Plan only — not implemented, deployed, tested or showcased. Every checklist item below is proposed work, not a completed check. Source descriptions are inherited research observations/recommendations; the selected architecture, schema, limits and recovery policy are new design choices. This is one strategy, not a collection of interchangeable stacks.
Source navigation: scope-2-keep-what-matters, state-and-trust, workflow, platform, artifact-atlas > Chapter knowledge, not runtime receipts, source-coverage, experience-and-acceptance, evidence-and-limits. The source locators below distinguish the two dated corpora; September 10 paths refer to the read-only starter corpus inventoried in STARTER_CORPUS_MAP.yaml, not public download routes.
approach_b:
status: "PLAN ONLY; all checks pending; no runtime or showcase evidence produced"
strategy: "S2: one person's meaningful work survives return visits and devices"
prototype: "Private work cards: write a short note, explicitly save, return and continue"
optimization: "Smallest account-wide record service with credible access and recovery"
distinct_from:
static_local: "A trusted server and identity are essential, not optional browser preferences"
authoritative_multiplayer: "No live world, room state, ticks, presence or simultaneous collaboration"
gives_up:
- "Instant account-free durable saving; private retrieval requires authentication"
- "Offline synchronization, collaborative editing, live rooms, feeds and public sharing"
- "Moderators, broad roles, social graphs, background agents and runtime AI"
- "Unlimited history, rich attachments, generated-code execution and multi-node scale"
smallest_useful_loop: "Draft -> access check -> allowed saved record -> authenticated return"
success_cases:
- "Owner saves a card and retrieves the exact accepted content after refresh and on another device"
- "Another account or signed-out visitor cannot discover, read, change, delete or export it"
- "Interrupted saving preserves the draft and resolves uncertain commitment without duplication"
fused_source_grounding:
september_06:
- source: "PRD.md:62-74,109-128; CHEATSHEET.md:90-120"
source_fact: "Persistence needs minimum fields, trusted permissions and return/failure checks; identity alone is not authorization"
adoption: "One owner policy, explicit schema, denied-access probes and A5/A6/A7 gates"
- source: "scoped-posters.json: scopes/S2; scope-2-keep-what-matters.png"
source_fact: "Browser draft requests access; saved records are reached only when allowed; AI is detached and optional"
adoption: "Make the access boundary executable; do not treat the diagram as an existing API"
- source: "PLAN.md:74-143; PRD.md:76-107,138-145"
source_fact: "Complete reachable states, truthful success, targeted repair and creator-controlled publication"
adoption: "Preserve input, expose failures, verify the return journey before any later publication"
september_10:
- source: "CHEATSHEET.md:22-66,135-168,170-207,262-277"
source_fact: "Independent-app lane; lean SvelteKit recommendation; local indexed storage is not sync or backup; server needs change deployment"
adoption: "Use a request-time independent app; omit Dexie because offline record sync is not admitted"
- source: "Websim-Stax.html: Fix/Reprint; websim-stax/src/js/playground.js:402-432,518-544,580-593,622-637"
source_fact: "Darkroom teaches explicit local save/read-back, content-derived IDs, lineage, comparison, selection, deletion and undo"
qualification: "Its capped 20-version localStorage history can fail; 12-hex digest prefixes do not establish permanent or collision-free storage"
adoption: "Retain explicit save and read-back; replace local-only persistence with authorized records; do not copy a version tree without a user need"
- source: "STARTER_CORPUS_MAP.yaml: history-is-bounded and state-saving-version-lineage-and-recovery"
source_fact: "Corrected fusion separates local history, source rollback and actual user-data recovery"
adoption: "Prove backup restoration separately from restoring an application revision"
new_design_not_source_fact:
- "Private text work cards, SQLite, OIDC, adapter-node, version-checked writes and bounded operation receipts"
- "All numeric limits, retention schedules and recovery targets below"
not_inferred:
- "Websim's private database, transaction semantics, backup guarantees or framework"
- "Any new app behavior from Darkroom's prerecorded replay or historical verification receipt"
steering_and_automation:
user_steers:
- "Choose content, explicitly save, select a card, resolve a conflict and request export/deletion"
- "Authorize the account transition; decide whether to carry an unsaved guest draft into that account"
- "Choose discard versus recovery; approve any import preview before records are created"
application_automates:
- "Validate input and trusted session, enforce ownership, transact writes and read back accepted data"
- "Track pending operations and reconcile their status without inventing success"
- "Run the declared bounded backup schedule; never publish or send private content to AI"
builder_boundary:
- "OMP may assist development; reviewed code changes do not authorize data access or release"
- "The owner chooses a tested revision and later publication; this plan authorizes neither"
prohibitions:
- "No autosave hidden behind typing; no automatic conflict merge, account transfer or destructive reset"
- "No provider calls, generated content or prompt history in the visitor runtime"
checklist:
- id: B1
action: "Fix the product and deployment boundary"
checks:
- "Build one independent SvelteKit/TypeScript app using the existing starter-family conventions"
- "Use ordinary DOM controls; admit existing Tailwind/daisyUI styling, not graphics or a second widget system"
- "Select adapter-node with one request-time service and one private SQLite database on persistent local storage"
- "Serve browser and application endpoints on one HTTPS origin; database files and backups are not web-served"
- "Keep session/OIDC secrets server-side; Vite is development tooling, not the production server"
- "Do not deploy on static-only hosting or ephemeral instance storage; do not add a separate API fleet"
- "Use a maintained OIDC integration against one selected provider; never implement password handling"
boundary: "Hosting, provider, supported package versions and operational credentials are prerequisites, not existing resources"
- id: B2
action: "Define only the state and records that earn retention"
schema:
work_card:
id: "Server-created random UUID; unique constraint; opaque identifier is not permission"
owner: "Verified issuer + subject identity; derived only from the trusted session"
title: "Required plain text, at most 120 characters"
body: "Plain text, at most 20000 characters; not HTML or executable source"
revision: "Server-controlled increasing integer for stale-write detection"
updated_at: "Server timestamp for ordering and visible last-save context"
operation_receipt:
fields: "Owner, operation UUID, action, record ID, request digest, accepted revision/outcome, expiry"
purpose: "Atomic retry deduplication and recovery of a lost response, not activity analytics"
retention: "24 hours; never include full body or raw tokens; owner-only lookup"
identity_and_session: "Only integration-required identity/session material; no duplicate profile, roles or contact directory"
checks:
- "Cap the pilot at 100 cards per account; enforce limits and a 128 KiB request ceiling at the server"
- "Validate types, lengths and allowed fields; never accept owner/revision authority from submitted fields"
- "Use parameterized queries and render user text as text; omit uploads, arbitrary URLs and rich HTML"
- "Keep editor draft, selected card and pending UI state in memory; no private localStorage cache"
- "Allow explicit draft download before leaving; explain that a browser close can lose unsaved memory"
- "Keep no autosaved keystrokes, version forest, prompt transcript, feed, presence or usage-content log"
- "Ordinary application logs exclude bodies, exported contents and credentials; bound diagnostic retention"
tradeoff: "Current accepted content only; earlier edits require a prior export or a retained operational backup"
- id: B3
action: "Implement draft -> access check -> saved record"
checks:
- "Let a guest try drafting without pretending the draft is durable; sign-in is required for account storage"
- "Before authentication navigation, disclose unsaved-input risk and offer download or cancel; do not silently upload the draft"
- "For every list/read/create/update/delete/export/import request, authenticate first and authorize the specific operation"
- "Allow a signed-in user only their own records; deny all unspecified operations and cross-owner transfer"
- "Owner-scope database queries; apply identical checks to direct HTTP requests, not just page controls"
- "Protect cookie sessions with Secure/HttpOnly policy, appropriate SameSite settings and explicit CSRF protection"
- "Use the integration's state/nonce and session validation; reject expired or revoked sessions"
- "Commit a mutation and its operation receipt in one transaction; rollback both on failure"
- "Use expected revision for update/delete; a stale device gets a conflict, never last-write-wins loss"
- "Keep the submitted draft until authorized post-commit read-back returns the accepted revision/content"
- "If read-back finds a newer revision, explain the intervening change and preserve the local draft"
- "Show Saved only after confirmation; distinguish pending, failed and committed-but-not-yet-read-back states"
- "If bytes are unchanged, report Already up to date rather than manufacture another revision"
identity_boundary: "A second device with the same issuer/subject is the same owner; another account is never merged by display name or email"
- id: B4
action: "Make denial, interruption and conflict recoverable"
checks:
- "Signed-out access requests sign-in; authenticated foreign IDs use the same non-disclosing result as unknown IDs"
- "Never include another owner's title, body, count or existence hint in responses or errors"
- "On denial, clear protected displayed records while retaining only the actor's unsaved draft in memory"
- "On logout/account switch, warn about unsaved work, offer draft download, then clear private application state"
- "Serve private pages/data as non-cacheable; no service-worker cache that survives account switching"
- "Offline, quota, disk-full, database lock and server errors retain the draft and never display Saved"
- "Reuse an operation UUID only for the identical payload; reject reuse with changed content"
- "After timeout/lost response, reconcile by authorized receipt/read before offering an explicit retry"
- "Repeated activation or duplicate delivery has one committed effect; do not blindly mint another create operation"
- "After receipt expiry, mark outcome unresolved and inspect current records; never automatically replay an ambiguous create"
- "On stale revision, show local draft versus fetched current text; user chooses discard or an explicit new save"
- "For confirmed deletion, remove the live row and verify authorized absence; no Undo button unless it truly restores data"
boundary: "No durable offline queue or crash-surviving unsaved draft is promised"
- id: B5
action: "Separate personal export, operational backup and identity recovery"
personal_export:
- "Export only the current authenticated owner's selected/all live cards as versioned JSON"
- "Include title/body/revision/timestamp and format version; exclude sessions, secrets and internal owner identifiers"
- "Treat downloaded plaintext as the user's private copy; disclose its sensitivity and lack of automatic updates"
- "Validate size/schema on import, preview the proposed records, then require explicit confirmation"
- "Import creates new records owned by the current user; reject ownership fields and never overwrite by imported IDs"
- "Imported text passes normal authorization, content limits and capacity checks; failures are explicit"
operational_backup:
- "Use SQLite's consistent backup mechanism, not a live file copy that ignores WAL state"
- "Propose encrypted daily backups off the application volume, retained for 7 days"
- "Target at most 24 hours of data loss and restoration within one working day; targets are not measured guarantees"
- "Back up the required owner mapping/schema; preserve issuer/subject meaning during restore"
- "Operators, not ordinary accounts, control backup keys and restoration; application users cannot browse backups"
- "Restore to an isolated non-public instance first; verify records and ownership before any cutover"
- "Do not revive expired/revoked sessions from backups; require fresh authentication after recovery"
- "Disclose that deleted data can remain in retained backups; purge by the retention schedule"
- "A historical restore must not silently republish deleted records; reconcile against the intact current store or block public cutover for explicit recovery review"
identity_recovery:
- "Provider account recovery is separate from application record recovery; prove the return of the same identity"
- "A new account gets no old-account access merely because the human claims both accounts"
- "With a prior export, the human can explicitly import a copy into the new account; no hidden account-linking tool"
boundary: "Code rollback, Darkroom Reprint and /clear are not database restores; user export is not an operator disaster-recovery system"
- id: B6
action: "Finish the actual return-journey interface"
checks:
- "At rest, one primary Save action; saved-card list is private navigation, not a feed"
- "Cover first-run, empty, loading, partial completion, error, offline, no-permission, unavailable and success states inline"
- "Keep save status adjacent to the content and textual; do not rely on transient toasts or color"
- "Keyboard/touch, visible focus, Back/discard warnings and any opened layer's Escape behavior remain complete"
- "Check 320px, 400% zoom and reduced motion; retain readable controls without requiring animation or audio"
- "Use source accessibility targets: text contrast 4.5:1, control/focus cues 3:1, targets 24px minimum and primary/touch targets 44px"
- "Never place private draft content or session credentials in URLs; authorized record links still require access checks"
acceptance_gates:
all_pending: true
required_evidence:
- gate: "A1/A2/A3: correct revision and usable loop"
evidence: "Actual deployment revision, screenshots plus keyboard/touch/Back/zoom observations; no visual-only substitute for behavior"
- gate: "A5: durable return and read-back"
evidence: "Save known text, capture acknowledged revision, refresh/restart app, then retrieve matching content in an independent same-account device session"
- gate: "A6: access boundary and second account"
evidence: "Separate owner, second-account and signed-out sessions; tamper IDs/owner/UI and directly attempt list/read/create/update/delete/export/import/receipt access; record denials and unchanged protected data"
- gate: "A7: interrupted writes and storage failure"
evidence: "Inject disk/full or write-denial failure, drop a response after commit, interrupt read-back, double-activate and replay a receipt; observe preserved draft, truthful status and one committed effect"
- gate: "Two-device sequential conflict"
evidence: "Both devices load one revision, device one saves, device two tries stale save/delete; original accepted record survives and resolution needs human choice"
- gate: "Session/account boundary"
evidence: "Expire/revoke session during editing; reject CSRF; switch accounts and use Back; no cross-account cache leak or implicit draft upload"
- gate: "Recovery/export and A12"
evidence: "Export and explicitly reimport representative records; restore an off-volume backup to an isolated instance, compare content/ownership, deny second-account reads, measure recovery time and loss window; separately restore code"
- gate: "A11 applicable content/deletion slice"
evidence: "Adversarial text renders inert; unauthorized deletion fails; authorized deletion and backup-retention disclosure match actual behavior"
not_applicable:
- "A8/A9 live multiplayer: deliberately absent"
- "A10 runtime AI: deliberately absent"
- "Public-content moderation and roles: absent; infrastructure operator powers remain documented"
evidence_rules:
- "Record exact revision/configuration, environment, actors, steps, observed results and failures without publishing private test content"
- "Use isolated synthetic accounts/data, never operator-owned records; tests and screenshots must refer to this prototype"
- "Fresh runtime evidence is required; foundation research and historical Darkroom receipts are not passed prototype gates"
- "A failed authorization or restore gate blocks the durable-records claim even if the UI looks finished"
risks_and_exact_unresolved_facts:
- "No hosting target, persistent-volume contract, OIDC provider, maintained integration version or credentials have been selected/provisioned"
- "Provider recovery behavior, stable identity mapping, session revocation and intended two-device sign-in have not been exercised"
- "SQLite durability settings, disk limits, transactional idempotency and backup consistency remain implementation/measurement obligations"
- "Backup destination, encryption key custody, accountable operator and deletion-safe restore procedure have not been established"
- "No measured recovery-time or recovery-point result exists; seven-day retention leaves older losses unrecoverable without personal exports"
- "Infrastructure operators can access service data; owner-only application rules are not end-to-end encryption"
- "Memory-only drafts can be lost on browser crash/close; manual export is intentional friction, not automatic recovery"
- "Single-node availability and write throughput are bounded; this plan promises neither high availability nor multiplayer scale"
- "The accepted work-card limits and schema require later user-loop proof; do not silently expand into a general document platform"
stop_condition:
- "Do not call this real until the actual permitted-return, denial, interruption and recovery gates have attached evidence"
- "Do not claim data durability from refresh alone or security from a hidden control"
- "This file completes only approach B planning; implementation, showcase and release await the owner's subsequent phase"