Qualify actual import, annotation, and reopen journeys after deployment

[sarthakagrawal927]

The 2026-09-07 repair fixes a reproduced IndexedDB lost-update bug: concurrent local note/title edits used separate read/write transactions and reloaded with notes missing. The browser storage regression now passes using one atomic readwrite transaction. Hono route fixtures prove guest cloud import/read/update returns 401 and account reads/ownership checks carry the correct account ID.

Remaining gates after separately approved deployment:

• Use an approved synthetic article/PDF and real test account for import -> read -> annotate -> reopen/full reload.
• Verify Google sign-in/cookies, D1/R2 storage, account switching, expired sessions, and write failure recovery.
• Exercise guest URL import and actual annotation controls, including rapid edit/navigation and pending saves.
• Inspect desktop/mobile rendering and annotation anchors.

No live upload, account write, or deployment performed. The isolated Chromium storage harness uses real IndexedDB/FileReader and a synthetic PDF byte payload; it does not qualify PDF rendering, the full Reader UI, cloud storage, or hosted ownership enforcement.

Guest PDF page notes (#56) now have an actual built-Chromium synthetic import/render/page-note/reload/edit/delete receipt, including storage-failure retry and no API writes. This does not qualify hosted uploads or Google account storage. The shared PDF.js API/worker version mismatch was fixed by aligning the existing dependency to 5.4.624. After approved deployment, verify the real PDF reader and local persistence on the deployed revision.

Account PDF page notes are now implemented and locally qualified through real handlers and an isolated database; see the account persistence receipt below. The earlier placeholder was replaced with the shared page-note editor. Text-selection highlights and embedding notes into PDF exports are not part of the guest page-note contract.

Account PDF affordance repair

Source 1b3456d21cb5d5750a5ef0baec6ada0ed56aed01 removes ineffective font-size/font-family controls for PDFs and labels the supported appearance action as viewer background. It removes the empty Notes tab, keeps explicit AI chat entry, and fixes a reproduced 390px sidebar obstruction that hid the PDF. Desktop retains two panels.

pnpm quality passes 126 app and 20 extension tests with full builds/code-health/docs. Synthetic authenticated built-browser fixtures verify actual PDF rendering, page navigation, zoom, computed sepia background, absent inert controls, and zero API writes/external calls. Listen receives current-page text through a stubbed speech sink: device audio quality is not qualified. Both guest and account browser journeys pass; independent 390/1440 review finds no blocking issue.

At that revision account page notes were still pending; they are completed by the later receipt below. Hosted Google/D1/R2/provider and real article annotation gates above remain actionable. No live documents, account uploads, credentials, migration or deployment were touched.

The exact pushed revision passed CI and Docs. CI includes local IndexedDB, guest PDF and synthetic-account PDF browser checks. This is source/fixture qualification, not hosted or account-annotation completion.

Account page-note implementation proposal

Why / What

Complete actual account PDF page-note create/edit/delete/reopen behavior. Existing owner-scoped article PUT supports notes, but its anchor normalizer previously dropped PDF page numbers. Reuse the verified guest page-note interaction and preserve explicit account save/failure feedback. No schema change, migration, AI/provider call, hosted upload or deployment.

Design

Extract the existing note panel for local/account reuse. Account writes use existing authenticated PUT followed by a canonical read; positive integer PDF page numbers survive normalization. Reader route and PDF queries/drafts are keyed by account plus article, so switching accounts hides prior cached records and draft state. Ownership is enforced by the real handlers and the database user predicate.

Requirements

• Account notes SHALL retain text and page anchors across save, reload, edit and delete.
• Failed saves SHALL retain the draft and allow explicit retry; success SHALL follow server acknowledgment.
• A second account SHALL neither read nor mutate the first account's document/notes, and switching accounts SHALL hide cached document data and drafts.
• The UI SHALL identify account storage and retain page-note/no-embedded-export wording.

Local implementation tasks

• Preserve validated PDF page anchors in account persistence.
• Share note editor and wire account save/reload with account-scoped state.
• Verify two-account handler/database/browser lifecycle with isolated synthetic data, failed writes and reload.
• Full checks, checked push/exact CI, durable docs/receipts. Hosted gates above remain open.

Account persistence completion receipt

Source 09866165252689297718414a55c3eecee7f5956b, pushed to origin/main. Shared local/account page-note editor supports create/edit/delete, page anchors and explicit save failure/retry. Real account normalization retains only positive safe-integer page numbers. Account-scoped article query keys and keyed PDF mounts isolate saved content and drafts. No schema change or production dependency was needed.

pnpm quality passes 126 app and 20 extension tests, full type/lint/coverage/build/docs/code-health gates. pnpm test:account-notes passes two tests using unchanged Hono handlers and Drizzle against isolated SQLite; authentication and PDF bytes are synthetic. It verifies real ownership predicates, sanitization, anchor round trips and invalid anchors, failed PUT/no database change/draft retry, page-two create/reload/navigation/edit/reopen/delete, and Bob independent notes. PUT and GET responses are separately held across a same-SPA Alice-to-Bob Better Auth visibility refresh; late responses never expose Alice content or drafts in Bob's UI. Bob's foreign write returns 404. Guest PDF and account-control browser regressions pass, with independent 390/1440 source/visual review.

Exact CI and Docs passed, including the new real-handler browser suite.

This completes the bounded account page-note implementation. This issue stays open for its original hosted import/annotation/reopen and broader article/extension gates. No hosted upload, provider call, deployment or migration occurred. External browser requests were blocked. The whole-note-array PUT contract does not merge simultaneous editors across tabs/devices; page notes are not text-selection highlights or embedded PDF/export annotations.

Account article reconciliation repair

Reproduced on 0986616 with the built SPA and real local article handlers: leave an article for /extension without unmounting QueryClient, update two notes in isolated SQLite, reopen, edit the stale cached note. The real PUT replaced both current server notes with one stale edited note. Earlier malformed auxiliary-map fixture failures are not product evidence.

Requirements: clean note state SHALL refresh from fetched article notes; reading SHALL not create annotation writes; pending writes SHALL preserve newer edits and be serialized; account/article cache and draft ownership SHALL align. Existing selection/anchor/edit semantics remain. No new schema, dependencies, hosted calls or deployment.

• Repair clean-note reconciliation, dirty-save gating and account-scoped reader state.
• Verify actual selection/create/retry/edit/reload/delete, fresh-cache reopen, pending-edit and account-switch behavior through real handlers/SQLite.
• Full checks, exact pushed CI, owning documentation and retained hosted gates.

Account article completion receipt

Source bec336d2b988b13ed85285aefddc4a36cf788bf4, pushed to origin/main. The reproduced cached-reopen note loss is repaired: clean notes reconcile with fetched article data, refreshed note IDs remain unique, and reads make no writes. ReaderClient and ReaderCore share account-scoped cache keys; the reader mount is keyed by account/article. Dirty edits are protected from refetch, stale acknowledgements cannot clear newer changes, and marker reanchoring uses the same serialized queue. Failed writes remain failed until explicit retry or a new edit.

pnpm quality passes 126 app and 20 extension tests, all existing quality thresholds, builds and docs. The account suite now passes four tests (two PDF, two article), with actual built browser/Hono/Drizzle/isolated SQLite evidence. It covers the same-cache /extension reopen regression; selection-menu note creation; failed PUT with no automatic retry, manual retry, reload, edit, delete; fresh GET during a dirty edit; a physical marker drag while a save is held with no extra write; latest text/anchor persistence; and a delayed Alice save crossing a same-SPA Bob session switch. Bob cannot read/write Alice's article and can independently save/reopen his note. Local IndexedDB and guest PDF regressions also pass. Desktop/mobile images and the scoped receipt are in .fleet/evidence/account-article/.

Implementation CI and Docs passed. Evidence-only follow-up c9db01b353a9351282e46bc2d30448f590cd50a8 strengthens the test with actual article viewport assertions and regenerated screenshots; its exact CI also passed. The Docs path filter does not rerun for the test/images-only follow-up; documentation is unchanged from its green revision. No hosted import/upload, provider call, migration or deployment occurred; fixtures use synthetic HTML/authentication and explicitly unavailable auxiliary services.

Retain this issue for its hosted and broader capture/extension/provider gates. Whole-note-array updates still do not merge simultaneous editors across tabs/devices. The bounded local article and account-PDF annotation journeys are complete; this is not a hosted-shareability verdict.

September 8 hosted failure reproduced

Actual canonical-host guest UI import of https://example.com returned not_found, saving nothing. Network and independent same-origin fetch both confirm JSON 404 for /api/snapshot?url=https%3A%2F%2Fexample.com and /api/auth/get-session, each returning {error: "not_found", path: ...}. This is an API availability/routing failure before article extraction, not proof that example.com content is unsupported. The current owning source registers both routes. All six deployment guard gates passed at c9db01b; no release has yet been made in this pass. Identify the active production Worker/source, release the tested source with correct routing, then repeat guest and account qualification. No owner data, account upload, or credentials were accessed.

Worker routing repair, September 8

Root cause confirmed in owning source: handleAgentEdge ran before Hono and returned its generic JSON 404 for all API GET/HEAD requests except discovery. Commit 48ef4f272794a5216bad1751c8369f33b53784f0 lets product APIs reach Hono and preserves /api/ai discovery. Three real Worker entry-point regressions cover session dispatch, real protected snapshot/article handlers returning guest 401, and discovery GET/HEAD. Full local quality passed 129 app and 20 extension tests, all builds/code-health/docs gates. Remote D1 reports no pending migrations. CI/deploy/live receipts remain pending.

A separate guest capture mismatch is now explicit: HomeClient offers local URL import but /api/snapshot intentionally requires authentication. The routing fix preserves this protection. Resolve the guest experience and verify the authenticated import flow before a whole-product shareability claim.

Routing release verified

Exact CI34199770055 and Docs34199770042 succeeded, including all local/browser regressions. Deploy34200018115 succeeded. Worker version b2765665-1624-458d-b20c-7e9e50a9e671, deployment ac9ecc91-21d5-40ed-8cba-3666699ffa12, serves 100% with full tag 48ef4f272794a5216bad1751c8369f33b53784f0. Canonical hosted session GET now returns 200/null, guest snapshot 401/Unauthorized, and discovery 200. No migrations were pending. This closes the API discovery interception regression.

Whole-product gates remain open. The PDF upload connector rejected both temporary and workspace fixture paths before upload; no hosted PDF qualification is claimed. Guest URL import/auth mismatch and real Google/D1/R2 import/read/annotate/reload need completion. The sample page loads, but this does not qualify personal persistence. Test browser closed and workspace fixture moved to Trash.

Guest import handoff repaired

Source 6a7c1942edba96561e4375fd9ed9d391e351c6f4 changes the guest URL CTA to Sign in to import, explains account storage, and keeps the URL/category in current-tab session storage for review after return. The account import remains explicit; no automatic snapshot fetch or write occurs on return. Failed extraction retains the draft; cancellation and completed import clear it. Blocked session storage retains the visible draft and prevents navigation with an actionable message. No authentication protections, provider bindings, dependencies, or schema changed.

Full quality passes 129 app/20 extension tests and all established thresholds. The guest PDF suite passes its full PDF note lifecycle and a new built 390px browser journey: no guest snapshot call, storage failure/no navigation, synthetic signed-in callback restores exact URL/category, no automatic import, explicit import failure followed by reload retention, and cancel clears the draft. Phone screenshots are committed under .fleet/evidence/import-signin/. This uses synthetic auth and extraction, not a real Google account or cloud storage receipt. CI and production qualification pending for this source.

Final September 8 hosted guest qualification

Source 6a7c1942edba96561e4375fd9ed9d391e351c6f4 passed CI34201035372 and Docs34201035387. Deploy34201302561 succeeded. Cloudflare deployment 4bb277aa-ff10-4193-90d6-407ebaa39e7d, version 6b0b85f4-d645-47a1-8ced-f2edf464a932, serves that exact full SHA at 100%.

Two fresh-browser tests on the actual canonical host passed without API interception: guest URL CTA/storage-failure feedback/no navigation, sign-in handoff, return while still a guest restores URL/category, cancel and reload clear the draft with zero snapshot requests; and in-memory synthetic PDF import/render both pages, page-2 note save/failure/retry/reload/anchor navigation/edit/reopen/delete, with zero Reader API writes. PDF presentation has no document overflow at 390/768/1440px. The earlier connector file-path rejection is superseded for this bounded guest PDF test: the fixture was generated in memory, with no local file upload access needed. Tests closed their fresh browsers and temporary workspace copies were removed to Trash.

Remaining: real Google callback/account session, cloud URL/PDF storage and notes/read/reopen, expiry/account switching/write recovery, broader extension/provider paths. The actual OAuth button reaches the Google credential page, but no preauthenticated account is available in this browser. Local fixtures cover simulated account return; the hosted test does not claim an authenticated callback. Keep this issue open and shareability unpromoted until the cloud journey is qualified.

[sarthakagrawal927]

Reader concurrent notes reproduction

Source: 6a7c194.
Command: pnpm exec vitest run --config vitest.account-notes.config.ts -t 'independent note editors'
Synthetic account authentication only; unchanged Hono/Drizzle handlers and isolated in-memory SQLite. No hosted data, credentials, provider calls, or migrations.

Two editors read note 1. Editor A adds note 2 and receives HTTP 200. Editor B edits note 1 from its older snapshot and receives HTTP 200. The canonical subsequent GET contains only revised note 1. The assertion retaining note 2 fails (1 failed, 4 unrelated skipped). This reproduces silent lost updates, independently of unavailable Google authentication.

Probe was temporarily appended to the existing account qualification test, then removed exactly; original test bytes restored. The complete probe remains alongside this receipt.

Additional source finding: useBoardArticleSync sends the board's partial note array as the entire article notes value, assigns IDs by array position, and marks work synced before checking the HTTP response. This is source evidence, not a separately executed browser reproduction.

A repair must cover all note writers and atomic server conflict handling. A client-only GET-before-PUT is insufficient because two writers can race after reading. Preserve local drafts and saved notes on conflict, and provide an explicit resolution path. Article/PDF and linked-board flows must be qualified together. Extension API review found no note writer in its current side-panel API.

[sarthakagrawal927]

Concurrent notes repair in progress

Local changes based on 6a7c1942edba96561e4375fd9ed9d391e351c6f4 now compare base/submitted/current notes and apply only the editor's changes. The database update compares the original notes column atomically and retries bounded races. Independent edits merge; overlapping edits return 409; missing snapshots and duplicate IDs fail validation. A lost successful acknowledgement can be retried without deleting unrelated notes. No schema or dependency change.

Article and PDF callers send their editing snapshot. Canonical acknowledgements update the article cache; newer in-flight edits remain dirty. PDF editing captures its original snapshot rather than silently replacing it on query refresh. Conflicts retain the draft and explain copying changes before reload/comparison.

Verification so far:

• Type checking passes.
• 129 existing application tests pass.
• Real-handler isolated SQLite tests pass ownership, page anchors, simultaneous independent saves, conflicting edits, idempotent retry, deletion preserving unrelated additions, missing snapshot rejection and duplicate-ID rejection.
• Built browser PDF lifecycle passes.
• Cached article reopen passes.
• The article selection/retry/edit/account-switch journey passes after updating the old expectation that a concurrent same-note edit should be silently overwritten. It now proves server preservation, draft preservation, harmless conflicting retry and explicit reload/reapply. Its one extra intentional retry accounts for 10 writes instead of 9.

This remains UNCOMMITTED and UNDEPLOYED work in the owning Reader checkout. Do not promote sharing or ship this partial contract: linked-board synchronization still needs migration from partial whole-array replacement to stable note ownership and safe acknowledgement/retry. Full quality, additional browser race evidence, documentation, exact CI and production release remain. Generated test screenshot churn and the build-generated tracked landing deletion were restored to their prior bytes. No test processes remain running.

[sarthakagrawal927]

Reader concurrent-note and board repair is now deployed.

Source: 90bc397. Exact-source CI34273051317 and Docs34273051412 passed. Deploy34273454449 succeeded after all six deployment guard gates passed. Cloudflare version f5e1f86a-a051-4bc1-a6a2-cd91af8b2be9 serves 100% traffic with that full source SHA tag, verified directly after deployment.

The repair preserves independent concurrent notes with bounded atomic compare-and-swap, rejects conflicting same-note edits with 409 while retaining the draft, and gives board notes stable provenance and acknowledged retry behavior. The previously zero-height board canvas is visible and usable. Concurrent board-document and AI-conversation merging are not covered by this repair.

Validation: full pnpm quality passed (134 app tests, 20 extension tests, unchanged quality thresholds). The seven account-note tests passed using real Hono/Drizzle/SQLite and built Chromium, including actual board editing, failed-save retry, independent-note preservation, same-note conflict, reload, and account isolation. These are synthetic account fixtures.

Fresh isolated production browser: landing and sample load; private articles return 401 Unauthorized; session GET returns 200/null. A plain Python HTTP probe was rejected by Cloudflare 1010, while the real browser requests succeeded. This bounded release smoke does not requalify the full guest PDF journey or establish a real signed-in Google/D1/R2 journey. Keep issue 55 open and shareability false until the authenticated import/read/annotate/reopen and account recovery gates are verified.

Reader checkout clean after source push; temporary browser tab closed. Earlier implementation checkpoint statements about uncommitted source or pending board tests are superseded by this receipt.

[sarthakagrawal927]

Fresh credential-free hosted verification, 9 September 2026 at 06:50 UTC, source 90bc39768fcb773f91ecde87549aa3e5a4b3cb51:

• Actual isolated Chromium at 390px: open /library, choose Readable article, enter a clearly synthetic example.com URL and category, choose Sign in to import, reach /login, then click Sign in with Google.
• Google reaches its normal email/phone account-entry screen; no redirect_uri_mismatch appeared. Callback is https://read.significanthobbies.com/api/auth/callback/google; public client ID is 207924374505-77bhmntg3lg4d3rgjvduqpf6g61oeggv.apps.googleusercontent.com.
• API requests were session GET, client-config GET and OAuth-start POST only. No snapshot extraction, article/PDF upload, D1/R2 document write or credentials entry was performed. The synthetic draft remained within the disposable browser context, which was closed.
• Landing and Google-entry screenshots were visually inspected. Current source is clean/synced with main; exact CI34273051317, Docs34273051412 and Deploy34273454449 remain green.

This verifies the guest sign-in handoff, not completed Google callback/session or the real-account import → read → annotate → reopen loop. No demonstrated source blocker was found within this credential-free slice; real-account Google/D1/R2 and recovery gates above remain open. No source, deployment or provider configuration changed.