Rapid remote Visual source changes are coalesced only at the Visual projection layer to one animation frame; CRDT/canonical source synchronization remains synchronous. Source collaboration document/file-map revisions are deliberately excluded from the CodeMirror lifecycle, so remote synchronization cannot remount the editor. Visual remote batching only retains a pre-transaction bookmark when the active file's own Y.Text actually changes. Visual history uses the same per-file Yjs `UndoManager`, preserving peer edits across local undo/redo. **Conflict policy:** non-overlapping remote changes are rebased under the local Visual edit; a genuine overlap falls back to authoritative projection rather than blindly applying a stale edit. Full Visual projection replacement remains an exceptional structural fallback and no longer recreates the EditorState. Normal presence can never change another user's file/mode/scroll/caret; only explicit Follow controls view-follow behavior. **Review policy:** Track Changes cannot be enabled while live collaboration is active. Starting a host session automatically disables an empty Track Changes projection, but refuses to start when pending tracked changes still need acceptance/rejection. Collaboration authorship remains Yjs metadata outside `.tex` and existing review completion cleanup remains intact. **UX:** collaboration dialog is viewport-bounded with no horizontal overflow, truncates long names/paths, stacks metadata/actions responsively, scrolls large collaborator lists, and keeps Open/Follow buttons visible. Source/Visual collaborator caret/selection/authorship colors continue to use the assigned collaborator color. **Verification in this extracted source archive:** BF31 guards cover TX6 live-health metadata, Source no-remount lifecycle, active-file-only Visual remote bookmark batching, Yjs-backed Visual history, and the two-browser peer-edit-survives-undo case. Dependency-independent gate counts are rerun before packaging. `server/signaling.spec.mjs` and the authored two-browser collaboration E2E cannot execute in this archive because the dependency tree is not installed (`vitest`/Playwright unavailable); dependency-backed tsgo/Biome/Vitest/Playwright remain mandatory production CI/installer gates. **Compatibility:** TX5 and older share codes are deliberately legacy. Create a new TX6 collaboration session after upgrading so absolute-position and relative-position clients cannot mix. # R14.28.14 Build Fix 30 implementation checkpoint — 2026-08-21 **Objective:** fix the dependency-backed production Biome accessibility failure after BF29 without suppressing lint or weakening the join loader. **Implemented:** the shared-project loader's visual progress bar is now `role="progressbar"` with `aria-label="Shared project loading progress"`, `aria-valuemin={0}`, `aria-valuemax={100}`, and `aria-valuenow={joinPercent}`. BF30 adds source-guard and focused regression coverage for this exact semantic contract and rotates the PWA cache generation. **Preserved:** BF29 command dependency typing and BF28 TX5 full-project materialization, binary chunk transfer, immediate create/delete/rename propagation, loader behavior, Source collaborator names, server relay behavior, admin-Pro access and TikZ fixes. # R14.28.14 Build Fix 29 implementation checkpoint — 2026-08-21 **Objective:** fix the dependency-backed production `tsgo` failure exposed after BF28 by making directory command dependency metadata match the services actually used by the handlers. **Implemented:** `command::ws:create-directory`, `command::ws:rename-directory`, and `command::ws:delete-directory` now include `projectCollaboration` in their declared service dependencies. This resolves the three `TS2339` errors without changing collaboration behavior or weakening types. BF29 adds a fail-closed source guard and regression coverage for the exact dependency manifests and rotates the PWA cache generation. **Preserved:** BF28 TX5 full-project materialization, binary chunk transfer, immediate create/delete/rename propagation, loader, Source collaborator names, server relay behavior, admin-Pro access and TikZ fixes. # R14.28.14 Build Fix 28 implementation checkpoint — 2026-08-21 **Objective:** make collaboration authoritative for the entire project, not only LaTeX-family text: complete join-time transfer, immediate bidirectional file/directory operations, code/data text collaboration and binary asset transfer. **Implemented:** TX5/v5 retains upstream `WebsocketProvider`/`IndexeddbPersistence`; Yjs owns text/file-tree/operation metadata while a transient chunked payload channel carries opaque bytes. The shared catalog now includes text files, binary file records, directories and ordered create/delete/rename/mkdir/rmdir/rename-directory events. Guest `/projects` joining shows a blocking progress loader and does not complete until every text/code/data file and every image/PDF/binary payload has been written locally and the file-tree revision is stable. Binary payloads use SHA-256 and exact-size verification and are never retained server-side. Host project readiness is delayed until payload serving is available. Sidebar, terminal, Project Tools, AI mutations and project image insertion are connected to the collaboration mutation path. **Compatibility:** TX4 and older collaboration tokens are intentionally rejected. Start a new TX5 session after upgrading. # R14.28.14 Build Fix 27 implementation checkpoint — 2026-08-21 **Objective:** make collaboration feel like joining a shared project rather than configuring a collaboration transport inside an already-created workspace, and give Source mode the same visible collaborator identity that Visual mode already had. **Implemented:** upstream `y-websocket`/`y-indexeddb` architecture from BF25/BF26 is retained; protocol advances to self-contained TX4 tokens with no second password; Host advertises project name/readiness; Guest verifies sync + compatible live Host awareness + ready project before storage allocation; `/projects` exposes Join Project before New Project; verified joins create/reuse BrowserOPFS/Browser workspaces using the Host name, materialize shared text/root state, then navigate without reloading the live provider. Joined workspace metadata records only protocol/room/source, not token secret or manuscript data. The editor dialog now owns Start/Share/Manage only. **Source presence:** CodeMirror's existing `.cm-ySelectionInfo` awareness label is now always visible above the remote caret, with the collaborator's Yjs-assigned color and a compact TeXise UI-font name label. No fork of `y-codemirror.next` is introduced. **Failure safety:** legacy/invalid/unavailable sessions are rejected before workspace creation; failures after allocation roll back a newly created browser workspace; rejoining the same room reuses its local project; account metadata synchronization is best-effort and occurs after in-app navigation. **Known intentionally deferred collaboration scope:** destructive shared file rename/delete still requires a dedicated CRDT file-operation/review design; collaboration still targets TeX-oriented editable text extensions; binary assets remain manifest-verified/manual import rather than automatic network transfer. # R14.28.14 Build Fix 26 implementation checkpoint — 2026-08-21 - BF26 corrects the BF25 `y-indexeddb` custom metadata marker to a numeric migration version (`1`) accepted by strict TypeScript typings. - `LEGACY_MIGRATION_KEY` is browser-local migration bookkeeping only; it imports the old TeXise collaboration IndexedDB snapshot at most once per BF25/BF26 room persistence database. - BF25 collaboration architecture remains unchanged: upstream `WebsocketProvider`, TX3 share codes, verified live host presence, room-isolated `IndexeddbPersistence`, relative authorship provenance, and standard `/collab-live/` routing. - Installer/deploy now run `repair-buildfix26-source.mjs` before strict typecheck and reject the old boolean marker source shape. # R14.28.14 Build Fix 25 implementation checkpoint — 2026-08-21 **Objective:** repair the production collaboration case where Host and Guest both completed relay sync but each stayed on `Waiting for collaborators to join…`. **Root cause:** BF24 treated Yjs server sync as proof of a successful join and still used a TeXise-written browser provider. A password mismatch (or any room-identity divergence) could therefore create two valid empty rooms; each client completed Sync Step 2 and reported `live` without ever seeing the intended peer. **Implemented architecture:** upstream `y-websocket` browser provider; `TX3` versioned share codes; v3 SHA-256 room derivation; host CRDT marker + live awareness verification before Guest activation; `y-indexeddb` persistence with one-time BF20/BF24 snapshot migration; standard `/collab-live/` routing; real-provider production health certification with BroadcastChannel disabled; safe collaboration diagnostics; role-aware solo status. **Preserved invariants:** `Y.Text` remains the collaboration authority; Source uses `y-codemirror.next`; structured Visual/AI/Math/TikZ/citation operations flow through canonical source into Yjs exactly once; collaboration projections do not echo back; collaborator provenance remains Yjs-relative metadata outside `.tex`; accepted review clears provenance only. **Release gate:** BF25 must pass frozen-lock/workspace/barrel checks, focused R14.28.14 regressions, full static release audit, runtime-hardening suite, SaaS/security audit, server node tests, syntax checks and archive integrity locally. The dependency-backed pinned `tsgo` + Biome + Vite + Playwright pipeline remains the production installer/CI gate because the clean packaging workspace intentionally has no installed dependency tree. # R14.28.14 Build Fix 24 implementation checkpoint — 2026-08-21 - Production BF23 passed its stale-source guard, then native-preview TypeScript correctly reported that awareness `origin: unknown` was still used directly as a `WebSocket` map key. - Awareness handling now resolves `origin` by identity against `created.clients.keys()` and only uses the resulting `WebSocket | undefined` value for `Map.get()`. No `any`, forced cast, or protocol change is introduced. - Added `repair-buildfix24-source.mjs`, retaining BF23's stale BF21 repairs and additionally repairing/verifying the exact BF23 unknown-origin map-key pattern before dependency/build gates. - Installer/deployment hooks and PWA shell generation advance to Build Fix 24 / `texise-app-shell-r14-28-14-buildfix24-v1`. - Preserves all BF21–BF23 collaboration, authorship, TikZ and administrator-Pro behavior. # R14.28.14 Build Fix 23 implementation checkpoint — 2026-08-21 - Verified the BF22 release ZIP itself already contains `socket.send(wirePayload.buffer)` plus typed signaling callbacks; repeated BF21 compiler output therefore came from a stale server source tree rather than the BF22 artifact. - Added an idempotent collaboration source repair/verification guard before dependency installation and again before typecheck. - Installer now identifies `R14.28.14 Build Fix 23` explicitly in its first install banner. - Rotated the PWA shell generation to `texise-app-shell-r14-28-14-buildfix23-v1`. - Preserved all BF21/BF22 collaboration, authorship, TikZ and administrator-Pro behavior. # R14.28.14 Build Fix 22 implementation checkpoint — 2026-08-21 - Corrected BF21's two dependency-backed strict-TypeScript integration failures without changing collaboration semantics. - Browser WebSocket writes now cross the TS 7 DOM boundary using a fresh `ArrayBuffer`-backed payload. - Yjs relay document/awareness callbacks now carry explicit JSDoc types under `checkJs`. - Rotated the PWA shell generation to `texise-app-shell-r14-28-14-buildfix22-v1`. - Added BF22 regression/release contracts and retained every BF21 collaboration, authorship, TikZ and administrator-Pro behavior. # R14.28.14 Build Fix 21 implementation checkpoint — 2026-08-21 Completed: - Replaced the custom BF17 collaboration snapshot relay with the standard Yjs sync/awareness wire protocol on `/collab-live`; server rooms now retain a merged `Y.Doc` rather than accepting a client snapshot as room authority. - Tightened `ProjectCollaborationService` so active-room `Y.Text` is authoritative, Source/Visual/canonical mutations cross the bridge once, collaboration projections cannot echo, and storage synchronization reads/writes durable text without stale `LatexSourceService` fallback. - Replaced delayed absolute-offset `texiseAuthor` formatting with relative-position provenance in a collaborative Yjs map, including migration/cleanup of legacy marks and Source/Visual attribution projection outside `.tex`. - Added incremental bidirectional, late-join and Source→Visual collaboration coverage plus a production live-protocol checker. - Scoped TikZ dark property-modal headings to a light foreground while retaining light-theme surrounding controls. - Centralized account effective entitlement: `role=admin` is Pro before licence lookup, so the bootstrap `admin@texise.com` account and future administrator-role accounts receive every existing Pro capability without a licence. - Propagated administrator Pro through account/UI entitlement, templates, Cloud Compile, Linux Terminal and cloud AI/AI Review server gates; authentication, CSRF, worker/gateway restrictions and infrastructure limits remain enforced. - Added licence-less, auditable administrator AI Review reservations with role revalidation and no paid-quota consumption; made the nullable licence column/entitlement source an idempotent compatibility repair suitable for MySQL DDL auto-commit behavior. - Advanced PWA shell generation to `texise-app-shell-r14-28-14-buildfix21-v1`. Validation in this source workspace: - release audit 347/347 PASS - focused R14.28.14 regression 18/18 PASS - runtime hardening 99/99 PASS - administrator entitlement/AI Review/migration tests 11/11 PASS - Cloud Compile 5/5, Linux Terminal 4/4, router 3/3, security 5/5, auth 4/4 and licence-policy 4/4 PASS - changed server scripts pass Node syntax checks - dependency-backed workspace TypeScript/Biome/Vite/Playwright and the live Yjs WebSocket spec are not executable in this extracted archive because `node_modules`/pnpm are absent and Corepack cannot resolve registry.npmjs.org in the current environment; they remain mandatory CI/installer gates before production deployment. # R14.28.14 Build Fix 20 implementation checkpoint — 2026-08-21 Completed: - Corrected TikZ modal width at the actual shared-dialog breakpoint boundary (`sm:max-w-sm`). - Added explicit `sm:max-w-[1680px]` plus inline 97vw/1680px/92dvh sizing guard. - Replaced TikZ Draw dark tool tiles with white/yellow TeXise controls and black icons/text; active/primary = `#DA0B4E`. - Normalized TikZ Objects header, selected objects, checkbox accent, disabled controls, and hover states. - Advanced PWA shell generation to `texise-app-shell-r14-28-14-buildfix20-v1`. - Added BF20 focused regression and release-audit protection. Validation before packaging: - release audit 346/346 PASS - SaaS/static audit 43/43 PASS - focused R14.28.14 regression 17/17 PASS - runtime hardening 99/99 PASS - combined server/deployment/regression 91/91 PASS - lock/dependency/barrel/template checks PASS - shell/Node syntax PASS - TypeScript syntax parse 957 files PASS # R14.28.14 Build Fix 18 implementation checkpoint — 2026-08-21 ## R14.28.14 Build Fix 19 — collaboration E2E Biome noParameterAssign correction — 2026-08-21 - Production BF18 install passed custom validation and TypeScript, then stopped on Biome `lint/style/noParameterAssign` in `packages/tooling/e2e-tests/src/latex-collaboration-r9.e2e.ts`. - Fixed by introducing a local `routedUrl` variable and never assigning to the constructor parameter `url`. - Added dependency-free regression/release contracts for the exact production lint failure. Completed: - Patched BF17 collaboration transport for strict native-preview TypeScript compatibility. - `waitForSync()` unsubscribe is explicitly optional `() => void`. - Browser binary frame creation now returns a concrete `ArrayBuffer` for `WebSocket.send()`. - Server `ws.RawData` normalization handles fragmented `Buffer[]` messages with `Buffer.concat()` before other binary shapes. - Added BF18 focused regression and release-audit protection. Validation before packaging: - release audit 344/344 PASS - SaaS/static audit 43/43 PASS - focused R14.28.14 regression 15/15 PASS - runtime hardening 99/99 PASS - server/deployment 74/74 PASS - lock/dependency/barrel/template checks PASS - deployment/install/upgrade/uninstall and collaboration Node syntax PASS # R14.28.14 Build Fix 17 implementation checkpoint — 2026-08-21 - TikZ Draw is now the canonical visual TikZ creation surface, vendored locally with MIT attribution and bridged to browser-local project assets/source insertion. - `/collab-live` replaces WebRTC-only synchronization as the authoritative current collaboration transport; `/collab-signal` is compatibility-only. - Collaboration lifecycle exposes truthful connection/sync phases, late-file binding without CodeMirror recreation, per-user Source/Visual authorship, deterministic colors, Follow, and shared review cleanup. - Visible toolbar labels: Tools / Track / Cloud Terminal. - BF17 source-level release matrix is green: 343/343 release contracts, 43/43 SaaS/security, 14/14 focused regression, 99/99 hardening, 74/74 server/deployment, lock/dependency/barrel/template checks, deployment shell/Node syntax and 955-file TS/TSX syntax parsing. Dependency-backed pnpm/tsgo/Biome/Vite/Playwright remain CI/production-host gates because release artifacts exclude node_modules. - Build Fix 16: hardens `/ws#route=editor&wsPath=...` as a live top-level editor surface with post-initialization URL restoration, history/hash observation and a new PWA shell cache generation; adds persistent Yjs-only collaborator-authorship highlighting in Source + Visual with hover attribution and Review-driven provenance cleanup after acceptance. - Build Fix 15: fixes the BF14 production Biome accessibility failure in Learn LaTeX by giving the completion meter an explicit ARIA `progressbar` role with value semantics; adds regression/release contracts for the exact lint class. - Build Fix 14: adds the browser-local TikZ Visual Editor v1, stronger Source/Visual collaboration presence, public `/learn` training with browser-local progress, and pins the standalone Console Gateway to `ws 8.21.0`. - Build Fix 11: `texlive/texlive-console:pro` is now a TeXise-local image built from `deploy/docker/console/` instead of pulled from Docker Hub; Cloud Compile remains `texlive/texlive:latest`. - Build Fix 10: Cloud Compile and Linux Terminal now use separate Docker images (`texlive/texlive:latest` and `texlive/texlive-console:pro`), the temporary scientific overlay is retired, and Apache owns the explicit `/examples -> /templates` compatibility redirect. Build Fix 8 favicon/site-manifest integration remains retained. # R14.28.14 continuation ledger — canonical www + Cloud Compile + Linux Terminal Pro ## R14.28.14 Build Fix 6 deployment correction - Linux Terminal production certification now loads `ws` with Node `createRequire()` scoped to the installed Console Gateway package. This fixes the production `WebSocket is not a constructor` error while retaining location-independent canonical `public_html` resolution. - Trusted API and Cloud Compile were already healthy in the failing deployment; no API-port or `app.texise.com` routing change is involved in this fix. Authoritative rollback baseline: `texise-saas-r14.28.13-publichtml-runtime-blog-media-article-final.zip`, SHA-256 `bffb8140b309c59373a5c7d8384c54e7aebb539ad010d8c69699eafc9514e1de`. ## R14.28.14 Build Fix 5 deployment correction - Linux Terminal Pro certification is now working-directory independent. `scripts/check-console-gateway.mjs` resolves `public_html` from its own module URL before importing the gateway-local `ws` dependency. - This specifically fixes production installs invoked from `/var/www/texise.com`, where cwd-relative resolution previously omitted the canonical `public_html` segment. ## R14.28.14 Build Fix 4 deployment correction - Execution-service provisioning now quiesces pre-existing `Restart=always` Cloud Compile/Console units during `npm ci`, verifies required dependency markers, preserves `node-pty` executable modes, and validates workspace writability as the actual dedicated service accounts. - `texise-data` and its shared `tmp` parent use execute-only traversal for non-`texise` execution users while Cloud Compile/Console child workspaces remain private and individually owned. - Worker/gateway health checks include bounded startup retries after systemd restart. ## R14.28.14 completed source phases - Canonical public origin: `https://www.texise.com`; canonical source/runtime root: `/var/www/texise.com/public_html`. - Non-destructive migration/rollback handling for the former `app.texise.com` tree, certificates and service source. - Apache canonical/redirect vhosts, trusted API, authoritative `/collab-live` Yjs document/awareness routing plus compatibility-only `/collab-signal`, private namespace denial, media/template/static/SPA precedence. - Trusted `texise.service` migration while retaining its hardening. - Real supplied `texise-latex-compile.service` source integrated as the private Pro Cloud Compile worker, with trusted API brokerage, server-side entitlement/quota enforcement and hardened Docker execution. - Explicit editor `Local Compile` / `Cloud Compile · Pro` target selection; Local remains Free and default. - Linux Terminal · Pro integrated into the editor top bar for logged-in Pro accounts, with explicit project upload, isolated Linux/TeX Live/Python/Git/scientific sessions, authenticated file download, one-time websocket credentials, real-path confinement and workspace quotas. - Cloud Compile uses `TEXISE_CLOUD_COMPILE_IMAGE=texlive/texlive:latest`; Linux Terminal Pro uses `TEXISE_CONSOLE_IMAGE=texlive/texlive-console:pro`. Their image lifecycles and runtime policies are independent. - Home redesign from the supplied TeXise reference, Pricing redesign from the supplied layout reference, and CMS-driven responsive Docs redesign including Local/Cloud Compile documentation. - Active OAuth/SEO/PWA/mobile/package/server absolute URLs normalized to the www origin. - Supplied Console Gateway and Hocuspocus service sources plus the live Laravel Reverb unit audited. Console Gateway is now an active **Linux Terminal · Pro** service; Hocuspocus and Reverb are the only legacy retirement candidates and remain preserved for rollback. - App-shell cache/release coherence advanced to R14.28.14 while retaining the current BusyTeX adapter build-fix generation. ## Verification state Final dependency-free source verification is green: 329 repository contract checks, 81 server/deployment tests (including Cloud/Terminal and R14.28.14 regressions), 99 runtime-hardening tests, 43 SaaS static audits, 69 lock importers, 68-package dependency consistency, 67 public barrels, 13/13 template compiler requirements, and shell/Node syntax. The sandbox has no installed workspace dependency tree and cannot resolve `registry.npmjs.org` (`EAI_AGAIN`), therefore pinned `pnpm run custom-validation`, `pnpm run typecheck`/`tsgo`, Biome and Vite production build are **not certified in this environment**. They remain mandatory installer/OVH gates. Live Apache/TLS/MySQL/OAuth/browser/WebSocket/Blog-upload/real Docker compile checks likewise remain production-host certification steps. ## Service topology after successful activation Active: - `texise.service` — trusted API plus current collaboration signaling. - `texise-latex-compile.service` — private Pro Cloud Compile worker. - `texise-console-gateway.service` — authenticated Linux Terminal · Pro gateway. Legacy rollback units disabled only after health success: - `texise-collab.service` - `texise-reverb.service` --- # TeXise SaaS implementation ledger Authoritative master prompt: user-provided TeXise SaaS master plan, 2026-08-20. Source baseline: `texise-r14.28.12-r31-build-fix-4.4-equation-fidelity-exact-caret-rc-lintfix2-no-review-source-ledger-public_html(1).zip`. Design/font reference archives were used during implementation; current production styling and assets are TeXise-owned. ## Current state **Source implementation:** complete for phases P0-P14 defined below. **Dependency-free verification:** complete and green. **External/dependency-backed runtime certification:** pending where explicitly marked `NOT RUNTIME-VERIFIED` in `TEXISE_SAAS_VALIDATION_REPORT.md`. There is no remaining routine source phase intentionally held for confirmation. The next work in a real deployment environment is runtime certification/fix iteration, not a redesign of the architecture. ## Historical R14.28.12 architecture decisions (superseded by the R14.28.14 addendum where different) - `/ws` remains the existing editor authority and keeps its hash-based internal router/services. - Canonical public/account/admin pathnames are selected by the same browser entry before the editor app is mounted; TeXise remains one product/service graph. - `/projects` reuses existing WorkspaceOps/WorkspaceState/storage/native-filesystem services. No second local project manager exists. - The existing trusted Node service is extended with optional MySQL SaaS capabilities. No second backend was added. - MySQL stores safe account/project metadata, entitlement/quota, CMS/support and audit data only. It does not store manuscript/project contents. - At the R14.28.12 checkpoint, browser-local compile was the only integrated compile authority. **Superseded in R14.28.14:** Local Compile remains the default/Free path and the explicit Pro Cloud Compile broker/worker path is now integrated. - Browser filesystem handles remain in browser-local persistence and are never serialized to MySQL. - Existing anonymous signed entitlement remains. Logged-in entitlement/block/quota is server-authoritative. - Prefix is a visual-system reference only. TeXise does not ship Prefix identity/copy/backend/analytics URLs. - ProseMirror remains internal editor machinery. Visible product identity is TeXise. - STIX Two Text is restricted to the actual visual manuscript `.ProseMirror`; it is forbidden in general UI chrome. - Inter/JetBrains roles are configured as explicit family stacks; the supplied archive did not contain their binaries. ## Prefix/design extraction Audited supplied Prefix reference values include: - primary yellow `#DA0B4E`; - stronger yellow `#B80A42`; - blue `#5773ff`; - deep navy `#001d38`; - success `#70c038`; - danger `#ff6b38`; - warm background `#f8f6f2`; - warm surface `#f1ede4`; - dark surfaces around `#181f25`, `#111518`, `#101519`; - radius scale 2/4/6/8/12/16/24/32 px; - restrained ~150 ms default transitions; - principal responsive breakpoint around 67rem. TeXise-owned semantic tokens/components implement these values rather than importing Prefix compiled CSS. ## Phase ledger ### P0 — Audit and guardrails — COMPLETE Audited TeXise editor/router/services, storage, compiler, licensing, AI Review, Paper Memory, templates, trusted server, installer, Apache, tests, Prefix reference and supplied fonts. Corrected the early unsupported progress claims after the user's `?`; all work after that point is filesystem/test-backed. ### P1 — Prefix design extraction and semantic design system — COMPLETE Added light/dark semantic tokens, typography domains and common application/public styling. Moranga/STIX source paths are wired; STIX scope is statically guarded to visual manuscript only. ### P2 — Trusted backend foundation — COMPLETE SOURCE / LIVE DB NOT RUNTIME-VERIFIED Added optional MySQL pool/bootstrap, safe configuration, schema migrations, opaque sessions, CSRF, common security helpers, runtime lifecycle and health integration. SaaS activation is upgrade-safe: the default DB name alone does not turn SaaS on. ### P3 — Authentication/account — COMPLETE SOURCE / LIVE GOOGLE NOT RUNTIME-VERIFIED Implemented Google authorization-code + PKCE/state, stable `sub` mapping, avatar/profile/settings/logout/delete, suspended/expired session behavior, password-admin bootstrap, forced password change and one-time legacy MD5 upgrade. OAuth cannot claim the admin account or rebind a different Google identity by email. ### P4 — Project cloud registry — COMPLETE SOURCE / CROSS-DEVICE BROWSER FLOW NOT RUNTIME-VERIFIED Implemented metadata-only project records, same-browser reconciliation, missing-device relink state, local-only **Add to account**, non-blocking `last_opened_at`, deferred browser-local metadata-patch retry, rename metadata sync, archive/restore and remove-from-account. Template/import registrations retain only a safe storage/template descriptor for later metadata retry. Local workspace/native handles remain authoritative. ### P5 — Canonical SaaS shell and `/projects` — COMPLETE SOURCE / VISUAL RUNTIME NOT VERIFIED Implemented public/account/admin pathname shell over the same services, Prefix-density Projects UI and local project actions without onboarding. Blank creation uses one compact storage/name dialog rather than a staged storage wizard, and restored account storage preferences determine the default where supported. ### P6 — Licensing and quota — COMPLETE SOURCE / EXTERNAL PAYHIP PATH NOT RUNTIME-VERIFIED Added persistent account license association, server-authoritative block/entitlement/quota, account AI Review reservation accounting and anonymous signed-entitlement compatibility. Re-verification cannot self-unblock and another active account's license cannot be silently reassigned. ### P7 — Filesystem template authority — COMPLETE + EXECUTABLE TESTED Materialized eight existing seed templates under `texise-templates/free/*` and `texise-templates/pro/*`. Added deterministic scanner, tier/path/symlink/size/entry validation, duplicate rejection, explicit binary-safe file list, atomic `.tmp` replacement and build/deploy synchronization. ### P8 — Template gallery/detail/apply — COMPLETE SOURCE / BROWSER FILESYSTEM RUNTIME NOT VERIFIED Added gallery/detail filters and Free/Pro entitlement flow. Apply copies the complete local tree into browser/native storage, registers account metadata only if authenticated and opens the entry file in `/ws`. Storage chooser is one functional action, not onboarding. ### P9 — Public website/CMS/docs/search/contact/SEO — COMPLETE SOURCE Implemented required public routes, original TeXise copy, templates/examples, pricing/shop config, blog/docs CMS, docs navigation/search, metadata-rich public slash search with editor/input exclusions, contact tickets/SMTP, sitemap/robots and route metadata. CMS publication/detail carries author/tags/publication metadata and public detail regenerates sanitized HTML from Markdown. ### P10 — Administration — COMPLETE SOURCE Implemented dashboard, searchable/paginated Users/Licenses/Support, explicit operational Users/Licenses columns, user detail/project/support history, suspension, bidirectional quota controls, license block/unblock, support status changes, Blog/Docs CRUD/publish/safe preview and server-side role/CSRF/audit enforcement. ### P11 — `/ws` Prefix application-density redesign — COMPLETE SOURCE / BROWSER VISUAL QA NOT VERIFIED Restyled TeXise top bar, primary Compile, account avatar, compact Light/Dark/System theme control, file/sidebar/pane/PDF/AI/Paper Memory/terminal/dialog/mobile chrome through stable selectors without rewriting CodeMirror, ProseMirror, MathLive, compiler or PDF engines. Removed remaining visible inherited identity assets/labels while keeping required internal compatibility identifiers. ### P12 — Security and installer/upgrade hardening — COMPLETE SOURCE + DEPENDENCY-FREE TESTED Covered same-origin mutations, CSRF, OAuth state/PKCE, session fixation defense, parameterized SQL, Markdown/XSS protection, safe redirect, mass assignment, license/quota authority, template traversal, support abuse/header-injection controls, malformed legacy settings recovery, secret boundaries, staged runtime dependencies, database-create opt-in, additive legacy migration repair and Apache route/cache policy. ### P13 — Visual QA and full regression — PARTIALLY CERTIFIED BY STATIC/DEPENDENCY-FREE TESTS All runnable source/runtime-hardening checks are green. Actual built-browser viewport/theme/editor interaction, live MySQL/OAuth/SMTP and real production installer behavior are explicitly `NOT RUNTIME-VERIFIED` because required dependencies/services are unavailable in this container. ### P14 — Packaging/release documentation — COMPLETE Added environment documentation, migration notes, release changelog, changed-files ledger, validation report and font-restoration instructions. Final delivery is staged under a single top-level `public_html/` and omits font binaries from the downloadable ZIP. ## Post-release completeness audit — 2026-08-20 The previous packaged SaaS release was re-audited directly against the complete master plan. The second audit did not change the fundamental architecture; it closed account-preference, project-reconciliation, no-onboarding, CMS metadata/search, admin operational visibility, contact-header and legacy-settings resilience gaps. All source changes are included in the current package and the exact delta is recorded in `TEXISE_SAAS_CHANGED_FILES.md`. **COMPLETED:** all source phases P0-P14 plus the second-audit corrective pass. **CURRENT:** release packaging/verification only. **REMAINING:** dependency/service/browser runtime certification items already marked `NOT RUNTIME-VERIFIED`; there is no routine source phase intentionally paused for user confirmation. ## Database state Schema version: `2`. Canonical/additional tables: `users`, `sessions`, `oauth_accounts`, `user_settings`, `projects`, `license_keys`, `license_verifications`, `ai_usage`, `ai_review_reservations`, `admin_audit_log`, `support_tickets`, `cms_posts`, `cms_post_content`, `cms_tags`, `cms_post_tags`, `cms_docs`, `cms_doc_content`, `cms_doc_tags`, `schema_migrations`, plus preserved compatibility `blogs`/`docs`. Migration policy is additive/idempotent; there are no blind DROP operations. Missing legacy identity/license/support columns/indexes are repaired. Duplicate legacy non-empty identity/license values cause a clear stop rather than silent destructive merging. ## API changes Major SaaS routes include: - `/api/config/public`, `/api/health` - `/api/auth/me`, `/api/auth/google`, `/api/auth/google/callback`, `/api/auth/logout` - `/api/user/profile`, `/api/user/settings`, `/api/user/license`, `/api/user/quota`, `/api/user/account` - `/api/projects`, `/api/projects/:id` - `/api/licenses/verify`, existing anonymous `/api/license/*` - `/api/blog`, `/api/blog/:slug`, `/api/docs`, `/api/docs/:slug` - `/api/contact` - `/api/admin/dashboard`, `/api/admin/users*`, `/api/admin/licenses*`, `/api/admin/support*`, `/api/admin/blog*`, `/api/admin/docs*`, `/api/admin/cms/preview` - existing scholarly/AI Review routes retained and account-aware where appropriate. No `/api/projects/upload` or server TeX compile endpoint exists. ## Environment changes See `TEXISE_SAAS_ENVIRONMENT.md`. Important additions include `TEXISE_APP_URL`, `TEXISE_SHOP`, MySQL variables, Google OAuth variables, SMTP variables, `SESSION_SECRET`, optional `TEXISE_SAAS_ENABLED`, session days and strict `TEXISE_MYSQL_CREATE_DATABASE` opt-in. ## Verification frozen at release checkpoint - SaaS/security/auth/session/contact/database/license/migration/public-index tests: **39/39 PASS**. - Template/indexer + installer configuration tests: **12/12 PASS**. - Existing runtime-hardening/BusyTeX compatibility suite: **99/99 PASS** (current delivered baseline test count). - SaaS static audit: **23/23 PASS**. - Existing static contract audit: **328/328 PASS**. - Template compiler requirements: **13/13 PASS**. - Workspace dependency consistency: **68 packages PASS**. - Public barrels: **67 entries across 68 packages PASS**. - Modified server/script syntax and deploy-shell syntax: **PASS**. - Touched TypeScript parser-class diagnostic scan: **PASS**. - Full `pnpm build/typecheck/lint/test/release:quality`: **NOT RUNTIME-VERIFIED** (`pnpm`/`node_modules` unavailable; Corepack registry fetch fails). - Live MySQL, Google OAuth, SMTP, browser filesystem, PDF/compiler and viewport visual QA: **NOT RUNTIME-VERIFIED**. Full status mapping is in `TEXISE_SAAS_VALIDATION_REPORT.md`. ## Problems found and fixed during implementation - Early unsupported progress reporting before actual source changes — corrected; work restarted from extracted source. - Hard-coded template catalogue — replaced by filesystem manifest authority. - CMS public reads trusted cached HTML — changed to regenerate sanitized HTML from Markdown. - Returning OAuth overwrote user-edited display name — identity refresh now preserves the TeXise display label. - OAuth email fallback could attach to admin/different stable identity — blocked. - Logged-in AI Review could use stale browser entitlement — account authority now wins. - Account license re-verification could clear an admin block — block reset removed and policy centralized. - License could be silently reassigned to another active account — rejected. - Default `MYSQL_DATABASE` accidentally signaled SaaS on editor-only upgrades — fixed and tested. - Legacy migration did not guarantee newer unique/search indexes — non-destructive index repair added with duplicate-data stop. - Release audits pinned obsolete icon-only Compile presentation — updated to assert compile semantics plus new primary TeXise control. - Contact behavior had no direct executable coverage — added tests covering account association, validation, abuse, CR/LF mail-header injection, SMTP and DB failure semantics. - Safe account preferences were write-only — login now restores theme/project-storage best-effort without making local editing depend on the server. - `/ws` app navigation exposed appearance only through Settings — added a compact Light/Dark/System header control using existing Workbench state with best-effort safe account sync. - Blank project creation still used inherited staged storage onboarding — replaced with one functional storage/name dialog. - Project metadata failures were logged and forgotten — safe metadata-only pending patches now persist browser-locally and retry without blocking local work. - Existing local-only projects had no account reconciliation action — added **Add to account** using allowlisted metadata only. - Offline template/import metadata creation could lose template/storage identity on later retry — added a safe local registration descriptor with no manuscript contents. - Admin list UI hid required account/license/quota fields — replaced generic truncating tables with explicit operational columns and added quota decrease. - CMS schema carried author/tags but publication/search did not expose them fully — completed author/tag/publication metadata and metadata-rich search. - Contact single-line fields relied on the mail library for CR/LF defense — server validation now rejects header injection before DB/SMTP work. - Malformed legacy settings JSON could break settings reads — it now degrades safely to `{}` and is repaired by the next valid write. - No preview/thumbnail assets exist in the supplied template tree — retained the specified safe-placeholder fallback rather than fabricating previews. ## Known limitations/risks requiring deployment attention - The downloadable package does not include font binaries. Restore assets documented in `FONT-ASSETS-REQUIRED.md` before build/deploy. - Native-folder display rename does not imply that the operating-system directory itself is renamed; account/local workspace naming is synchronized, while the local folder remains user-owned. - Anonymous signed licenses intentionally retain offline-grace behavior; an administrator cannot instantly revoke a client that is fully offline until it refreshes online. - Real visual fidelity at each requested viewport cannot be certified without a built browser application. - External Google/Payhip/SMTP behavior must be tested with real credentials/endpoints. - MySQL fresh/repeat/upgrade migrations must be exercised against the production MySQL version before release approval. ## Exact next action in a deployment-capable environment Restore the required font assets, install the pinned workspace dependencies, run full build/typecheck/lint/release-quality, then execute the runtime verification sequence in `TEXISE_SAAS_VALIDATION_REPORT.md`. For every failure use the same loop: **Execute → Verify → Diagnose/Fix → Verify → Continue**. Do not restart completed source phases. ## Chat-handoff rule If a future continuation chat approaches its practical context limit, finish the current safe subtask, update this ledger and generate a self-contained continuation prompt preserving source/build identity, completed/current/remaining phases, architecture, design/font boundaries, DB/CMS/API/env/auth/license/quota/template/installer changes, tests, failures/fixes, changed files, artifacts, risks and the exact next action. End that handoff with: > Continue autonomously from this exact state. Do not restart completed phases. Do not ask for confirmation. Execute all remaining phases sequentially, verify each phase, fix problems, and continue until the project is complete. If this chat again approaches its context limit, generate another complete continuation prompt for the next chat before stopping. ## Production build/install corrective pass — 2026-08-20 **COMPLETED:** corrected the two concrete `tsgo` failures reported from `/var/www/app.texise.com/public_html`, and corrected the writable AI Review audit-state location for the hardened systemd service. **CURRENT:** package/verification freeze. **REMAINING:** rerun the production `pnpm run build`/typecheck on the deployment host; all other environment-dependent runtime certification remains as previously listed. ### Concrete failures and fixes 1. `lucide-react` did not export `Github` under the pinned production dependency set. The symbol was unused, so the import was removed rather than replacing it with an unnecessary icon. 2. Template Apply inferred `type` as only `browser | browser-opfs`; assigning `nativefs` then failed strict TypeScript. The variable is now explicitly typed `WorkspaceStorageType`, preserving the existing enum/union contract. 3. The historical AI Review audit DB default was under `/etc/texise`, but the hardened unit mounts `/etc/texise` read-only. Operational writable state now defaults to `/var/www/app.texise.com/public_html/texise-data/audit/ai-review-audit.sqlite3`; old TeXise-owned default configuration/state migrates during upgrade without changing custom administrator paths. ### `/etc/texise` authority The observed production layout is valid and is now explicitly preserved by installer logic: `root:texise 0750` directory, `root:texise 0640` for `texise.env`, `config.json`, `license-keys`, private entitlement key and refresh key, and `root:texise 0640` for the public entitlement key. No writable runtime database belongs in `/etc/texise`. ### 2026-08-20 production permission normalization Observed `/etc/texise` contained `entitlement-public.pem` as `root:root 0644` while all other TeXise configuration/signing artifacts were `root:texise 0640`. Although the enclosing directory was already `root:texise 0750`, the installer now normalizes the public key to `root:texise 0640` as well. Existing key contents are preserved; only ownership/mode are normalized. The service's writable AI Review SQLite state remains outside `/etc`, under `/var/www/app.texise.com/public_html/texise-data/audit`. ### 2026-08-20 /etc/texise normalization follow-up The install and upgrade entry points now call `texise_normalize_config_permissions` after key preservation. This makes the expected production state deterministic even when an older installation has mixed modes such as `entitlement-public.pem root:root 0644`. Only the six known TeXise-owned files are normalized; unrelated administrator files are left untouched. The exact legacy-state regression passes. ### 2026-08-20 `/etc/texise` post-condition enforcement A repeated production listing still showed `entitlement-public.pem root:root 0644`. The normalization helper was already called by both install and upgrade, but there was no explicit post-condition proving the live filesystem had accepted the repair. The installer now calls `texise_verify_config_permissions` immediately after normalization. It verifies the directory is `root:texise 0750` and every present known TeXise config/signing file is `root:texise 0640`; any mismatch aborts with the exact observed owner/group or mode. Known files must also be regular, non-symlink files before normalization. This preserves unrelated administrator files and does not regenerate entitlement material. Targeted and regression verification: 39/39 dependency-free server tests, 12/12 template+installer tests, 99/99 runtime-hardening tests, 22/22 SaaS static audits; deployment shell syntax PASS. ## Production Biome lint corrective pass — 2026-08-20 **COMPLETED:** fixed all 31 Biome diagnostics reported by the OVH deployment build after custom validation and TypeScript typecheck passed. **CURRENT:** corrective release packaging. **REMAINING:** rerun the production build on OVH and confirm Biome/build reaches the next gate; continue autonomously on any new concrete failure. ### Exact reported lint classes fixed 1. 26 native buttons without explicit type → all raw SaaS `