fix(git-sync): subpages round-trips (was {{SUBPAGES}} literal) + exhaustive all-node round-trip test

subpages exported to the literal `{{SUBPAGES}}`, which has no markdown/HTML
inverse, so on re-import it came back as a plain paragraph holding the visible
text "{{SUBPAGES}}" — the embed rendered as that literal string on the page
after a sync (round-trip data loss, seen live). It now emits the schema-matching
`<div data-type="subpages">` like every other embed node, so the schema's
parseHTML rebuilds the subpages node. Also dropped the leaf-atom content-hole
in the subpages renderHTML.

New committed regression coverage:
- packages/git-sync/test/roundtrip-all-nodes.test.ts — exhaustive serialize ->
  deserialize round trip for ALL 40 node/mark types; each asserts the node/mark
  survives and no `{{...}}` literal leaks. This is the test that caught subpages.
- §13.1 gate (git-sync-converter-gate.spec.ts): subpages added to the green
  corpus (round-trips through the REAL server schema).
- Corrected two PR-authored tests that asserted the old {{SUBPAGES}} loss as
  "by design" — they now assert the fixed round trip.

Also folds in review #1679 coverage-gap tests (no prod change): orchestrator
pollTick/enabledSpaces, datasource 3-way merge dispatch, page.repo
last_updated_source provenance SQL.

git-sync vitest 659 (+1 expected-fail), server tsc clean, server specs green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

apps/server/src/collaboration/git-sync-converter-gate.spec.ts

@@ -360,6 +360,15 @@ const CORPUS: Record<string, any> = {
       content: [para(text('quote at the end'))],
     },
   ),
+
+  // Atom embeds that carry no inline text: they must round-trip via their
+  // schema-matching HTML (data-type div), NOT a literal that re-imports as plain
+  // text. `subpages` used to export as the literal "{{SUBPAGES}}" and came back
+  // as visible text on the page (red-team round-trip data loss) — this locks it.
+  // editor-ext materializes the `recursive: false` default on import, so the
+  // fixture pre-authors it to sit at the round-trip fixpoint (matches the other
+  // default-materializing fixtures above).
+  'subpages embed': doc({ type: 'subpages', attrs: { recursive: false } }),
 };
 
 describe('git-sync converter §13.1 idempotency gate (editor-ext schema)', () => {

apps/server/src/database/repos/page/page.repo.spec.ts

@@ -0,0 +1,157 @@
+import {
+  Kysely,
+  CamelCasePlugin,
+  DummyDriver,
+  PostgresAdapter,
+  PostgresIntrospector,
+  PostgresQueryCompiler,
+  CompiledQuery,
+} from 'kysely';
+import { PageRepo } from './page.repo';
+import type { KyselyDB } from '../../types/kysely.types';
+
+/**
+ * SQL-builder unit test for the git-sync provenance stamp on PageRepo's
+ * soft-delete / restore paths (PR #119 review). Both `removePage` and
+ * `restorePage` take an optional `lastUpdatedSource` arg and conditionally fold
+ * it into the recursive-subtree `UPDATE pages SET ...` via
+ * `...(lastUpdatedSource ? { lastUpdatedSource } : {})`. The change-listener
+ * loop-guard reads `last_updated_source = 'git-sync'` to recognize git-sync's own
+ * writes and skip the echo cycle; this test guards that the stamp is present when
+ * the arg is supplied and ABSENT when it is omitted (an ordinary user delete must
+ * not clobber the column).
+ *
+ * Harness: the same compile-only Kysely/DummyDriver pattern as
+ * space.repo.spec.ts, plus the production `CamelCasePlugin` (so the compiled SQL
+ * carries the real snake_case column names, e.g. `last_updated_source`) and a
+ * thin driver that returns ONE fixed row for every query. The fixed row is what
+ * lets the repo's guard reads (root snapshot / recursive descendants / restore
+ * target) resolve non-empty so execution reaches the subtree UPDATE we assert on
+ * — a bare DummyDriver returns no rows and both methods short-circuit before the
+ * update. We never hit a real database; we capture each compiled statement via
+ * Kysely's `log` hook and inspect the `update "pages" set ...` SQL.
+ */
+describe('PageRepo — git-sync provenance on soft-delete / restore SQL', () => {
+  // A single row shaped to satisfy every column the repo reads off its guard
+  // queries. `parentPageId: null` keeps restorePage on the simple path (no
+  // parent-detach UPDATE), so the only `update "pages"` statement is the one we
+  // assert on.
+  const FIXED_ROW = {
+    id: 'p1',
+    slugId: 's1',
+    title: 'Doc',
+    icon: null,
+    position: 'a0',
+    spaceId: 'space-1',
+    parentPageId: null,
+    deletedAt: null,
+  };
+
+  class FixedRowDriver extends DummyDriver {
+    async acquireConnection(): Promise<any> {
+      return {
+        async executeQuery() {
+          return { rows: [{ ...FIXED_ROW }] };
+        },
+        // eslint-disable-next-line @typescript-eslint/no-empty-function
+        async *streamQuery() {},
+      };
+    }
+  }
+
+  interface Captured {
+    sql: string;
+    parameters: readonly unknown[];
+  }
+
+  // Compile-only Kysely on the Postgres dialect (CamelCasePlugin for real column
+  // names) whose `log` hook records every executed statement's compiled SQL.
+  function makeRepoCapturingSql() {
+    const captured: Captured[] = [];
+    const db = new Kysely<any>({
+      dialect: {
+        createAdapter: () => new PostgresAdapter(),
+        createDriver: () => new FixedRowDriver(),
+        createIntrospector: (d) => new PostgresIntrospector(d),
+        createQueryCompiler: () => new PostgresQueryCompiler(),
+      },
+      plugins: [new CamelCasePlugin()],
+      log: (event) => {
+        if (event.level === 'query') {
+          const q = event.query as CompiledQuery;
+          captured.push({ sql: q.sql, parameters: q.parameters });
+        }
+      },
+    });
+
+    const repo = new PageRepo(
+      db as unknown as KyselyDB,
+      {} as any,
+      { emit: jest.fn() } as any,
+    );
+    // Find the single subtree UPDATE on pages (collapse whitespace for matching).
+    const getUpdatePagesSql = (): Captured | undefined =>
+      captured
+        .map((c) => ({ ...c, sql: c.sql.replace(/\s+/g, ' ') }))
+        .find((c) => /update "pages" set/i.test(c.sql));
+    return { repo, getUpdatePagesSql };
+  }
+
+  describe('removePage', () => {
+    it("stamps last_updated_source = 'git-sync' on the subtree soft-delete when the provenance arg is supplied", async () => {
+      const { repo, getUpdatePagesSql } = makeRepoCapturingSql();
+
+      await repo.removePage('p1', 'user-1', 'ws-1', 'git-sync');
+
+      const update = getUpdatePagesSql();
+      expect(update).toBeDefined();
+      // The provenance column is in the UPDATE's SET clause...
+      expect(update!.sql).toContain('"last_updated_source" =');
+      // ...with the 'git-sync' marker as the bound value.
+      expect(update!.parameters).toContain('git-sync');
+      // Sanity: it is still the soft-delete UPDATE (sets deleted_at too).
+      expect(update!.sql).toContain('"deleted_at" =');
+    });
+
+    it('OMITS last_updated_source from the soft-delete when the provenance arg is undefined', async () => {
+      const { repo, getUpdatePagesSql } = makeRepoCapturingSql();
+
+      await repo.removePage('p1', 'user-1', 'ws-1');
+
+      const update = getUpdatePagesSql();
+      expect(update).toBeDefined();
+      // Ordinary user delete: the column must NOT be touched (keeps prior value).
+      expect(update!.sql).not.toContain('last_updated_source');
+      expect(update!.parameters).not.toContain('git-sync');
+      // It is still the soft-delete UPDATE.
+      expect(update!.sql).toContain('"deleted_at" =');
+    });
+  });
+
+  describe('restorePage', () => {
+    it("stamps last_updated_source = 'git-sync' on the subtree restore when the provenance arg is supplied", async () => {
+      const { repo, getUpdatePagesSql } = makeRepoCapturingSql();
+
+      await repo.restorePage('p1', 'ws-1', 'git-sync');
+
+      const update = getUpdatePagesSql();
+      expect(update).toBeDefined();
+      expect(update!.sql).toContain('"last_updated_source" =');
+      expect(update!.parameters).toContain('git-sync');
+      // Sanity: it is the restore UPDATE (clears deleted_at).
+      expect(update!.sql).toContain('"deleted_at" =');
+    });
+
+    it('OMITS last_updated_source from the restore when the provenance arg is undefined', async () => {
+      const { repo, getUpdatePagesSql } = makeRepoCapturingSql();
+
+      await repo.restorePage('p1', 'ws-1');
+
+      const update = getUpdatePagesSql();
+      expect(update).toBeDefined();
+      expect(update!.sql).not.toContain('last_updated_source');
+      expect(update!.parameters).not.toContain('git-sync');
+      expect(update!.sql).toContain('"deleted_at" =');
+    });
+  });
+});

apps/server/src/integrations/git-sync/services/git-sync.orchestrator.spec.ts

@@ -19,6 +19,14 @@ jest.mock('../git-sync.loader', () => ({
 }));
 
 import { Logger } from '@nestjs/common';
+import {
+  Kysely,
+  DummyDriver,
+  PostgresAdapter,
+  PostgresIntrospector,
+  PostgresQueryCompiler,
+  CompiledQuery,
+} from 'kysely';
 import {
   GitSyncOrchestrator,
   GitSyncLockHeldError,
@@ -466,4 +474,91 @@ describe('GitSyncOrchestrator', () => {
       expect(built.scheduler.addInterval).not.toHaveBeenCalled();
     });
   });
+
+  // The poll-safety backstop: each tick enumerates the STRICT opt-in spaces and
+  // reconciles each one under its own lock. We drive the private `pollTick()`
+  // directly and (separately) compile `enabledSpaces()` to assert its opt-in SQL.
+  describe('pollTick + enabledSpaces (strict opt-in backstop)', () => {
+    it('runs runOnce exactly once per enabled space, with the right (spaceId, workspaceId)', async () => {
+      const built = build();
+      // Isolate the tick wiring from the cycle machinery: stub the enumeration
+      // and count runOnce (it never throws; here we don't exercise its body).
+      const runOnce = jest
+        .spyOn(built.orchestrator, 'runOnce')
+        .mockResolvedValue({ spaceId: 'x', ran: true });
+      jest
+        .spyOn(built.orchestrator as any, 'enabledSpaces')
+        .mockResolvedValue([
+          { spaceId: 'space-1', workspaceId: 'ws-1' },
+          { spaceId: 'space-2', workspaceId: 'ws-2' },
+        ]);
+
+      await (built.orchestrator as any).pollTick();
+
+      expect(runOnce).toHaveBeenCalledTimes(2);
+      // Per-space isolation: each space is reconciled with its OWN workspace id.
+      expect(runOnce).toHaveBeenNthCalledWith(1, 'space-1', 'ws-1');
+      expect(runOnce).toHaveBeenNthCalledWith(2, 'space-2', 'ws-2');
+    });
+
+    it('does NOT throw and runs nothing when the enabled-spaces query throws (try/catch backstop)', async () => {
+      jest.spyOn(Logger.prototype, 'error').mockImplementation(() => undefined);
+      const built = build();
+      const runOnce = jest.spyOn(built.orchestrator, 'runOnce');
+      jest
+        .spyOn(built.orchestrator as any, 'enabledSpaces')
+        .mockRejectedValue(new Error('db down'));
+
+      // A failed enumeration must never break the interval — pollTick swallows it.
+      await expect(
+        (built.orchestrator as any).pollTick(),
+      ).resolves.toBeUndefined();
+      expect(runOnce).not.toHaveBeenCalled();
+    });
+
+    it('early-returns (no enumeration, no runOnce) when git-sync is disabled', async () => {
+      const built = build({ enabled: false });
+      const enabled = jest.spyOn(built.orchestrator as any, 'enabledSpaces');
+      const runOnce = jest.spyOn(built.orchestrator, 'runOnce');
+
+      await (built.orchestrator as any).pollTick();
+
+      // Gated on the master switch before any DB work.
+      expect(enabled).not.toHaveBeenCalled();
+      expect(runOnce).not.toHaveBeenCalled();
+    });
+
+    it('compiles the STRICT opt-in enumeration SQL (spaces, deletedAt is null, enabled flag)', async () => {
+      // Inject a compile-only Kysely (DummyDriver) whose `log` hook captures the
+      // exact SQL `enabledSpaces()` runs — no fake builder, the real query is
+      // compiled. DummyDriver yields no rows; we only assert the SQL shape.
+      const built = build();
+      let captured: CompiledQuery | undefined;
+      const compileDb = new Kysely<any>({
+        dialect: {
+          createAdapter: () => new PostgresAdapter(),
+          createDriver: () => new DummyDriver(),
+          createIntrospector: (d) => new PostgresIntrospector(d),
+          createQueryCompiler: () => new PostgresQueryCompiler(),
+        },
+        log: (event) => {
+          if (event.level === 'query') captured = event.query as CompiledQuery;
+        },
+      });
+      // Swap the orchestrator's injected db for the compile-only instance.
+      (built.orchestrator as any).db = compileDb;
+
+      const rows = await (built.orchestrator as any).enabledSpaces();
+      // DummyDriver returns no rows -> empty opt-in list (the no-space default).
+      expect(rows).toEqual([]);
+
+      expect(captured).toBeDefined();
+      const sql = captured!.sql.replace(/\s+/g, ' ');
+      expect(sql).toContain('from "spaces"');
+      // deletedAt-is-null guard (live spaces only).
+      expect(sql).toContain('"deletedAt" is null');
+      // STRICT per-space opt-in: the raw jsonb flag predicate, verbatim.
+      expect(sql).toContain(`settings->'gitSync'->>'enabled' = 'true'`);
+    });
+  });
 });

apps/server/src/integrations/git-sync/services/gitmost-datasource.service.spec.ts

@@ -48,6 +48,11 @@ jest.mock('../git-sync.loader', () => ({
 
 import * as Y from 'yjs';
 import { GitmostDataSourceService } from './gitmost-datasource.service';
+// The body-write seam picks 2-way vs 3-way merge based on whether a base doc was
+// built. We spy on the real module exports (ts-jest CJS output references them
+// through the namespace object, so the spies intercept the SUT's calls) and let
+// them call through, so we assert WHICH merge ran without mocking the behaviour.
+import * as bodyMerge from './yjs-body-merge';
 
 // Focused unit/contract test for the native GitSyncClient adapter.
 // No DB, no real collab server: the repos/services/gateway are mocked and we
@@ -271,6 +276,46 @@ describe('GitmostDataSourceService', () => {
       // The body fragment is non-empty: the incoming block was merged in.
       expect(realDoc.getXmlFragment('default').length).toBeGreaterThan(0);
     });
+
+    // The 2-way path (no base) is covered above; this exercises the THREE-WAY
+    // branch that only fires when a `baseMarkdown` is supplied (review #5).
+    describe('with a baseMarkdown (three-way merge)', () => {
+      afterEach(() => jest.restoreAllMocks());
+
+      it('builds a base doc and dispatches to mergeXmlFragments3Way (not the 2-way merge)', async () => {
+        const { service, mocks } = build();
+        mocks.pageRepo.findById.mockResolvedValue({
+          id: 'p1',
+          updatedAt: new Date('2026-06-20T11:00:00.000Z'),
+        });
+        // Spy through to the real implementations so we observe the dispatch.
+        const merge3 = jest.spyOn(bodyMerge, 'mergeXmlFragments3Way');
+        const merge2 = jest.spyOn(bodyMerge, 'mergeXmlFragments');
+
+        await service
+          .bind(CTX)
+          .importPageMarkdown('p1', '# Full\n\ngit', '# Base\n\nbase');
+
+        // The body write was staged through collab as before.
+        expect(mocks.conn.transact).toHaveBeenCalledTimes(1);
+        expect(typeof mocks.conn.capturedFn).toBe('function');
+
+        // Running the captured merge against a real live doc takes the 3-way path:
+        // the base was parsed/built and the 3-way helper is invoked with three
+        // fragments; the 2-way fallback is NOT used.
+        const liveDoc = new Y.Doc();
+        expect(() => mocks.conn.capturedFn?.(liveDoc)).not.toThrow();
+
+        expect(merge3).toHaveBeenCalledTimes(1);
+        expect(merge2).not.toHaveBeenCalled();
+        const [liveFrag, gitFrag, baseFrag] = merge3.mock.calls[0];
+        expect(liveFrag).toBeInstanceOf(Y.XmlFragment);
+        expect(gitFrag).toBeInstanceOf(Y.XmlFragment);
+        // The third arg is the BASE fragment — proof the base markdown was parsed
+        // and converted into its own doc for the common-ancestor comparison.
+        expect(baseFrag).toBeInstanceOf(Y.XmlFragment);
+      });
+    });
   });
 
   describe('createPage', () => {

packages/git-sync/src/lib/docmost-schema.ts

@@ -932,7 +932,7 @@ const Subpages = Node.create({
     return [{ tag: 'div[data-type="subpages"]' }];
   },
   renderHTML({ HTMLAttributes }) {
-    return ["div", { "data-type": "subpages", ...HTMLAttributes }, 0];
+    return ["div", { "data-type": "subpages", ...HTMLAttributes }];
   },
 });
 

packages/git-sync/src/lib/markdown-converter.ts

@@ -649,7 +649,12 @@ export function convertProseMirrorToMarkdown(content: any): string {
         return `<div data-type="pageBreak"></div>`;
 
       case "subpages":
-        return "{{SUBPAGES}}";
+        // Emit the schema-matching div[data-type="subpages"] so marked passes it
+        // through as a block and generateJSON rebuilds the subpages atom. The old
+        // `{{SUBPAGES}}` literal had no parseHTML inverse, so on import it stayed
+        // as plain text — the embed rendered as the literal "{{SUBPAGES}}" on the
+        // page after a round-trip (red-team: subpages round-trip data loss).
+        return `<div data-type="subpages"></div>`;
 
       case "status": {
         // Inline status pill. The schema reads the label from the element's

packages/git-sync/test/markdown-converter-gaps.test.ts

@@ -68,28 +68,27 @@ describe('pageBreak data loss (no converter case — SPEC §11 divergence)', ()
 });
 
 // ---------------------------------------------------------------------------
-// 2. subpages LOSSY round-trip (`case "subpages"` emits `{{SUBPAGES}}`).
+// 2. subpages round-trip (`case "subpages"` emits the schema-matching div).
 //
-// The golden test only pins the EMISSION string. The token has no markdown or
-// HTML meaning, so on re-import marked treats `{{SUBPAGES}}` as ordinary text:
-// the subpages BLOCK comes back as a plain PARAGRAPH carrying that literal
-// string, NOT a `subpages` node. The export is "lossy but legible" by design;
-// this test pins the actual lossy round-trip behavior.
+// It used to emit the literal `{{SUBPAGES}}`, which has no markdown/HTML meaning,
+// so on re-import the subpages BLOCK came back as a plain PARAGRAPH carrying the
+// literal string (the embed rendered as visible "{{SUBPAGES}}" text on the page
+// after a sync — data loss). It now emits `<div data-type="subpages">` like the
+// other embed nodes, so the schema's parseHTML rebuilds the subpages node.
 // ---------------------------------------------------------------------------
-describe('subpages lossy round-trip ({{SUBPAGES}} placeholder)', () => {
-  it('emits {{SUBPAGES}} which re-imports as a paragraph, not a subpages node', async () => {
+describe('subpages round-trip (schema-matching div)', () => {
+  it('emits the subpages div and re-imports as a subpages node (no literal leak)', async () => {
     const { md1, doc2 } = await roundTrip({ type: 'subpages' });
-    expect(md1).toBe('{{SUBPAGES}}');
+    expect(md1).toBe('<div data-type="subpages"></div>');
 
-    // The re-imported doc has a single paragraph holding the literal token.
-    const top = doc2.content || [];
-    expect(top).toHaveLength(1);
-    expect(top[0].type).toBe('paragraph');
-    expect(top[0].content?.[0]).toMatchObject({ type: 'text', text: '{{SUBPAGES}}' });
-
-    // The subpages node itself is gone: nothing in the doc is a subpages node.
-    const allTypes = top.map((n: any) => n.type);
-    expect(allTypes).not.toContain('subpages');
+    const collect = (n: any): string[] => [
+      n.type,
+      ...((n.content || []) as any[]).flatMap(collect),
+    ];
+    const allTypes = (doc2.content || []).flatMap(collect);
+    // The subpages node survives, and no literal {{SUBPAGES}} text leaked back.
+    expect(allTypes).toContain('subpages');
+    expect(JSON.stringify(doc2)).not.toContain('{{SUBPAGES}}');
   });
 });
 

packages/git-sync/test/markdown-converter-golden.test.ts

@@ -142,8 +142,8 @@ describe('paragraph.textAlign -> <div align>', () => {
 });
 
 describe('subpages token + unknown-in-container fallback', () => {
-  it('subpages emits the {{SUBPAGES}} placeholder token', () => {
-    expect(c({ type: 'subpages' })).toBe('{{SUBPAGES}}');
+  it('subpages emits the schema-matching div (round-trips, unlike the old {{SUBPAGES}} literal)', () => {
+    expect(c({ type: 'subpages' })).toBe('<div data-type="subpages"></div>');
   });
 
   it('an unknown block inside a raw-HTML container is wrapped in <div> (never markdown)', () => {

packages/git-sync/test/roundtrip-all-nodes.test.ts

@@ -0,0 +1,109 @@
+import { describe, expect, it } from 'vitest';
+import { convertProseMirrorToMarkdown } from '../src/lib/markdown-converter.js';
+import { markdownToProseMirror } from '../src/lib/markdown-to-prosemirror.js';
+
+/**
+ * Exhaustive serialize -> deserialize round trip for EVERY node and mark type the
+ * Docmost document schema supports. The git-sync converter exports a page body to
+ * Markdown and imports it back; any node type that has no parseHTML inverse (or is
+ * serialized to a literal that never re-parses) silently degrades to plain text on
+ * a round trip — e.g. `subpages` used to export as the literal `{{SUBPAGES}}` and
+ * came back as the visible text "{{SUBPAGES}}" instead of the embed.
+ *
+ * This guards the whole class: for one representative fixture per type, the node
+ * (or mark) MUST still be present after convert -> import, and the exported
+ * Markdown must not contain a `{{...}}` template literal (the old lossy form).
+ */
+
+const T = (t: string, marks?: any[]) =>
+  marks ? { type: 'text', text: t, marks } : { type: 'text', text: t };
+const P = (...c: any[]) => ({ type: 'paragraph', content: c });
+const doc = (...c: any[]) => ({ type: 'doc', content: c });
+
+// `primary` is the node/mark type that must survive the round trip.
+const FIXTURES: Record<string, { doc: any; primary: string }> = {
+  paragraph: { doc: doc(P(T('hello'))), primary: 'paragraph' },
+  heading: { doc: doc({ type: 'heading', attrs: { level: 2 }, content: [T('H2')] }), primary: 'heading' },
+  blockquote: { doc: doc({ type: 'blockquote', content: [P(T('q'))] }), primary: 'blockquote' },
+  codeBlock: { doc: doc({ type: 'codeBlock', attrs: { language: 'js' }, content: [T('foo()')] }), primary: 'codeBlock' },
+  bulletList: { doc: doc({ type: 'bulletList', content: [{ type: 'listItem', content: [P(T('a'))] }] }), primary: 'bulletList' },
+  orderedList: { doc: doc({ type: 'orderedList', attrs: { start: 1 }, content: [{ type: 'listItem', content: [P(T('a'))] }] }), primary: 'orderedList' },
+  taskList: { doc: doc({ type: 'taskList', content: [{ type: 'taskItem', attrs: { checked: true }, content: [P(T('done'))] }] }), primary: 'taskList' },
+  horizontalRule: { doc: doc({ type: 'horizontalRule' }), primary: 'horizontalRule' },
+  image: { doc: doc({ type: 'image', attrs: { src: '/f/x.png', width: '320', align: 'center' } }), primary: 'image' },
+  hardBreak: { doc: doc(P(T('a'), { type: 'hardBreak' }, T('b'))), primary: 'hardBreak' },
+  callout: { doc: doc({ type: 'callout', attrs: { type: 'info' }, content: [P(T('note'))] }), primary: 'callout' },
+  columns: {
+    doc: doc({ type: 'columns', content: [
+      { type: 'column', attrs: { width: '50%' }, content: [P(T('L'))] },
+      { type: 'column', attrs: { width: '50%' }, content: [P(T('R'))] }] }),
+    primary: 'column',
+  },
+  details: {
+    doc: doc({ type: 'details', content: [
+      { type: 'detailsSummary', content: [T('Sum')] },
+      { type: 'detailsContent', content: [P(T('body'))] }] }),
+    primary: 'details',
+  },
+  table: {
+    doc: doc({ type: 'table', content: [
+      { type: 'tableRow', content: [{ type: 'tableHeader', content: [P(T('H1'))] }, { type: 'tableHeader', content: [P(T('H2'))] }] },
+      { type: 'tableRow', content: [{ type: 'tableCell', content: [P(T('C1'))] }, { type: 'tableCell', content: [P(T('C2'))] }] }] }),
+    primary: 'tableCell',
+  },
+  mathBlock: { doc: doc({ type: 'mathBlock', attrs: { math: 'x^2' } }), primary: 'mathBlock' },
+  mathInline: { doc: doc(P({ type: 'mathInline', attrs: { math: 'x^2' } })), primary: 'mathInline' },
+  mention: { doc: doc(P({ type: 'mention', attrs: { id: 'u1', label: 'Bob', entityType: 'user', entityId: 'u1' } })), primary: 'mention' },
+  drawio: { doc: doc({ type: 'drawio', attrs: { src: '/f/d.drawio', attachmentId: 'a1' } }), primary: 'drawio' },
+  excalidraw: { doc: doc({ type: 'excalidraw', attrs: { src: '/f/e.excalidraw', attachmentId: 'a1' } }), primary: 'excalidraw' },
+  embed: { doc: doc({ type: 'embed', attrs: { src: 'https://youtube.com/x', provider: 'iframe' } }), primary: 'embed' },
+  pdf: { doc: doc({ type: 'pdf', attrs: { src: '/f/x.pdf', attachmentId: 'a1' } }), primary: 'pdf' },
+  video: { doc: doc({ type: 'video', attrs: { src: '/f/v.mp4', width: '640' } }), primary: 'video' },
+  audio: { doc: doc({ type: 'audio', attrs: { src: '/f/a.mp3' } }), primary: 'audio' },
+  attachment: { doc: doc({ type: 'attachment', attrs: { url: '/f/x.zip', name: 'x.zip', attachmentId: 'a1' } }), primary: 'attachment' },
+  youtube: { doc: doc({ type: 'youtube', attrs: { src: 'https://youtube.com/watch?v=x' } }), primary: 'youtube' },
+  subpages: { doc: doc({ type: 'subpages' }), primary: 'subpages' },
+  pageBreak: { doc: doc({ type: 'pageBreak' }), primary: 'pageBreak' },
+  htmlEmbed: { doc: doc({ type: 'htmlEmbed', attrs: { source: '<b>hi</b>' } }), primary: 'htmlEmbed' },
+  pageEmbed: { doc: doc({ type: 'pageEmbed', attrs: { pageId: 'p1' } }), primary: 'pageEmbed' },
+  transclusion: { doc: doc({ type: 'transclusionSource', attrs: { pageId: 'p1' } }), primary: 'transclusionSource' },
+  footnote: {
+    doc: doc(
+      P(T('x'), { type: 'footnoteReference', attrs: { id: 'fn1' } }),
+      { type: 'footnotesList', content: [{ type: 'footnoteDefinition', attrs: { id: 'fn1' }, content: [P(T('note'))] }] }),
+    primary: 'footnoteReference',
+  },
+  status: { doc: doc(P({ type: 'status', attrs: { text: 'Done', color: 'green' } })), primary: 'status' },
+  // marks
+  bold: { doc: doc(P(T('b', [{ type: 'bold' }]))), primary: 'bold' },
+  italic: { doc: doc(P(T('i', [{ type: 'italic' }]))), primary: 'italic' },
+  strike: { doc: doc(P(T('s', [{ type: 'strike' }]))), primary: 'strike' },
+  code: { doc: doc(P(T('c', [{ type: 'code' }]))), primary: 'code' },
+  underline: { doc: doc(P(T('u', [{ type: 'underline' }]))), primary: 'underline' },
+  superscript: { doc: doc(P(T('x', [{ type: 'superscript' }]))), primary: 'superscript' },
+  subscript: { doc: doc(P(T('x', [{ type: 'subscript' }]))), primary: 'subscript' },
+  highlight: { doc: doc(P(T('h', [{ type: 'highlight', attrs: { color: 'yellow' } }]))), primary: 'highlight' },
+  link: { doc: doc(P(T('l', [{ type: 'link', attrs: { href: 'https://x.com' } }]))), primary: 'link' },
+};
+
+function collectTypes(n: any, set = new Set<string>()): Set<string> {
+  if (!n || typeof n !== 'object') return set;
+  if (n.type) set.add(n.type);
+  if (Array.isArray(n.content)) n.content.forEach((c: any) => collectTypes(c, set));
+  if (Array.isArray(n.marks)) n.marks.forEach((m: any) => m?.type && set.add(m.type));
+  return set;
+}
+
+describe('git-sync converter: every node/mark type survives a Markdown round trip', () => {
+  for (const [name, { doc: original, primary }] of Object.entries(FIXTURES)) {
+    it(`round-trips ${name} (keeps the ${primary} node/mark, no literal leak)`, async () => {
+      const md = convertProseMirrorToMarkdown(original);
+      // The lossy old form serialized embeds to `{{...}}` literals that never
+      // re-parsed; no node may export to one.
+      expect(md).not.toMatch(/\{\{.*\}\}/);
+      const back = await markdownToProseMirror(md);
+      const types = collectTypes(back);
+      expect(types.has(primary)).toBe(true);
+    });
+  }
+});