fix(offline-sync): keep page titles in sync between REST and Yjs

Title now lives in the page's Yjs 'title' fragment, but two paths corrupted it:

- Rename-revert: a REST/MCP title change wrote only the page.title column,
  never the Yjs fragment, so the next editor open replayed the stale Yjs title
  and reverted the rename. PageService.update now mirrors the new title into the
  Yjs 'title' fragment via CollaborationGateway.writePageTitle, which goes
  through openDirectConnection directly (Redis-independent: works with
  COLLAB_DISABLE_REDIS and in single-process deployments, unlike the
  Redis-routed handleYjsEvent path). The write is best-effort: a Yjs failure is
  logged and never rolls back the committed column write. Agent provenance
  (actor/aiChatId) is threaded into the store context.

- Untitled-on-open: an empty/just-initialized 'title' fragment clobbered a
  non-empty page.title to '' on open. onStoreDocument now treats the title as
  changed only when the extracted text is non-empty, covering both the
  title-only and body+title save branches. Empty-retitling via collab is
  intentionally impossible; the REST DTO is the place to enforce non-empty.

writeTitleFragment does a full clear+seed of the 'title' fragment (no
duplication/concatenation) and leaves the body fragment intact. Removed the dead
useTreeMutation.handleRename path. Adds unit tests for writeTitleFragment, the
gateway write, the anti-empty-clobber guard, and agent provenance.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

apps/server/src/collaboration/extensions/persistence.extension.spec.ts

@@ -182,6 +182,55 @@ describe('PersistenceExtension', () => {
       expect(historyQueue.add).not.toHaveBeenCalled();
     });
 
+    it('an EMPTY title fragment does NOT overwrite a non-empty page.title (anti-corruption guard, Bug 2)', async () => {
+      // The client can momentarily seed the 'title' fragment as an EMPTY heading
+      // (hasTitleFragment true, extracted text '') before the real title syncs.
+      // Body is unchanged here, so the only candidate write is the title -> the
+      // guard must turn this into a full no-op (no updatePage, no broadcast).
+      const document = buildDoc();
+      addTitleFragment(document, ''); // empty heading: length > 0 but text ''
+      const page = basePage({
+        content: cloneOut(document),
+        title: 'Real Title',
+      });
+      pageRepo.findById.mockResolvedValue(page);
+
+      await ext.onStoreDocument({
+        documentName: 'page.PAGE_ID',
+        document,
+        context,
+      } as any);
+
+      // No write at all: the empty title is not authoritative and the body is
+      // unchanged, so onStoreDocument must take the no-op fast path.
+      expect(pageRepo.updatePage).not.toHaveBeenCalled();
+      expect(document.broadcastStateless).not.toHaveBeenCalled();
+    });
+
+    it('an EMPTY title fragment alongside a body change persists the body but NOT an empty title (anti-corruption guard, Bug 2)', async () => {
+      const document = buildDoc();
+      addTitleFragment(document, ''); // empty title fragment
+      const page = basePage({
+        content: { type: 'doc', content: [] }, // different body -> bodyChanged
+        title: 'Real Title',
+      });
+      pageRepo.findById.mockResolvedValue(page);
+
+      await ext.onStoreDocument({
+        documentName: 'page.PAGE_ID',
+        document,
+        context,
+      } as any);
+
+      expect(pageRepo.updatePage).toHaveBeenCalledTimes(1);
+      const call = pageRepo.updatePage.mock.calls[0];
+      // Body is persisted, but the title is NOT included (empty == not
+      // authoritative) and no tree update is broadcast for the title.
+      expect(call[0].content).toBeTruthy();
+      expect('title' in call[0]).toBe(false);
+      expect(call[3]).toBeUndefined();
+    });
+
     it('body + title change persists both with full body side-effects', async () => {
       const document = buildDoc();
       addTitleFragment(document, 'New Title');

apps/server/src/collaboration/extensions/persistence.extension.ts

@@ -307,8 +307,26 @@ export class PersistenceExtension implements Extension {
         bodyChanged = !isDeepStrictEqual(tiptapJson, page.content);
         // Only a populated 'title' fragment may update page.title; compare
         // against the current column value (treat null as '').
+        //
+        // ANTI-CORRUPTION GUARD (Bug 2): the client's collaborative title-editor
+        // can momentarily initialize the 'title' fragment as an EMPTY heading
+        // (so `hasTitleFragment` is true, but the extracted `titleText` is '')
+        // BEFORE the server's real-title seed has synced. Writing that '' would
+        // silently wipe a non-empty page.title to "untitled". A wiki page is
+        // never legitimately retitled to empty via this path, so we treat an
+        // empty extracted title as "not authoritative" and never persist it.
+        // The `titleText.length > 0` clause makes this guard apply to BOTH the
+        // title-only branch and the body+title branch below.
+        //
+        // DELIBERATE: this intentionally makes it impossible to retitle a page
+        // to EMPTY via the collab path — a wiki page is never legitimately
+        // empty-titled. If a non-empty-title rule ever needs relaxing or
+        // enforcing differently, the REST UpdatePageDto is the place to validate
+        // the title, not this collab guard.
         const titleChanged =
-          hasTitleFragment && titleText !== (page.title ?? '');
+          hasTitleFragment &&
+          titleText.length > 0 &&
+          titleText !== (page.title ?? '');
 
         // No-op fast path: neither body nor title changed.
         if (!bodyChanged && !titleChanged) {