fix(#342 review round-2 F5-F6): drop the posthog re-render remount + test chunk detector

- F5 [stability/regression]: the round-1 F2 fix re-rendered the root with
  <PostHogProvider><App/></PostHogProvider> after the analytics chunk loaded. In
  the ChunkLoadErrorBoundary child slot the element TYPE changes App ->
  PostHogProvider, so React does NOT reconcile in place — it REMOUNTS the whole
  App: every mount effect runs twice (websocket connect/disconnect, origin
  tracking, subscriptions) and local state / focus / scroll / in-progress input is
  lost on cloud cold-load (e.g. typing in /login before analytics loads). And it
  was USELESS: the app has ZERO consumers of the PostHog React context (no
  usePostHog / useFeatureFlag* / PostHogFeature), and PostHogProvider given an
  initialized client is a no-op — all capture goes through the posthog singleton.
  Fix: initAnalytics now inits the posthog SINGLETON only (no posthog-js/react
  import, no second render); renderApp() renders <App/> once. First paint stays
  instant, cloud analytics behavior unchanged, no remount.
- F6 [test]: exported isChunkLoadError + chunk-load-error-boundary.test.ts —
  pins the detector (ChunkLoadError name + the 3 dynamic-import failure messages,
  case-insensitive → true; null/undefined/ordinary errors → false) so a
  false-negative that re-blanks the app on a real chunk-404 is caught.

Gate: client tsc 0, chunk-load + sanitize tests 14 passed. Entry chunk unchanged.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.env.example

@@ -209,20 +209,6 @@ MCP_DOCMOST_PASSWORD=
 # active" behavior.
 # AI_CHAT_DEFERRED_TOOLS=true
 
-# --- Autonomous / detached agent runs (settings.ai.autonomousRuns) ---
-# Opt-in per workspace (AI settings; off by default). When on, a chat turn becomes
-# a server-side RUN that survives a browser disconnect — only an explicit Stop ends
-# it, and a client reconnects/live-follows the run.
-#
-# DEPLOY CONSTRAINT — SINGLE-INSTANCE ONLY in phase 1: Stop and the in-process
-# AbortController that backs it are process-local, so a Stop only aborts a run
-# executing on the SAME replica that owns it (cross-instance pub/sub stop is phase
-# 2 and not yet reliable). Do NOT enable autonomousRuns on a horizontally-scaled
-# deployment (multiple replicas behind a load balancer, or Docmost cloud
-# CLOUD=true) — run a single instance instead. The server logs a startup WARNING
-# when it detects a multi-instance deployment (CLOUD=true) so the constraint is
-# visible, and a startup sweep settles any run left dangling by a restart.
-
 # --- Anonymous public-share AI assistant ---
 # Opt-in per workspace (AI settings -> "public share assistant"; off by default).
 # When enabled, anonymous visitors of a published share can ask an AI about that
@@ -256,27 +242,3 @@ MCP_DOCMOST_PASSWORD=
 # FAILS CLOSED if Redis is unavailable (default: 1,000,000 tokens per workspace
 # per rolling day).
 # SHARE_AI_WORKSPACE_TOKEN_BUDGET_PER_DAY=1000000
-
-# --- Observability / perf metrics (#355) ---
-#
-# Two INDEPENDENT toggles, both OFF by default:
-#
-# 1) METRICS_PORT — the server-side Prometheus scrape endpoint.
-#    UNSET (default) => the whole prom subsystem is OFF: no registry, no
-#    collectors, and NOTHING is exposed on the main app port. There is NO
-#    default port — leaving it blank disables it. When set to a port (e.g.
-#    9464), a SEPARATE bare node:http listener serves GET /metrics on that port
-#    only (never on the main :3000 app listener), for a scraper such as
-#    VictoriaMetrics/Prometheus reaching it as <host>:<port>/metrics.
-# METRICS_PORT=9464
-#
-# 2) CLIENT_TELEMETRY_ENABLED — the public client perf-telemetry sink.
-#    OFF by default. When true, the unauthenticated POST /api/telemetry/vitals
-#    endpoint is registered and browsers collect + send web-vitals / editor
-#    metrics into the `client_metrics` table (read directly by Grafana, separate
-#    from METRICS_PORT). Leave OFF unless you actually consume this data: the
-#    endpoint is public and the table has NO app-side retention, so enabling it
-#    requires an EXTERNAL pruner to bound `client_metrics` growth (the deployed
-#    infra prunes rows >90d via a maintenance container). When off, the endpoint
-#    does not exist and the client installs no observers.
-# CLIENT_TELEMETRY_ENABLED=false

.github/workflows/develop.yml

@@ -18,48 +18,12 @@ env:
   IMAGE: ghcr.io/vvzvlad/gitmost
 
 jobs:
-  # Run the reusable test suite. Together with the e2e jobs below it gates the
+  # Run the reusable test suite first so a failing test blocks the image build.
-  # publish job (the image push), not the build itself — build runs in parallel.
   test:
     uses: ./.github/workflows/test.yml
 
-  # Runs in parallel with the test/e2e jobs and only warms the buildx cache
-  # (GHA cache, scope develop-amd64). No push happens here — the publish job
-  # below is the only one that pushes the image.
   build:
-    runs-on: ubuntu-latest
+    needs: test
-    timeout-minutes: 30
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Resolve version
-        id: version
-        run: echo "value=$(git describe --tags --always)" >> "$GITHUB_OUTPUT"
-
-      - name: Build develop image (warm cache, no push)
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          platforms: linux/amd64
-          build-args: |
-            APP_VERSION=${{ steps.version.outputs.value }}
-            AI_AGENT_ROLES_CATALOG_URL=https://raw.githubusercontent.com/vvzvlad/gitmost/develop/agent-roles-catalog
-          push: false
-          cache-from: type=gha,scope=develop-amd64
-          cache-to: type=gha,scope=develop-amd64,mode=max,ignore-error=true
-
-  # The gate: rebuilds from the cache the build job just wrote (near-instant on
-  # a cache hit; worst case — cache eviction — a full rebuild, which matches the
-  # old sequential timing) and pushes :develop only when unit tests AND both
-  # e2e suites AND the build are green.
-  publish:
-    needs: [test, e2e-server, e2e-mcp, build]
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
@@ -93,10 +57,13 @@ jobs:
           push: true
           tags: ${{ env.IMAGE }}:develop
           cache-from: type=gha,scope=develop-amd64
+          cache-to: type=gha,scope=develop-amd64,mode=max,ignore-error=true
 
-  # e2e jobs gate the publish (image push), not the build: the :develop image
+  # e2e jobs run on every develop push but DO NOT gate the build/publish above:
-  # is pushed only when unit tests AND both e2e suites pass (publish.needs
+  # `build` stays `needs: test` only, so the :develop image still ships even if
-  # lists them all).
+  # e2e fails. A failing e2e job turns the run red and triggers GitHub's email
+  # to the pusher — that red run + email is the intended notification, not a
+  # deploy block.
   e2e-server:
     runs-on: ubuntu-latest
     # Hard cap: the full-AppModule e2e leaks open handles and hung jest to the 6h max.
@@ -157,7 +124,9 @@ jobs:
       - name: Run server e2e
         run: pnpm --filter ./apps/server test:e2e
 
-  # Gates the publish too — see the comment above e2e-server.
+  # Same rationale as e2e-server: this job is intentionally NOT in
+  # `build.needs`. Deploy of the :develop image must not be blocked by e2e;
+  # a red run plus GitHub's email to the pusher is the notification mechanism.
   e2e-mcp:
     runs-on: ubuntu-latest
     timeout-minutes: 20

AGENTS.md

@@ -201,7 +201,7 @@ pnpm workspace (`pnpm@10.4.0`) orchestrated by **Nx**. Four workspace packages:
 | `apps/client` | `client` | React 18 + Vite + Mantine 8 + TanStack Query + Jotai | SPA frontend |
 | `packages/editor-ext` | `@docmost/editor-ext` | Tiptap/ProseMirror | Shared Tiptap node/mark extensions, imported by both the client and the server |
 | `packages/mcp` | `@docmost/mcp` | MCP SDK, Tiptap, Yjs | Standalone MCP server, also bundled into the server at `/mcp`. Consumes the shared converter/schema from `@docmost/prosemirror-markdown` (#293) — it no longer carries its own vendored converter/schema copy |
-| `packages/prosemirror-markdown` | `@docmost/prosemirror-markdown` | Tiptap, marked, jsdom | The single, canonical ProseMirror↔Markdown converter + Docmost schema mirror (#293). Consumed by `mcp`, `git-sync`, AND `apps/server` (server-side markdown import/export, #345); there is exactly ONE copy of the converter now |
+| `packages/prosemirror-markdown` | `@docmost/prosemirror-markdown` | Tiptap, marked, jsdom | The single, canonical ProseMirror↔Markdown converter + Docmost schema mirror (#293). Consumed by `mcp` and `git-sync`; there is exactly ONE copy of the converter now |
 
 `build` targets are Nx-cached and dependency-ordered (`dependsOn: ["^build"]`), so `editor-ext` builds before the apps. `nx.json` sets `affected.defaultBase: main`.
 
@@ -279,12 +279,11 @@ The API server is a Fastify app with a global `/api` prefix (`main.ts` excludes
    - `core/ai-chat/tools/` — the agent's ~40 read+write tools. Every tool runs under the **calling user's** CASL permissions via a per-user loopback access token (`docmost-client.loader.ts`), so the agent can never exceed what the user could do. Only **reversible** operations are exposed (page history + trash; no permanent delete). Agent edits get an "AI agent" provenance badge in page history (`20260616T130000-agent-provenance` migration).
    - `core/ai-chat/embedding/` — RAG indexer + a BullMQ consumer on `AI_QUEUE` that embeds pages into `page_embeddings` (vector search), complementing Postgres full-text search. Pages are (re)indexed on edit; `AI_EMBEDDING_TIMEOUT_MS` bounds a hung embeddings endpoint.
    - `core/ai-chat/external-mcp/` — admins can attach external MCP servers (e.g. Tavily) to give the agent web access. **`ssrf-guard.ts` validates outbound MCP URLs against SSRF** — keep that guard in the path when touching external-MCP connection logic.
-   - `core/ai-chat/ai-chat-run.service.ts` + `ai_chat_runs` — **detached/autonomous agent runs** (`#184`), behind the per-workspace `settings.ai.autonomousRuns` flag (off by default). When on, a turn becomes a server-side RUN that survives a browser disconnect; only an explicit `POST /ai-chat/stop` ends it, and a client reconnects/live-follows via `POST /ai-chat/run`. **DEPLOY CONSTRAINT — single-instance only in phase 1:** Stop and the AbortController that backs it are process-local, so a Stop only aborts a run executing on the **same** replica that owns it (cross-instance pub/sub stop is phase 2). Do **not** enable `autonomousRuns` on a horizontally-scaled deployment (multiple replicas behind a load balancer, or Docmost cloud `CLOUD=true`) — run a single instance instead. The server logs a startup WARNING when it detects a multi-instance deployment (`CLOUD=true`) so the constraint is visible. The startup sweep settles any run left dangling by a restart.
 
 ### Client structure
 Vite SPA. Code is organized by feature under `apps/client/src/features/*` (mirrors the server domains: `page`, `space`, `comment`, `ai-chat`, `editor`, …). Conventions:
 - **TanStack Query** for server state (one `queries/` file per feature), **Jotai** atoms for local/shared UI state, **Mantine 8** + CSS modules (`*.module.css`) + `postcss-preset-mantine` for UI.
-- The editor is Tiptap; shared node/mark extensions live in `packages/editor-ext` and are imported by **both the client and the server** (collaboration, schema, `canonicalizeFootnotes`) — editor schema changes often need to be made in `editor-ext`, not just the client. Server-side markdown import/export no longer lives in `editor-ext`: it goes through the canonical converter (#345, see below). The ProseMirror↔Markdown converter and its Docmost schema mirror now live in a SINGLE package, `@docmost/prosemirror-markdown` (#293), consumed by `mcp`, `git-sync`, and `apps/server` (#345) — do NOT reintroduce a per-package copy. `editor-ext` is the upstream source of the Tiptap schema; the package's `docmost-schema.ts` mirrors it and a serializer-contract test (`packages/prosemirror-markdown/test/serializer-contract.test.ts`) guards the boundary (every schema node must have a converter case), so a drift surfaces as a failing test rather than silent divergence.
+- The editor is Tiptap; shared node/mark extensions live in `packages/editor-ext` and are imported by **both the client and the server** (collaboration, import/export) — editor schema changes often need to be made in `editor-ext`, not just the client. The ProseMirror↔Markdown converter and its Docmost schema mirror now live in a SINGLE package, `@docmost/prosemirror-markdown` (#293), consumed by both `mcp` and `git-sync` — do NOT reintroduce a per-package copy. `editor-ext` is the upstream source of the Tiptap schema; the package's `docmost-schema.ts` mirrors it and a serializer-contract test (`packages/prosemirror-markdown/test/serializer-contract.test.ts`) guards the boundary (every schema node must have a converter case), so a drift surfaces as a failing test rather than silent divergence.
 - API access goes through `apps/client/src/lib/api-client.ts` (axios). The `@` alias maps to `apps/client/src`.
 - Runtime config is injected at build time by `vite.config.ts` via `define` (`APP_URL`, `COLLAB_URL`, `APP_VERSION`, …) — these come from the root `.env`, not from `import.meta.env`.
 

CHANGELOG.md

@@ -72,19 +72,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   append/prepend fragments, nor to COMMENT bodies — a comment may legitimately
   contain a standalone footnote definition, which canonicalization would drop.
   (#228)
-- **Detached, autonomous agent runs that survive a browser disconnect.** When the
-  new `settings.ai.autonomousRuns` workspace flag is on (off by default), an
-  AI-chat turn becomes a first-class, server-side RUN tracked in a new
-  `ai_chat_runs` table instead of a socket-bound stream: closing the tab or
-  losing the connection no longer aborts the turn — it keeps executing and
-  persisting server-side, and only an explicit Stop ends it. A client can
-  reconnect and live-follow (or stop) an in-flight run via `POST /ai-chat/run`
-  (resolve the latest run + its assistant message for a chat) and
-  `POST /ai-chat/stop` (stop by `runId` or `chatId`). A partial unique index
-  enforces one active run per chat, and a startup sweep settles any run left
-  dangling by a restart. Phase 1 is single-instance-only (cross-instance Stop is
-  not yet reliable); the server warns at startup on a horizontally-scaled
-  deployment. (#184)
 - **Out-of-band page transfer via an in-RAM blob sandbox (`stash_page`).** A
   new MCP tool serializes a whole page (its full ProseMirror JSON, with every
   internal image/file mirrored) into an ephemeral in-RAM blob and returns only

Dockerfile

@@ -5,13 +5,6 @@ RUN npm install -g pnpm@10.4.0
 
 FROM base AS builder
 
-# re2 (packages/mcp) always compiles from source under pnpm (the prebuilt-binary
-# download cannot identify the GitHub repo), so node-gyp needs python3/make/g++.
-# This stage is discarded, so the toolchain can stay installed.
-RUN apt-get update \
-  && apt-get install -y --no-install-recommends python3 make g++ \
-  && rm -rf /var/lib/apt/lists/*
-
 WORKDIR /app
 
 COPY . .
@@ -64,17 +57,10 @@ COPY --from=builder /app/patches /app/patches
 
 RUN chown -R node:node /app
 
-# Toolchain is needed transiently to compile re2 during the prod install; install
-# and purge it in one layer to keep the final image slim. The install itself runs
-# as the node user via su to keep node_modules ownership without a costly chown layer.
-RUN apt-get update \
-  && apt-get install -y --no-install-recommends python3 make g++ \
-  && su node -c "pnpm install --frozen-lockfile --prod" \
-  && apt-get purge -y --auto-remove python3 make g++ \
-  && rm -rf /var/lib/apt/lists/*
-
 USER node
 
+RUN pnpm install --frozen-lockfile --prod
+
 RUN mkdir -p /app/data/storage
 
 VOLUME ["/app/data/storage"]

apps/client/package.json

@@ -13,6 +13,7 @@
   },
   "dependencies": {
     "@ai-sdk/react": "^3.0.208",
+    "@braintree/sanitize-url": "7.1.2",
     "@atlaskit/pragmatic-drag-and-drop": "1.8.1",
     "@atlaskit/pragmatic-drag-and-drop-auto-scroll": "2.1.5",
     "@atlaskit/pragmatic-drag-and-drop-flourish": "2.0.15",
@@ -61,7 +62,6 @@
     "react-clear-modal": "^2.0.18",
     "react-dom": "^18.3.1",
     "react-drawio": "1.0.7",
-    "web-vitals": "^5.1.0",
     "react-error-boundary": "6.1.1",
     "react-helmet-async": "3.0.0",
     "react-i18next": "16.5.8",

apps/client/src/App.tsx

@@ -1,38 +1,72 @@
+import { lazy, Suspense } from "react";
 import { Navigate, Route, Routes } from "react-router-dom";
+import { Center, Loader } from "@mantine/core";
+import { Error404 } from "@/components/ui/error-404.tsx";
+import Layout from "@/components/layouts/global/layout.tsx";
+import { useTrackOrigin } from "@/hooks/use-track-origin";
+
+// ShareLayout is route-split: its ShareShell chrome pulls in the table of
+// contents (and thus TipTap), so keeping it out of the eager graph removes the
+// editor engine from startup for authenticated users too.
+const ShareLayout = lazy(
+  () => import("@/features/share/components/share-layout.tsx"),
+);
+
+// Auth / entry pages stay eager: they are the first paint for an unauthenticated
+// visitor (e.g. /login) and are already small, so code-splitting them would only
+// add a cold-chunk round trip to the most common cold-start path.
 import SetupWorkspace from "@/pages/auth/setup-workspace.tsx";
 import LoginPage from "@/pages/auth/login";
-import Home from "@/pages/dashboard/home";
-import Page from "@/pages/page/page";
-import AccountSettings from "@/pages/settings/account/account-settings";
-import WorkspaceMembers from "@/pages/settings/workspace/workspace-members";
-import WorkspaceSettings from "@/pages/settings/workspace/workspace-settings";
-import AiSettings from "@/pages/settings/workspace/ai-settings";
-import Groups from "@/pages/settings/group/groups";
-import GroupInfo from "./pages/settings/group/group-info";
-import Spaces from "@/pages/settings/space/spaces.tsx";
-import { Error404 } from "@/components/ui/error-404.tsx";
-import AccountPreferences from "@/pages/settings/account/account-preferences.tsx";
-import SpaceHome from "@/pages/space/space-home.tsx";
-import PageRedirect from "@/pages/page/page-redirect.tsx";
-import Layout from "@/components/layouts/global/layout.tsx";
 import InviteSignup from "@/pages/auth/invite-signup.tsx";
 import ForgotPassword from "@/pages/auth/forgot-password.tsx";
 import PasswordReset from "./pages/auth/password-reset";
-import SharedPage from "@/pages/share/shared-page.tsx";
+import PageRedirect from "@/pages/page/page-redirect.tsx";
-import Shares from "@/pages/settings/shares/shares.tsx";
-import ShareLayout from "@/features/share/components/share-layout.tsx";
 import ShareRedirect from "@/pages/share/share-redirect.tsx";
-import { useTrackOrigin } from "@/hooks/use-track-origin";
+
-import SpacesPage from "@/pages/spaces/spaces.tsx";
+// Heavy / leaf pages are route-split with React.lazy so their code (most
-import SpaceTrash from "@/pages/space/space-trash.tsx";
+// importantly the whole TipTap editor + KaTeX + lowlight grammars + drawio that
-import FavoritesPage from "@/pages/favorites/favorites-page";
+// the page editor and the readonly share editor pull in) is fetched only when
-import LabelPage from "@/pages/label/label-page";
+// the matching route is actually visited. The <Suspense> boundaries live inside
+// each Layout (around its <Outlet/>), so the app shell stays mounted while a
+// route chunk loads.
+const Home = lazy(() => import("@/pages/dashboard/home"));
+const Page = lazy(() => import("@/pages/page/page"));
+const SpaceHome = lazy(() => import("@/pages/space/space-home.tsx"));
+const SpaceTrash = lazy(() => import("@/pages/space/space-trash.tsx"));
+const SpacesPage = lazy(() => import("@/pages/spaces/spaces.tsx"));
+const FavoritesPage = lazy(() => import("@/pages/favorites/favorites-page"));
+const LabelPage = lazy(() => import("@/pages/label/label-page"));
+const SharedPage = lazy(() => import("@/pages/share/shared-page.tsx"));
+
+const AccountSettings = lazy(
+  () => import("@/pages/settings/account/account-settings"),
+);
+const AccountPreferences = lazy(
+  () => import("@/pages/settings/account/account-preferences.tsx"),
+);
+const WorkspaceSettings = lazy(
+  () => import("@/pages/settings/workspace/workspace-settings"),
+);
+const AiSettings = lazy(() => import("@/pages/settings/workspace/ai-settings"));
+const WorkspaceMembers = lazy(
+  () => import("@/pages/settings/workspace/workspace-members"),
+);
+const Groups = lazy(() => import("@/pages/settings/group/groups"));
+const GroupInfo = lazy(() => import("./pages/settings/group/group-info"));
+const Spaces = lazy(() => import("@/pages/settings/space/spaces.tsx"));
+const Shares = lazy(() => import("@/pages/settings/shares/shares.tsx"));
 
 export default function App() {
   useTrackOrigin();
 
   return (
-    <>
+    <Suspense
+      fallback={
+        <Center h="100vh">
+          <Loader size="sm" />
+        </Center>
+      }
+    >
       <Routes>
         <Route index element={<Navigate to="/home" />} />
         <Route path={"/login"} element={<LoginPage />} />
@@ -83,6 +117,6 @@ export default function App() {
 
         <Route path="*" element={<Error404 />} />
       </Routes>
-    </>
+    </Suspense>
   );
 }

apps/client/src/components/chunk-load-error-boundary.test.ts

@@ -0,0 +1,37 @@
+import { describe, it, expect } from "vitest";
+import { isChunkLoadError } from "./chunk-load-error-boundary";
+
+// The detector decides whether a caught render error is a stale-deploy chunk-404
+// (→ auto-reload to fetch the new manifest) vs a genuine app error (→ generic
+// recovery UI, no reload). A false negative on a real chunk failure re-blanks the
+// app; a false positive would auto-reload on an ordinary error. Pin both sides.
+describe("isChunkLoadError", () => {
+  it("detects the ChunkLoadError name", () => {
+    expect(isChunkLoadError({ name: "ChunkLoadError", message: "x" })).toBe(true);
+  });
+
+  it.each([
+    "Failed to fetch dynamically imported module: https://x/assets/index-abc.js",
+    "error loading dynamically imported module",
+    "Importing a module script failed.",
+  ])("detects the dynamic-import failure message %#", (message) => {
+    expect(isChunkLoadError({ name: "TypeError", message })).toBe(true);
+  });
+
+  it("is case-insensitive on the message", () => {
+    expect(
+      isChunkLoadError({ message: "FAILED TO FETCH DYNAMICALLY IMPORTED MODULE" }),
+    ).toBe(true);
+  });
+
+  it.each([
+    null,
+    undefined,
+    {},
+    { name: "TypeError", message: "Cannot read properties of undefined" },
+    { message: "Network request failed" },
+    new Error("some ordinary render error"),
+  ])("returns false for a non-chunk error %#", (err) => {
+    expect(isChunkLoadError(err)).toBe(false);
+  });
+});

apps/client/src/components/chunk-load-error-boundary.tsx

@@ -0,0 +1,71 @@
+import { ReactNode } from "react";
+import { ErrorBoundary } from "react-error-boundary";
+import { Button, Center, Stack, Text } from "@mantine/core";
+
+const RELOAD_FLAG = "chunk-reload-attempted";
+
+// Heuristic detection of a failed dynamic import. Since the code-splitting work,
+// every route (plus Aside / AiChatWindow) is React.lazy: when a new deploy
+// replaces the hashed chunks, a tab left open on the old index.html requests a
+// chunk URL that now 404s, and React.lazy rejects. Browsers / Vite surface these
+// with a ChunkLoadError name or one of these messages.
+export function isChunkLoadError(error: unknown): boolean {
+  if (!error) return false;
+  const name = (error as { name?: string }).name ?? "";
+  const message = (error as { message?: string }).message ?? "";
+  return (
+    name === "ChunkLoadError" ||
+    /Failed to fetch dynamically imported module/i.test(message) ||
+    /error loading dynamically imported module/i.test(message) ||
+    /Importing a module script failed/i.test(message)
+  );
+}
+
+function handleError(error: unknown) {
+  if (!isChunkLoadError(error)) return;
+  // A stale-chunk 404 is cured by a full reload that re-fetches index.html and
+  // the new chunk manifest. Auto-reload once, guarding against a reload loop
+  // (e.g. a genuinely missing chunk) with a one-shot sessionStorage flag. If the
+  // flag is already set we fall through to the manual recovery UI below.
+  try {
+    if (sessionStorage.getItem(RELOAD_FLAG)) return;
+    sessionStorage.setItem(RELOAD_FLAG, "1");
+  } catch {
+    // sessionStorage unavailable (private mode / disabled): skip the automatic
+    // reload rather than risk an unguarded loop; the fallback UI still recovers.
+    return;
+  }
+  window.location.reload();
+}
+
+// Root-level boundary that sits ABOVE every route-level Suspense boundary so a
+// lazy route/component chunk failure is caught here instead of unmounting the
+// whole tree into a blank white screen. Per-feature ErrorBoundaries (page.tsx,
+// transclusion, page-embed) remain in place underneath for their local errors.
+export function ChunkLoadErrorBoundary({ children }: { children: ReactNode }) {
+  return (
+    <ErrorBoundary
+      onError={handleError}
+      fallbackRender={({ error }) => {
+        const chunk = isChunkLoadError(error);
+        return (
+          <Center h="100vh" p="md">
+            <Stack align="center" gap="sm" maw={420}>
+              <Text fw={600}>
+                {chunk ? "A new version is available" : "Something went wrong"}
+              </Text>
+              <Text size="sm" c="dimmed" ta="center">
+                {chunk
+                  ? "Please reload the page to load the latest version."
+                  : "An unexpected error occurred. Reloading the page may help."}
+              </Text>
+              <Button onClick={() => window.location.reload()}>Reload</Button>
+            </Stack>
+          </Center>
+        );
+      }}
+    >
+      {children}
+    </ErrorBoundary>
+  );
+}

apps/client/src/components/layouts/global/global-app-shell.tsx

@@ -1,9 +1,10 @@
 import { AppShell, Container } from "@mantine/core";
-import React, { useEffect, useRef, useState } from "react";
+import React, { Suspense, useEffect, useRef, useState } from "react";
 import { useLocation } from "react-router-dom";
 import { useTranslation } from "react-i18next";
 import SettingsSidebar from "@/components/settings/settings-sidebar.tsx";
-import { useAtom } from "jotai";
+import { useAtom, useAtomValue } from "jotai";
+import { aiChatWindowOpenAtom } from "@/features/ai-chat/atoms/ai-chat-atom.ts";
 import {
   APP_NAVBAR_ID,
   NAVBAR_COLLAPSE_BREAKPOINT,
@@ -14,8 +15,6 @@ import {
 } from "@/components/layouts/global/hooks/atoms/sidebar-atom.ts";
 import { SpaceSidebar } from "@/features/space/components/sidebar/space-sidebar.tsx";
 import { AppHeader } from "@/components/layouts/global/app-header.tsx";
-import Aside from "@/components/layouts/global/aside.tsx";
-import AiChatWindow from "@/features/ai-chat/components/ai-chat-window.tsx";
 import GitmostGlobalBridge from "@/features/editor/gitmost/gitmost-global-bridge.tsx";
 import classes from "./app-shell.module.css";
 import { useToggleSidebar } from "@/components/layouts/global/hooks/hooks/use-toggle-sidebar.ts";
@@ -23,6 +22,21 @@ import GlobalSidebar from "@/components/layouts/global/global-sidebar.tsx";
 import { ASIDE_PANEL_ID } from "@/hooks/use-toggle-aside.tsx";
 import { MAIN_CONTENT_ID, SkipToMain } from "@/components/ui/skip-to-main.tsx";
 
+// Lazily load the AI chat window so the AI SDK runtime it pulls in is fetched
+// only after the user first opens the chat, instead of for every authenticated
+// user on load. The window itself renders null while closed, so there is no
+// behavior difference — it simply is not mounted until first opened.
+const AiChatWindow = React.lazy(
+  () => import("@/features/ai-chat/components/ai-chat-window.tsx"),
+);
+
+// The right aside hosts the comment panel and table of contents, both of which
+// pull in TipTap. It only ever renders on page routes, so lazy-loading it keeps
+// the whole editor engine out of the eager global-shell startup graph.
+const Aside = React.lazy(
+  () => import("@/components/layouts/global/aside.tsx"),
+);
+
 export default function GlobalAppShell({
   children,
 }: {
@@ -37,6 +51,15 @@ export default function GlobalAppShell({
   const [isResizing, setIsResizing] = useState(false);
   const sidebarRef = useRef(null);
 
+  // Latch: once the AI chat window has been opened, keep it mounted so an
+  // in-flight stream is never torn down. Before the first open the AI chat chunk
+  // is never fetched.
+  const aiChatOpen = useAtomValue(aiChatWindowOpenAtom);
+  const [aiChatEverOpened, setAiChatEverOpened] = useState(false);
+  useEffect(() => {
+    if (aiChatOpen) setAiChatEverOpened(true);
+  }, [aiChatOpen]);
+
   const startResizing = React.useCallback((mouseDownEvent) => {
     mouseDownEvent.preventDefault();
     setIsResizing(true);
@@ -160,13 +183,21 @@ export default function GlobalAppShell({
                   : undefined
           }
         >
-          <Aside />
+          <Suspense fallback={null}>
+            <Aside />
+          </Suspense>
         </AppShell.Aside>
       )}
     </AppShell>
-    {/* Floating AI chat window. Mounted once globally; it is position: fixed
+    {/* Floating AI chat window. Mounted once globally on first open; it is
-        and self-hides when closed, so its place in the tree is not critical. */}
+        position: fixed and self-hides when closed, so its place in the tree is
-    <AiChatWindow />
+        not critical. Kept mounted after the first open so a live stream is not
+        aborted. */}
+    {aiChatEverOpened && (
+      <Suspense fallback={null}>
+        <AiChatWindow />
+      </Suspense>
+    )}
       {/* Global gitmost native bridge: registers listSpaces / listPages /
           createPageWithRecording on window.gitmost so the native host can
           create a page with a recording even when no page editor is open. */}

apps/client/src/components/layouts/global/layout.tsx

@@ -1,5 +1,7 @@
+import { Suspense, useEffect } from "react";
 import { UserProvider } from "@/features/user/user-provider.tsx";
 import { Outlet, useParams } from "react-router-dom";
+import { Center, Loader } from "@mantine/core";
 import GlobalAppShell from "@/components/layouts/global/global-app-shell.tsx";
 import { SearchSpotlight } from "@/features/search/components/search-spotlight.tsx";
 import { useGetSpaceBySlugQuery } from "@/features/space/queries/space-query.ts";
@@ -8,10 +10,39 @@ export default function Layout() {
   const { spaceSlug } = useParams();
   const { data: space } = useGetSpaceBySlugQuery(spaceSlug);
 
+  // Warm the (now route-split) editor chunk during idle time on authenticated
+  // routes, so the first navigation to a page renders from cache instead of a
+  // cold chunk fetch. Best-effort: gated on requestIdleCallback and never blocks
+  // startup — the dynamic import mirrors the App.tsx route lazy loader so both
+  // resolve to the same chunk.
+  useEffect(() => {
+    const ric =
+      typeof window !== "undefined" && (window as any).requestIdleCallback;
+    const warm = () => {
+      // Best-effort prefetch: a failed warm-up (offline, stale 404) is harmless
+      // and must not surface as an unhandledrejection.
+      void import("@/pages/page/page").catch(() => {});
+    };
+    if (ric) {
+      const id = ric(warm);
+      return () => (window as any).cancelIdleCallback?.(id);
+    }
+    const timer = setTimeout(warm, 2000);
+    return () => clearTimeout(timer);
+  }, []);
+
   return (
     <UserProvider>
       <GlobalAppShell>
-        <Outlet />
+        <Suspense
+          fallback={
+            <Center h="60vh">
+              <Loader size="sm" />
+            </Center>
+          }
+        >
+          <Outlet />
+        </Suspense>
       </GlobalAppShell>
       <SearchSpotlight spaceId={space?.id} />
     </UserProvider>

apps/client/src/features/ai-chat/components/ai-chat-window.tsx

@@ -19,7 +19,7 @@ import {
   IconPlus,
   IconX,
 } from "@tabler/icons-react";
-import { useAtom, useAtomValue, useSetAtom } from "jotai";
+import { useAtom, useSetAtom } from "jotai";
 import { useLocation, useMatch } from "react-router-dom";
 import { useTranslation } from "react-i18next";
 import { useQueryClient } from "@tanstack/react-query";
@@ -41,24 +41,13 @@ import { extractPageSlugId } from "@/lib";
 import {
   AI_CHATS_RQ_KEY,
   AI_CHAT_MESSAGES_RQ_KEY,
-  AI_CHAT_RUN_RQ_KEY,
   useAiChatMessagesQuery,
-  useAiChatRunQuery,
   useAiChatsQuery,
   useAiRolesQuery,
 } from "@/features/ai-chat/queries/ai-chat-query.ts";
-import {
-  shouldClearLatchOnQueryError,
-  shouldClearStoppingLatch,
-  shouldObserveRun,
-} from "@/features/ai-chat/utils/run-polling.ts";
-import { workspaceAtom } from "@/features/user/atoms/current-user-atom";
 import ConversationList from "@/features/ai-chat/components/conversation-list.tsx";
 import ChatThread from "@/features/ai-chat/components/chat-thread.tsx";
-import {
+import { exportAiChat } from "@/features/ai-chat/services/ai-chat-service.ts";
-  exportAiChat,
-  stopRun,
-} from "@/features/ai-chat/services/ai-chat-service.ts";
 import { useChatSession } from "@/features/ai-chat/hooks/use-chat-session.ts";
 import {
   shouldCollapseOnOutsidePointer,
@@ -245,147 +234,6 @@ export default function AiChatWindow() {
   const { data: messageRows, isLoading: messagesLoading } =
     useAiChatMessagesQuery(activeChatId ?? undefined);
 
-  // #184 reconnect-and-live-follow. Whether detached agent runs are enabled for
-  // this workspace. The reconnect endpoint itself is NOT flag-gated server-side
-  // (it is only owner-gated and returns `{ run: null }` when the chat has no
-  // run); but when the feature is off no runs are ever created, so polling it
-  // would always come back empty — we gate it off here to avoid pointless polls.
-  const workspace = useAtomValue(workspaceAtom);
-  const autonomousRunsEnabled =
-    workspace?.settings?.ai?.autonomousRuns === true;
-
-  // Whether THIS tab is the one actively streaming the open chat's run locally
-  // (it started the run here and holds the SSE). Reported up from ChatThread. We
-  // are the STREAMER while true and a passive OBSERVER while false — the basis of
-  // the observer-vs-streamer detection. Reset to false by the fresh ChatThread's
-  // mount effect on every chat switch.
-  const [localStreaming, setLocalStreaming] = useState(false);
-  const onStreamingChange = useCallback((streaming: boolean) => {
-    setLocalStreaming(streaming);
-  }, []);
-
-  // #184 Stop wiring. While a detached run is being stopped we SUPPRESS the
-  // observer merge so the stopping run's still-persisting output does not
-  // re-stream back into view between the moment the user pressed Stop and the run
-  // actually settling as 'aborted' server-side. Polling itself keeps running (so
-  // the terminal transition is still detected) — only the visual merge is gated.
-  // Cleared when the run is observed terminal (below) or the chat is switched.
-  const [stoppingRun, setStoppingRun] = useState(false);
-  // Reset the stopping latch whenever the open chat changes: it is scoped to the
-  // run of the previously-open chat.
-  useEffect(() => {
-    setStoppingRun(false);
-  }, [activeChatId]);
-
-  // Authoritative stop of the open chat's detached run (the Stop button in
-  // autonomous mode). Latch "stopping" first (suppresses the re-stream flash),
-  // then request the server stop — the ONLY thing that ends a detached run; a mere
-  // local SSE abort is a client disconnect the server ignores. On failure we
-  // release the latch so the observer resumes (better to show the live run than to
-  // freeze the view) and surface the error.
-  const handleServerStop = useCallback(
-    (chatId: string): void => {
-      setStoppingRun(true);
-      // #234 F4: drop the PREVIOUS turn's run from the cache so `run` becomes null
-      // until the CURRENT turn's run is fetched fresh. Without this, once the local
-      // stream aborts (localStreaming -> false) the run query re-enables and
-      // react-query SYNCHRONOUSLY returns the still-cached prior terminal run; the
-      // terminal effect would then clear the stopping latch against that STALE run
-      // before the current turn's (still-running, detached, growing) run is ever
-      // observed — re-opening the observer merge and flashing the growing output
-      // over the frozen row. With the cache cleared the terminal effect's
-      // `if (!run) return` holds the latch until the current run itself is observed
-      // terminal (see shouldClearStoppingLatch).
-      queryClient.removeQueries({ queryKey: AI_CHAT_RUN_RQ_KEY(chatId) });
-      void stopRun(chatId).catch(() => {
-        setStoppingRun(false);
-        notifications.show({
-          message: t("Failed to stop the run"),
-          color: "red",
-        });
-      });
-    },
-    [t, queryClient],
-  );
-
-  // Poll the latest run of the open chat ONLY when we are a passive observer:
-  // feature on, a chat is open, and we are NOT the local streamer (the streamer
-  // already has the live SSE — polling/merging too would double-render). The
-  // query's own status-keyed refetchInterval stops once the run is terminal.
-  const { data: runData, isError: runQueryFailed } = useAiChatRunQuery(
-    activeChatId ?? undefined,
-    autonomousRunsEnabled && !localStreaming,
-  );
-  const run = runData?.run ?? null;
-
-  // Safety net (#234 F4 review): after handleServerStop clears the run cache,
-  // `run` is null until the current turn's run is fetched fresh, and the terminal
-  // effect below holds the latch via `if (!run) return`. If that refetch instead
-  // ERRORS PERMANENTLY (the GET-run keeps failing) while we are no longer the
-  // streamer, the run stays null, its status-keyed refetchInterval is off, and
-  // nothing would ever observe a terminal run — freezing the view with the
-  // observer merge suppressed. Release the latch on that error so the live view
-  // resumes rather than stays stuck (the local stopRun may already have succeeded
-  // independently).
-  //
-  // #234 F7: this must NOT fire on a TRANSIENT error while `run` is still an
-  // ACTIVE held run. In TanStack Query v5 (retry:false) the query's `data` is
-  // RETAINED on error, so `runQueryFailed` can be true while `run` is still
-  // pending/running — releasing then would re-open the observer merge and flash
-  // the growing detached run over the frozen row (the very flash F4 prevents). The
-  // decision is the pure, unit-tested `shouldClearLatchOnQueryError`, which gates
-  // on the run NOT being active: it cures only the genuine permanent-null-freeze
-  // (`run === null`) and never releases against an active run.
-  useEffect(() => {
-    if (
-      shouldClearLatchOnQueryError({
-        stoppingRun,
-        isLocalStreaming: localStreaming,
-        runQueryFailed,
-        run,
-      })
-    )
-      setStoppingRun(false);
-  }, [stoppingRun, localStreaming, runQueryFailed, run]);
-  // The run's incrementally-persisted assistant message to merge into the thread,
-  // but only while we are an observer (never when we are the streamer — guards
-  // against a stale poll fighting the live stream). Includes a terminal run so the
-  // final persisted output is shown on reopen.
-  const observedRow =
-    shouldObserveRun(run, localStreaming) && !stoppingRun
-      ? (runData?.message ?? null)
-      : null;
-
-  // When the observed run reaches a terminal status, do a final messages refetch
-  // so the persisted final state (token/context badge, export source) is shown,
-  // then the query's refetchInterval has already stopped polling. Deduped per run
-  // id so it fires exactly once per run, not on every subsequent poll-less render.
-  const finalizedRunIdRef = useRef<string | null>(null);
-  useEffect(() => {
-    if (!run || !activeChatId) return;
-    if (run.status === "pending" || run.status === "running") {
-      // Active again (a new run) — re-arm so its terminal transition fires once.
-      finalizedRunIdRef.current = null;
-      return;
-    }
-    // Terminal: a stop we requested has landed (or the run finished on its own),
-    // so release the stopping latch — the observer merge can now show the final
-    // persisted (aborted/finished) output without any live re-stream. The decision
-    // is the pure, unit-tested `shouldClearStoppingLatch` (run-polling.ts): release
-    // ONLY when we requested a stop, this tab is no longer the streamer, AND the
-    // CURRENT run is terminal. The #234 F4 cache removal in handleServerStop makes
-    // `run` null (this branch's `if (!run) return` above holds) until the current
-    // turn's run is fetched fresh, so the latch can never clear against a stale
-    // cached run.
-    if (shouldClearStoppingLatch({ stoppingRun, run, isLocalStreaming: localStreaming }))
-      setStoppingRun(false);
-    if (finalizedRunIdRef.current === run.id) return;
-    finalizedRunIdRef.current = run.id;
-    queryClient.invalidateQueries({
-      queryKey: AI_CHAT_MESSAGES_RQ_KEY(activeChatId),
-    });
-  }, [run, activeChatId, queryClient, stoppingRun, localStreaming]);
-
   // The page the user is currently viewing. AiChatWindow lives in a pathless
   // parent layout route, so useParams() can't see :pageSlug. Match the full
   // pathname against the authenticated page route instead so "the current page"
@@ -1034,18 +882,6 @@ export default function AiChatWindow() {
               assistantName={currentRole?.name}
               onTurnFinished={onTurnFinished}
               onServerChatId={onServerChatId}
-              // #184: live-follow a still-running run when we reopened the chat as
-              // a passive observer; null when there is nothing to observe or this
-              // tab is the streamer. onStreamingChange lets the window stop polling
-              // while we are the streamer.
-              observedRow={observedRow}
-              onStreamingChange={onStreamingChange}
-              // #184: in autonomous mode the Stop button must hit the authoritative
-              // server stop (a local SSE abort is a client disconnect the server
-              // ignores). onServerStop also arms the "stopping" latch above so the
-              // stopped run's output does not re-stream via the observer merge.
-              autonomousRunsEnabled={autonomousRunsEnabled}
-              onServerStop={handleServerStop}
             />
           )}
         </div>

apps/client/src/features/ai-chat/components/chat-thread.test.tsx

@@ -11,7 +11,6 @@ const h = vi.hoisted(() => ({
     onFinish: null as null | ((arg: Record<string, unknown>) => void),
     sendMessage: vi.fn(),
     stop: vi.fn(),
-    setMessages: vi.fn(),
     transport: null as null | {
       prepareSendMessagesRequest: (arg: {
         messages: unknown[];
@@ -31,8 +30,6 @@ vi.mock("@ai-sdk/react", () => ({
       status: h.state.status,
       stop: h.state.stop,
       error: null,
-      // #184: ChatThread reads setMessages to merge a polled observer run.
-      setMessages: h.state.setMessages,
     };
   },
 }));
@@ -231,56 +228,3 @@ describe("ChatThread — turn-end decision (onFinish)", () => {
     }
   });
 });
-
-// #184 passive-observer merge: when reconnecting to a still-running run, the
-// parent feeds the polled run message via `observedRow`; ChatThread merges it via
-// setMessages — but ONLY when this tab is NOT itself streaming (the streamer's
-// SSE owns the view, so a stale observedRow must never overwrite it).
-describe("ChatThread — observer run merge (#184)", () => {
-  beforeEach(() => {
-    h.state.onFinish = null;
-    h.state.setMessages.mockReset();
-  });
-
-  const observedRow = {
-    id: "a-run",
-    role: "assistant",
-    content: "step 1\nstep 2",
-    metadata: {
-      parts: [{ type: "text", text: "step 1\nstep 2" }],
-    },
-    createdAt: "2026-01-01T00:00:00Z",
-  } as const;
-
-  function renderObserver(status: string) {
-    h.state.status = status;
-    render(
-      <MantineProvider>
-        <ChatThread
-          chatId="c1"
-          initialRows={[]}
-          onTurnFinished={vi.fn()}
-          observedRow={observedRow as never}
-        />
-      </MantineProvider>,
-    );
-  }
-
-  it("merges the polled run message when this tab is a passive observer", () => {
-    renderObserver("ready");
-    expect(h.state.setMessages).toHaveBeenCalledTimes(1);
-    // The updater replaces/append the observed assistant row by id.
-    const updater = h.state.setMessages.mock.calls[0][0] as (
-      prev: { id: string; parts: { text: string }[] }[],
-    ) => { id: string; parts: { text: string }[] }[];
-    const merged = updater([{ id: "u1", parts: [{ text: "hi" }] }]);
-    expect(merged).toHaveLength(2);
-    expect(merged[1].id).toBe("a-run");
-    expect(merged[1].parts[0].text).toBe("step 1\nstep 2");
-  });
-
-  it("does NOT merge while THIS tab is the streamer (no double-render)", () => {
-    renderObserver("streaming");
-    expect(h.state.setMessages).not.toHaveBeenCalled();
-  });
-});

apps/client/src/features/ai-chat/components/chat-thread.tsx

@@ -24,7 +24,6 @@ import {
 } from "@/features/ai-chat/utils/role-launch.ts";
 import { describeChatError } from "@/features/ai-chat/utils/error-message.ts";
 import { extractServerChatId } from "@/features/ai-chat/utils/adopt-chat-id.ts";
-import { mergeObservedMessage } from "@/features/ai-chat/utils/run-polling.ts";
 import {
   dequeue,
   enqueueMessage,
@@ -87,29 +86,6 @@ interface ChatThreadProps {
    *  Copy/export button available mid-stream). Distinct from onTurnFinished,
    *  which fires only at the terminal outcome. */
   onServerChatId?: (serverChatId?: string) => void;
-  /** #184 reconnect-and-live-follow. When THIS tab reopened a chat whose agent
-   *  run is still going (it is a PASSIVE OBSERVER — it did not start the run here),
-   *  the parent polls the reconnect endpoint and feeds the run's incrementally-
-   *  persisted assistant message here; we merge it into the live list so new
-   *  steps/tool-calls appear as they are persisted. Null when there is nothing to
-   *  observe (no run, feature off, or this tab IS the streamer). The merge is
-   *  ADDITIONALLY guarded by our own `isStreaming`, so a stale value can never
-   *  fight the local stream when we are the streamer. */
-  observedRow?: IAiChatMessageRow | null;
-  /** Report this tab's live streaming status up to the parent, so it can stop
-   *  polling the run while WE are the active streamer (the SSE owns the view) and
-   *  resume once we go idle. Called from an effect on every transition. */
-  onStreamingChange?: (streaming: boolean) => void;
-  /** #184: whether detached/autonomous agent runs are enabled for this workspace.
-   *  When true the Stop button must additionally hit the AUTHORITATIVE server stop
-   *  (via onServerStop) — aborting only the local SSE is just a client disconnect,
-   *  which the server deliberately ignores, so the detached run would keep going. */
-  autonomousRunsEnabled?: boolean;
-  /** #184: request the server-side stop of this chat's active run (the parent owns
-   *  the endpoint call + the "stopping" latch that keeps observer-polling from
-   *  immediately re-streaming the stopping run's output). Called with the resolved
-   *  chat id when the user presses Stop in autonomous mode. */
-  onServerStop?: (chatId: string) => void;
 }
 
 /**
@@ -155,10 +131,6 @@ export default function ChatThread({
   assistantName,
   onTurnFinished,
   onServerChatId,
-  observedRow,
-  onStreamingChange,
-  autonomousRunsEnabled,
-  onServerStop,
 }: ChatThreadProps) {
   const { t } = useTranslation();
 
@@ -244,16 +216,6 @@ export default function ChatThread({
   const flushOnAbortRef = useRef(false);
   const interruptNextSendRef = useRef(false);
 
-  // #234 F5: the user pressed Stop while streaming a BRAND-NEW chat whose server
-  // chat id has not been adopted yet (the `start` chunk carrying it hadn't landed
-  // when Stop was pressed). A local SSE abort alone does NOT stop the DETACHED
-  // autonomous run — it keeps burning tokens and WRITING TO PAGES — so we cannot
-  // just no-op. We latch the stop as PENDING and fire the authoritative server
-  // stop the moment onServerChatId adopts the id (below). Read-and-cleared there;
-  // also defused on every new turn start so it can never fire against a later,
-  // unrelated turn's run.
-  const stopPendingRef = useRef(false);
-
   // FIFO dequeue + send the next queued message (no-op when the queue is empty).
   // Returns whether a message was actually sent, so callers can tell an empty
   // dequeue (nothing to flush) from a real send.
@@ -312,7 +274,7 @@ export default function ChatThread({
     [],
   );
 
-  const { messages, sendMessage, status, stop, error, setMessages } = useChat({
+  const { messages, sendMessage, status, stop, error } = useChat({
     // Stable per-mount key. Existing chats use their real id; new chats use a
     // generated client id (never `undefined`) so the store is NOT re-created on
     // every render mid-stream (see `chatStoreId` above).
@@ -403,14 +365,7 @@ export default function ChatThread({
       return;
     lastForwardedChatIdRef.current = serverChatId;
     onServerChatId(serverChatId);
-    // #234 F5: if Stop was pressed before the id was known, the authoritative
+  }, [messages, onServerChatId]);
-    // server stop was deferred to this adoption point — fire it now with the
-    // just-adopted id. One-shot (read-and-clear) so it can't fire twice.
-    if (stopPendingRef.current) {
-      stopPendingRef.current = false;
-      onServerStop?.(serverChatId);
-    }
-  }, [messages, onServerChatId, onServerStop]);
 
   // Live "turn was interrupted" marker for the CURRENT session. The red error
   // banner (driven by `error`) covers the error case; this covers an aborted
@@ -423,27 +378,6 @@ export default function ChatThread({
 
   const isStreaming = status === "submitted" || status === "streaming";
 
-  // #184: report our live streaming status up so the parent stops polling the run
-  // while WE are the streamer (the SSE owns the view) and resumes once we go idle.
-  // Effect (not render) so it never updates parent state during our own render;
-  // fires on mount with `false`, which also re-syncs the parent after a chat
-  // switch remounts this thread (a fresh mount is idle until the user sends).
-  useEffect(() => {
-    onStreamingChange?.(isStreaming);
-  }, [isStreaming, onStreamingChange]);
-
-  // #184 passive-observer merge: when the parent feeds a polled run message (we
-  // reopened a chat whose run is still going and did NOT start it here), merge it
-  // into the live list so new steps/tool-calls appear as they are persisted. Hard-
-  // gated by `!isStreaming`: if THIS tab is actually the streamer, the local SSE
-  // owns the view and a stale observedRow must never overwrite it. `observedRow`
-  // is a stable per-poll object, so this runs once per poll, not per render.
-  useEffect(() => {
-    if (isStreaming || !observedRow) return;
-    const observed = rowToUiMessage(observedRow);
-    setMessages((prev) => mergeObservedMessage(prev, observed));
-  }, [observedRow, isStreaming, setMessages]);
-
   // "Send now" on a queued message: interrupt the current turn and immediately
   // send THIS message, keeping the agent's partial output. Other queued messages
   // stay queued and flush normally after the new turn. Reuses the existing
@@ -475,40 +409,6 @@ export default function ChatThread({
     [setQueue, stop],
   );
 
-  // Stop the current turn. ALWAYS abort the local SSE (`stop()`) so the composer
-  // returns to idle immediately. In AUTONOMOUS mode the turn is a DETACHED run:
-  // aborting the local SSE is only a client disconnect, which the server ignores,
-  // so the run would keep executing — we ADDITIONALLY request the authoritative
-  // server-side stop (the parent owns that call + the "stopping" latch that keeps
-  // observer-polling from re-streaming the stopping run's output). The chat id is
-  // read live from chatIdRef (adopted early at the stream's `start` chunk); if it
-  // is not known yet — a brand-new chat in the first moment of its first turn —
-  // only the local abort happens (there is no server-side run handle to stop yet).
-  const handleStop = useCallback(() => {
-    stop();
-    if (!autonomousRunsEnabled) return;
-    if (chatIdRef.current) {
-      onServerStop?.(chatIdRef.current);
-    } else {
-      // #234 F5: no chat id yet (brand-new chat in the first moment of its first
-      // turn, before the `start` chunk adopted the id). Latch the stop as pending;
-      // the onServerChatId adoption effect fires the deferred server stop as soon
-      // as the id appears, so the detached run is still authoritatively stopped
-      // instead of left running by a silent local-only abort.
-      //
-      // KNOWN LIMITATION (#234 F5 review): `stop()` above has already aborted the
-      // local SSE reader. In the rare sub-window where Stop is pressed while still
-      // `submitted` (request sent, not one chunk read yet), that abort can cancel
-      // the reader BEFORE the `start` chunk is applied to `messages`, so the
-      // adoption effect never runs and this pending stop never fires. The detached
-      // run then keeps going for that turn. This is not a regression (the pre-fix
-      // behavior sent no server stop at all); closing it fully would require
-      // deferring the local abort until adoption, which is riskier and out of scope
-      // for this fix. Documented so a future change can address the abort-ordering.
-      stopPendingRef.current = true;
-    }
-  }, [stop, autonomousRunsEnabled, onServerStop]);
-
   // Clear the stopped marker as soon as a new turn begins streaming, and drop any
   // stale "Send now" interrupt flags. On the legit interrupt path both refs are
   // already consumed synchronously (onFinish + prepareSendMessagesRequest) before
@@ -520,11 +420,6 @@ export default function ChatThread({
       setStopNotice(null);
       flushOnAbortRef.current = false;
       interruptNextSendRef.current = false;
-      // #234 F5: a new turn is starting — drop any pending deferred-stop from a
-      // previous turn that never adopted an id, so it can never fire against this
-      // (or a later) unrelated turn's run. A deferred stop for the CURRENT turn is
-      // set AFTER this effect (on the Stop click), so this does not clobber it.
-      stopPendingRef.current = false;
     }
   }, [isStreaming]);
 
@@ -644,7 +539,7 @@ export default function ChatThread({
         <ChatInput
           onSend={(text) => sendMessage({ text })}
           onQueue={enqueue}
-          onStop={handleStop}
+          onStop={stop}
           isStreaming={isStreaming}
         />
       </Stack>

apps/client/src/features/ai-chat/queries/ai-chat-query.ts

@@ -12,7 +12,6 @@ import {
   deleteAiChat,
   deleteAiRole,
   getAiChatMessages,
-  getAiChatRun,
   getAiChats,
   getAiRoleCatalog,
   getAiRoleCatalogBundle,
@@ -25,7 +24,6 @@ import {
 import {
   IAiChat,
   IAiChatMessageRow,
-  IAiChatRunResponse,
   IAiRole,
   IAiRoleCatalog,
   IAiRoleCatalogBundle,
@@ -36,7 +34,6 @@ import {
   IAiRoleUpdateFromCatalogResult,
 } from "@/features/ai-chat/types/ai-chat.types.ts";
 import { IPagination } from "@/lib/types.ts";
-import { runPollInterval } from "@/features/ai-chat/utils/run-polling.ts";
 
 export const AI_CHATS_RQ_KEY = ["ai-chats"];
 export const AI_ROLES_RQ_KEY = ["ai-roles"];
@@ -54,18 +51,16 @@ export const AI_CHAT_MESSAGES_RQ_KEY = (chatId: string) => [
   "ai-chat-messages",
   chatId,
 ];
-export const AI_CHAT_RUN_RQ_KEY = (chatId: string) => ["ai-chat-run", chatId];
 
 /** Paginated list of the current user's chats (auto-loads further pages). */
 export function useAiChatsQuery() {
   const query = useInfiniteQuery({
     queryKey: AI_CHATS_RQ_KEY,
-    queryFn: ({ pageParam }) => getAiChats({ cursor: pageParam, limit: 50 }),
+    queryFn: ({ pageParam }) =>
+      getAiChats({ cursor: pageParam, limit: 50 }),
     initialPageParam: undefined as string | undefined,
     getNextPageParam: (lastPage) =>
-      lastPage.meta.hasNextPage
+      lastPage.meta.hasNextPage ? (lastPage.meta.nextCursor ?? undefined) : undefined,
-        ? (lastPage.meta.nextCursor ?? undefined)
-        : undefined,
   });
 
   const data = useMemo<IPagination<IAiChat> | undefined>(() => {
@@ -95,9 +90,7 @@ export function useAiChatMessagesQuery(chatId: string | undefined) {
       getAiChatMessages({ chatId: chatId as string, cursor: pageParam }),
     initialPageParam: undefined as string | undefined,
     getNextPageParam: (lastPage) =>
-      lastPage.meta.hasNextPage
+      lastPage.meta.hasNextPage ? (lastPage.meta.nextCursor ?? undefined) : undefined,
-        ? (lastPage.meta.nextCursor ?? undefined)
-        : undefined,
     enabled: !!chatId,
   });
 
@@ -138,34 +131,6 @@ export function useAiChatMessagesQuery(chatId: string | undefined) {
   };
 }
 
-/**
- * Reconnect to a chat's latest agent run and LIVE-FOLLOW it (#184). While the run
- * is active the query re-polls every {@link runPollInterval} ms (driven off the
- * fetched `run.status`, the same status-keyed refetchInterval pattern as the
- * embeddings reindex polling); once the run reaches a terminal status — or there
- * is no run — the interval returns `false` and polling stops on its own. Polling
- * is thus naturally bounded by the run terminating; no separate timeout cap.
- *
- * `enabled` gates the whole thing: callers pass `false` when the autonomous-runs
- * feature is off (the endpoint is NOT flag-gated server-side, but with the feature
- * off the chat has no runs, so polling would only ever return `{ run: null }`) OR
- * when THIS tab is the one actively streaming the run (the live SSE owns the view,
- * so we must not also poll/merge). The global `retry: false` means a failed fetch
- * leaves `data` undefined, so refetchInterval(undefined run) returns false — a
- * failed fetch can never spin a tight loop.
- */
-export function useAiChatRunQuery(
-  chatId: string | undefined,
-  enabled: boolean,
-) {
-  return useQuery<IAiChatRunResponse, Error>({
-    queryKey: AI_CHAT_RUN_RQ_KEY(chatId ?? ""),
-    queryFn: () => getAiChatRun(chatId as string),
-    enabled: !!chatId && enabled,
-    refetchInterval: (query) => runPollInterval(query.state.data?.run),
-  });
-}
-
 export function useRenameAiChatMutation() {
   const queryClient = useQueryClient();
   const { t } = useTranslation();
@@ -315,14 +280,11 @@ export function useImportAiRolesFromCatalogMutation() {
     mutationFn: (payload) => importAiRolesFromCatalog(payload),
     onSuccess: (result) => {
       notifications.show({
-        message: t(
+        message: t("Imported {{created}}, renamed {{renamed}}, skipped {{skipped}}", {
-          "Imported {{created}}, renamed {{renamed}}, skipped {{skipped}}",
+          created: result.created,
-          {
+          renamed: result.renamed,
-            created: result.created,
+          skipped: result.skipped,
-            renamed: result.renamed,
+        }),
-            skipped: result.skipped,
-          },
-        ),
       });
       // Surface partial failures (e.g. unique-name races) as a red warning.
       if (result.errors.length > 0) {

apps/client/src/features/ai-chat/queries/ai-chat-run-query.test.tsx

@@ -1,92 +0,0 @@
-import { describe, it, expect, vi, beforeEach } from "vitest";
-import React from "react";
-import { renderHook, waitFor } from "@testing-library/react";
-import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
-import type { IAiChatRunResponse } from "@/features/ai-chat/types/ai-chat.types.ts";
-
-// react-i18next is pulled in transitively by ai-chat-query.ts (the mutation hooks
-// use it); stub it so the module imports cleanly in this hook test.
-vi.mock("react-i18next", () => ({
-  useTranslation: () => ({ t: (key: string) => key }),
-}));
-
-vi.mock("@mantine/notifications", () => ({
-  notifications: { show: vi.fn() },
-}));
-
-// Mock the whole service module; only getAiChatRun is exercised here, but the
-// other named exports must exist so ai-chat-query.ts imports resolve.
-vi.mock("@/features/ai-chat/services/ai-chat-service.ts", () => ({
-  getAiChatRun: vi.fn(),
-  getAiChatMessages: vi.fn(),
-  getAiChats: vi.fn(),
-  getAiRoleCatalog: vi.fn(),
-  getAiRoleCatalogBundle: vi.fn(),
-  getAiRoles: vi.fn(),
-  importAiRolesFromCatalog: vi.fn(),
-  createAiRole: vi.fn(),
-  deleteAiChat: vi.fn(),
-  deleteAiRole: vi.fn(),
-  renameAiChat: vi.fn(),
-  updateAiRole: vi.fn(),
-  updateAiRoleFromCatalog: vi.fn(),
-}));
-
-import { getAiChatRun } from "@/features/ai-chat/services/ai-chat-service.ts";
-import { useAiChatRunQuery } from "@/features/ai-chat/queries/ai-chat-query.ts";
-
-function createWrapper() {
-  const queryClient = new QueryClient({
-    defaultOptions: { queries: { retry: false } },
-  });
-  return function Wrapper({ children }: { children: React.ReactNode }) {
-    return (
-      <QueryClientProvider client={queryClient}>{children}</QueryClientProvider>
-    );
-  };
-}
-
-const runningResponse: IAiChatRunResponse = {
-  run: { id: "run-1", chatId: "c1", status: "running" },
-  message: {
-    id: "a1",
-    role: "assistant",
-    content: "working...",
-    createdAt: "2026-01-01T00:00:00Z",
-  },
-};
-
-describe("useAiChatRunQuery — enable gating", () => {
-  beforeEach(() => {
-    vi.clearAllMocks();
-  });
-
-  it("fetches the run when enabled (passive observer, feature on)", async () => {
-    vi.mocked(getAiChatRun).mockResolvedValue(runningResponse);
-    const { result } = renderHook(() => useAiChatRunQuery("c1", true), {
-      wrapper: createWrapper(),
-    });
-    await waitFor(() => expect(result.current.isSuccess).toBe(true));
-    expect(getAiChatRun).toHaveBeenCalledWith("c1");
-    expect(result.current.data?.run?.status).toBe("running");
-  });
-
-  it("does NOT fetch when disabled (this tab is the streamer / feature off)", async () => {
-    vi.mocked(getAiChatRun).mockResolvedValue(runningResponse);
-    renderHook(() => useAiChatRunQuery("c1", false), {
-      wrapper: createWrapper(),
-    });
-    // Give any errant fetch a chance to fire, then assert none did.
-    await new Promise((r) => setTimeout(r, 20));
-    expect(getAiChatRun).not.toHaveBeenCalled();
-  });
-
-  it("does NOT fetch when there is no chat id", async () => {
-    vi.mocked(getAiChatRun).mockResolvedValue(runningResponse);
-    renderHook(() => useAiChatRunQuery(undefined, true), {
-      wrapper: createWrapper(),
-    });
-    await new Promise((r) => setTimeout(r, 20));
-    expect(getAiChatRun).not.toHaveBeenCalled();
-  });
-});

apps/client/src/features/ai-chat/services/ai-chat-service.ts

@@ -5,7 +5,6 @@ import {
   IAiChatListParams,
   IAiChatMessageRow,
   IAiChatMessagesParams,
-  IAiChatRunResponse,
   IAiRole,
   IAiRoleCatalog,
   IAiRoleCatalogBundle,
@@ -43,38 +42,6 @@ export async function getAiChatMessages(
   return req.data;
 }
 
-/**
- * Reconnect to the latest agent run of a chat (#184). Returns the run's
- * persisted lifecycle state and the assistant message it materializes (the
- * partial output while the run is in-flight, the final output once it finished).
- * The DB is the source of truth, so this works for an in-flight run (the browser
- * dropped, the run kept going) and a finished one alike; `{ run: null }` when the
- * chat has never had a run. Owner-gated server-side (the requesting user must own
- * the chat); it is NOT flag-gated — when the feature is off the chat simply has no
- * runs, so the endpoint returns `{ run: null }`.
- */
-export async function getAiChatRun(
-  chatId: string,
-): Promise<IAiChatRunResponse> {
-  const req = await api.post<IAiChatRunResponse>("/ai-chat/run", { chatId });
-  return req.data;
-}
-
-/**
- * Explicitly STOP the active agent run of a chat (#184). This is the ONLY thing
- * that ends a DETACHED run — a mere browser disconnect (aborting the local SSE)
- * is deliberately ignored server-side, so the client must call this to actually
- * stop an autonomous run. Targeted by `chatId` (the server resolves whatever run
- * is active on it); owner-gated server-side. Returns `{ stopped }` — false when
- * there was nothing active to stop.
- */
-export async function stopRun(
-  chatId: string,
-): Promise<{ stopped: boolean }> {
-  const req = await api.post<{ stopped: boolean }>("/ai-chat/stop", { chatId });
-  return req.data;
-}
-
 /**
  * Resolve the chat bound to a document (the current user's most-recent chat
  * created on that page), or null when there is none. Drives auto-open-on-page.

apps/client/src/features/ai-chat/types/ai-chat.types.ts

@@ -200,38 +200,6 @@ export interface IAiChatMessageRow {
   createdAt: string;
 }
 
-/**
- * A persisted agent-run row (#184), mirroring the `ai_chat_runs` fields the
- * client reads from `POST /ai-chat/run`. Only `status` is load-bearing for the
- * reconnect-and-live-update UX (it drives the poll cadence); the rest are carried
- * for display/diagnostics. The DB is the source of truth, so this resolves for an
- * in-flight run (the browser dropped, the run kept going) and a finished one.
- */
-export interface IAiChatRun {
-  id: string;
-  chatId: string;
-  // 'pending' | 'running' | 'succeeded' | 'failed' | 'aborted'. The first two are
-  // ACTIVE (keep polling); the rest are TERMINAL (stop polling).
-  status: "pending" | "running" | "succeeded" | "failed" | "aborted" | string;
-  error?: string | null;
-  stepCount?: number;
-  assistantMessageId?: string | null;
-  startedAt?: string | null;
-  finishedAt?: string | null;
-  createdAt?: string;
-  updatedAt?: string;
-}
-
-/**
- * Response of `POST /ai-chat/run` (#184): the latest run of a chat and the
- * assistant message it materializes (the partial/final output, projected from the
- * persisted rows). Both are `null` when the chat has never had a run.
- */
-export interface IAiChatRunResponse {
-  run: IAiChatRun | null;
-  message: IAiChatMessageRow | null;
-}
-
 export interface IAiChatListParams extends QueryParams {}
 
 export interface IAiChatMessagesParams {

apps/client/src/features/ai-chat/utils/run-polling.test.ts

@@ -1,303 +0,0 @@
-import { describe, it, expect } from "vitest";
-import type { UIMessage } from "@ai-sdk/react";
-import type { IAiChatRun } from "@/features/ai-chat/types/ai-chat.types.ts";
-import {
-  RUN_POLL_INTERVAL_MS,
-  isRunActive,
-  runPollInterval,
-  shouldObserveRun,
-  shouldClearStoppingLatch,
-  shouldClearLatchOnQueryError,
-  mergeObservedMessage,
-} from "./run-polling.ts";
-
-function makeRun(status: string): IAiChatRun {
-  return { id: "run-1", chatId: "c1", status };
-}
-
-function makeMsg(id: string, text: string): UIMessage {
-  return {
-    id,
-    role: "assistant",
-    parts: [{ type: "text", text }],
-  } as UIMessage;
-}
-
-describe("isRunActive", () => {
-  it("treats pending and running as active", () => {
-    expect(isRunActive(makeRun("pending"))).toBe(true);
-    expect(isRunActive(makeRun("running"))).toBe(true);
-  });
-
-  it("treats terminal / unknown / nullish as not active", () => {
-    expect(isRunActive(makeRun("succeeded"))).toBe(false);
-    expect(isRunActive(makeRun("failed"))).toBe(false);
-    expect(isRunActive(makeRun("aborted"))).toBe(false);
-    expect(isRunActive(makeRun("weird-future-status"))).toBe(false);
-    expect(isRunActive(null)).toBe(false);
-    expect(isRunActive(undefined)).toBe(false);
-  });
-});
-
-describe("runPollInterval (the refetchInterval helper)", () => {
-  it("returns 2000ms while the run is pending/running", () => {
-    expect(runPollInterval(makeRun("pending"))).toBe(RUN_POLL_INTERVAL_MS);
-    expect(runPollInterval(makeRun("running"))).toBe(RUN_POLL_INTERVAL_MS);
-    expect(RUN_POLL_INTERVAL_MS).toBe(2000);
-  });
-
-  it("returns false (stop polling) once the run is terminal", () => {
-    expect(runPollInterval(makeRun("succeeded"))).toBe(false);
-    expect(runPollInterval(makeRun("failed"))).toBe(false);
-    expect(runPollInterval(makeRun("aborted"))).toBe(false);
-  });
-
-  it("returns false (no polling) when there is no run", () => {
-    expect(runPollInterval(null)).toBe(false);
-    expect(runPollInterval(undefined)).toBe(false);
-  });
-});
-
-describe("shouldObserveRun (observer-vs-streamer decision)", () => {
-  it("observes an active run when this tab is NOT the local streamer", () => {
-    expect(shouldObserveRun(makeRun("running"), false)).toBe(true);
-    expect(shouldObserveRun(makeRun("pending"), false)).toBe(true);
-  });
-
-  it("observes a terminal run too (so the final output shows on reopen)", () => {
-    expect(shouldObserveRun(makeRun("succeeded"), false)).toBe(true);
-  });
-
-  it("does NOT observe when this tab IS the streamer (no double-render)", () => {
-    expect(shouldObserveRun(makeRun("running"), true)).toBe(false);
-    expect(shouldObserveRun(makeRun("succeeded"), true)).toBe(false);
-  });
-
-  it("does NOT observe when there is no run", () => {
-    expect(shouldObserveRun(null, false)).toBe(false);
-    expect(shouldObserveRun(undefined, false)).toBe(false);
-  });
-});
-
-describe("shouldClearStoppingLatch (#234 latch-release decision)", () => {
-  // The one case the latch SHOULD clear: we requested a stop, we are the passive
-  // observer (not streaming), and the CURRENT run is terminal.
-  it("clears only when stopping, observing, and the run is terminal", () => {
-    expect(
-      shouldClearStoppingLatch({
-        stoppingRun: true,
-        run: makeRun("aborted"),
-        isLocalStreaming: false,
-      }),
-    ).toBe(true);
-    expect(
-      shouldClearStoppingLatch({
-        stoppingRun: true,
-        run: makeRun("succeeded"),
-        isLocalStreaming: false,
-      }),
-    ).toBe(true);
-    expect(
-      shouldClearStoppingLatch({
-        stoppingRun: true,
-        run: makeRun("failed"),
-        isLocalStreaming: false,
-      }),
-    ).toBe(true);
-  });
-
-  // Round-3 regression: clearing while THIS tab is still the local streamer would
-  // re-open the flash for the current turn the moment we switch to observer role.
-  // A predicate lacking the streaming gate would (wrongly) return true here.
-  it("does NOT clear while this tab is the local streamer", () => {
-    expect(
-      shouldClearStoppingLatch({
-        stoppingRun: true,
-        run: makeRun("aborted"),
-        isLocalStreaming: true,
-      }),
-    ).toBe(false);
-    expect(
-      shouldClearStoppingLatch({
-        stoppingRun: true,
-        run: makeRun("succeeded"),
-        isLocalStreaming: true,
-      }),
-    ).toBe(false);
-  });
-
-  // The detached run keeps growing after a local abort — while it is still
-  // active the latch MUST hold so the observer merge stays suppressed.
-  it("does NOT clear while the run is still active", () => {
-    expect(
-      shouldClearStoppingLatch({
-        stoppingRun: true,
-        run: makeRun("running"),
-        isLocalStreaming: false,
-      }),
-    ).toBe(false);
-    expect(
-      shouldClearStoppingLatch({
-        stoppingRun: true,
-        run: makeRun("pending"),
-        isLocalStreaming: false,
-      }),
-    ).toBe(false);
-  });
-
-  // #234 F4: on Stop the stale PREVIOUS-turn run is removed from the cache, so the
-  // observed `run` is null until the current turn's run is fetched fresh. A null
-  // run HOLDS the latch — it can never clear against the just-removed stale run,
-  // only against the current turn's own terminal run once observed.
-  it("does NOT clear against a removed/absent run (F4 stale-run guard)", () => {
-    expect(
-      shouldClearStoppingLatch({
-        stoppingRun: true,
-        run: null,
-        isLocalStreaming: false,
-      }),
-    ).toBe(false);
-    expect(
-      shouldClearStoppingLatch({
-        stoppingRun: true,
-        run: undefined,
-        isLocalStreaming: false,
-      }),
-    ).toBe(false);
-  });
-
-  it("does NOT clear when no stop was requested", () => {
-    expect(
-      shouldClearStoppingLatch({
-        stoppingRun: false,
-        run: makeRun("aborted"),
-        isLocalStreaming: false,
-      }),
-    ).toBe(false);
-  });
-});
-
-describe("shouldClearLatchOnQueryError (#234 F7 error-safety-net decision)", () => {
-  // This guards the REAL anti-flash decision the component's run-query-error
-  // safety-net effect uses (ai-chat-window.tsx wires the effect to THIS helper,
-  // not a copy — so the test is non-vacuous vs the live code).
-
-  // (b) The F7 hole: a TRANSIENT run-query error while `run` is STILL ACTIVE must
-  // NOT clear the latch. TanStack Query v5 retains `data` on error, so
-  // runQueryFailed can be true while the held run is still pending/running.
-  // Against the PRE-F7 condition (without `!isRunActive(run)`) this would return
-  // true — so this assertion fails on the buggy code (non-vacuous).
-  it("does NOT clear on a transient error while the run is still ACTIVE (F7)", () => {
-    expect(
-      shouldClearLatchOnQueryError({
-        stoppingRun: true,
-        isLocalStreaming: false,
-        runQueryFailed: true,
-        run: makeRun("running"),
-      }),
-    ).toBe(false);
-    expect(
-      shouldClearLatchOnQueryError({
-        stoppingRun: true,
-        isLocalStreaming: false,
-        runQueryFailed: true,
-        run: makeRun("pending"),
-      }),
-    ).toBe(false);
-  });
-
-  // (a) The genuine permanent-null-freeze: run cache cleared by removeQueries +
-  // the refetch keeps ERRORING, so `run === null`. This is the ONLY case the
-  // safety-net exists to cure — it MUST clear so the frozen view resumes.
-  it("clears on a permanent error when the run is null (permanent-null-freeze)", () => {
-    expect(
-      shouldClearLatchOnQueryError({
-        stoppingRun: true,
-        isLocalStreaming: false,
-        runQueryFailed: true,
-        run: null,
-      }),
-    ).toBe(true);
-    expect(
-      shouldClearLatchOnQueryError({
-        stoppingRun: true,
-        isLocalStreaming: false,
-        runQueryFailed: true,
-        run: undefined,
-      }),
-    ).toBe(true);
-  });
-
-  // A TERMINAL run also satisfies `!isRunActive`; clearing then is harmless — the
-  // terminal effect (shouldClearStoppingLatch) already clears for a terminal run,
-  // so this only ever agrees with it. Asserted so the (c) reasoning is pinned.
-  it("clears on an error when the run is terminal (harmless, agrees with terminal effect)", () => {
-    expect(
-      shouldClearLatchOnQueryError({
-        stoppingRun: true,
-        isLocalStreaming: false,
-        runQueryFailed: true,
-        run: makeRun("aborted"),
-      }),
-    ).toBe(true);
-  });
-
-  it("does NOT clear without an actual query error", () => {
-    expect(
-      shouldClearLatchOnQueryError({
-        stoppingRun: true,
-        isLocalStreaming: false,
-        runQueryFailed: false,
-        run: null,
-      }),
-    ).toBe(false);
-  });
-
-  it("does NOT clear while this tab is the local streamer", () => {
-    expect(
-      shouldClearLatchOnQueryError({
-        stoppingRun: true,
-        isLocalStreaming: true,
-        runQueryFailed: true,
-        run: null,
-      }),
-    ).toBe(false);
-  });
-
-  it("does NOT clear when no stop was requested", () => {
-    expect(
-      shouldClearLatchOnQueryError({
-        stoppingRun: false,
-        isLocalStreaming: false,
-        runQueryFailed: true,
-        run: null,
-      }),
-    ).toBe(false);
-  });
-});
-
-describe("mergeObservedMessage", () => {
-  it("replaces the message with the same id in place (per-step growth)", () => {
-    const prev = [makeMsg("u1", "hi"), makeMsg("a1", "step 1")];
-    const observed = makeMsg("a1", "step 1\nstep 2");
-    const next = mergeObservedMessage(prev, observed);
-    expect(next).toHaveLength(2);
-    expect(next[1]).toBe(observed);
-    expect(next[0]).toBe(prev[0]); // untouched
-    expect(next).not.toBe(prev); // new array (never mutates input)
-  });
-
-  it("appends when the observed message is not yet present", () => {
-    const prev = [makeMsg("u1", "hi")];
-    const observed = makeMsg("a1", "first token");
-    const next = mergeObservedMessage(prev, observed);
-    expect(next).toHaveLength(2);
-    expect(next[1]).toBe(observed);
-  });
-
-  it("returns the original list unchanged when there is nothing to merge", () => {
-    const prev = [makeMsg("u1", "hi")];
-    expect(mergeObservedMessage(prev, null)).toBe(prev);
-    expect(mergeObservedMessage(prev, undefined)).toBe(prev);
-  });
-});

apps/client/src/features/ai-chat/utils/run-polling.ts

@@ -1,151 +0,0 @@
-import type { UIMessage } from "@ai-sdk/react";
-import type { IAiChatRun } from "@/features/ai-chat/types/ai-chat.types.ts";
-
-/**
- * Reconnect-and-live-follow helpers (#184). When a chat is reopened while its
- * agent run is STILL going, this tab is a PASSIVE OBSERVER: it did not start the
- * run here (no local SSE stream), so it catches up by POLLING the reconnect
- * endpoint (`POST /ai-chat/run`) and merging the run's incrementally-persisted
- * assistant message into the rendered thread. These are the small pure decisions
- * that machinery hangs off, extracted so they can be unit-tested in isolation
- * (mirrors how reindex polling / editor-sync-state are tested).
- */
-
-/** How often to re-poll the reconnect endpoint while a run is ACTIVE. */
-export const RUN_POLL_INTERVAL_MS = 2000;
-
-// 'pending' and 'running' are the two ACTIVE statuses; 'succeeded' | 'failed' |
-// 'aborted' are TERMINAL (and any unknown future status is treated as terminal,
-// so a stale/odd value never polls forever).
-const ACTIVE_STATUSES = new Set(["pending", "running"]);
-
-/** Whether a run is still going (worth polling / merging live updates from). */
-export function isRunActive(run: IAiChatRun | null | undefined): boolean {
-  return !!run && ACTIVE_STATUSES.has(run.status);
-}
-
-/**
- * The TanStack Query `refetchInterval` value for the run query: poll every
- * {@link RUN_POLL_INTERVAL_MS} while the run is active, and `false` (stop) once
- * it is terminal or there is no run. Polling is thus naturally bounded by the run
- * reaching a terminal status — no separate timeout cap is needed.
- */
-export function runPollInterval(
-  run: IAiChatRun | null | undefined,
-): number | false {
-  return isRunActive(run) ? RUN_POLL_INTERVAL_MS : false;
-}
-
-/**
- * Observer-vs-streamer decision. We render the polled run message (catch up +
- * keep advancing) ONLY when this tab is a passive observer: there IS a run AND
- * this tab is NOT the one locally streaming it (we reconnected, we didn't start
- * it here). When this tab is the streamer, the live SSE stream owns the view, so
- * we neither poll nor merge — avoiding a double-render fight. Terminal runs still
- * merge (so the final persisted output is shown on reopen); the poll itself is
- * stopped separately by {@link runPollInterval}.
- */
-export function shouldObserveRun(
-  run: IAiChatRun | null | undefined,
-  localStreaming: boolean,
-): boolean {
-  return !!run && !localStreaming;
-}
-
-/**
- * Should the "stopping" latch — which suppresses the observer re-stream flash
- * after the user pressed Stop — be RELEASED now? All three must hold:
- *  - `stoppingRun`: we actually requested a stop (otherwise nothing to release);
- *  - `!isLocalStreaming`: this tab is NOT the local streamer. While we are the
- *    streamer the run query is disabled, so the observed `run` is not the run we
- *    are following — releasing the latch then would re-open the flash for the
- *    current turn the instant we switch to observer role;
- *  - the observed `run` EXISTS and has reached a TERMINAL status.
- *
- * The null / still-active `run` case is the #234 F4 invariant. On Stop the stale
- * PREVIOUS-turn run is removed from the query cache (`removeQueries`), so `run`
- * is null until the CURRENT turn's run is re-fetched fresh; a null or active run
- * therefore HOLDS the latch, so it can only ever clear against the current turn's
- * OWN terminal run — never a stale cached one. (The cache removal itself is
- * integration-level in AiChatWindow; this predicate encodes the decision given
- * whatever run is currently observed, and a stale terminal run is
- * indistinguishable from a current terminal run at the predicate level — hence
- * the cache removal is what guarantees only the current run is ever passed here.)
- */
-export function shouldClearStoppingLatch(args: {
-  stoppingRun: boolean;
-  run: IAiChatRun | null | undefined;
-  isLocalStreaming: boolean;
-}): boolean {
-  const { stoppingRun, run, isLocalStreaming } = args;
-  if (!stoppingRun || isLocalStreaming) return false;
-  return !!run && !isRunActive(run);
-}
-
-/**
- * Should the "stopping" latch be RELEASED by the run-query ERROR safety-net?
- * (#234 F7 — a NEW path of the same re-stream flash the F4 latch exists to
- * prevent.) After Stop, `handleServerStop` clears the run cache; the terminal
- * effect then holds the latch via `if (!run) return` until the CURRENT turn's run
- * is fetched fresh. If that refetch instead ERRORS permanently, `run` stays null,
- * its status-keyed refetchInterval is off, and nothing would ever observe a
- * terminal run — freezing the view with the observer merge suppressed. This
- * safety-net cures ONLY that genuine permanent-null-freeze.
- *
- * All four must hold:
- *  - `stoppingRun`: we actually requested a stop (otherwise nothing to release);
- *  - `!isLocalStreaming`: this tab is NOT the local streamer (same reason as
- *    {@link shouldClearStoppingLatch});
- *  - `runQueryFailed`: the run query is in its error state (TanStack Query v5 with
- *    retry:false — isError);
- *  - `!isRunActive(run)`: the observed `run` is NOT an active (pending/running)
- *    held run. This is the F7 gate. In TanStack Query v5 the query's `data` is
- *    RETAINED on error, so `runQueryFailed` can be true while `run` is STILL an
- *    ACTIVE run (a single transient GET-run failure in the window between Stop and
- *    settle). Without this gate a transient error would release the latch early —
- *    re-opening the observer merge and flashing the growing detached run over the
- *    frozen row (exactly the F4 flash). Gating on the run NOT being active means we
- *    only ever cure the permanent-null-freeze (`run === null`, so
- *    `isRunActive(null)` is false), never release against an active run.
- *
- * (A terminal `run` also satisfies `!isRunActive(run)`; clearing then is harmless
- * — the terminal effect's {@link shouldClearStoppingLatch} already clears the
- * latch for a terminal run, so this only ever agrees with it, never conflicts.)
- *
- * INVARIANT (do not break): clearing the latch on the `run === null` branch is safe
- * ONLY because the run query's `refetchInterval` (see {@link runPollInterval}) stops
- * polling when the data is empty — so after we clear on null+error there is no
- * subsequent auto-poll that could return a still-active detached run and re-open the
- * merge. If `refetchInterval` is ever changed to keep polling on `run === null`/on
- * error, this null-branch clear would re-open the F7 flash through the null path.
- * Do not change the run query's refetchInterval without re-checking this path.
- */
-export function shouldClearLatchOnQueryError(args: {
-  stoppingRun: boolean;
-  isLocalStreaming: boolean;
-  runQueryFailed: boolean;
-  run: IAiChatRun | null | undefined;
-}): boolean {
-  const { stoppingRun, isLocalStreaming, runQueryFailed, run } = args;
-  return (
-    stoppingRun && !isLocalStreaming && runQueryFailed && !isRunActive(run)
-  );
-}
-
-/**
- * Merge an observed assistant message into the rendered list: replace the message
- * with the same id in place (the in-progress assistant row is already seeded from
- * history, so per-step growth replaces it), or append it when absent. Returns a
- * new array; the input is never mutated.
- */
-export function mergeObservedMessage(
-  messages: UIMessage[],
-  observed: UIMessage | null | undefined,
-): UIMessage[] {
-  if (!observed) return messages;
-  const idx = messages.findIndex((m) => m.id === observed.id);
-  if (idx === -1) return [...messages, observed];
-  const next = messages.slice();
-  next[idx] = observed;
-  return next;
-}

apps/client/src/features/editor/atoms/editor-atoms.ts

@@ -1,5 +1,8 @@
 import { atom } from "jotai";
-import { Editor } from "@tiptap/core";
+// Type-only: these atoms only hold an Editor reference for typing. A value
+// import would drag the whole @tiptap/core engine into the eager graph of every
+// shell component that reads one of these atoms.
+import type { Editor } from "@tiptap/core";
 import { PageEditMode } from "@/features/user/types/user.types.ts";
 import type { DictationUnavailableReason } from "@/features/dictation/dictation-status";
 

apps/client/src/features/editor/components/drawio/drawio-menu-lazy.tsx

@@ -0,0 +1,16 @@
+import { lazy, Suspense } from "react";
+import { EditorMenuProps } from "@/features/editor/components/table/types/types.ts";
+
+// Lazily load the drawio bubble menu so it is split out of the editor chunk and
+// fetched only when an editable editor is mounted (mirrors excalidraw-menu-lazy).
+const DrawioMenu = lazy(
+  () => import("@/features/editor/components/drawio/drawio-menu.tsx"),
+);
+
+export default function DrawioMenuLazy(props: EditorMenuProps) {
+  return (
+    <Suspense fallback={null}>
+      <DrawioMenu {...props} />
+    </Suspense>
+  );
+}

apps/client/src/features/editor/components/drawio/drawio-view-lazy.tsx

@@ -0,0 +1,17 @@
+import { lazy, Suspense } from "react";
+import { NodeViewProps } from "@tiptap/react";
+
+// Lazily load the drawio node view so the heavy react-drawio embed runtime is
+// split into its own chunk and fetched only when a drawio diagram is actually
+// rendered (mirrors excalidraw-view-lazy).
+const DrawioView = lazy(
+  () => import("@/features/editor/components/drawio/drawio-view.tsx"),
+);
+
+export default function DrawioViewLazy(props: NodeViewProps) {
+  return (
+    <Suspense fallback={null}>
+      <DrawioView {...props} />
+    </Suspense>
+  );
+}

apps/client/src/features/editor/components/math/math-block-lazy.tsx

@@ -0,0 +1,19 @@
+import { lazy, Suspense } from "react";
+import { NodeViewProps } from "@tiptap/react";
+
+// Lazily load the KaTeX-backed block math view so the katex chunk is fetched
+// only when a document actually contains a math node (mirrors the mermaid/
+// excalidraw lazy pattern). The local Suspense keeps a slow katex chunk from
+// crashing or blocking the whole editor: while it loads we render the raw
+// LaTeX source as a node-sized placeholder.
+const MathBlockView = lazy(
+  () => import("@/features/editor/components/math/math-block.tsx"),
+);
+
+export default function MathBlockViewLazy(props: NodeViewProps) {
+  return (
+    <Suspense fallback={<div data-katex="true">{props.node.attrs.text}</div>}>
+      <MathBlockView {...props} />
+    </Suspense>
+  );
+}

apps/client/src/features/editor/components/math/math-inline-lazy.tsx

@@ -0,0 +1,19 @@
+import { lazy, Suspense } from "react";
+import { NodeViewProps } from "@tiptap/react";
+
+// Lazily load the KaTeX-backed inline math view so the katex chunk is fetched
+// only when a document actually contains a math node (mirrors the mermaid/
+// excalidraw lazy pattern). The local Suspense keeps a slow katex chunk from
+// crashing or blocking the whole editor: while it loads we render the raw
+// LaTeX source as a node-sized placeholder.
+const MathInlineView = lazy(
+  () => import("@/features/editor/components/math/math-inline.tsx"),
+);
+
+export default function MathInlineViewLazy(props: NodeViewProps) {
+  return (
+    <Suspense fallback={<span data-katex="true">{props.node.attrs.text}</span>}>
+      <MathInlineView {...props} />
+    </Suspense>
+  );
+}

apps/client/src/features/editor/extensions/extensions.ts

@@ -81,8 +81,8 @@ import {
   createResizeHandle,
   buildResizeClasses,
 } from "@/features/editor/components/common/node-resize-handles.ts";
-import MathInlineView from "@/features/editor/components/math/math-inline.tsx";
+import MathInlineView from "@/features/editor/components/math/math-inline-lazy.tsx";
-import MathBlockView from "@/features/editor/components/math/math-block.tsx";
+import MathBlockView from "@/features/editor/components/math/math-block-lazy.tsx";
 import ImageView from "@/features/editor/components/image/image-view.tsx";
 import CalloutView from "@/features/editor/components/callout/callout-view.tsx";
 import StatusView from "@/features/editor/components/status/status-view.tsx";
@@ -90,7 +90,7 @@ import VideoView from "@/features/editor/components/video/video-view.tsx";
 import AudioView from "@/features/editor/components/audio/audio-view.tsx";
 import AttachmentView from "@/features/editor/components/attachment/attachment-view.tsx";
 import CodeBlockView from "@/features/editor/components/code-block/code-block-view.tsx";
-import DrawioView from "../components/drawio/drawio-view";
+import DrawioView from "../components/drawio/drawio-view-lazy.tsx";
 import ExcalidrawView from "@/features/editor/components/excalidraw/excalidraw-view-lazy.tsx";
 import EmbedView from "@/features/editor/components/embed/embed-view.tsx";
 import HtmlEmbedView from "@/features/editor/components/html-embed/html-embed-view.tsx";

apps/client/src/features/editor/gitmost/gitmost-global-bridge.tsx

@@ -1,8 +1,17 @@
 import { useEffect, useRef } from "react";
 import { useNavigate } from "react-router-dom";
 import { getDefaultStore } from "jotai";
-import { WebSocketStatus } from "@hocuspocus/provider";
+
-import { Editor } from "@tiptap/core";
+// Literal value of WebSocketStatus.Connected from @hocuspocus/provider. Inlined
+// so this always-mounted global bridge does not statically import
+// @hocuspocus/provider — that import pulls Yjs (and, through a shared chunk, the
+// whole TipTap engine) into the eager startup graph. yjsConnectionStatusAtom
+// already stores these raw status strings.
+const YJS_STATUS_CONNECTED = "connected";
+// Type-only: importing Editor as a type keeps @tiptap/core (the whole editor
+// engine) out of the eager global-shell graph — the bridge only uses it for
+// annotations/casts, never as a runtime value.
+import type { Editor } from "@tiptap/core";
 import {
   pageEditorAtom,
   yjsConnectionStatusAtom,
@@ -16,15 +25,19 @@ import {
   getSidebarPages,
 } from "@/features/page/services/page-service.ts";
 import { buildPageUrl } from "@/features/page/page.utils.ts";
-import {
+// Types are erased at build time, so importing them does not pull the module's
+// runtime (which drags in @tiptap + the editor-ext barrel). The actual recording
+// helpers are dynamically imported at call time inside createPageWithRecording,
+// keeping the editor engine out of the eager global-shell startup graph — the
+// bridge is mounted for every authenticated user but recording is a rare,
+// native-host-driven action.
+import type {
   GitmostBridge,
   GitmostCreatePagePayload,
   GitmostCreatePageResult,
   GitmostListPagesPayload,
   GitmostListPagesResult,
   GitmostListSpacesResult,
-  gitmostDecodePayloadToFile,
-  gitmostUploadFileToEditor,
 } from "@/features/editor/gitmost/gitmost-recording.ts";
 
 // How long to wait for a freshly-navigated page's editor to mount, become
@@ -57,7 +70,7 @@ function gitmostWaitForEditor(
         !editor.isDestroyed &&
         editor.isEditable &&
         editorPageId === pageId &&
-        yjsStatus === WebSocketStatus.Connected;
+        yjsStatus === YJS_STATUS_CONNECTED;
       if (ready) {
         resolve(editor);
         return;
@@ -171,6 +184,12 @@ export default function GitmostGlobalBridge() {
           };
         }
 
+        // Load the recording helpers on demand (see the import note above). This
+        // is the only place they are needed, so the @tiptap/editor-ext code they
+        // pull in stays out of the eager startup graph.
+        const { gitmostDecodePayloadToFile, gitmostUploadFileToEditor } =
+          await import("@/features/editor/gitmost/gitmost-recording.ts");
+
         // Validate/decode the recording BEFORE creating the page so a bad
         // payload never leaves an empty junk page behind. Per the createPage
         // error contract, any decode failure collapses to "insert-failed" (the

apps/client/src/features/editor/page-editor.tsx

@@ -59,7 +59,7 @@ import {
   handlePaste,
 } from "@/features/editor/components/common/editor-paste-handler.tsx";
 import ExcalidrawMenu from "./components/excalidraw/excalidraw-menu-lazy";
-import DrawioMenu from "./components/drawio/drawio-menu";
+import DrawioMenu from "./components/drawio/drawio-menu-lazy";
 import { useCollabToken } from "@/features/auth/queries/auth-query.tsx";
 import SearchAndReplaceDialog from "@/features/editor/components/search-and-replace/search-and-replace-dialog.tsx";
 import { useDebouncedCallback, useDocumentVisibility } from "@mantine/hooks";
@@ -93,11 +93,6 @@ import {
   isBodyEditable,
   isCollabSynced,
 } from "@/features/editor/editor-sync-state";
-import {
-  isVitalsActive,
-  measurePageOpen,
-  reportEditorTx,
-} from "@/lib/telemetry/vitals";
 
 interface PageEditorProps {
   pageId: string;
@@ -356,40 +351,6 @@ export default function PageEditor({
           editor.storage.pageId = pageId;
           handleScrollTo(editor);
           editorRef.current = editor;
-
-          // #355 — perf instrumentation. Skip ALL of it when telemetry is
-          // disabled (F1 flag off) or this session isn't sampled: no page-open
-          // measure, and crucially NO dispatch wrapping, so a non-collecting
-          // session pays zero per-transaction cost.
-          if (isVitalsActive()) {
-            // page_open_ms: this is the first editor-content render, so measure
-            // against any page-open mark set on the tree-row/link click.
-            measurePageOpen();
-
-            // editor_tx_ms: time the SYNCHRONOUS part of applying each
-            // transaction (state.apply + updateState) by wrapping the view's
-            // dispatch. Only slow syncs (>8ms) are reported (see reportEditorTx),
-            // so the common path adds just one performance.now() pair. Passive:
-            // the original dispatch still runs unchanged.
-            try {
-              const view = editor.view as unknown as {
-                dispatch: (tr: unknown) => void;
-              };
-              const originalDispatch = view.dispatch.bind(view);
-              view.dispatch = (tr: unknown) => {
-                const started = performance.now();
-                originalDispatch(tr);
-                const elapsed = performance.now() - started;
-                try {
-                  reportEditorTx(elapsed, editor.state.doc.content.size);
-                } catch {
-                  // never let telemetry break editing
-                }
-              };
-            } catch {
-              // if the view shape changes, skip editor_tx instrumentation
-            }
-          }
         }
       },
       onUpdate({ editor }) {

apps/client/src/features/share/components/share-layout.tsx

@@ -1,10 +1,20 @@
+import { Suspense } from "react";
 import { Outlet } from "react-router-dom";
+import { Center, Loader } from "@mantine/core";
 import ShareShell from "@/features/share/components/share-shell.tsx";
 
 export default function ShareLayout() {
   return (
     <ShareShell>
-      <Outlet />
+      <Suspense
+        fallback={
+          <Center h="60vh">
+            <Loader size="sm" />
+          </Center>
+        }
+      >
+        <Outlet />
+      </Suspense>
     </ShareShell>
   );
 }

apps/client/src/features/workspace/components/settings/components/ai-provider-settings.tsx

@@ -394,10 +394,6 @@ export default function AiProviderSettings() {
     useState<boolean>(
       workspace?.settings?.ai?.publicShareAssistant ?? false,
     );
-  // #184: detached/autonomous agent runs (settings.ai.autonomousRuns).
-  const [autonomousRunsEnabled, setAutonomousRunsEnabled] = useState<boolean>(
-    workspace?.settings?.ai?.autonomousRuns ?? false,
-  );
   const [chatToggleLoading, setChatToggleLoading] = useState(false);
   const [searchToggleLoading, setSearchToggleLoading] = useState(false);
   const [dictationToggleLoading, setDictationToggleLoading] = useState(false);
@@ -407,8 +403,6 @@ export default function AiProviderSettings() {
     publicShareAssistantToggleLoading,
     setPublicShareAssistantToggleLoading,
   ] = useState(false);
-  const [autonomousRunsToggleLoading, setAutonomousRunsToggleLoading] =
-    useState(false);
 
   // Whether a key is currently stored server-side (drives the placeholder).
   const [hasApiKey, setHasApiKey] = useState(false);
@@ -736,37 +730,6 @@ export default function AiProviderSettings() {
     }
   }
 
-  // Optimistic toggle for detached/autonomous agent runs
-  // (settings.ai.autonomousRuns). When on, a chat turn becomes a server-side run
-  // that survives a browser disconnect and can be reconnected to / live-followed;
-  // only an explicit Stop ends it. Off by default; single-instance-only in phase 1.
-  async function handleToggleAutonomousRuns(value: boolean) {
-    setAutonomousRunsToggleLoading(true);
-    const previous = autonomousRunsEnabled;
-    setAutonomousRunsEnabled(value);
-    try {
-      const updated = await updateWorkspace({ autonomousRuns: value });
-      setWorkspace({
-        ...updated,
-        settings: {
-          ...updated.settings,
-          ai: { ...updated.settings?.ai, autonomousRuns: value },
-        },
-      });
-      notifications.show({ message: t("Updated successfully") });
-    } catch (err) {
-      setAutonomousRunsEnabled(previous);
-      const message = (err as { response?: { data?: { message?: string } } })
-        ?.response?.data?.message;
-      notifications.show({
-        message: message ?? t("Failed to update data"),
-        color: "red",
-      });
-    } finally {
-      setAutonomousRunsToggleLoading(false);
-    }
-  }
-
   // Admins only — match the previous behavior.
   if (!isAdmin) {
     return (
@@ -997,31 +960,6 @@ export default function AiProviderSettings() {
           {...form.getInputProps("publicShareAssistantRoleId")}
         />
 
-        {/* Detached/autonomous agent runs: a chat turn becomes a server-side run
-            that survives a browser disconnect; only an explicit Stop ends it.
-            Single-instance-only in phase 1. */}
-        <Group justify="space-between" align="center" wrap="nowrap" mt="md">
-          <Stack gap={0}>
-            <Text fw={600} size="sm">
-              {t("Autonomous agent runs")}
-            </Text>
-            <Text size="xs" c="dimmed">
-              {t(
-                "Keep an agent turn running server-side even if the browser disconnects; reconnect and follow it on reopen. Single-instance deployments only.",
-              )}
-            </Text>
-          </Stack>
-          <Switch
-            label={t("Enabled")}
-            labelPosition="left"
-            checked={autonomousRunsEnabled}
-            disabled={autonomousRunsToggleLoading}
-            onChange={(e) =>
-              handleToggleAutonomousRuns(e.currentTarget.checked)
-            }
-          />
-        </Group>
-
         <Group mt="md" align="center">
           <Button
             variant="default"

apps/client/src/features/workspace/types/workspace.types.ts

@@ -26,9 +26,6 @@ export interface IWorkspace {
   aiDictation?: boolean;
   aiDictationStreaming?: boolean;
   aiPublicShareAssistant?: boolean;
-  // Write-only field for updateWorkspace({ autonomousRuns }). Read state lives at
-  // settings.ai.autonomousRuns.
-  autonomousRuns?: boolean;
   trashRetentionDays?: number;
   // Default lifetime (HOURS) for new temporary notes; frozen per-note at creation.
   temporaryNoteHours?: number;
@@ -68,9 +65,6 @@ export interface IWorkspaceAiSettings {
   dictation?: boolean;
   dictationStreaming?: boolean;
   publicShareAssistant?: boolean;
-  // #184: detached agent runs (a run survives a browser disconnect and can be
-  // reconnected to / live-followed on reopen). Gates the run-reconnect polling.
-  autonomousRuns?: boolean;
 }
 
 export interface IWorkspaceSharingSettings {

apps/client/src/hooks/use-clipboard.ts

@@ -1,7 +1,7 @@
 // Source: https://github.com/mantinedev/mantine/blob/master/packages/@mantine/hooks/src/use-clipboard/use-clipboard.ts
 // polyfilled to support execCommand fallback
 import { useState } from "react";
-import { execCommandCopy } from "@docmost/editor-ext";
+import { execCommandCopy } from "@/lib/copy-to-clipboard.ts";
 
 export type UseClipboardOptions = {
   timeout?: number;

apps/client/src/lib/config.ts

@@ -1,7 +1,7 @@
 import bytes from "bytes";
 import { castToBoolean } from "@/lib/utils.tsx";
 import { AvatarIconType } from "@/features/attachments/types/attachment.types.ts";
-import { sanitizeUrl } from "@docmost/editor-ext";
+import { sanitizeUrl } from "@/lib/sanitize-url.ts";
 
 declare global {
   interface Window {
@@ -47,13 +47,6 @@ export function isCompactPageTreeEnabled(): boolean {
   return castToBoolean(getConfigValue("COMPACT_PAGE_TREE", "true"));
 }
 
-// #355 — operator toggle for client perf-telemetry. DEFAULT OFF: the server
-// mirrors CLIENT_TELEMETRY_ENABLED into window.CONFIG; when off the client
-// installs no observers and sends nothing (the sink endpoint doesn't exist).
-export function isClientTelemetryEnabled(): boolean {
-  return castToBoolean(getConfigValue("CLIENT_TELEMETRY_ENABLED", "false"));
-}
-
 export function getAvatarUrl(
   avatarUrl: string,
   type: AvatarIconType = AvatarIconType.AVATAR,

apps/client/src/lib/copy-to-clipboard.ts

@@ -0,0 +1,16 @@
+// Client-local execCommand copy fallback (previously imported from
+// @docmost/editor-ext). It lives here so the ubiquitous useClipboard / CopyButton
+// path does not pull in the editor-ext barrel — and with it the whole TipTap
+// engine — through the eager startup graph. Behavior is identical to the
+// editor-ext helper it replaces.
+export function execCommandCopy(text: string): void {
+  const textarea = document.createElement("textarea");
+  textarea.value = text;
+  textarea.style.position = "fixed";
+  textarea.style.left = "-9999px";
+  textarea.style.top = "-9999px";
+  document.body.appendChild(textarea);
+  textarea.select();
+  document.execCommand("copy");
+  document.body.removeChild(textarea);
+}

apps/client/src/lib/sanitize-url.test.ts

@@ -0,0 +1,31 @@
+import { describe, it, expect } from "vitest";
+import { sanitizeUrl } from "./sanitize-url";
+
+// `sanitizeUrl` is a byte-identical client-local copy of editor-ext's wrapper
+// around @braintree/sanitize-url: it maps the sanitizer's "about:blank" XSS
+// sentinel to "". These assertions mirror editor-ext's own security-contract
+// test so the extracted copy keeps the same guarantees.
+describe("sanitizeUrl", () => {
+  it("blocks dangerous schemes (returns empty string)", () => {
+    expect(sanitizeUrl("javascript:alert(1)")).toBe("");
+    expect(sanitizeUrl("data:text/html,<script>alert(1)</script>")).toBe("");
+    expect(sanitizeUrl("vbscript:msgbox(1)")).toBe("");
+    // Case / whitespace obfuscation must not slip past the sanitizer.
+    expect(sanitizeUrl("  JaVaScRiPt:alert(1)")).toBe("");
+  });
+
+  it("returns empty string for empty / undefined input", () => {
+    expect(sanitizeUrl(undefined)).toBe("");
+    expect(sanitizeUrl("")).toBe("");
+  });
+
+  it("allows safe https, relative file and mailto URLs", () => {
+    expect(sanitizeUrl("https://example.com/page")).toMatch(
+      /^https:\/\/example\.com\/page/,
+    );
+    expect(sanitizeUrl("/api/files/abc-123")).toBe("/api/files/abc-123");
+    expect(sanitizeUrl("mailto:user@example.com")).toBe(
+      "mailto:user@example.com",
+    );
+  });
+});

apps/client/src/lib/sanitize-url.ts

@@ -0,0 +1,15 @@
+import { sanitizeUrl as braintreeSanitizeUrl } from "@braintree/sanitize-url";
+
+// Client-local copy of editor-ext's sanitizeUrl wrapper. Importing it from the
+// editor-ext barrel dragged the whole TipTap engine into the eager startup graph
+// via the app-wide config module (getFileUrl). This keeps the exact same
+// behavior (braintree sanitize + normalize "about:blank" -> "") without that
+// dependency.
+export function sanitizeUrl(url: string | undefined): string {
+  if (!url) return "";
+
+  const sanitized = braintreeSanitizeUrl(url);
+
+  // Return an empty string instead of "about:blank".
+  return sanitized === "about:blank" ? "" : sanitized;
+}

apps/client/src/lib/telemetry/route-template.test.ts

@@ -1,35 +0,0 @@
-import { describe, it, expect } from "vitest";
-import { templateRoute } from "./route-template";
-
-describe("templateRoute", () => {
-  it("templates a space page path (never leaks slugs)", () => {
-    const t = templateRoute("/s/engineering/p/design-doc-abc123");
-    expect(t).toBe("/s/:space/p/:slug");
-    expect(t).not.toContain("engineering");
-    expect(t).not.toContain("design-doc");
-  });
-
-  it("templates share, redirect and space paths", () => {
-    expect(templateRoute("/share/abc/p/xyz")).toBe("/share/:shareId/p/:slug");
-    expect(templateRoute("/share/p/xyz")).toBe("/share/p/:slug");
-    expect(templateRoute("/p/some-slug")).toBe("/p/:slug");
-    expect(templateRoute("/s/team")).toBe("/s/:space");
-    expect(templateRoute("/s/team/trash")).toBe("/s/:space/trash");
-    expect(templateRoute("/labels/urgent")).toBe("/labels/:label");
-  });
-
-  it("keeps known static routes verbatim", () => {
-    expect(templateRoute("/home")).toBe("/home");
-    expect(templateRoute("/settings/members")).toBe("/settings/members");
-    expect(templateRoute("/")).toBe("/");
-  });
-
-  it("normalises a trailing slash", () => {
-    expect(templateRoute("/s/team/p/slug/")).toBe("/s/:space/p/:slug");
-  });
-
-  it("collapses unknown paths to 'other' (bounded cardinality)", () => {
-    expect(templateRoute("/weird/unknown/thing")).toBe("other");
-    expect(templateRoute("/s/team/p/slug/extra/segments")).toBe("other");
-  });
-});

apps/client/src/lib/telemetry/route-template.ts

@@ -1,70 +0,0 @@
-/**
- * Map a raw pathname to a BOUNDED route TEMPLATE (#355).
- *
- * Perf metrics must be labelled by route template only — never a raw path with
- * slugs/ids — so the server-side `route` column and any downstream aggregation
- * stay low-cardinality and carry NO page slugs/titles (privacy). Anything that
- * does not match a known pattern collapses to `other`.
- *
- * The template vocabulary mirrors the issue's example (`/s/:space/p/:slug`).
- */
-const ROUTE_PATTERNS: { re: RegExp; template: string }[] = [
-  // Share pages (public).
-  { re: /^\/share\/[^/]+\/p\/[^/]+$/, template: '/share/:shareId/p/:slug' },
-  { re: /^\/share\/p\/[^/]+$/, template: '/share/p/:slug' },
-  { re: /^\/share\/[^/]+$/, template: '/share/:shareId' },
-  // Page redirect.
-  { re: /^\/p\/[^/]+$/, template: '/p/:slug' },
-  // Space + page.
-  { re: /^\/s\/[^/]+\/p\/[^/]+$/, template: '/s/:space/p/:slug' },
-  { re: /^\/s\/[^/]+\/trash$/, template: '/s/:space/trash' },
-  { re: /^\/s\/[^/]+$/, template: '/s/:space' },
-  // Misc dynamic.
-  { re: /^\/labels\/[^/]+$/, template: '/labels/:label' },
-  { re: /^\/invites\/[^/]+$/, template: '/invites/:invitationId' },
-  { re: /^\/settings\/groups\/[^/]+$/, template: '/settings/groups/:groupId' },
-];
-
-// Static routes we accept verbatim (finite set).
-const STATIC_ROUTES = new Set<string>([
-  '/home',
-  '/spaces',
-  '/favorites',
-  '/login',
-  '/forgot-password',
-  '/password-reset',
-  '/setup/register',
-  '/settings/account/profile',
-  '/settings/account/preferences',
-  '/settings/workspace',
-  '/settings/ai',
-  '/settings/members',
-  '/settings/groups',
-  '/settings/spaces',
-  '/settings/sharing',
-]);
-
-export function templateRoute(pathname: string): string {
-  // Normalise a trailing slash (except root).
-  const path =
-    pathname.length > 1 && pathname.endsWith('/')
-      ? pathname.slice(0, -1)
-      : pathname;
-
-  if (path === '' || path === '/') return '/';
-  if (STATIC_ROUTES.has(path)) return path;
-
-  for (const { re, template } of ROUTE_PATTERNS) {
-    if (re.test(path)) return template;
-  }
-  return 'other';
-}
-
-/** Template for the current window location. */
-export function currentRouteTemplate(): string {
-  try {
-    return templateRoute(window.location.pathname);
-  } catch {
-    return 'other';
-  }
-}

apps/client/src/lib/telemetry/vitals.ts

@@ -1,290 +0,0 @@
-import {
-  onCLS,
-  onINP,
-  onLCP,
-  onTTFB,
-  type CLSMetricWithAttribution,
-  type INPMetricWithAttribution,
-  type LCPMetricWithAttribution,
-  type TTFBMetricWithAttribution,
-} from "web-vitals/attribution";
-import { isClientTelemetryEnabled } from "@/lib/config";
-import { currentRouteTemplate } from "./route-template";
-
-/**
- * Client perf-telemetry (#355): web-vitals + custom metrics buffered and posted
- * to POST /api/telemetry/vitals via sendBeacon.
- *
- * Design constraints from the issue:
- *  - Sampling is decided ONCE per session (25%), cached in sessionStorage,
- *    BEFORE any observer is subscribed. Non-sampled sessions send nothing.
- *  - Route labels are TEMPLATES only; attr is truncated to 120 chars; no page
- *    titles/slugs/text ever leave the browser.
- *  - Observers are passive and reporting is best-effort — telemetry must not
- *    degrade the perf it measures.
- */
-
-const ENDPOINT = "/api/telemetry/vitals";
-const SAMPLE_RATE = 0.25;
-const SAMPLE_KEY = "gm_vitals_sampled";
-const FLUSH_INTERVAL_MS = 15_000;
-const MAX_BUFFER = 40; // flush early if the buffer fills between timers
-const MAX_ATTR_LENGTH = 120;
-const EDITOR_TX_MIN_MS = 8; // only report editor transactions slower than this
-
-const ALLOWED_NAMES = new Set([
-  "INP",
-  "LCP",
-  "CLS",
-  "TTFB",
-  "editor_tx_ms",
-  "page_open_ms",
-  "longtask_ms",
-]);
-
-interface VitalEvent {
-  name: string;
-  value: number;
-  rating?: string;
-  route?: string;
-  attr?: string;
-  docSize?: number;
-}
-
-let sampledCache: boolean | null = null;
-let initialised = false;
-let buffer: VitalEvent[] = [];
-let longtaskSum = 0; // accumulated longtask duration (ms) for the current window
-
-/**
- * Decide once per session whether this session is sampled. Cached in
- * sessionStorage so the choice is stable across reloads within the session and
- * identical for every observer/custom-metric caller.
- */
-export function isVitalsSampled(): boolean {
-  if (sampledCache !== null) return sampledCache;
-  try {
-    const stored = sessionStorage.getItem(SAMPLE_KEY);
-    if (stored === "1") return (sampledCache = true);
-    if (stored === "0") return (sampledCache = false);
-    const sampled = Math.random() < SAMPLE_RATE;
-    sessionStorage.setItem(SAMPLE_KEY, sampled ? "1" : "0");
-    return (sampledCache = sampled);
-  } catch {
-    // sessionStorage unavailable (private mode / SSR): default to not sampled.
-    return (sampledCache = false);
-  }
-}
-
-/**
- * True only when telemetry is BOTH enabled by the operator (F1 flag) AND this
- * session is sampled. Callers outside initVitals (e.g. the editor dispatch
- * wrapper) use this to skip ALL instrumentation cost on disabled/non-sampled
- * sessions — no observers, no per-transaction timing.
- */
-export function isVitalsActive(): boolean {
-  return isClientTelemetryEnabled() && isVitalsSampled();
-}
-
-function truncateAttr(value: unknown): string | undefined {
-  if (typeof value !== "string" || value.length === 0) return undefined;
-  return value.slice(0, MAX_ATTR_LENGTH);
-}
-
-function enqueue(event: VitalEvent): void {
-  if (!ALLOWED_NAMES.has(event.name)) return;
-  if (!Number.isFinite(event.value)) return;
-  buffer.push(event);
-  if (buffer.length >= MAX_BUFFER) flush();
-}
-
-function flush(): void {
-  // Fold any pending longtask total into the batch first.
-  if (longtaskSum > 0) {
-    buffer.push({
-      name: "longtask_ms",
-      value: Math.round(longtaskSum),
-      route: currentRouteTemplate(),
-    });
-    longtaskSum = 0;
-  }
-  if (buffer.length === 0) return;
-
-  const payload = JSON.stringify({ events: buffer });
-  buffer = [];
-
-  try {
-    const blob = new Blob([payload], { type: "application/json" });
-    if (navigator.sendBeacon && navigator.sendBeacon(ENDPOINT, blob)) return;
-    // Fallback for browsers without sendBeacon: keepalive fetch.
-    void fetch(ENDPOINT, {
-      method: "POST",
-      body: payload,
-      headers: { "Content-Type": "application/json" },
-      keepalive: true,
-    }).catch(() => undefined);
-  } catch {
-    // Best-effort: never throw out of telemetry.
-  }
-}
-
-/**
- * Report a custom client metric (editor_tx_ms, page_open_ms). No-op unless the
- * session is sampled. Route is always the current TEMPLATE.
- */
-export function reportClientMetric(
-  name: "editor_tx_ms" | "page_open_ms",
-  value: number,
-  extra?: { docSize?: number },
-): void {
-  if (!isVitalsActive()) return;
-  if (!Number.isFinite(value)) return;
-  enqueue({
-    name,
-    value,
-    route: currentRouteTemplate(),
-    docSize: extra?.docSize,
-  });
-}
-
-/** Threshold-gated editor transaction reporter (only reports slow syncs). */
-export function reportEditorTx(ms: number, docSize: number): void {
-  if (ms <= EDITOR_TX_MIN_MS) return;
-  reportClientMetric("editor_tx_ms", ms, { docSize });
-}
-
-const PAGE_OPEN_MARK = "gm_page_open_start";
-
-/** Mark the start of a page-open interaction (tree-row / link click). */
-export function markPageOpenStart(): void {
-  try {
-    performance.clearMarks(PAGE_OPEN_MARK);
-    performance.mark(PAGE_OPEN_MARK);
-  } catch {
-    // ignore
-  }
-}
-
-/**
- * Measure page_open_ms at first editor-content render, if a start mark exists.
- * Consumes the mark so a later render doesn't double-count.
- */
-export function measurePageOpen(): void {
-  try {
-    const marks = performance.getEntriesByName(PAGE_OPEN_MARK, "mark");
-    if (marks.length === 0) return;
-    const started = marks[0].startTime;
-    const elapsed = performance.now() - started;
-    performance.clearMarks(PAGE_OPEN_MARK);
-    if (elapsed > 0 && Number.isFinite(elapsed)) {
-      reportClientMetric("page_open_ms", elapsed);
-    }
-  } catch {
-    // ignore
-  }
-}
-
-function attrTarget(
-  metric:
-    | INPMetricWithAttribution
-    | LCPMetricWithAttribution
-    | CLSMetricWithAttribution,
-): string | undefined {
-  const a = metric.attribution as Record<string, unknown> | undefined;
-  if (!a) return undefined;
-  // Different vitals expose their culprit element under different keys; only a
-  // CSS-selector-ish target string is taken (no text content / titles).
-  return (
-    truncateAttr(a.interactionTarget) ??
-    truncateAttr(a.element) ??
-    truncateAttr(a.largestShiftTarget) ??
-    undefined
-  );
-}
-
-/**
- * Initialise client telemetry. Safe to call multiple times (idempotent). Returns
- * immediately without subscribing when the session is not sampled — so a
- * non-sampled session subscribes to NO observers and sends nothing.
- */
-export function initVitals(): void {
-  if (initialised) return;
-  initialised = true;
-
-  // Operator flag gate (F1, default OFF): when telemetry is disabled the sink
-  // endpoint does not even exist server-side, so install ZERO observers.
-  if (!isClientTelemetryEnabled()) return;
-
-  // Sampling gate is evaluated BEFORE any observer subscription.
-  if (!isVitalsSampled()) return;
-
-  const report = (
-    metric:
-      | INPMetricWithAttribution
-      | LCPMetricWithAttribution
-      | CLSMetricWithAttribution
-      | TTFBMetricWithAttribution,
-  ) => {
-    enqueue({
-      name: metric.name,
-      value: metric.value,
-      rating: metric.rating,
-      route: currentRouteTemplate(),
-      attr:
-        metric.name === "TTFB"
-          ? undefined
-          : attrTarget(
-              metric as
-                | INPMetricWithAttribution
-                | LCPMetricWithAttribution
-                | CLSMetricWithAttribution,
-            ),
-    });
-  };
-
-  onINP(report);
-  onLCP(report);
-  onCLS(report);
-  onTTFB(report);
-
-  // Long tasks: aggregate the total blocking time per flush window (a passive
-  // observer; individual entries are summed, never stored/sent individually).
-  try {
-    if (typeof PerformanceObserver !== "undefined") {
-      const observer = new PerformanceObserver((list) => {
-        for (const entry of list.getEntries()) {
-          longtaskSum += entry.duration;
-        }
-      });
-      observer.observe({ type: "longtask", buffered: true });
-    }
-  } catch {
-    // longtask entry type unsupported: skip silently.
-  }
-
-  // page_open_ms start: mark when the user clicks a page link/tree-row (any
-  // anchor navigating to a page URL). Passive capture listener; the matching
-  // measure fires at first editor-content render (measurePageOpen). No page
-  // titles/slugs are read — only the click timing is marked.
-  document.addEventListener(
-    "click",
-    (event) => {
-      const target = event.target as Element | null;
-      const anchor = target?.closest?.("a[href]") as HTMLAnchorElement | null;
-      if (!anchor) return;
-      const href = anchor.getAttribute("href") ?? "";
-      // A page link is `/s/:space/p/:slug`, `/p/:slug` or a share page path.
-      if (/\/p\//.test(href)) markPageOpenStart();
-    },
-    { capture: true, passive: true },
-  );
-
-  // Flush on tab hide (most reliable delivery point) and periodically.
-  const onHidden = () => {
-    if (document.visibilityState === "hidden") flush();
-  };
-  document.addEventListener("visibilitychange", onHidden);
-  window.addEventListener("pagehide", flush);
-
-  setInterval(flush, FLUSH_INTERVAL_MS);
-}

apps/client/src/main.tsx

@@ -13,16 +13,14 @@ import { ModalsProvider } from "@mantine/modals";
 import { Notifications } from "@mantine/notifications";
 import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
 import { HelmetProvider } from "react-helmet-async";
+import { ChunkLoadErrorBoundary } from "@/components/chunk-load-error-boundary.tsx";
 import "./i18n";
-import { PostHogProvider } from "posthog-js/react";
 import {
   getPostHogHost,
   getPostHogKey,
   isCloud,
   isPostHogEnabled,
 } from "@/lib/config.ts";
-import posthog from "posthog-js";
-import { initVitals } from "@/lib/telemetry/vitals";
 
 export const queryClient = new QueryClient({
   defaultOptions: {
@@ -35,35 +33,65 @@ export const queryClient = new QueryClient({
   },
 });
 
-if (isCloud() && isPostHogEnabled) {
-  posthog.init(getPostHogKey(), {
-    api_host: getPostHogHost(),
-    defaults: "2025-05-24",
-    disable_session_recording: true,
-    capture_pageleave: false,
-  });
-}
-
-// #355 — client perf-telemetry. Decides sampling ONCE (25%/session) before
-// subscribing to any observer; non-sampled sessions send nothing.
-initVitals();
-
 const container = document.getElementById("root") as HTMLElement;
 const root = (container as any).__reactRoot ??= ReactDOM.createRoot(container);
 
-root.render(
+function renderApp() {
-  <BrowserRouter>
+  root.render(
-    <MantineProvider theme={theme} cssVariablesResolver={mantineCssResolver}>
+    <BrowserRouter>
-      <ModalsProvider>
+      <MantineProvider theme={theme} cssVariablesResolver={mantineCssResolver}>
-        <QueryClientProvider client={queryClient}>
+        <ModalsProvider>
-          <Notifications position="bottom-center" limit={3} zIndex={10000} />
+          <QueryClientProvider client={queryClient}>
-          <HelmetProvider>
+            <Notifications position="bottom-center" limit={3} zIndex={10000} />
-            <PostHogProvider client={posthog}>
+            <HelmetProvider>
-              <App />
+              {/* Root boundary above every lazy route's Suspense: a stale-chunk
-            </PostHogProvider>
+                  404 after a deploy is caught and recovered here instead of
-          </HelmetProvider>
+                  blanking the whole app. */}
-        </QueryClientProvider>
+              <ChunkLoadErrorBoundary>
-      </ModalsProvider>
+                <App />
-    </MantineProvider>
+              </ChunkLoadErrorBoundary>
-  </BrowserRouter>,
+            </HelmetProvider>
-);
+          </QueryClientProvider>
+        </ModalsProvider>
+      </MantineProvider>
+    </BrowserRouter>,
+  );
+}
+
+async function initAnalytics() {
+  // posthog-js is only pulled in for cloud deployments with analytics enabled, so
+  // self-hosted builds never download it. The gate is kept identical to the
+  // previous eager code so cloud analytics behavior is unchanged; the import is
+  // simply deferred behind it.
+  //
+  // Crucially this runs AFTER the immediate first render below, so first paint is
+  // never gated on the analytics chunk. Any failure (network, stale 404, or an
+  // ad-blocker blocking a chunk named "posthog") is swallowed so the user keeps a
+  // working app without analytics instead of a permanently blank page.
+  //
+  // NOTE: we init the posthog SINGLETON only and do NOT wrap the tree in
+  // <PostHogProvider>. The app has zero consumers of the PostHog React context
+  // (no usePostHog / useFeatureFlag* / PostHogFeature), and PostHogProvider given
+  // an already-initialized `client` is a no-op — all capture goes through the
+  // singleton. Re-rendering to attach the provider would only REMOUNT the whole
+  // App (running every mount effect twice and dropping local state / focus /
+  // in-progress input on cloud cold-load) for no functional gain.
+  if (!(isCloud() && isPostHogEnabled)) return;
+  try {
+    const { default: posthog } = await import("posthog-js");
+    posthog.init(getPostHogKey(), {
+      api_host: getPostHogHost(),
+      defaults: "2025-05-24",
+      disable_session_recording: true,
+      capture_pageleave: false,
+    });
+  } catch {
+    // Analytics failed to load — degrade gracefully; the app already rendered.
+  }
+}
+
+// Paint immediately for everyone (self-hosted stays exactly as instant as before,
+// cloud no longer blocks on the analytics import). The posthog singleton is
+// initialized after, without re-rendering the tree.
+renderApp();
+void initAnalytics();

apps/client/vite.config.ts

@@ -63,6 +63,20 @@ export default defineConfig(({ mode }) => {
                 name: "vendor-mantine",
                 test: /[\\/]node_modules[\\/]@mantine[\\/]/,
               },
+              // NOTE: TipTap/ProseMirror/Yjs are intentionally NOT force-grouped
+              // into a single vendor chunk. Doing so backfires: rolldown co-locates
+              // a small module shared with the (eager) react-i18next runtime into
+              // that group chunk, which then drags the whole ~590KB editor engine
+              // into the eager modulepreload graph. Left to the default splitting,
+              // the editor engine stays in lazily-loaded chunks pulled only by the
+              // route-split editor/share pages. KaTeX is safe to group (nothing
+              // eager references it).
+              // KaTeX in its own stable chunk; loaded on demand by the lazy math
+              // node views (never in the startup path).
+              {
+                name: "vendor-katex",
+                test: /[\\/]node_modules[\\/]katex[\\/]/,
+              },
             ],
           },
         },

apps/server/package.json

@@ -23,7 +23,7 @@
     "migration:reset": "tsx src/database/migrate.ts down-to NO_MIGRATIONS",
     "migration:codegen": "kysely-codegen --dialect=postgres --camel-case --env-file=../../.env --out-file=./src/database/types/db.d.ts",
     "lint": "eslint \"{src,apps,libs,test}/**/*.ts\" --fix",
-    "pretest": "pnpm --filter @docmost/editor-ext build && pnpm --filter @docmost/prosemirror-markdown build",
+    "pretest": "pnpm --filter @docmost/editor-ext build",
     "test": "jest",
     "test:int": "jest --config test/jest-integration.json",
     "test:watch": "jest --watch",
@@ -43,7 +43,6 @@
     "@clickhouse/client": "^1.18.2",
     "@docmost/mcp": "workspace:*",
     "@docmost/pdf-inspector": "1.9.6",
-    "@docmost/prosemirror-markdown": "workspace:*",
     "@fastify/cookie": "^11.0.2",
     "@fastify/multipart": "^10.0.0",
     "@fastify/static": "^9.1.3",
@@ -112,7 +111,6 @@
     "pino-pretty": "^13.1.3",
     "postgres": "^3.4.8",
     "postmark": "^4.0.7",
-    "prom-client": "^15.1.3",
     "react": "^18.3.1",
     "react-email": "6.0.8",
     "reflect-metadata": "^0.2.2",
@@ -176,7 +174,7 @@
       "/node_modules/"
     ],
     "transform": {
-      "(happy-dom.+|prosemirror-markdown/build/.+)\\.js$": [
+      "happy-dom.+\\.js$": [
         "babel-jest",
         {
           "presets": [
@@ -194,7 +192,7 @@
       "^.+\\.(t|j)sx?$": "ts-jest"
     },
     "transformIgnorePatterns": [
-      "/node_modules/(?!(\\.pnpm/)?(nanoid|uuid|image-dimensions|marked|happy-dom|lib0|@docmost/prosemirror-markdown)(@|/))"
+      "/node_modules/(?!(\\.pnpm/)?(nanoid|uuid|image-dimensions|marked|happy-dom|lib0)(@|/))"
     ],
     "collectCoverageFrom": [
       "**/*.(t|j)s"
@@ -205,8 +203,7 @@
       "^@docmost/db/(.*)$": "<rootDir>/database/$1",
       "^@docmost/transactional/(.*)$": "<rootDir>/integrations/transactional/$1",
       "^@docmost/ee/(.*)$": "<rootDir>/ee/$1",
-      "^src/(.*)$": "<rootDir>/$1",
+      "^src/(.*)$": "<rootDir>/$1"
-      "^@tiptap/react$": "<rootDir>/../test/stubs/tiptap-react.js"
     }
   }
 }

apps/server/src/app.module.ts

@@ -31,8 +31,6 @@ import { McpModule } from './integrations/mcp/mcp.module';
 import { SandboxModule } from './integrations/sandbox/sandbox.module';
 import { AiModule } from './integrations/ai/ai.module';
 import { AiChatModule } from './core/ai-chat/ai-chat.module';
-import { MetricsModule } from './integrations/metrics/metrics.module';
-import { ClientTelemetryModule } from './core/telemetry/client-telemetry.module';
 
 const enterpriseModules = [];
 try {
@@ -95,10 +93,6 @@ try {
     SandboxModule,
     AiModule,
     AiChatModule,
-    MetricsModule,
-    // Gated OFF by default: only registers the public vitals sink controller
-    // when CLIENT_TELEMETRY_ENABLED=true (maintainer decision E1=B).
-    ClientTelemetryModule.register(),
     ...enterpriseModules,
   ],
   controllers: [AppController],

apps/server/src/collaboration/collaboration.util.ts

@@ -43,6 +43,7 @@ import {
   Column,
   Status,
   addUniqueIdsToDoc,
+  htmlToMarkdown,
   TransclusionSource,
   TransclusionReference,
   FootnoteReference,
@@ -50,7 +51,6 @@ import {
   FootnoteDefinition,
   PageEmbed,
 } from '@docmost/editor-ext';
-import { convertProseMirrorToMarkdown } from '@docmost/prosemirror-markdown';
 import { generateText, getSchema, JSONContent } from '@tiptap/core';
 import { generateHTML, generateJSON } from '../common/helpers/prosemirror/html';
 // @tiptap/html library works best for generating prosemirror json state but not HTML
@@ -239,10 +239,6 @@ export function prosemirrorNodeToYElement(node: any): Y.XmlElement | Y.XmlText {
 }
 
 export function jsonToMarkdown(tiptapJson: any): string {
-  // Direct ProseMirror JSON -> Markdown via the canonical converter
+  const html = jsonToHtml(tiptapJson);
-  // (`@docmost/prosemirror-markdown`) — no HTML intermediate, no second
+  return htmlToMarkdown(html);
-  // editor-ext markdown layer. Same serializer as the page/space export and the
-  // git-sync vault writer, so every server PM->MD path emits identical canonical
-  // markdown (issue #345).
-  return convertProseMirrorToMarkdown(tiptapJson);
 }

apps/server/src/collaboration/extensions/persistence.extension.ts

@@ -41,7 +41,6 @@ import {
   HISTORY_INTERVAL,
 } from '../constants';
 import { TransclusionService } from '../../core/page/transclusion/transclusion.service';
-import { observeCollabStore } from '../../integrations/metrics/metrics.registry';
 
 /**
  * #251 — wire format of the client→server stateless message that signals a
@@ -193,17 +192,6 @@ export class PersistenceExtension implements Extension {
   }
 
   async onStoreDocument(data: onStoreDocumentPayload) {
-    // #355 — time the full store (persist + post-store side effects) into
-    // collab_store_duration_seconds. No-op when METRICS_PORT is unset.
-    const startedAt = performance.now();
-    try {
-      await this.storeDocument(data);
-    } finally {
-      observeCollabStore((performance.now() - startedAt) / 1000);
-    }
-  }
-
-  private async storeDocument(data: onStoreDocumentPayload) {
     const { documentName, document, context } = data;
 
     const pageId = getPageId(documentName);

apps/server/src/core/ai-chat/ai-chat-run.service.spec.ts

@@ -1,527 +0,0 @@
-import { Logger } from '@nestjs/common';
-import {
-  AiChatRunService,
-  RunAlreadyActiveError,
-  ONE_ACTIVE_RUN_PER_CHAT_INDEX,
-  mapTurnStatusToRun,
-} from './ai-chat-run.service';
-
-/** Shape a Postgres unique-violation the way the postgres.js driver surfaces it:
- *  SQLSTATE 23505 + the offending index in `constraint_name`. */
-function uniqueViolation(constraintName: string): Error & {
-  code: string;
-  constraint_name: string;
-} {
-  return Object.assign(
-    new Error('duplicate key value violates unique constraint'),
-    {
-      code: '23505',
-      constraint_name: constraintName,
-    },
-  );
-}
-
-/**
- * Unit coverage for the #184 phase-1 run lifecycle (AiChatRunService) with a
- * hand-rolled mock repo — no Nest graph, no DB. The invariant under test is the
- * one that makes a run "autonomous": a run keeps going when its SUBSCRIBER (the
- * browser) detaches, and ONLY an explicit stop aborts it. We assert that at the
- * abort-signal level (the signal the agent loop actually consumes).
- */
-
-/** Minimal EnvironmentService stub. Single-instance (CLOUD unset) by default. */
-function makeEnv(isCloud = false) {
-  return { isCloud: () => isCloud };
-}
-
-function makeRepo(overrides: Record<string, jest.Mock> = {}) {
-  return {
-    insert: jest.fn(async (v: any) => ({
-      id: 'run-1',
-      status: v.status ?? 'running',
-      chatId: v.chatId,
-      workspaceId: v.workspaceId,
-    })),
-    update: jest.fn(async () => ({ id: 'run-1' })),
-    markStopRequested: jest.fn(async () => ({ id: 'run-1' })),
-    findActiveByChat: jest.fn(async () => undefined),
-    findLatestByChat: jest.fn(async () => undefined),
-    findById: jest.fn(async () => undefined),
-    sweepRunning: jest.fn(async () => 0),
-    ...overrides,
-  };
-}
-
-describe('mapTurnStatusToRun', () => {
-  it('maps the turn terminal status to the run terminal status', () => {
-    expect(mapTurnStatusToRun('completed')).toBe('succeeded');
-    expect(mapTurnStatusToRun('error')).toBe('failed');
-    expect(mapTurnStatusToRun('aborted')).toBe('aborted');
-  });
-});
-
-describe('AiChatRunService.onModuleInit (startup sweep)', () => {
-  afterEach(() => jest.restoreAllMocks());
-
-  it('calls sweepRunning and resolves; logs when > 0', async () => {
-    const repo = makeRepo({ sweepRunning: jest.fn(async () => 2) });
-    const logSpy = jest
-      .spyOn(Logger.prototype, 'log')
-      .mockImplementation(() => undefined);
-    const svc = new AiChatRunService(repo as never, makeEnv() as never);
-    await expect(svc.onModuleInit()).resolves.toBeUndefined();
-    expect(repo.sweepRunning).toHaveBeenCalledTimes(1);
-    expect(logSpy).toHaveBeenCalledTimes(1);
-    expect(String(logSpy.mock.calls[0][0])).toContain('2');
-  });
-
-  it('a sweep failure is swallowed (never blocks startup)', async () => {
-    const repo = makeRepo({
-      sweepRunning: jest.fn(async () => {
-        throw new Error('db down');
-      }),
-    });
-    const warnSpy = jest
-      .spyOn(Logger.prototype, 'warn')
-      .mockImplementation(() => undefined);
-    const svc = new AiChatRunService(repo as never, makeEnv() as never);
-    await expect(svc.onModuleInit()).resolves.toBeUndefined();
-    // The first warn is the sweep failure (the multi-instance warn never fires
-    // single-instance), so the message is the db error.
-    expect(String(warnSpy.mock.calls[0][0])).toContain('db down');
-  });
-
-  it('F1 (DECISION C): the boot sweep is UNCONDITIONAL — sweepRunning is called with NO staleness window, so a fresh running run (updatedAt = now) is settled, not skipped', async () => {
-    // The bug: a fast restart (deploy/OOM within minutes of the last step) left a
-    // run stuck 'running' under the old 10-min window, 409ing every later turn in
-    // the chat. The fix settles ALL pending|running on boot. We assert the service
-    // invokes sweepRunning with no `staleMs` (the unconditional path); the repo's
-    // own spec proves no-window => no updatedAt filter.
-    const repo = makeRepo({ sweepRunning: jest.fn(async () => 1) });
-    jest.spyOn(Logger.prototype, 'log').mockImplementation(() => undefined);
-    const svc = new AiChatRunService(repo as never, makeEnv() as never);
-    await svc.onModuleInit();
-    expect(repo.sweepRunning).toHaveBeenCalledTimes(1);
-    const callArgs = repo.sweepRunning.mock.calls[0] as unknown[];
-    const firstArg = callArgs[0] as { staleMs?: number } | undefined;
-    // Either no opts at all, or opts without a staleMs window => unconditional.
-    expect(firstArg?.staleMs).toBeUndefined();
-  });
-
-  it('F2 (DECISION A): warns at startup that autonomousRuns is single-instance-only when a horizontally-scaled deployment (CLOUD) is detected', async () => {
-    const repo = makeRepo();
-    const warnSpy = jest
-      .spyOn(Logger.prototype, 'warn')
-      .mockImplementation(() => undefined);
-    const svc = new AiChatRunService(repo as never, makeEnv(true) as never);
-    await svc.onModuleInit();
-    const warned = warnSpy.mock.calls.some((c) =>
-      /single-instance-only/i.test(String(c[0])),
-    );
-    expect(warned).toBe(true);
-  });
-
-  it('F2: does NOT warn about multi-instance on a single-instance (CLOUD unset) deployment', async () => {
-    const repo = makeRepo();
-    const warnSpy = jest
-      .spyOn(Logger.prototype, 'warn')
-      .mockImplementation(() => undefined);
-    const svc = new AiChatRunService(repo as never, makeEnv(false) as never);
-    await svc.onModuleInit();
-    const warned = warnSpy.mock.calls.some((c) =>
-      /single-instance-only/i.test(String(c[0])),
-    );
-    expect(warned).toBe(false);
-  });
-});
-
-describe('AiChatRunService run lifecycle', () => {
-  it('beginRun inserts a running row and registers a live abort controller', async () => {
-    const repo = makeRepo();
-    const svc = new AiChatRunService(repo as never, makeEnv() as never);
-    const handle = await svc.beginRun({
-      chatId: 'chat-1',
-      workspaceId: 'ws-1',
-      userId: 'user-1',
-    });
-    expect(repo.insert).toHaveBeenCalledWith(
-      expect.objectContaining({
-        chatId: 'chat-1',
-        workspaceId: 'ws-1',
-        createdBy: 'user-1',
-        status: 'running',
-        trigger: 'user',
-      }),
-    );
-    expect(handle.runId).toBe('run-1');
-    expect(handle.signal.aborted).toBe(false);
-    expect(svc.isLocallyActive('run-1')).toBe(true);
-  });
-
-  it('beginRun REJECTS the racer: a 23505 on the one-active-per-chat index throws RunAlreadyActiveError (not swallowed) and registers no controller', async () => {
-    // The race: the controller's cheap pre-check passed for BOTH concurrent
-    // turns, so the loser's INSERT hits the partial unique index. That rejection
-    // is the authoritative gate — it must surface, not be swallowed into an
-    // untracked turn.
-    const repo = makeRepo({
-      insert: jest.fn(async () => {
-        throw uniqueViolation(ONE_ACTIVE_RUN_PER_CHAT_INDEX);
-      }),
-    });
-    const svc = new AiChatRunService(repo as never, makeEnv() as never);
-    await expect(
-      svc.beginRun({ chatId: 'chat-1', workspaceId: 'ws-1', userId: 'user-1' }),
-    ).rejects.toBeInstanceOf(RunAlreadyActiveError);
-    // No controller leaked for a rejected start.
-    expect(svc.isLocallyActive('run-1')).toBe(false);
-  });
-
-  it('beginRun does NOT mask an unrelated unique violation as already-active', async () => {
-    // A 23505 on some OTHER constraint is a real bug, not the race — it must
-    // propagate unchanged so it is never silently treated as "already active".
-    const other = uniqueViolation('ai_chat_runs_pkey');
-    const repo = makeRepo({
-      insert: jest.fn(async () => {
-        throw other;
-      }),
-    });
-    const svc = new AiChatRunService(repo as never, makeEnv() as never);
-    await expect(
-      svc.beginRun({ chatId: 'chat-1', workspaceId: 'ws-1', userId: 'user-1' }),
-    ).rejects.toBe(other);
-  });
-
-  it('beginRun propagates a non-unique insert failure unchanged', async () => {
-    const boom = new Error('connection reset');
-    const repo = makeRepo({
-      insert: jest.fn(async () => {
-        throw boom;
-      }),
-    });
-    const svc = new AiChatRunService(repo as never, makeEnv() as never);
-    await expect(
-      svc.beginRun({ chatId: 'chat-1', workspaceId: 'ws-1', userId: 'user-1' }),
-    ).rejects.toBe(boom);
-  });
-
-  it('two concurrent begins on one chat: exactly one wins, the other is rejected as already-active', async () => {
-    // Integration-style: model the DB partial unique index with a one-shot slot.
-    // The first insert claims it; the second hits a 23505 on the active index.
-    let slotTaken = false;
-    const repo = makeRepo({
-      insert: jest.fn(async (v: any) => {
-        if (slotTaken) throw uniqueViolation(ONE_ACTIVE_RUN_PER_CHAT_INDEX);
-        slotTaken = true;
-        return { id: 'run-win', status: v.status, chatId: v.chatId };
-      }),
-    });
-    const svc = new AiChatRunService(repo as never, makeEnv() as never);
-    const results = await Promise.allSettled([
-      svc.beginRun({ chatId: 'chat-1', workspaceId: 'ws-1', userId: 'user-1' }),
-      svc.beginRun({ chatId: 'chat-1', workspaceId: 'ws-1', userId: 'user-1' }),
-    ]);
-    const fulfilled = results.filter((r) => r.status === 'fulfilled');
-    const rejected = results.filter((r) => r.status === 'rejected');
-    expect(fulfilled).toHaveLength(1);
-    expect(rejected).toHaveLength(1);
-    expect((rejected[0] as PromiseRejectedResult).reason).toBeInstanceOf(
-      RunAlreadyActiveError,
-    );
-    // Exactly the winner is locally active.
-    expect(svc.isLocallyActive('run-win')).toBe(true);
-  });
-
-  it('a SUBSCRIBER detaching does NOT abort the run (only an explicit stop does)', async () => {
-    const repo = makeRepo();
-    const svc = new AiChatRunService(repo as never, makeEnv() as never);
-    const handle = await svc.beginRun({
-      chatId: 'chat-1',
-      workspaceId: 'ws-1',
-      userId: 'user-1',
-    });
-    // Model a browser disconnect: nothing in the run service is told to stop.
-    // The signal the agent loop consumes must stay un-aborted and the run stays
-    // locally active — i.e. it keeps running server-side.
-    expect(handle.signal.aborted).toBe(false);
-    expect(svc.isLocallyActive('run-1')).toBe(true);
-    // markStopRequested was never called by a mere detach.
-    expect(repo.markStopRequested).not.toHaveBeenCalled();
-  });
-
-  it('requestStop aborts the live controller, marks the row, and reports true', async () => {
-    const repo = makeRepo();
-    const svc = new AiChatRunService(repo as never, makeEnv() as never);
-    const handle = await svc.beginRun({
-      chatId: 'chat-1',
-      workspaceId: 'ws-1',
-      userId: 'user-1',
-    });
-    const aborted = jest.fn();
-    handle.signal.addEventListener('abort', aborted);
-
-    const result = await svc.requestStop('run-1', 'ws-1');
-
-    expect(result).toBe(true);
-    expect(handle.signal.aborted).toBe(true);
-    expect(aborted).toHaveBeenCalledTimes(1);
-    expect(repo.markStopRequested).toHaveBeenCalledWith('run-1', 'ws-1');
-  });
-
-  it('requestStop on a run this replica does NOT hold still marks the row (true)', async () => {
-    // e.g. after a restart, or a sibling replica owns the controller. The row is
-    // marked so the owning replica/sweep settles it; we report a stop took effect.
-    const repo = makeRepo({
-      markStopRequested: jest.fn(async () => ({ id: 'run-9' })),
-    });
-    const svc = new AiChatRunService(repo as never, makeEnv() as never);
-    const result = await svc.requestStop('run-9', 'ws-1');
-    expect(result).toBe(true);
-    expect(svc.isLocallyActive('run-9')).toBe(false);
-  });
-
-  it('requestStop still aborts the live controller when markStopRequested rejects (transient DB error)', async () => {
-    // F15: the in-memory abort is the ONLY thing that stops a run and must not be
-    // hostage to the audit write of stop_requested_at. A transient failure on
-    // markStopRequested must NOT prevent abort() nor make requestStop throw.
-    const warnSpy = jest
-      .spyOn(Logger.prototype, 'warn')
-      .mockImplementation(() => undefined);
-    const repo = makeRepo({
-      markStopRequested: jest.fn(async () => {
-        throw new Error('pool exhausted');
-      }),
-    });
-    const svc = new AiChatRunService(repo as never, makeEnv() as never);
-    const handle = await svc.beginRun({
-      chatId: 'chat-1',
-      workspaceId: 'ws-1',
-      userId: 'user-1',
-    });
-    const aborted = jest.fn();
-    handle.signal.addEventListener('abort', aborted);
-
-    // Does NOT throw despite the DB write rejecting.
-    const result = await svc.requestStop('run-1', 'ws-1');
-
-    // The live turn was aborted even though the audit write failed...
-    expect(handle.signal.aborted).toBe(true);
-    expect(aborted).toHaveBeenCalledTimes(1);
-    expect(repo.markStopRequested).toHaveBeenCalledWith('run-1', 'ws-1');
-    // ...the catch branch logged the swallowed failure...
-    expect(warnSpy).toHaveBeenCalledTimes(1);
-    // ...and a stop is reported as having taken effect (the entry existed).
-    expect(result).toBe(true);
-    warnSpy.mockRestore();
-  });
-
-  it('requestStop on an already-settled run (nothing active) reports false', async () => {
-    const repo = makeRepo({
-      markStopRequested: jest.fn(async () => undefined),
-    });
-    const svc = new AiChatRunService(repo as never, makeEnv() as never);
-    const result = await svc.requestStop('run-done', 'ws-1');
-    expect(result).toBe(false);
-  });
-
-  it('finalizeRun settles the row to the mapped status with finishedAt and drops the in-memory entry', async () => {
-    const repo = makeRepo();
-    const svc = new AiChatRunService(repo as never, makeEnv() as never);
-    await svc.beginRun({
-      chatId: 'chat-1',
-      workspaceId: 'ws-1',
-      userId: 'user-1',
-    });
-    expect(svc.isLocallyActive('run-1')).toBe(true);
-
-    await svc.finalizeRun('run-1', 'ws-1', 'error', 'provider blew up');
-
-    expect(svc.isLocallyActive('run-1')).toBe(false);
-    expect(repo.update).toHaveBeenCalledWith(
-      'run-1',
-      'ws-1',
-      expect.objectContaining({
-        status: 'failed',
-        error: 'provider blew up',
-        finishedAt: expect.any(Date),
-      }),
-    );
-  });
-
-  it('finalizeRun is IDEMPOTENT: a second settle no-ops (single terminal write)', async () => {
-    // The #184 review fix: AiChatService.stream wraps the turn in a safety-net
-    // catch that settles a failed turn AND streamText's terminal callback may
-    // also settle — both routes call finalizeRun. Only the FIRST may write the
-    // terminal row; the second must no-op so a late settle can never clobber the
-    // real terminal status or double-write the row.
-    const repo = makeRepo();
-    const svc = new AiChatRunService(repo as never, makeEnv() as never);
-    await svc.beginRun({
-      chatId: 'chat-1',
-      workspaceId: 'ws-1',
-      userId: 'user-1',
-    });
-
-    await svc.finalizeRun('run-1', 'ws-1', 'error', 'first');
-    expect(svc.isLocallyActive('run-1')).toBe(false);
-    // A second settle (e.g. a streamText callback firing after the catch) no-ops.
-    await svc.finalizeRun('run-1', 'ws-1', 'completed', undefined);
-
-    expect(repo.update).toHaveBeenCalledTimes(1);
-    expect(repo.update).toHaveBeenCalledWith(
-      'run-1',
-      'ws-1',
-      expect.objectContaining({ status: 'failed', error: 'first' }),
-    );
-  });
-
-  it('CONCURRENCY: two simultaneous finalizeRun on the same run write the terminal row EXACTLY ONCE (the 2nd caller exits synchronously at the atomic claim)', async () => {
-    // The CRITICAL race: AiChatService.stream's safety-net catch settles the turn
-    // to 'error' while a streamText terminal callback also settles it — both call
-    // finalizeRun for the SAME runId. The once-gate must close ATOMICALLY: a
-    // `settled.has` check alone is read BEFORE the awaited UPDATE, so both callers
-    // would pass it and BOTH write the row (last-write-wins clobber + double
-    // write). The fix claims the run with a SYNCHRONOUS `active.delete` before any
-    // await, so the second caller returns in the same tick, before the UPDATE.
-    //
-    // We force the two calls to overlap by making `update` return a promise we
-    // resolve only AFTER both finalizeRun calls have run their synchronous bodies.
-    let resolveUpdate!: (v: unknown) => void;
-    const updateGate = new Promise((res) => {
-      resolveUpdate = res;
-    });
-    const update = jest.fn(() => updateGate);
-    const repo = makeRepo({ update });
-    const svc = new AiChatRunService(repo as never, makeEnv() as never);
-    await svc.beginRun({
-      chatId: 'chat-1',
-      workspaceId: 'ws-1',
-      userId: 'user-1',
-    });
-
-    // Fire both before the (pending) update resolves. The first synchronously
-    // claims the entry (active.delete) and awaits update; the second, started in
-    // the same macrotask, finds the entry already gone and returns at the claim
-    // WITHOUT ever calling update.
-    const p1 = svc.finalizeRun('run-1', 'ws-1', 'completed');
-    const p2 = svc.finalizeRun('run-1', 'ws-1', 'error', 'safety-net');
-
-    // The decisive assertion: exactly one caller reached the terminal UPDATE.
-    expect(update).toHaveBeenCalledTimes(1);
-
-    // Let the single in-flight update land; both calls resolve cleanly.
-    resolveUpdate({ id: 'run-1' });
-    await Promise.all([p1, p2]);
-
-    expect(update).toHaveBeenCalledTimes(1);
-    // The winner is the FIRST caller ('completed' -> 'succeeded'); the late
-    // 'error' settle never wrote, so it could not clobber the real status.
-    expect(update).toHaveBeenCalledWith(
-      'run-1',
-      'ws-1',
-      expect.objectContaining({ status: 'succeeded' }),
-    );
-    expect(svc.isLocallyActive('run-1')).toBe(false);
-  });
-
-  it('F6: a TRANSIENT terminal-write failure is ridden out by the bounded retry — the run is settled, not stranded', async () => {
-    // The bug: finalizeRun used to DROP the in-memory entry BEFORE the terminal
-    // UPDATE, then only warn-log a failure. A single transient blip (pool
-    // exhaustion / deadlock / connection hiccup) on that PK UPDATE left the row
-    // 'running' with nothing left to recover it -> every later turn in that chat
-    // 409s until a restart. The fix updates FIRST and retries.
-    let calls = 0;
-    const repo = makeRepo({
-      update: jest.fn(async () => {
-        calls += 1;
-        if (calls === 1) throw new Error('deadlock detected');
-        return { id: 'run-1' };
-      }),
-    });
-    jest.spyOn(Logger.prototype, 'warn').mockImplementation(() => undefined);
-    const svc = new AiChatRunService(repo as never, makeEnv() as never);
-    await svc.beginRun({
-      chatId: 'chat-1',
-      workspaceId: 'ws-1',
-      userId: 'user-1',
-    });
-
-    await svc.finalizeRun('run-1', 'ws-1', 'completed');
-
-    // The retry landed the terminal write: the entry is dropped (slot freed) and
-    // the row carries the real terminal status — NOT stranded at 'running'.
-    expect(svc.isLocallyActive('run-1')).toBe(false);
-    expect(repo.update).toHaveBeenCalledTimes(2);
-    expect(repo.update).toHaveBeenLastCalledWith(
-      'run-1',
-      'ws-1',
-      expect.objectContaining({ status: 'succeeded' }),
-    );
-  });
-
-  it('F6: if the terminal write keeps failing, the entry is RETAINED and a LATER settle completes it (chat not permanently 409d)', async () => {
-    // Worst case: the DB is down for the whole first finalize (all attempts fail).
-    // The run must NOT be silently lost — the entry stays so a subsequent settle
-    // (a streamText callback, requestStop -> onAbort, or a future sweep) can retry.
-    let healthy = false;
-    const repo = makeRepo({
-      update: jest.fn(async () => {
-        if (!healthy) throw new Error('pool exhausted');
-        return { id: 'run-1' };
-      }),
-    });
-    jest.spyOn(Logger.prototype, 'warn').mockImplementation(() => undefined);
-    const errorSpy = jest
-      .spyOn(Logger.prototype, 'error')
-      .mockImplementation(() => undefined);
-    const svc = new AiChatRunService(repo as never, makeEnv() as never);
-    await svc.beginRun({
-      chatId: 'chat-1',
-      workspaceId: 'ws-1',
-      userId: 'user-1',
-    });
-
-    // First settle: every bounded attempt fails -> entry retained, NOT settled.
-    await svc.finalizeRun('run-1', 'ws-1', 'completed');
-    expect(svc.isLocallyActive('run-1')).toBe(true);
-    // F12: the give-up emits ONE explicit, greppable ERROR (run + chat context)
-    // so an operator can tell "gave up, run held in memory" from a per-attempt
-    // blip — distinct from the per-attempt warns.
-    const gaveUp = errorSpy.mock.calls.some(
-      (c) =>
-        /NON-TERMINAL/.test(String(c[0])) &&
-        /run-1/.test(String(c[0])) &&
-        /chat-1/.test(String(c[0])),
-    );
-    expect(gaveUp).toBe(true);
-
-    // The DB recovers; a later settle now succeeds and frees the slot.
-    healthy = true;
-    await svc.finalizeRun('run-1', 'ws-1', 'completed');
-    expect(svc.isLocallyActive('run-1')).toBe(false);
-    expect(repo.update).toHaveBeenLastCalledWith(
-      'run-1',
-      'ws-1',
-      expect.objectContaining({ status: 'succeeded' }),
-    );
-
-    // And it is now idempotent: a further settle no-ops (terminal row already
-    // written), so a double-settle can never clobber the real status.
-    const callsBefore = repo.update.mock.calls.length;
-    await svc.finalizeRun('run-1', 'ws-1', 'error', 'late');
-    expect(repo.update).toHaveBeenCalledTimes(callsBefore);
-  });
-
-  it('recordStep / linkAssistantMessage are best-effort: a repo failure is swallowed', async () => {
-    const repo = makeRepo({
-      update: jest.fn(async () => {
-        throw new Error('transient');
-      }),
-    });
-    jest.spyOn(Logger.prototype, 'warn').mockImplementation(() => undefined);
-    const svc = new AiChatRunService(repo as never, makeEnv() as never);
-    await expect(svc.recordStep('run-1', 'ws-1', 3)).resolves.toBeUndefined();
-    await expect(
-      svc.linkAssistantMessage('run-1', 'ws-1', 'msg-1'),
-    ).resolves.toBeUndefined();
-  });
-});

apps/server/src/core/ai-chat/ai-chat-run.service.ts

@@ -1,452 +0,0 @@
-import { Injectable, Logger, OnModuleInit } from '@nestjs/common';
-import { AiChatRunRepo } from '@docmost/db/repos/ai-chat/ai-chat-run.repo';
-import { AiChatRun } from '@docmost/db/types/entity.types';
-import { isUniqueViolation, violatedConstraint } from '@docmost/db/utils';
-import { EnvironmentService } from '../../integrations/environment/environment.service';
-
-/** Name of the partial unique index enforcing "one active run per chat" (see the
- *  ai_chat_runs migration). A 23505 on THIS constraint is the race-safe signal
- *  that a concurrent turn already owns the chat — distinct from any other unique
- *  collision, which must NOT be silently treated as "already active". */
-export const ONE_ACTIVE_RUN_PER_CHAT_INDEX = 'ai_chat_runs_one_active_per_chat';
-
-/**
- * Thrown by {@link AiChatRunService.beginRun} when the run-row INSERT loses the
- * race for a chat's single active slot (the partial unique index rejects it with
- * a 23505). This is the AUTHORITATIVE concurrency gate: the controller's cheap
- * pre-check is only a fast-path, and a request that slips past it must NOT run
- * untracked. The caller (AiChatService.stream) translates this into a 409 and
- * aborts the turn BEFORE any AI/provider call.
- */
-export class RunAlreadyActiveError extends Error {
-  constructor(public readonly chatId: string) {
-    super(`An agent run is already in progress for chat ${chatId}`);
-    this.name = 'RunAlreadyActiveError';
-  }
-}
-
-/**
- * The terminal status of a TURN (the #183 assistant-row lifecycle) maps onto the
- * terminal status of a RUN (#184). A turn that completed -> the run succeeded; a
- * turn that errored -> the run failed; a turn aborted (explicit user stop) -> the
- * run aborted. Pure + unit-testable.
- */
-export type TurnTerminalStatus = 'completed' | 'error' | 'aborted';
-export type RunTerminalStatus = 'succeeded' | 'failed' | 'aborted';
-
-export function mapTurnStatusToRun(
-  status: TurnTerminalStatus,
-): RunTerminalStatus {
-  switch (status) {
-    case 'completed':
-      return 'succeeded';
-    case 'error':
-      return 'failed';
-    case 'aborted':
-      return 'aborted';
-  }
-}
-
-/** An in-flight run held in process memory: its AbortController is the ONLY thing
- *  that can stop the turn (an explicit user stop), independent of the browser
- *  socket. A mere disconnect never touches it, so the run keeps going. */
-interface ActiveRun {
-  controller: AbortController;
-  chatId: string;
-  workspaceId: string;
-}
-
-/** The live handle the streaming path drives a run through (returned by
- *  {@link AiChatRunService.beginRun}). The `signal` governs the agent loop's
- *  abort — wired to the run, NOT to the HTTP socket. */
-export interface RunHandle {
-  runId: string;
-  signal: AbortSignal;
-}
-
-/**
- * AiChatRunService (#184 phase 1) — owns the agent RUN as a first-class,
- * server-side lifecycle object detached from the HTTP request / browser window.
- *
- * Responsibilities:
- *  - create a run row when a turn starts (inserted directly as 'running'; the
- *    'pending' status is only the column default + a reserved value, never
- *    written by code in phase 1) and register an in-memory AbortController for it
- *    (the explicit-stop lever);
- *  - finalize the run row (succeeded / failed / aborted) and unregister it;
- *  - service an EXPLICIT user stop (`requestStop`) — the ONLY thing that aborts a
- *    run; a browser disconnect deliberately does NOT;
- *  - crash-recovery sweep of dangling runs on startup.
- *
- * The agent loop itself still runs in AiChatService.stream (reusing #183's
- * step-granular durable write path, `consumeStream` already drains it independent
- * of the socket); this service only wraps it in a durable lifecycle and an
- * abort handle that outlives the subscriber.
- */
-@Injectable()
-export class AiChatRunService implements OnModuleInit {
-  private readonly logger = new Logger(AiChatRunService.name);
-
-  // runId -> ActiveRun. Process-local on purpose (phase 1 is single-process /
-  // in-memory transport; a cross-process BullMQ runner + Redis stop-signal is
-  // deferred to phase 2). A stop for a runId not in this map (e.g. after a
-  // restart) still records `stop_requested_at` on the row.
-  private readonly active = new Map<string, ActiveRun>();
-
-  // runIds whose TERMINAL row write has SUCCEEDED — the idempotency once-gate
-  // (F6). A finalize must short-circuit only AFTER the terminal write has landed,
-  // NOT merely after the in-memory entry was dropped: a transient UPDATE failure
-  // has to stay retryable, so "already settled" means "row already terminal", not
-  // "entry already gone". Grows by one short UUID per finished run over process
-  // uptime — negligible in phase 1's single process.
-  private readonly settled = new Set<string>();
-
-  // Bounded retry for the terminal write (F6): a single PK UPDATE can fail
-  // transiently under many fire-and-forget writes (pool exhaustion, deadlock, a
-  // brief connection blip). Riding out that blip in-place matters because the
-  // dominant success path (streamText onFinish) settles exactly ONCE — if that
-  // write is dropped and never retried, the row is stranded 'running' and the
-  // one-active-run gate 409s every future turn in the chat until a restart (no
-  // periodic sweep in phase 1).
-  private static readonly FINALIZE_MAX_ATTEMPTS = 3;
-  private static readonly FINALIZE_RETRY_BASE_MS = 50;
-
-  constructor(
-    private readonly runRepo: AiChatRunRepo,
-    private readonly environment: EnvironmentService,
-  ) {}
-
-  /**
-   * Crash-recovery sweep on server start: settle EVERY run still left
-   * pending/running to 'aborted' (F1 / DECISION C). The boot sweep is
-   * UNCONDITIONAL — no staleness window — because phase 1 is single-process: on a
-   * fresh boot any pending|running run is definitionally hung (no live runner owns
-   * it), so even a fast restart (deploy/OOM within minutes of the last step) can
-   * no longer leave a run stuck 'running' forever (which would make the
-   * one-active-run gate 409 every future turn in that chat). The staleness window
-   * is reintroduced only for the phase-2 multi-instance timer sweep, where a
-   * booting replica must not abort a run another replica is actively executing.
-   * Best-effort — a sweep failure is logged but MUST NOT block startup (mirrors
-   * AiChatService.onModuleInit for #183).
-   */
-  async onModuleInit(): Promise<void> {
-    this.warnIfMultiInstance();
-    try {
-      // No `staleMs`: unconditional boot sweep (F1). See AiChatRunRepo.sweepRunning.
-      const swept = await this.runRepo.sweepRunning();
-      if (swept > 0) {
-        this.logger.log(
-          `Startup sweep: marked ${swept} dangling agent run(s) as 'aborted'.`,
-        );
-      }
-    } catch (err) {
-      this.logger.warn(
-        `Startup sweep of dangling runs failed: ${
-          err instanceof Error ? err.message : 'unknown error'
-        }`,
-      );
-    }
-  }
-
-  /**
-   * F2 (DECISION A): autonomous runs are SINGLE-INSTANCE-ONLY in phase 1. An
-   * explicit Stop, and the in-memory AbortController that backs it, are
-   * process-local: a Stop only aborts the live turn if it lands on the SAME
-   * replica that owns the run (it still stamps `stop_requested_at` cross-instance,
-   * but nothing reads that flag during an active run yet). Cross-instance pub/sub
-   * stop is phase 2. So if the deployment is horizontally scaled, warn loudly at
-   * startup that a Stop may not reach a run executing on another replica.
-   *
-   * DETECTION: this codebase always wires the socket.io Redis adapter (REDIS_URL
-   * is mandatory), so the adapter alone is NOT a horizontal-scaling signal. The
-   * authoritative signal the codebase has is `CLOUD=true` (EnvironmentService
-   * .isCloud()), the Docmost-cloud multi-replica deployment. We warn whenever that
-   * is set, because any workspace could enable settings.ai.autonomousRuns. A
-   * self-hosted operator running multiple replicas behind a load balancer is also
-   * multi-instance; the deploy docs (.env.example / AGENTS.md) spell out the
-   * single-instance constraint for that case.
-   */
-  private warnIfMultiInstance(): void {
-    if (this.environment.isCloud()) {
-      this.logger.warn(
-        'Autonomous agent runs (settings.ai.autonomousRuns) are SINGLE-INSTANCE-ONLY ' +
-          'in phase 1: a horizontally-scaled deployment was detected (CLOUD=true). ' +
-          'An explicit Stop only aborts a run executing on the same replica that owns ' +
-          'it (cross-instance Stop is not yet reliable — phase 2). Run a single ' +
-          'instance if you enable autonomousRuns, or keep the flag off.',
-      );
-    }
-  }
-
-  /**
-   * Start a run for a turn: insert the run row (status 'running', startedAt now),
-   * register a fresh AbortController for it, and return a {@link RunHandle} whose
-   * `signal` the agent loop uses. The DB partial unique index guarantees at most
-   * one active run per chat — a second concurrent start on the same chat REJECTS
-   * at the insert (a 23505 on {@link ONE_ACTIVE_RUN_PER_CHAT_INDEX}). That
-   * rejection is the AUTHORITATIVE race gate: it is surfaced as a distinct
-   * {@link RunAlreadyActiveError} (NOT swallowed), so the caller turns it into a
-   * 409 and never streams an untracked turn. The controller is registered AFTER a
-   * successful insert so a rejected start leaks nothing.
-   */
-  async beginRun(args: {
-    chatId: string;
-    workspaceId: string;
-    userId: string;
-    trigger?: string;
-  }): Promise<RunHandle> {
-    let run: AiChatRun;
-    try {
-      run = await this.runRepo.insert({
-        chatId: args.chatId,
-        workspaceId: args.workspaceId,
-        createdBy: args.userId,
-        trigger: args.trigger ?? 'user',
-        status: 'running',
-        startedAt: new Date(),
-      });
-    } catch (err) {
-      // The race backstop: a concurrent turn already holds this chat's single
-      // active slot, so the partial unique index rejected our insert. Surface a
-      // distinct signal — the caller MUST reject this turn (409), not run it
-      // untracked. Any OTHER error propagates unchanged.
-      if (
-        isUniqueViolation(err) &&
-        violatedConstraint(err) === ONE_ACTIVE_RUN_PER_CHAT_INDEX
-      ) {
-        throw new RunAlreadyActiveError(args.chatId);
-      }
-      throw err;
-    }
-    const controller = new AbortController();
-    this.active.set(run.id, {
-      controller,
-      chatId: args.chatId,
-      workspaceId: args.workspaceId,
-    });
-    return { runId: run.id, signal: controller.signal };
-  }
-
-  /** Link the assistant message (the #183 projection) to its run. Best-effort. */
-  async linkAssistantMessage(
-    runId: string,
-    workspaceId: string,
-    assistantMessageId: string,
-  ): Promise<void> {
-    try {
-      await this.runRepo.update(runId, workspaceId, { assistantMessageId });
-    } catch (err) {
-      this.logger.warn(
-        `Failed to link assistant message to run ${runId}: ${
-          err instanceof Error ? err.message : 'unknown error'
-        }`,
-      );
-    }
-  }
-
-  /** Persist progress: bump the run's finished-step count. Best-effort (never
-   *  blocks or breaks the stream). */
-  async recordStep(
-    runId: string,
-    workspaceId: string,
-    stepCount: number,
-  ): Promise<void> {
-    try {
-      await this.runRepo.update(runId, workspaceId, { stepCount });
-    } catch (err) {
-      this.logger.warn(
-        `Failed to record step for run ${runId}: ${
-          err instanceof Error ? err.message : 'unknown error'
-        }`,
-      );
-    }
-  }
-
-  /**
-   * Finalize a run to its terminal status (succeeded / failed / aborted),
-   * stamping finishedAt + any error. Best-effort, but ROBUST against a transient
-   * terminal-write failure (F6) AND atomically safe against a concurrent settle.
-   *
-   * ATOMIC ONCE-CLAIM (the gate must close in ONE synchronous tick): two
-   * finalizeRun calls for the SAME run can race — the documented real path is
-   * AiChatService.stream's safety-net catch settling the turn to 'error' while a
-   * streamText terminal callback (onFinish/onAbort/onError) ALSO settles it. The
-   * `settled.has` check alone is NOT a gate: it is read BEFORE the awaited UPDATE,
-   * so two callers can both see `false` and both write the row (last-write-wins
-   * clobbers the real terminal status, and the bounded retry only widens that
-   * window). The claim therefore happens via `active.delete`, a SYNCHRONOUS
-   * check-and-clear with NO await between the gate and the entry removal: the
-   * second concurrent caller finds the entry already gone and returns in the same
-   * tick, before any UPDATE. The transition "nobody is finalizing" -> "I am
-   * finalizing" is thus a single atomic step.
-   *
-   * ORDER MATTERS (F6): once we own the claim, the terminal UPDATE happens FIRST;
-   * only once it SUCCEEDS do we record the run as settled. If the UPDATE fails on
-   * every bounded attempt we RESTORE the in-memory entry, leave the run UNsettled,
-   * and emit an ERROR signal that the row is left non-terminal 'running' (which
-   * would 409 every future turn in the chat until recovery). An in-process retry
-   * by a LATER settle is only POSSIBLE, never guaranteed: it needs (a) the entry
-   * to have been restored at the give-up path AND (b) a fresh settler to arrive
-   * AFTER that restore. A concurrent settler that arrives DURING the retry window
-   * — while the entry is deleted for backoff and not yet restored — is consumed at
-   * the synchronous `active.delete` claim (it finds nothing to delete and returns
-   * a no-op), so it does NOT become an in-process retrier. The NO-streamText path
-   * (the turn threw before streamText was wired, so ONLY the safety-net ever
-   * settles) likewise has no second in-process settler at all. The UNCONDITIONAL
-   * backstop in every case is the boot sweep on the next restart (phase 1 has no
-   * periodic in-process sweep); the retained entry is bounded (cleared on restart)
-   * and harmless meanwhile.
-   *
-   * IDEMPOTENT on SUCCESS (#184 review): the terminal write happens AT MOST ONCE
-   * per run. After a successful write the once-gate keys off {@link settled} (the
-   * terminal row already written) so a settle arriving AFTER the entry was already
-   * dropped-and-settled returns early; a settle racing the in-flight write is
-   * stopped earlier still, by the `active.delete` claim. Either way a genuine
-   * double-settle collapses to a single write and a late settle can never clobber
-   * the real terminal status or double-write the row.
-   */
-  async finalizeRun(
-    runId: string,
-    workspaceId: string,
-    turnStatus: TurnTerminalStatus,
-    error?: string,
-  ): Promise<void> {
-    // ---- Atomic once-claim (synchronous; NO await before the gate closes) ----
-    // Already terminally written -> idempotent no-op.
-    if (this.settled.has(runId)) return;
-    // Capture the entry BEFORE the delete so a total-failure path can restore it.
-    const entry = this.active.get(runId);
-    // SYNCHRONOUS check-and-clear: the FIRST caller deletes (claims) the entry;
-    // any concurrent SECOND caller finds nothing to delete and returns HERE, in
-    // the same tick, before any await — so it can never reach the UPDATE.
-    if (!this.active.delete(runId)) return;
-
-    let lastError: unknown;
-    for (
-      let attempt = 1;
-      attempt <= AiChatRunService.FINALIZE_MAX_ATTEMPTS;
-      attempt++
-    ) {
-      try {
-        await this.runRepo.update(runId, workspaceId, {
-          status: mapTurnStatusToRun(turnStatus),
-          finishedAt: new Date(),
-          error: error ?? null,
-        });
-        // Terminal write landed: arm the once-gate. The entry is already gone
-        // (claimed above); we do NOT restore it. The slot is now free.
-        this.settled.add(runId);
-        return;
-      } catch (err) {
-        lastError = err;
-        this.logger.warn(
-          `Failed to finalize run ${runId} (attempt ${attempt}/${
-            AiChatRunService.FINALIZE_MAX_ATTEMPTS
-          }): ${err instanceof Error ? err.message : 'unknown error'}`,
-        );
-        if (attempt < AiChatRunService.FINALIZE_MAX_ATTEMPTS) {
-          await this.delay(AiChatRunService.FINALIZE_RETRY_BASE_MS * attempt);
-        }
-      }
-    }
-    // Every attempt failed: this is a give-up, materially worse than a per-attempt
-    // blip — the row is left NON-TERMINAL ('running'), so emit ONE explicit,
-    // greppable ERROR so an operator can tell "survived a blip" from "gave up, run
-    // held in memory until recovery" (the last warn alone says only "attempt 3/3").
-    this.logger.error(
-      `Run ${runId} (chat ${entry?.chatId ?? 'unknown'}) left NON-TERMINAL ` +
-        `('running'): terminal write failed after ${
-          AiChatRunService.FINALIZE_MAX_ATTEMPTS
-        } attempts; entry retained in memory, recovery deferred to next settle / ` +
-        `boot sweep`,
-      lastError,
-    );
-    // RESTORE the claimed entry (and leave the run UNsettled) so a LATER settle
-    // that arrives AFTER this restore MAY retry the terminal write — but that
-    // in-process retry is NOT guaranteed (a concurrent settler caught in the retry
-    // window above is consumed at the `active.delete` claim, and the no-streamText
-    // path has no second settler at all). The UNCONDITIONAL backstop in every case
-    // is the boot sweep on the next restart; the restored entry is bounded and
-    // cleared on restart.
-    if (entry) this.active.set(runId, entry);
-  }
-
-  /** Small async backoff between terminal-write retries (F6). Isolated so it is
-   *  trivial to stub/fake-time in tests. */
-  private delay(ms: number): Promise<void> {
-    return new Promise((resolve) => setTimeout(resolve, ms));
-  }
-
-  /**
-   * Request an EXPLICIT stop of a run (the user pressed Stop). This is the ONLY
-   * thing that aborts a run — distinct from a browser disconnect, which leaves
-   * the run going. Aborts the in-process controller FIRST (the only thing that
-   * actually stops the run, if this replica owns it), then makes a best-effort
-   * attempt to stamp `stop_requested_at` — that audit write stamps only while the
-   * row is active and may be skipped on a DB error or lost to the finalize race,
-   * which is acceptable since the row still settles as 'aborted'. Returns true
-   * when a stop took effect (row marked and/or controller aborted), false when
-   * there was nothing active to stop.
-   */
-  async requestStop(runId: string, workspaceId: string): Promise<boolean> {
-    const entry = this.active.get(runId);
-    if (entry) {
-      // Abort the live turn FIRST -> streamText onAbort fires -> the partial is
-      // persisted (#183) and finalizeRun settles the row as 'aborted'. This is
-      // the ONLY thing that aborts a run, so it MUST NOT be hostage to the audit
-      // write below: a transient failure on `markStopRequested` (pool exhaustion,
-      // deadlock, dropped connection) must never leave the run executing despite
-      // an explicit Stop. At worst only the `stop_requested_at` timestamp is lost.
-      entry.controller.abort();
-    }
-    // Record `stop_requested_at` (best-effort). A transient DB failure here is
-    // logged and treated as `marked = false`; the abort above already took
-    // effect, so we never rethrow and skip stopping the run. Note: because
-    // markStopRequested only stamps while the row is active, aborting first means
-    // even a healthy write can lose the race against the resulting finalize and
-    // skip the stamp — acceptable, as the row still settles as 'aborted' and only
-    // this audit timestamp may be lost.
-    let marked: unknown;
-    try {
-      marked = await this.runRepo.markStopRequested(runId, workspaceId);
-    } catch (err) {
-      marked = undefined;
-      this.logger.warn(
-        `requestStop: markStopRequested failed for run ${runId} ` +
-          `(stop_requested_at not recorded); abort already issued: ` +
-          `${err instanceof Error ? err.message : String(err)}`,
-      );
-    }
-    return Boolean(marked) || Boolean(entry);
-  }
-
-  /** Latest persisted run for a chat — the reconnect target (an in-flight or
-   *  finished run). Pure read-through to the repo. */
-  getLatestForChat(
-    chatId: string,
-    workspaceId: string,
-  ): Promise<AiChatRun | undefined> {
-    return this.runRepo.findLatestByChat(chatId, workspaceId);
-  }
-
-  /** Fetch a run by id (workspace-scoped). Used to resolve + ownership-check an
-   *  explicit stop targeting a runId. */
-  getRun(runId: string, workspaceId: string): Promise<AiChatRun | undefined> {
-    return this.runRepo.findById(runId, workspaceId);
-  }
-
-  /** The active run on a chat, if any (used to reject a concurrent start with a
-   *  clean 409 before committing to the stream). */
-  getActiveForChat(
-    chatId: string,
-    workspaceId: string,
-  ): Promise<AiChatRun | undefined> {
-    return this.runRepo.findActiveByChat(chatId, workspaceId);
-  }
-
-  /** Test/diagnostic seam: whether this replica is holding a live controller for
-   *  the run. */
-  isLocallyActive(runId: string): boolean {
-    return this.active.has(runId);
-  }
-}

apps/server/src/core/ai-chat/ai-chat.controller.bound-chat.spec.ts

@@ -25,7 +25,6 @@ describe('AiChatController.boundChat', () => {
     };
     const controller = new AiChatController(
       {} as never,
-      {} as never, // aiChatRunService
       aiChatRepo as never,
       {} as never,
       {} as never,

apps/server/src/core/ai-chat/ai-chat.controller.export.spec.ts

@@ -53,7 +53,6 @@ describe('AiChatController.export', () => {
     };
     const controller = new AiChatController(
       {} as never,
-      {} as never, // aiChatRunService
       aiChatRepo as never,
       aiChatMessageRepo as never,
       {} as never,

apps/server/src/core/ai-chat/ai-chat.controller.run.spec.ts

@@ -1,164 +0,0 @@
-import { BadRequestException, ForbiddenException } from '@nestjs/common';
-import { AiChatController } from './ai-chat.controller';
-import type { User, Workspace } from '@docmost/db/types/entity.types';
-
-/**
- * Wiring spec for the #184 run-reconnect / run-stop endpoints
- * (`POST /ai-chat/run` and `POST /ai-chat/stop`). Both are OWNER-gated via
- * assertOwnedChat (the requesting user must own the chat) and NOT flag-gated.
- * Exercised with hand-rolled mocks — no Nest graph, no DB. The controller's
- * constructor order is (aiChatService, aiChatRunService, aiChatRepo,
- * aiChatMessageRepo, aiTranscription).
- */
-describe('AiChatController run endpoints (#184)', () => {
-  const user = { id: 'u1' } as User;
-  const workspace = { id: 'ws1' } as Workspace;
-
-  function makeController(opts: {
-    chat?: unknown; // what aiChatRepo.findById returns (owner-gate)
-    run?: unknown; // getLatestForChat / getRun result
-    activeRun?: unknown; // getActiveForChat result
-    message?: unknown; // aiChatMessageRepo.findById result
-    stopped?: boolean; // requestStop result
-  }) {
-    const aiChatRunService = {
-      getLatestForChat: jest.fn().mockResolvedValue(opts.run),
-      getRun: jest.fn().mockResolvedValue(opts.run),
-      getActiveForChat: jest.fn().mockResolvedValue(opts.activeRun),
-      requestStop: jest.fn().mockResolvedValue(opts.stopped ?? false),
-    };
-    const aiChatRepo = {
-      findById: jest.fn().mockResolvedValue(opts.chat),
-    };
-    const aiChatMessageRepo = {
-      findById: jest.fn().mockResolvedValue(opts.message),
-    };
-    const controller = new AiChatController(
-      {} as never, // aiChatService
-      aiChatRunService as never,
-      aiChatRepo as never,
-      aiChatMessageRepo as never,
-      {} as never, // aiTranscription
-      {} as never, // pageRepo
-    );
-    return { controller, aiChatRunService, aiChatRepo, aiChatMessageRepo };
-  }
-
-  describe('POST /ai-chat/run (getRun)', () => {
-    it('owner-gates: a chat the user does not own throws ForbiddenException', async () => {
-      const { controller, aiChatRunService } = makeController({
-        chat: { id: 'c1', creatorId: 'someone-else' },
-      });
-      await expect(
-        controller.getRun({ chatId: 'c1' }, user, workspace),
-      ).rejects.toBeInstanceOf(ForbiddenException);
-      // It must NOT reach the run lookup once the owner-gate fails.
-      expect(aiChatRunService.getLatestForChat).not.toHaveBeenCalled();
-    });
-
-    it('returns { run: null, message: null } when the chat has never had a run', async () => {
-      const { controller, aiChatRunService } = makeController({
-        chat: { id: 'c1', creatorId: 'u1' },
-        run: undefined,
-      });
-      const res = await controller.getRun({ chatId: 'c1' }, user, workspace);
-      expect(res).toEqual({ run: null, message: null });
-      expect(aiChatRunService.getLatestForChat).toHaveBeenCalledWith(
-        'c1',
-        'ws1',
-      );
-    });
-
-    it('returns the run and its projected assistant message', async () => {
-      const run = { id: 'run-1', chatId: 'c1', assistantMessageId: 'm1' };
-      const message = { id: 'm1', role: 'assistant' };
-      const { controller, aiChatMessageRepo } = makeController({
-        chat: { id: 'c1', creatorId: 'u1' },
-        run,
-        message,
-      });
-      const res = await controller.getRun({ chatId: 'c1' }, user, workspace);
-      expect(res).toEqual({ run, message });
-      expect(aiChatMessageRepo.findById).toHaveBeenCalledWith('m1', 'ws1');
-    });
-
-    it('returns message: null when the run has no linked assistant message', async () => {
-      const run = { id: 'run-1', chatId: 'c1', assistantMessageId: null };
-      const { controller, aiChatMessageRepo } = makeController({
-        chat: { id: 'c1', creatorId: 'u1' },
-        run,
-      });
-      const res = await controller.getRun({ chatId: 'c1' }, user, workspace);
-      expect(res).toEqual({ run, message: null });
-      expect(aiChatMessageRepo.findById).not.toHaveBeenCalled();
-    });
-  });
-
-  describe('POST /ai-chat/stop (stopRun)', () => {
-    it('throws BadRequestException when neither runId nor chatId is given', async () => {
-      const { controller } = makeController({});
-      await expect(
-        controller.stopRun({}, user, workspace),
-      ).rejects.toBeInstanceOf(BadRequestException);
-    });
-
-    it('stops by runId: owner-gates via the run’s chat, then requests the stop', async () => {
-      const { controller, aiChatRunService, aiChatRepo } = makeController({
-        run: { id: 'run-1', chatId: 'c1' },
-        chat: { id: 'c1', creatorId: 'u1' },
-        stopped: true,
-      });
-      const res = await controller.stopRun({ runId: 'run-1' }, user, workspace);
-      expect(res).toEqual({ stopped: true });
-      expect(aiChatRunService.getRun).toHaveBeenCalledWith('run-1', 'ws1');
-      expect(aiChatRepo.findById).toHaveBeenCalledWith('c1', 'ws1');
-      expect(aiChatRunService.requestStop).toHaveBeenCalledWith('run-1', 'ws1');
-    });
-
-    it('stops by runId: a foreign run’s chat throws ForbiddenException (no stop)', async () => {
-      const { controller, aiChatRunService } = makeController({
-        run: { id: 'run-1', chatId: 'c1' },
-        chat: { id: 'c1', creatorId: 'someone-else' },
-      });
-      await expect(
-        controller.stopRun({ runId: 'run-1' }, user, workspace),
-      ).rejects.toBeInstanceOf(ForbiddenException);
-      expect(aiChatRunService.requestStop).not.toHaveBeenCalled();
-    });
-
-    it('stops by runId: an unknown run reports { stopped: false }', async () => {
-      const { controller, aiChatRunService } = makeController({
-        run: undefined,
-      });
-      const res = await controller.stopRun({ runId: 'gone' }, user, workspace);
-      expect(res).toEqual({ stopped: false });
-      expect(aiChatRunService.requestStop).not.toHaveBeenCalled();
-    });
-
-    it('stops by chatId: owner-gates, resolves the active run, requests the stop', async () => {
-      const { controller, aiChatRunService, aiChatRepo } = makeController({
-        chat: { id: 'c1', creatorId: 'u1' },
-        activeRun: { id: 'run-9' },
-        stopped: true,
-      });
-      const res = await controller.stopRun({ chatId: 'c1' }, user, workspace);
-      expect(res).toEqual({ stopped: true });
-      expect(aiChatRepo.findById).toHaveBeenCalledWith('c1', 'ws1');
-      expect(aiChatRunService.getActiveForChat).toHaveBeenCalledWith(
-        'c1',
-        'ws1',
-      );
-      expect(aiChatRunService.requestStop).toHaveBeenCalledWith('run-9', 'ws1');
-    });
-
-    it('stops by chatId: reports { stopped: false } when no run is active', async () => {
-      const { controller, aiChatRunService } = makeController({
-        chat: { id: 'c1', creatorId: 'u1' },
-        activeRun: undefined,
-      });
-      const res = await controller.stopRun({ chatId: 'c1' }, user, workspace);
-      expect(res).toEqual({ stopped: false });
-      expect(aiChatRunService.requestStop).not.toHaveBeenCalled();
-    });
-  });
-});

apps/server/src/core/ai-chat/ai-chat.controller.ts

@@ -1,7 +1,6 @@
 import {
   BadRequestException,
   Body,
-  ConflictException,
   Controller,
   ForbiddenException,
   HttpCode,
@@ -21,13 +20,7 @@ import { JwtAuthGuard } from '../../common/guards/jwt-auth.guard';
 import { AuthUser } from '../../common/decorators/auth-user.decorator';
 import { AuthWorkspace } from '../../common/decorators/auth-workspace.decorator';
 import { SkipTransform } from '../../common/decorators/skip-transform.decorator';
-import {
+import { AiChat, User, Workspace } from '@docmost/db/types/entity.types';
-  AiChat,
-  AiChatMessage,
-  AiChatRun,
-  User,
-  Workspace,
-} from '@docmost/db/types/entity.types';
 import { PaginationOptions } from '@docmost/db/pagination/pagination-options';
 import { AiChatRepo } from '@docmost/db/repos/ai-chat/ai-chat.repo';
 import { AiChatMessageRepo } from '@docmost/db/repos/ai-chat/ai-chat-message.repo';
@@ -35,12 +28,7 @@ import { PageRepo } from '@docmost/db/repos/page/page.repo';
 import { UserThrottlerGuard } from '../../integrations/throttle/user-throttler.guard';
 import { AI_CHAT_THROTTLER } from '../../integrations/throttle/throttler-names';
 import { FileInterceptor } from '../../common/interceptors/file.interceptor';
-import {
+import { AiChatService, AiChatStreamBody } from './ai-chat.service';
-  AiChatRunHooks,
-  AiChatService,
-  AiChatStreamBody,
-} from './ai-chat.service';
-import { AiChatRunService } from './ai-chat-run.service';
 import { AiTranscriptionService } from './ai-transcription.service';
 import {
   BoundChatDto,
@@ -48,9 +36,7 @@ import {
   ExportChatDto,
   GeneratePageTitleDto,
   GetChatMessagesDto,
-  GetRunDto,
   RenameChatDto,
-  StopRunDto,
 } from './dto/ai-chat.dto';
 import { describeProviderError } from '../../integrations/ai/ai-error.util';
 import { buildChatMarkdown } from './chat-markdown.util';
@@ -67,7 +53,6 @@ export class AiChatController {
 
   constructor(
     private readonly aiChatService: AiChatService,
-    private readonly aiChatRunService: AiChatRunService,
     private readonly aiChatRepo: AiChatRepo,
     private readonly aiChatMessageRepo: AiChatMessageRepo,
     private readonly aiTranscription: AiTranscriptionService,
@@ -164,75 +149,6 @@ export class AiChatController {
     return { markdown };
   }
 
-  /**
-   * Reconnect to the latest run of a chat (#184 phase 1). Returns the run's
-   * persisted lifecycle state ({ status, error, stepCount, timings, ... }) plus
-   * the assistant message it projects (the partial/final output) — the DB is the
-   * source of truth, so this works for an in-flight run (the browser dropped, the
-   * run kept going) and a finished one alike. Owner-gated via assertOwnedChat.
-   * `{ run: null }` when the chat has never had a run.
-   */
-  @HttpCode(HttpStatus.OK)
-  @Post('run')
-  async getRun(
-    @Body() dto: GetRunDto,
-    @AuthUser() user: User,
-    @AuthWorkspace() workspace: Workspace,
-  ): Promise<{ run: AiChatRun | null; message: AiChatMessage | null }> {
-    await this.assertOwnedChat(dto.chatId, user, workspace);
-    const run = await this.aiChatRunService.getLatestForChat(
-      dto.chatId,
-      workspace.id,
-    );
-    if (!run) return { run: null, message: null };
-    const message = run.assistantMessageId
-      ? await this.aiChatMessageRepo.findById(
-          run.assistantMessageId,
-          workspace.id,
-        )
-      : undefined;
-    return { run, message: message ?? null };
-  }
-
-  /**
-   * Explicitly STOP an agent run (#184 phase 1) — the user pressed Stop. This is
-   * the ONLY thing that ends a detached run; a browser disconnect deliberately
-   * does not. Target by `runId` (from the streamed start metadata) or by `chatId`
-   * (stop whatever run is active on it). Owner-gated. Returns
-   * `{ stopped }` — false when there was nothing active to stop.
-   */
-  @HttpCode(HttpStatus.OK)
-  @Post('stop')
-  async stopRun(
-    @Body() dto: StopRunDto,
-    @AuthUser() user: User,
-    @AuthWorkspace() workspace: Workspace,
-  ): Promise<{ stopped: boolean }> {
-    let runId = dto.runId;
-    if (!runId && !dto.chatId) {
-      throw new BadRequestException('runId or chatId is required');
-    }
-    if (runId) {
-      // Resolve the run to its chat and owner-gate via that chat.
-      const run = await this.aiChatRunService.getRun(runId, workspace.id);
-      if (!run) return { stopped: false };
-      await this.assertOwnedChat(run.chatId, user, workspace);
-    } else {
-      await this.assertOwnedChat(dto.chatId!, user, workspace);
-      const active = await this.aiChatRunService.getActiveForChat(
-        dto.chatId!,
-        workspace.id,
-      );
-      if (!active) return { stopped: false };
-      runId = active.id;
-    }
-    const stopped = await this.aiChatRunService.requestStop(
-      runId,
-      workspace.id,
-    );
-    return { stopped };
-  }
-
   /** Rename a chat. */
   @HttpCode(HttpStatus.OK)
   @Post('rename')
@@ -284,20 +200,11 @@ export class AiChatController {
     @AuthWorkspace() workspace: Workspace,
   ): Promise<void> {
     // A7 gate: the workspace must have AI chat explicitly enabled.
-    const settings = (workspace.settings ?? {}) as {
+    const settings = (workspace.settings ?? {}) as { ai?: { chat?: boolean } };
-      ai?: { chat?: boolean; autonomousRuns?: boolean };
-    };
     if (settings.ai?.chat !== true) {
       throw new ForbiddenException('AI chat is disabled');
     }
 
-    // #184 phase 1 flag: when ON, the turn becomes a detached, durable RUN — its
-    // lifecycle is tracked in ai_chat_runs, a browser disconnect no longer aborts
-    // it, and only an explicit /ai-chat/stop ends it. When OFF (the default) the
-    // turn is socket-bound exactly as before, so existing deployments are
-    // unaffected.
-    const autonomousRuns = settings.ai?.autonomousRuns === true;
-
     const sessionId = (req.raw as { sessionId?: string }).sessionId;
     if (!sessionId) {
       // The chat requires an interactive session to mint loopback tokens
@@ -321,58 +228,6 @@ export class AiChatController {
     // HttpException) instead of breaking mid-stream.
     const model = await this.aiChatService.getChatModel(workspace.id, role);
 
-    // #184: one active run per chat. For an EXISTING chat reject a concurrent
-    // start with a clean 409 BEFORE hijack (the common double-submit / second-tab
-    // case), so the user gets JSON, not a mid-stream error. A brand-new chat
-    // (no chatId) cannot have a prior run, and the DB partial unique index is the
-    // backstop against any race that slips past this check.
-    if (autonomousRuns && body.chatId) {
-      const active = await this.aiChatRunService.getActiveForChat(
-        body.chatId,
-        workspace.id,
-      );
-      if (active) {
-        throw new ConflictException({
-          message: 'An agent run is already in progress for this chat',
-          code: 'A_RUN_ALREADY_ACTIVE',
-        });
-      }
-    }
-
-    // Run-lifecycle hooks (#184), only when the flag is on. They wrap the turn in
-    // a durable run whose abort is governed by the run (explicit stop), persist
-    // its progress, and settle its terminal status — see AiChatRunService.
-    const runHooks: AiChatRunHooks | undefined = autonomousRuns
-      ? {
-          begin: (chatId) =>
-            this.aiChatRunService.beginRun({
-              chatId,
-              workspaceId: workspace.id,
-              userId: user.id,
-              trigger: 'user',
-            }),
-          onAssistantSeeded: (runId, messageId) =>
-            this.aiChatRunService.linkAssistantMessage(
-              runId,
-              workspace.id,
-              messageId,
-            ),
-          onStep: (runId, stepCount) =>
-            void this.aiChatRunService.recordStep(
-              runId,
-              workspace.id,
-              stepCount,
-            ),
-          onSettled: (runId, status, error) =>
-            this.aiChatRunService.finalizeRun(
-              runId,
-              workspace.id,
-              status,
-              error,
-            ),
-        }
-      : undefined;
-
     // Abort the agent loop when the client disconnects. `close` also fires on
     // normal completion, so only abort when the response has not finished
     // writing (a genuine disconnect). `once` fires at most once and self-removes;
@@ -387,44 +242,18 @@ export class AiChatController {
       // A genuine disconnect leaves the response unfinished (unlike a normal
       // completion, which also fires `close`). Such a drop — e.g. a reverse
       // proxy cutting the SSE mid-answer — is otherwise invisible server-side,
-      // so log it here.
+      // so log it here before aborting the agent loop.
       if (!res.raw.writableEnded) {
-        if (autonomousRuns) {
+        this.logger.warn(
-          // #184: the turn is a DETACHED run. A disconnect must NOT abort it —
+          `AI chat stream: client disconnected before completion; aborting turn ` +
-          // the run keeps executing and persisting server-side; the client
+            `(elapsed=${Date.now() - reqStartedAt}ms since request received)`,
-          // reconnects via /ai-chat/run (or re-stops via /ai-chat/stop). Log only.
+        );
-          this.logger.log(
+        controller.abort();
-            `AI chat stream: client disconnected; run continues server-side ` +
-              `(elapsed=${Date.now() - reqStartedAt}ms since request received)`,
-          );
-        } else {
-          this.logger.warn(
-            `AI chat stream: client disconnected before completion; aborting turn ` +
-              `(elapsed=${Date.now() - reqStartedAt}ms since request received)`,
-          );
-          controller.abort();
-        }
       }
     };
     req.raw.once('close', onClose);
     res.raw.once('finish', () => req.raw.off('close', onClose));
 
-    // #184: in detached mode the turn is NOT aborted on disconnect, so the SDK's
-    // pipe keeps writing to a socket the client may have dropped — for the rest of
-    // the (continuing) run. A write to the dead socket can emit an 'error' on the
-    // raw response; without a listener that surfaces as an unhandled error event.
-    // Swallow it (the run continues server-side regardless). Legacy mode aborts on
-    // disconnect, so it does not need this and keeps its exact prior behavior.
-    if (autonomousRuns) {
-      res.raw.on('error', (err) => {
-        this.logger.debug(
-          `AI chat detached stream: post-disconnect socket error swallowed: ${
-            err instanceof Error ? err.message : String(err)
-          }`,
-        );
-      });
-    }
-
     // Commit to streaming: hijack so Fastify stops managing the response and
     // the AI SDK can write the UI-message stream directly to the Node socket.
     res.hijack();
@@ -439,32 +268,15 @@ export class AiChatController {
         signal: controller.signal,
         model,
         role,
-        // #184: present only when the flag is on; wraps the turn in a durable run.
-        runHooks,
       });
     } catch (err) {
-      // Any failure AFTER hijack can no longer go through Nest's exception
+      // Any failure AFTER hijack can no longer send a clean JSON error, so emit
-      // filter, so emit the error on the raw socket if nothing has been written
+      // a minimal error on the raw socket if nothing has been written yet.
-      // yet. The lost-the-race 409 (RunAlreadyActiveError -> ConflictException)
+      this.logger.error('AI chat stream failed', err as Error);
-      // is raised by stream() BEFORE it writes a byte, so headers are still
-      // unsent here: honor the HttpException's real status + body (a clean 409),
-      // not a blanket 500. Everything else stays a 500.
-      const isHttp = err instanceof HttpException;
-      if (!isHttp) {
-        this.logger.error('AI chat stream failed', err as Error);
-      }
       if (!res.raw.headersSent) {
-        const status = isHttp ? err.getStatus() : 500;
+        res.raw.statusCode = 500;
-        const payload = isHttp
-          ? err.getResponse()
-          : { error: 'Internal server error' };
-        res.raw.statusCode = status;
         res.raw.setHeader('Content-Type', 'application/json');
-        res.raw.end(
+        res.raw.end(JSON.stringify({ error: 'Internal server error' }));
-          JSON.stringify(
-            typeof payload === 'string' ? { message: payload } : payload,
-          ),
-        );
       } else if (!res.raw.writableEnded) {
         res.raw.end();
       }

apps/server/src/core/ai-chat/ai-chat.generate-page-title.spec.ts

@@ -57,7 +57,6 @@ describe('AiChatController.generatePageTitle', () => {
     const aiChatService = { generatePageTitle: generate };
     const controller = new AiChatController(
       aiChatService as never,
-      {} as never, // aiChatRunService
       {} as never,
       {} as never,
       {} as never,

apps/server/src/core/ai-chat/ai-chat.module.ts

@@ -3,7 +3,6 @@ import { AiModule } from '../../integrations/ai/ai.module';
 import { TokenModule } from '../auth/token.module';
 import { AiChatController } from './ai-chat.controller';
 import { AiChatService } from './ai-chat.service';
-import { AiChatRunService } from './ai-chat-run.service';
 import { AiTranscriptionService } from './ai-transcription.service';
 import { AiChatToolsService } from './tools/ai-chat-tools.service';
 import { EmbeddingModule } from './embedding/embedding.module';
@@ -43,7 +42,6 @@ import { PublicShareChatToolsService } from './tools/public-share-chat-tools.ser
   controllers: [AiChatController, PublicShareChatController],
   providers: [
     AiChatService,
-    AiChatRunService,
     AiTranscriptionService,
     AiChatToolsService,
     PublicShareChatService,

apps/server/src/core/ai-chat/ai-chat.service.lifecycle.spec.ts

@@ -1,7 +1,5 @@
 import { Logger } from '@nestjs/common';
-import { AiChatService, AiChatRunHooks } from './ai-chat.service';
+import { AiChatService } from './ai-chat.service';
-import { AiChatRunService } from './ai-chat-run.service';
-import type { User, Workspace } from '@docmost/db/types/entity.types';
 
 /**
  * Lifecycle unit tests for AiChatService.onModuleInit (#183 crash-recovery
@@ -63,99 +61,3 @@ describe('AiChatService.onModuleInit (startup sweep)', () => {
     expect(String(warnSpy.mock.calls[0][0])).toContain('db unavailable');
   });
 });
-
-/**
- * #184 CRITICAL run-lifecycle safety net (review fix). A transient failure
- * AFTER a successful beginRun but BEFORE streamText's terminal callbacks own the
- * lifecycle must STILL settle the run — otherwise the run row is stuck 'running'
- * forever (sweepRunning only runs at startup) and the partial unique index + the
- * controller pre-check 409 every future turn in that chat until a restart. Here
- * we model the very first bare await after beginRun (the user-message insert)
- * throwing, wiring the run hooks to a REAL AiChatRunService (mock repo) exactly
- * as the controller does, and assert the run is settled to 'error' and its
- * in-memory entry dropped (so a follow-up turn would NOT be 409'd).
- */
-describe('AiChatService.stream run-lifecycle safety net (#184)', () => {
-  const user = { id: 'u1' } as User;
-  const workspace = { id: 'ws1' } as Workspace;
-
-  afterEach(() => jest.restoreAllMocks());
-
-  it('an exception after beginRun settles the run to error and drops the in-memory entry', async () => {
-    jest.spyOn(Logger.prototype, 'error').mockImplementation(() => undefined);
-
-    // Real run service over a mock repo, so finalizeRun's in-memory bookkeeping
-    // (active.delete) is exercised for real.
-    const runRepo = {
-      insert: jest.fn().mockResolvedValue({ id: 'run-1', status: 'running' }),
-      update: jest.fn().mockResolvedValue({ id: 'run-1' }),
-    };
-    const runService = new AiChatRunService(runRepo as never, { isCloud: () => false } as never);
-
-    // The user-message insert (the first bare await after beginRun) throws.
-    const aiChatMessageRepo = {
-      insert: jest.fn().mockRejectedValue(new Error('insert boom')),
-    };
-    const aiChatRepo = {
-      // Existing chat -> chatId stays, no new-chat insert path.
-      findById: jest.fn().mockResolvedValue({ id: 'chat-1', creatorId: 'u1' }),
-    };
-
-    const service = new AiChatService(
-      {} as never, // ai
-      aiChatRepo as never,
-      aiChatMessageRepo as never,
-      {} as never, // aiChatPageSnapshotRepo
-      {} as never, // aiSettings
-      {} as never, // tools
-      {} as never, // mcpClients
-      {} as never, // aiAgentRoleRepo
-      {} as never, // pageRepo
-      {} as never, // pageAccess
-      {} as never, // environment
-    );
-
-    const runHooks: AiChatRunHooks = {
-      begin: (chatId) =>
-        runService.beginRun({
-          chatId,
-          workspaceId: workspace.id,
-          userId: user.id,
-          trigger: 'user',
-        }),
-      onSettled: (runId, status, error) =>
-        runService.finalizeRun(runId, workspace.id, status, error),
-    };
-
-    await expect(
-      service.stream({
-        user,
-        workspace,
-        sessionId: 'sess',
-        body: {
-          chatId: 'chat-1',
-          messages: [
-            { id: 'm', role: 'user', parts: [{ type: 'text', text: 'hi' }] },
-          ],
-        },
-        res: {} as never,
-        signal: new AbortController().signal,
-        model: {} as never,
-        role: null,
-        runHooks,
-      }),
-    ).rejects.toThrow('insert boom');
-
-    // The run was begun...
-    expect(runRepo.insert).toHaveBeenCalledTimes(1);
-    // ...then settled to a terminal FAILED status by the safety net...
-    expect(runRepo.update).toHaveBeenCalledTimes(1);
-    expect(runRepo.update).toHaveBeenCalledWith(
-      'run-1',
-      'ws1',
-      expect.objectContaining({ status: 'failed' }),
-    );
-    // ...and the in-memory entry is gone, so a follow-up turn is NOT 409'd.
-    expect(runService.isLocallyActive('run-1')).toBe(false);
-  });
-});

apps/server/src/core/ai-chat/ai-chat.service.run-race.spec.ts

@@ -1,489 +0,0 @@
-import { ConflictException, Logger } from '@nestjs/common';
-
-// Mock the AI SDK so we can PROVE no provider call is made for the turn we are
-// about to reject. The race rejection happens at runHooks.begin(), long before
-// any streamText/generateText, so these never resolve a real model.
-jest.mock('ai', () => ({
-  streamText: jest.fn(),
-  generateText: jest.fn(),
-  convertToModelMessages: jest.fn(() => []),
-  stepCountIs: jest.fn(() => () => false),
-}));
-
-import { streamText, generateText } from 'ai';
-import { AiChatService } from './ai-chat.service';
-import { RunAlreadyActiveError } from './ai-chat-run.service';
-
-/**
- * Race-closure coverage for the "one active run per chat" guard (#184).
- *
- * THE BUG: two simultaneous POST /ai-chat/stream on the same chat both pass the
- * controller's cheap pre-check (TOCTOU), so the loser's run-row INSERT hits the
- * partial unique index. Previously that 23505 was SWALLOWED and the second turn
- * streamed UNTRACKED (no runId, not stoppable). THE FIX: beginRun surfaces a
- * RunAlreadyActiveError and stream() turns it into a 409 BEFORE any AI call —
- * the second turn never runs.
- */
-describe('AiChatService.stream — concurrent-run race rejection (#184)', () => {
-  const streamTextMock = streamText as unknown as jest.Mock;
-  const generateTextMock = generateText as unknown as jest.Mock;
-
-  beforeEach(() => {
-    streamTextMock.mockReset();
-    generateTextMock.mockReset();
-  });
-
-  // Minimal service whose only reachable deps before begin() are aiChatRepo
-  // (resolve the existing chat) — everything past begin must remain untouched.
-  function makeService(beginImpl: () => Promise<unknown>) {
-    const aiChatMessageRepo = { insert: jest.fn() };
-    const aiChatRepo = {
-      // An existing chat: stream keeps the supplied chatId and skips creation.
-      findById: jest.fn(async () => ({ id: 'chat-1', workspaceId: 'ws-1' })),
-      insert: jest.fn(),
-    };
-    const svc = new AiChatService(
-      {} as never, // ai
-      aiChatRepo as never,
-      aiChatMessageRepo as never,
-      {} as never, // aiChatPageSnapshotRepo
-      {} as never, // aiSettings
-      {} as never, // tools
-      {} as never, // mcpClients
-      {} as never, // aiAgentRoleRepo
-      {} as never, // pageRepo
-      {} as never, // pageAccess
-      { isAiChatDeferredToolsEnabled: () => false } as never, // environment
-    );
-    const begin = jest.fn(beginImpl);
-    return { svc, begin, aiChatRepo, aiChatMessageRepo };
-  }
-
-  const baseArgs = (begin: jest.Mock) => ({
-    user: { id: 'user-1' } as never,
-    workspace: { id: 'ws-1' } as never,
-    sessionId: 'sess-1',
-    body: { chatId: 'chat-1', messages: [] } as never,
-    res: { raw: {} } as never,
-    signal: new AbortController().signal,
-    model: {} as never,
-    role: null,
-    runHooks: {
-      begin,
-      onAssistantSeeded: jest.fn(),
-      onStep: jest.fn(),
-      onSettled: jest.fn(),
-    } as never,
-  });
-
-  it('rejects the racer with a 409 ConflictException BEFORE any AI call, and never persists an untracked turn', async () => {
-    // begin loses the unique-index race -> RunAlreadyActiveError.
-    const { svc, begin, aiChatMessageRepo } = makeService(() => {
-      throw new RunAlreadyActiveError('chat-1');
-    });
-
-    const promise = svc.stream(baseArgs(begin));
-
-    await expect(promise).rejects.toBeInstanceOf(ConflictException);
-    await promise.catch((err: ConflictException) => {
-      expect(err.getStatus()).toBe(409);
-      expect((err.getResponse() as { code?: string }).code).toBe(
-        'A_RUN_ALREADY_ACTIVE',
-      );
-    });
-
-    // The decisive assertions: the rejected racer spent NO tokens and left NO
-    // untracked turn behind.
-    expect(begin).toHaveBeenCalledTimes(1);
-    expect(streamTextMock).not.toHaveBeenCalled();
-    expect(generateTextMock).not.toHaveBeenCalled();
-    expect(aiChatMessageRepo.insert).not.toHaveBeenCalled();
-  });
-});
-
-/**
- * F3 — the LOAD-BEARING run-detach wiring: `effectiveSignal = handle.signal`
- * after runHooks.begin, then `abortSignal: effectiveSignal` passed to streamText.
- * That single line is what makes a run survive a browser disconnect (the agent
- * loop's abort is governed by the RUN's signal, not the socket): a regression to
- * the socket-bound signal would still pass every other test green while silently
- * breaking Stop + durability. These two tests pin the exact signal streamText
- * consumes on both paths.
- */
-describe('AiChatService.stream — abortSignal wiring (#184 F3)', () => {
-  const streamTextMock = streamText as unknown as jest.Mock;
-
-  // A streamText result stub: the post-call drain + pipe are no-ops here; we only
-  // care WHICH abortSignal streamText was handed.
-  function makeStreamResult() {
-    return {
-      consumeStream: jest.fn(),
-      pipeUIMessageStreamToResponse: jest.fn(),
-    };
-  }
-
-  // A raw-response stub sufficient for the post-streamText wiring
-  // (stripStreamingHopByHopHeaders binds writeHead; startSseHeartbeat registers
-  // close/finish listeners; flushHeaders is belt-and-braces).
-  function makeRes() {
-    return {
-      raw: {
-        writeHead: jest.fn(),
-        write: jest.fn(),
-        once: jest.fn(),
-        on: jest.fn(),
-        flushHeaders: jest.fn(),
-        writableEnded: false,
-        destroyed: false,
-      },
-    };
-  }
-
-  // Wire only the deps reached on the way to streamText: resolve the existing
-  // chat, persist the user + seed the assistant row, load (empty) history, the
-  // admin settings, an empty external toolset + Docmost toolset.
-  function makeService() {
-    const aiChatRepo = {
-      findById: jest.fn(async () => ({ id: 'chat-1', workspaceId: 'ws-1' })),
-      insert: jest.fn(),
-    };
-    const aiChatMessageRepo = {
-      insert: jest.fn(async () => ({ id: 'msg-1' })),
-      findAllByChat: jest.fn(async () => []),
-      update: jest.fn(async () => ({ id: 'msg-1' })),
-    };
-    const aiSettings = { resolve: jest.fn(async () => ({})) };
-    const tools = { forUser: jest.fn(async () => ({})) };
-    const mcpClients = {
-      toolsFor: jest.fn(async () => ({
-        tools: {},
-        clients: [],
-        outcomes: [],
-        instructions: [],
-      })),
-    };
-    const svc = new AiChatService(
-      {} as never, // ai
-      aiChatRepo as never,
-      aiChatMessageRepo as never,
-      {} as never, // aiChatPageSnapshotRepo
-      aiSettings as never,
-      tools as never,
-      mcpClients as never,
-      {} as never, // aiAgentRoleRepo
-      {} as never, // pageRepo (openPage undefined -> never touched)
-      {} as never, // pageAccess
-      { isAiChatDeferredToolsEnabled: () => false } as never, // environment
-    );
-    return { svc };
-  }
-
-  const body = {
-    chatId: 'chat-1',
-    messages: [
-      { id: 'm1', role: 'user', parts: [{ type: 'text', text: 'hi' }] },
-    ],
-  };
-
-  beforeEach(() => {
-    streamTextMock.mockReset();
-    streamTextMock.mockImplementation(() => makeStreamResult());
-    jest
-      .spyOn(Logger.prototype, 'log')
-      .mockImplementation(() => undefined as never);
-  });
-
-  afterEach(() => jest.restoreAllMocks());
-
-  it('happy path (run-wrapped): streamText is driven with abortSignal === handle.signal (the RUN signal, NOT the socket)', async () => {
-    const { svc } = makeService();
-    const runController = new AbortController();
-    const runSignal = runController.signal;
-    const socketSignal = new AbortController().signal;
-
-    const begin = jest.fn(async () => ({ runId: 'run-1', signal: runSignal }));
-    await svc.stream({
-      user: { id: 'user-1' } as never,
-      workspace: { id: 'ws-1' } as never,
-      sessionId: 'sess-1',
-      body: body as never,
-      res: makeRes() as never,
-      signal: socketSignal,
-      model: {} as never,
-      role: null,
-      runHooks: {
-        begin,
-        onAssistantSeeded: jest.fn(),
-        onStep: jest.fn(),
-        onSettled: jest.fn(),
-      } as never,
-    });
-
-    expect(begin).toHaveBeenCalledTimes(1);
-    expect(streamTextMock).toHaveBeenCalledTimes(1);
-    // THE assertion: the agent loop's abort is wired to the RUN, so a browser
-    // disconnect (which aborts only `socketSignal`) cannot end the turn.
-    expect(streamTextMock.mock.calls[0][0].abortSignal).toBe(runSignal);
-    expect(streamTextMock.mock.calls[0][0].abortSignal).not.toBe(socketSignal);
-  });
-
-  it('legacy path (no runHooks): streamText is driven with the SOCKET signal', async () => {
-    const { svc } = makeService();
-    const socketSignal = new AbortController().signal;
-
-    await svc.stream({
-      user: { id: 'user-1' } as never,
-      workspace: { id: 'ws-1' } as never,
-      sessionId: 'sess-1',
-      body: body as never,
-      res: makeRes() as never,
-      signal: socketSignal,
-      model: {} as never,
-      role: null,
-      // No runHooks -> the turn stays socket-bound (flag off / default).
-    });
-
-    expect(streamTextMock).toHaveBeenCalledTimes(1);
-    expect(streamTextMock.mock.calls[0][0].abortSignal).toBe(socketSignal);
-  });
-
-  /**
-   * F9 — streamText's TERMINAL callbacks carry the #184 run lifecycle:
-   *   onStepFinish -> runHooks.onStep(runId, stepCount)
-   *   onFinish     -> runHooks.onSettled(runId, 'completed')   (dominant path)
-   *   onAbort      -> runHooks.onSettled(runId, 'aborted')
-   *   onError      -> runHooks.onSettled(runId, 'error', cause)
-   * makeStreamResult() ignores the streamText options, so these callbacks never
-   * fire on their own — a regression in this wiring (esp. the success path) would
-   * strand the run with NO test catching it. Here we CAPTURE the options streamText
-   * was handed and invoke each callback with the real wiring, asserting the run
-   * hooks fire with the right args.
-   */
-  // Drive stream() to the point streamText is called, capturing the options object
-  // (which carries onStepFinish/onFinish/onError/onAbort) and the run hooks.
-  async function captureStreamCallbacks() {
-    const { svc } = makeService();
-    let capturedOpts: any;
-    streamTextMock.mockImplementation((opts: any) => {
-      capturedOpts = opts;
-      return makeStreamResult();
-    });
-    const runHooks = {
-      begin: jest.fn(async () => ({
-        runId: 'run-1',
-        signal: new AbortController().signal,
-      })),
-      onAssistantSeeded: jest.fn(),
-      onStep: jest.fn(),
-      onSettled: jest.fn(),
-    };
-    await svc.stream({
-      user: { id: 'user-1' } as never,
-      workspace: { id: 'ws-1' } as never,
-      sessionId: 'sess-1',
-      body: body as never,
-      res: makeRes() as never,
-      signal: new AbortController().signal,
-      model: {} as never,
-      role: null,
-      runHooks: runHooks as never,
-    });
-    expect(capturedOpts).toBeDefined();
-    return { capturedOpts, runHooks };
-  }
-
-  it('F9: onStepFinish bumps the run step count, onFinish settles the run "completed" (the dominant autonomous-run path)', async () => {
-    const { capturedOpts, runHooks } = await captureStreamCallbacks();
-
-    // A finished step -> onStep(runId, finishedStepCount).
-    capturedOpts.onStepFinish({ text: 'step one', toolCalls: [], content: [] });
-    expect(runHooks.onStep).toHaveBeenCalledWith('run-1', 1);
-    capturedOpts.onStepFinish({ text: 'step two', toolCalls: [], content: [] });
-    expect(runHooks.onStep).toHaveBeenLastCalledWith('run-1', 2);
-
-    // The success terminal callback settles the run.
-    await capturedOpts.onFinish({
-      text: 'done',
-      finishReason: 'stop',
-      totalUsage: {},
-      usage: {},
-      steps: [],
-    });
-    expect(runHooks.onSettled).toHaveBeenCalledWith('run-1', 'completed');
-  });
-
-  it('F9: onAbort settles the run "aborted"', async () => {
-    jest
-      .spyOn(Logger.prototype, 'warn')
-      .mockImplementation(() => undefined as never);
-    const { capturedOpts, runHooks } = await captureStreamCallbacks();
-
-    await capturedOpts.onAbort({ steps: [] });
-    expect(runHooks.onSettled).toHaveBeenCalledWith('run-1', 'aborted');
-  });
-
-  it('F9: onError settles the run "error" carrying the provider cause', async () => {
-    jest
-      .spyOn(Logger.prototype, 'error')
-      .mockImplementation(() => undefined as never);
-    jest
-      .spyOn(Logger.prototype, 'warn')
-      .mockImplementation(() => undefined as never);
-    const { capturedOpts, runHooks } = await captureStreamCallbacks();
-
-    await capturedOpts.onError({ error: new Error('provider exploded') });
-    expect(runHooks.onSettled).toHaveBeenCalledWith(
-      'run-1',
-      'error',
-      expect.stringContaining('provider exploded'),
-    );
-  });
-});
-
-/**
- * F14 — the begin-failure RESILIENCE branch (the `else` of the run-race guard).
- *
- * stream() wraps runHooks.begin in try/catch with TWO branches:
- *   - RunAlreadyActiveError  -> 409 ConflictException (pinned above).
- *   - ANY OTHER begin failure -> SWALLOW + continue UNTRACKED on the socket signal
- *     (legacy fallback): it logs "...streaming without run tracking", leaves
- *     `effectiveSignal = signal` (runId undefined) and serves the turn anyway.
- *
- * The contract: a transient beginRun failure (e.g. a non-unique DB error inserting
- * the run row) must STILL serve the user's turn — it must NOT re-throw and must NOT
- * be misclassified as a 409. A regression that re-threw here would break EVERY turn
- * on a begin failure with nothing to catch it. This branch is otherwise undriven by
- * any spec, so it is pinned here SEPARATELY from the 409 path: a plain begin error
- * proceeds to streamText with the SOCKET signal and still persists the user turn.
- */
-describe('AiChatService.stream — begin-failure resilience / legacy fallback (#184 F14)', () => {
-  const streamTextMock = streamText as unknown as jest.Mock;
-
-  function makeStreamResult() {
-    return {
-      consumeStream: jest.fn(),
-      pipeUIMessageStreamToResponse: jest.fn(),
-    };
-  }
-
-  function makeRes() {
-    return {
-      raw: {
-        writeHead: jest.fn(),
-        write: jest.fn(),
-        once: jest.fn(),
-        on: jest.fn(),
-        flushHeaders: jest.fn(),
-        writableEnded: false,
-        destroyed: false,
-      },
-    };
-  }
-
-  // Same harness as the F3 abortSignal block, but it also exposes
-  // aiChatMessageRepo so we can assert the user turn IS persisted (the turn really
-  // streamed) despite begin() blowing up.
-  function makeService() {
-    const aiChatRepo = {
-      findById: jest.fn(async () => ({ id: 'chat-1', workspaceId: 'ws-1' })),
-      insert: jest.fn(),
-    };
-    const aiChatMessageRepo = {
-      insert: jest.fn(async () => ({ id: 'msg-1' })),
-      findAllByChat: jest.fn(async () => []),
-      update: jest.fn(async () => ({ id: 'msg-1' })),
-    };
-    const aiSettings = { resolve: jest.fn(async () => ({})) };
-    const tools = { forUser: jest.fn(async () => ({})) };
-    const mcpClients = {
-      toolsFor: jest.fn(async () => ({
-        tools: {},
-        clients: [],
-        outcomes: [],
-        instructions: [],
-      })),
-    };
-    const svc = new AiChatService(
-      {} as never, // ai
-      aiChatRepo as never,
-      aiChatMessageRepo as never,
-      {} as never, // aiChatPageSnapshotRepo
-      aiSettings as never,
-      tools as never,
-      mcpClients as never,
-      {} as never, // aiAgentRoleRepo
-      {} as never, // pageRepo
-      {} as never, // pageAccess
-      { isAiChatDeferredToolsEnabled: () => false } as never, // environment
-    );
-    return { svc, aiChatMessageRepo };
-  }
-
-  const body = {
-    chatId: 'chat-1',
-    messages: [
-      { id: 'm1', role: 'user', parts: [{ type: 'text', text: 'hi' }] },
-    ],
-  };
-
-  beforeEach(() => {
-    streamTextMock.mockReset();
-    streamTextMock.mockImplementation(() => makeStreamResult());
-    jest
-      .spyOn(Logger.prototype, 'log')
-      .mockImplementation(() => undefined as never);
-  });
-
-  afterEach(() => jest.restoreAllMocks());
-
-  it('a PLAIN begin() failure (NOT RunAlreadyActiveError) does NOT 409 — it swallows, logs, and streams the turn UNTRACKED on the socket signal', async () => {
-    const errorSpy = jest
-      .spyOn(Logger.prototype, 'error')
-      .mockImplementation(() => undefined as never);
-
-    const { svc, aiChatMessageRepo } = makeService();
-    const socketSignal = new AbortController().signal;
-
-    // A transient, NON-race begin failure (e.g. a non-unique DB error inserting
-    // the run row). This is the `else` branch of the begin try/catch.
-    const begin = jest.fn(async () => {
-      throw new Error('insert failed');
-    });
-
-    const promise = svc.stream({
-      user: { id: 'user-1' } as never,
-      workspace: { id: 'ws-1' } as never,
-      sessionId: 'sess-1',
-      body: body as never,
-      res: makeRes() as never,
-      signal: socketSignal,
-      model: {} as never,
-      role: null,
-      runHooks: {
-        begin,
-        onAssistantSeeded: jest.fn(),
-        onStep: jest.fn(),
-        onSettled: jest.fn(),
-      } as never,
-    });
-
-    // The turn proceeds: NO throw at all (in particular NOT a 409).
-    await expect(promise).resolves.toBeUndefined();
-
-    expect(begin).toHaveBeenCalledTimes(1);
-
-    // The resilience branch logged the legacy-fallback warning.
-    expect(errorSpy).toHaveBeenCalledWith(
-      expect.stringContaining('streaming without run tracking'),
-      expect.anything(),
-    );
-
-    // The turn really streamed: the user message was persisted and streamText ran.
-    expect(aiChatMessageRepo.insert).toHaveBeenCalled();
-    expect(streamTextMock).toHaveBeenCalledTimes(1);
-
-    // The decisive wiring: with no run handle, the fallback uses the SOCKET signal
-    // (effectiveSignal = signal, runId undefined) — not a run-bound signal.
-    expect(streamTextMock.mock.calls[0][0].abortSignal).toBe(socketSignal);
-  });
-});

apps/server/src/core/ai-chat/ai-chat.service.spec.ts

@@ -453,12 +453,6 @@ describe('chatStreamMetadata', () => {
     });
   });
 
-  it('attaches the runId on the start part when a run wraps the turn (#184)', () => {
-    expect(
-      chatStreamMetadata({ type: 'start' }, 'chat-1', undefined, 'run-1'),
-    ).toEqual({ chatId: 'chat-1', runId: 'run-1' });
-  });
-
   it('returns the CUMULATIVE step usage passed in for the finish-step part', () => {
     // finish-step usage is per-step in v6; the caller accumulates and passes the
     // running sum, which this just wraps.

apps/server/src/core/ai-chat/dto/ai-chat.dto.ts

@@ -43,30 +43,6 @@ export class BoundChatDto {
   pageId: string;
 }
 
-/**
- * Reconnect to the latest run of a chat (#184): fetch its persisted lifecycle
- * state (and the assistant message it projects) for an in-flight or finished run.
- */
-export class GetRunDto {
-  @IsString()
-  chatId: string;
-}
-
-/**
- * Explicitly STOP an agent run (#184): the user pressed Stop — distinct from a
- * browser disconnect, which never stops a run. Either the run id (preferred, from
- * the streamed start metadata) or the chat id (stop whatever run is active on it).
- */
-export class StopRunDto {
-  @IsOptional()
-  @IsString()
-  runId?: string;
-
-  @IsOptional()
-  @IsString()
-  chatId?: string;
-}
-
 /** Export a chat to Markdown (#183). `lang` localizes the few fixed
  *  role/tool-action labels; defaults to English server-side. */
 export class ExportChatDto {

apps/server/src/core/auth/auth.controller.ts

@@ -16,7 +16,6 @@ import {
   AUTH_THROTTLER,
   PAGE_TEMPLATE_THROTTLER,
   PUBLIC_SHARE_AI_THROTTLER,
-  VITALS_THROTTLER,
 } from '../../integrations/throttle/throttler-names';
 import { LoginDto } from './dto/login.dto';
 import { AuthService } from './services/auth.service';
@@ -185,21 +184,16 @@ export class AuthController {
   }
 
   // The global ThrottlerGuard applies ALL named throttlers to every route by
-  // default, so each non-AUTH bucket (AI chat, page template, public-share AI,
+  // default, so each non-AUTH bucket (AI chat, page template, public-share AI)
-  // client vitals) is explicitly skipped here. collab-token is auth-guarded
+  // is explicitly skipped here. collab-token is auth-guarded (JwtAuthGuard),
-  // (JwtAuthGuard), per-user and client-cached, so those feature buckets are
+  // per-user and client-cached, so those feature buckets are irrelevant to it;
-  // irrelevant to it; skipping them avoids spurious 429s when a user opens many
+  // skipping them avoids spurious 429s when a user opens many pages in a short
-  // pages in a short window. The VITALS bucket must be skipped too: it is a
+  // window. The AUTH bucket is skipped too for the same per-user, cached reason.
-  // process-wide named throttler, so without this skip its per-IP limit would
-  // silently cap collab-token (the one route that opts out of every other
-  // bucket) and break editing behind shared/NAT IPs. The AUTH bucket is skipped
-  // for the same per-user, cached reason.
   @SkipThrottle({
     [AUTH_THROTTLER]: true,
     [AI_CHAT_THROTTLER]: true,
     [PAGE_TEMPLATE_THROTTLER]: true,
     [PUBLIC_SHARE_AI_THROTTLER]: true,
-    [VITALS_THROTTLER]: true,
   })
   @UseGuards(JwtAuthGuard)
   @HttpCode(HttpStatus.OK)

apps/server/src/core/page/services/page.service.ts

@@ -52,9 +52,7 @@ import {
   INTERNAL_LINK_REGEX,
   extractPageSlugId,
 } from '../../../integrations/export/utils';
-import { canonicalizeFootnotes } from '@docmost/editor-ext';
+import { markdownToHtml, canonicalizeFootnotes } from '@docmost/editor-ext';
-import { markdownToProseMirror } from '@docmost/prosemirror-markdown';
-import { normalizeForeignMarkdown } from '../../../integrations/import/utils/foreign-markdown';
 import { WatcherService } from '../../watcher/watcher.service';
 import { sql } from 'kysely';
 import { TransclusionService } from '../transclusion/transclusion.service';
@@ -1303,14 +1301,8 @@ export class PageService {
 
     switch (format) {
       case 'markdown': {
-        // Canonical markdown -> ProseMirror JSON directly via
+        const html = await markdownToHtml(content as string);
-        // `@docmost/prosemirror-markdown` (issue #345) — no HTML intermediate,
+        prosemirrorJson = htmlToJson(html as string);
-        // no editor-ext markdown layer. Foreign markdown surfaces the strict
-        // parser rejects (GFM `[^id]` reference footnotes) are normalized to the
-        // canonical inline form first.
-        prosemirrorJson = await markdownToProseMirror(
-          normalizeForeignMarkdown(content as string),
-        );
         break;
       }
       case 'html': {

apps/server/src/core/telemetry/client-metrics.constants.ts

@@ -1,105 +0,0 @@
-/**
- * Server-side whitelist + limits for POST /api/telemetry/vitals (#355).
- *
- * The endpoint is PUBLIC (browsers post it, no auth) so it is a privacy and
- * abuse surface: everything not on these lists is silently DROPPED and the
- * request still returns 200 (never 400 — a 400 would make browsers retry).
- */
-
-// The only metric names accepted. Anything else is dropped.
-export const ALLOWED_METRIC_NAMES = new Set<string>([
-  'INP',
-  'LCP',
-  'CLS',
-  'TTFB',
-  'editor_tx_ms',
-  'page_open_ms',
-  'longtask_ms',
-]);
-
-// The only rating values accepted (web-vitals). Anything else -> null.
-export const ALLOWED_RATINGS = new Set<string>([
-  'good',
-  'needs-improvement',
-  'poor',
-]);
-
-// Max events accepted per batch; the rest are ignored.
-export const MAX_EVENTS_PER_BATCH = 50;
-
-// Defence-in-depth body cap (~16KB). Fastify's global bodyLimit is far larger,
-// so we re-check the parsed payload size here and drop oversized batches.
-export const MAX_BODY_BYTES = 16 * 1024;
-
-// attr is truncated to this many characters (attribution target only, no PII).
-export const MAX_ATTR_LENGTH = 120;
-
-// route label sanity cap (client sends a template like /s/:space/p/:slug).
-export const MAX_ROUTE_LENGTH = 200;
-
-// `client_metrics.doc_size` is a Postgres `int` (int4). A garbage/huge docSize
-// on a single event would overflow int4 and make Postgres reject the WHOLE
-// batch INSERT, losing every event in it. Values outside this range are DROPPED
-// to null (the event is still kept) so one bad field never loses the batch.
-export const DOC_SIZE_MAX = 2147483647; // 2^31 - 1 (int4 max)
-
-export interface ClientMetricRow {
-  name: string;
-  value: number;
-  rating: string | null;
-  route: string | null;
-  attr: string | null;
-  docSize: number | null;
-  workspaceId: string | null;
-}
-
-/**
- * Validate + normalise a single incoming event into a DB row, or return null to
- * DROP it. Pure so it is directly unit-testable. Enforces the name whitelist,
- * numeric value, rating whitelist, attr truncation and doc_size (int) coercion.
- */
-export function sanitizeVitalEvent(
-  raw: unknown,
-  workspaceId: string | null,
-): ClientMetricRow | null {
-  if (!raw || typeof raw !== 'object') return null;
-  const e = raw as Record<string, unknown>;
-
-  const name = e.name;
-  if (typeof name !== 'string' || !ALLOWED_METRIC_NAMES.has(name)) return null;
-
-  const value =
-    typeof e.value === 'number' && Number.isFinite(e.value) ? e.value : null;
-  if (value === null) return null;
-
-  const rating =
-    typeof e.rating === 'string' && ALLOWED_RATINGS.has(e.rating)
-      ? e.rating
-      : null;
-
-  let route: string | null = null;
-  if (typeof e.route === 'string' && e.route.length > 0) {
-    route = e.route.slice(0, MAX_ROUTE_LENGTH);
-  }
-
-  let attr: string | null = null;
-  if (typeof e.attr === 'string' && e.attr.length > 0) {
-    attr = e.attr.slice(0, MAX_ATTR_LENGTH);
-  }
-
-  let docSize: number | null = null;
-  if (typeof e.docSize === 'number' && Number.isFinite(e.docSize)) {
-    docSize = Math.trunc(e.docSize);
-  } else if (typeof e.doc_size === 'number' && Number.isFinite(e.doc_size)) {
-    // Accept snake_case too, in case a client sends the raw column name.
-    docSize = Math.trunc(e.doc_size as number);
-  }
-  // Guard the int4 column: an out-of-range docSize would overflow int4 and make
-  // Postgres reject the whole batch INSERT. Drop the field (keep the event)
-  // rather than lose every other event in the batch.
-  if (docSize !== null && (docSize < 0 || docSize > DOC_SIZE_MAX)) {
-    docSize = null;
-  }
-
-  return { name, value, rating, route, attr, docSize, workspaceId };
-}

apps/server/src/core/telemetry/client-telemetry.module.spec.ts

@@ -1,47 +0,0 @@
-import { ClientTelemetryModule } from './client-telemetry.module';
-import { VitalsController } from './vitals.controller';
-import { VitalsService } from './vitals.service';
-
-// The register() gate is the CORE of the maintainer's E1=B decision: the public,
-// unauthenticated /api/telemetry/vitals endpoint must be OFF by default, so a
-// self-host deploy has no anonymous disk-fill surface into `client_metrics`. A
-// regression that inverts the flag (or a truthiness bug where "" / "false"
-// registers the route) would silently reopen that surface — pin it here.
-describe('ClientTelemetryModule.register (E1=B gate)', () => {
-  const original = process.env.CLIENT_TELEMETRY_ENABLED;
-  afterEach(() => {
-    if (original === undefined) delete process.env.CLIENT_TELEMETRY_ENABLED;
-    else process.env.CLIENT_TELEMETRY_ENABLED = original;
-  });
-
-  it('OFF by default (flag unset) — no controller, no provider (endpoint absent)', () => {
-    delete process.env.CLIENT_TELEMETRY_ENABLED;
-    const mod = ClientTelemetryModule.register();
-    expect(mod.controllers).toEqual([]);
-    expect(mod.providers).toEqual([]);
-  });
-
-  it.each(['false', 'False', '0', '', 'yes', '1'])(
-    'stays OFF for non-"true" value %p (no route)',
-    (val) => {
-      process.env.CLIENT_TELEMETRY_ENABLED = val;
-      const mod = ClientTelemetryModule.register();
-      expect(mod.controllers).toEqual([]);
-      expect(mod.providers).toEqual([]);
-    },
-  );
-
-  it('ON only for "true" — registers VitalsController + VitalsService', () => {
-    process.env.CLIENT_TELEMETRY_ENABLED = 'true';
-    const mod = ClientTelemetryModule.register();
-    expect(mod.controllers).toContain(VitalsController);
-    expect(mod.providers).toContain(VitalsService);
-  });
-
-  it('ON is case-insensitive ("TRUE")', () => {
-    process.env.CLIENT_TELEMETRY_ENABLED = 'TRUE';
-    const mod = ClientTelemetryModule.register();
-    expect(mod.controllers).toContain(VitalsController);
-    expect(mod.providers).toContain(VitalsService);
-  });
-});

apps/server/src/core/telemetry/client-telemetry.module.ts

@@ -1,32 +0,0 @@
-import { DynamicModule, Module } from '@nestjs/common';
-import { VitalsController } from './vitals.controller';
-import { VitalsService } from './vitals.service';
-
-/**
- * Client perf-telemetry (#355): the public /api/telemetry/vitals sink that
- * persists web-vitals + custom client metrics into `client_metrics`.
- * Named ClientTelemetryModule to avoid confusion with the unrelated
- * integrations/telemetry (product usage ping) module.
- *
- * GATED OFF BY DEFAULT (maintainer decision E1=B). The public, unauthenticated
- * endpoint is only registered when CLIENT_TELEMETRY_ENABLED=true — otherwise the
- * route does NOT exist at all (no anonymous disk-fill surface, and no unbounded
- * `client_metrics` growth on a self-host deploy without an external pruner). The
- * client is told the same flag via window.CONFIG and skips sending when off.
- */
-@Module({})
-export class ClientTelemetryModule {
-  static register(): DynamicModule {
-    // Read process.env directly (not EnvironmentService) so the toggle is
-    // resolved at module-registration time, identical to how the metrics
-    // subsystem reads METRICS_PORT. Absent/anything-but-"true" => OFF.
-    const enabled =
-      (process.env.CLIENT_TELEMETRY_ENABLED ?? '').toLowerCase() === 'true';
-
-    return {
-      module: ClientTelemetryModule,
-      controllers: enabled ? [VitalsController] : [],
-      providers: enabled ? [VitalsService] : [],
-    };
-  }
-}

apps/server/src/core/telemetry/vitals.controller.ts

@@ -1,64 +0,0 @@
-import {
-  Body,
-  Controller,
-  HttpCode,
-  Post,
-  Req,
-  UseGuards,
-} from '@nestjs/common';
-import { SkipThrottle, Throttle, ThrottlerGuard } from '@nestjs/throttler';
-import { FastifyRequest } from 'fastify';
-import { Public } from '../../common/decorators/public.decorator';
-import {
-  AI_CHAT_THROTTLER,
-  AUTH_THROTTLER,
-  PAGE_TEMPLATE_THROTTLER,
-  PUBLIC_SHARE_AI_THROTTLER,
-  VITALS_THROTTLER,
-} from '../../integrations/throttle/throttler-names';
-import { VitalsService } from './vitals.service';
-
-/**
- * POST /api/telemetry/vitals (#355) — public client perf-metrics sink.
- *
- * PUBLIC (browsers post via sendBeacon, no session) but IP-throttled. Always
- * returns 200 with no body of interest: invalid/foreign/oversized payloads are
- * silently dropped by the service rather than 400'd, so browsers never retry.
- */
-@Controller('telemetry')
-export class VitalsController {
-  constructor(private readonly vitalsService: VitalsService) {}
-
-  @Public()
-  @UseGuards(ThrottlerGuard)
-  // The global ThrottlerGuard applies ALL named throttlers to every route, so
-  // every OTHER bucket must be skipped here — otherwise the strictest of them
-  // (public-share AI at 5/min) would override the intended vitals limit and cap
-  // this route at 5/min instead of 120/min. Skip them all so ONLY the VITALS
-  // bucket below applies.
-  @SkipThrottle({
-    [AUTH_THROTTLER]: true,
-    [AI_CHAT_THROTTLER]: true,
-    [PAGE_TEMPLATE_THROTTLER]: true,
-    [PUBLIC_SHARE_AI_THROTTLER]: true,
-  })
-  @Throttle({ [VITALS_THROTTLER]: { limit: 120, ttl: 60_000 } })
-  @Post('vitals')
-  @HttpCode(200)
-  async vitals(
-    @Body() body: unknown,
-    @Req() req: FastifyRequest,
-  ): Promise<{ ok: true }> {
-    // workspaceId is resolved by the workspace-host middleware onto req.raw when
-    // the browser posts from a workspace host; null otherwise. No other PII.
-    const workspaceId =
-      ((req.raw as unknown as { workspaceId?: string })?.workspaceId ?? null) ||
-      null;
-    try {
-      await this.vitalsService.ingest(body, workspaceId);
-    } catch {
-      // Never surface storage errors to the browser; telemetry is best-effort.
-    }
-    return { ok: true };
-  }
-}

apps/server/src/core/telemetry/vitals.service.spec.ts

@@ -1,149 +0,0 @@
-import { VitalsService } from './vitals.service';
-import { MAX_ATTR_LENGTH } from './client-metrics.constants';
-
-// buildRows is pure (no DB access), so a null db is fine here.
-const svc = new VitalsService(null as any);
-
-describe('VitalsService.buildRows', () => {
-  const WS = 'ws-uuid';
-
-  it('accepts a valid batch and maps whitelisted fields to rows', () => {
-    const body = {
-      events: [
-        { name: 'INP', value: 123.4, rating: 'good', route: '/s/:space/p/:slug' },
-        { name: 'editor_tx_ms', value: 12, route: '/s/:space/p/:slug', docSize: 4096 },
-      ],
-    };
-    const rows = svc.buildRows(body, WS);
-    expect(rows).toHaveLength(2);
-    expect(rows[0]).toEqual({
-      name: 'INP',
-      value: 123.4,
-      rating: 'good',
-      route: '/s/:space/p/:slug',
-      attr: null,
-      docSize: null,
-      workspaceId: WS,
-    });
-    expect(rows[1].name).toBe('editor_tx_ms');
-    expect(rows[1].docSize).toBe(4096);
-    expect(rows[1].workspaceId).toBe(WS);
-  });
-
-  it('accepts a bare array body', () => {
-    const rows = svc.buildRows([{ name: 'LCP', value: 1 }], WS);
-    expect(rows).toHaveLength(1);
-    expect(rows[0].name).toBe('LCP');
-  });
-
-  it('drops events with foreign metric names', () => {
-    const rows = svc.buildRows(
-      { events: [{ name: 'evil_metric', value: 1 }, { name: 'LCP', value: 2 }] },
-      WS,
-    );
-    expect(rows).toHaveLength(1);
-    expect(rows[0].name).toBe('LCP');
-  });
-
-  it('drops events with a non-numeric or missing value', () => {
-    const rows = svc.buildRows(
-      {
-        events: [
-          { name: 'CLS', value: 'nan' },
-          { name: 'CLS' },
-          { name: 'CLS', value: 0.1 },
-        ],
-      },
-      WS,
-    );
-    expect(rows).toHaveLength(1);
-    expect(rows[0].value).toBe(0.1);
-  });
-
-  it('strips foreign fields and only keeps whitelisted columns', () => {
-    const rows = svc.buildRows(
-      { events: [{ name: 'TTFB', value: 5, secret: 'drop-me', title: 'my page' }] },
-      WS,
-    );
-    expect(rows).toHaveLength(1);
-    expect(Object.keys(rows[0]).sort()).toEqual(
-      ['attr', 'docSize', 'name', 'rating', 'route', 'value', 'workspaceId'].sort(),
-    );
-    expect((rows[0] as any).secret).toBeUndefined();
-    expect((rows[0] as any).title).toBeUndefined();
-  });
-
-  it('rejects a rating outside the allowed set (-> null)', () => {
-    const rows = svc.buildRows(
-      { events: [{ name: 'INP', value: 1, rating: 'terrible' }] },
-      WS,
-    );
-    expect(rows[0].rating).toBeNull();
-  });
-
-  it('truncates attr to 120 chars', () => {
-    const longAttr = 'a'.repeat(500);
-    const rows = svc.buildRows(
-      { events: [{ name: 'INP', value: 1, attr: longAttr }] },
-      WS,
-    );
-    expect(rows[0].attr).toHaveLength(MAX_ATTR_LENGTH);
-  });
-
-  it('caps the batch at 50 events', () => {
-    const events = Array.from({ length: 200 }, () => ({ name: 'CLS', value: 1 }));
-    const rows = svc.buildRows({ events }, WS);
-    expect(rows).toHaveLength(50);
-  });
-
-  it('drops an oversized (>16KB) payload wholesale', () => {
-    const events = Array.from({ length: 50 }, () => ({
-      name: 'INP',
-      value: 1,
-      attr: 'x'.repeat(400),
-      route: '/s/:space/p/:slug',
-    }));
-    // Serialised body far exceeds 16KB.
-    const rows = svc.buildRows({ events }, WS);
-    expect(rows).toHaveLength(0);
-  });
-
-  it('returns [] for malformed bodies', () => {
-    expect(svc.buildRows(null, WS)).toEqual([]);
-    expect(svc.buildRows('nope', WS)).toEqual([]);
-    expect(svc.buildRows({ notEvents: 1 }, WS)).toEqual([]);
-    expect(svc.buildRows(42, WS)).toEqual([]);
-  });
-
-  it('carries a null workspaceId through', () => {
-    const rows = svc.buildRows({ events: [{ name: 'LCP', value: 1 }] }, null);
-    expect(rows[0].workspaceId).toBeNull();
-  });
-
-  it('drops an out-of-int4-range docSize to null without losing the batch', () => {
-    const rows = svc.buildRows(
-      {
-        events: [
-          // Garbage docSize overflowing int4 must NOT reject the whole batch:
-          // the field is dropped to null and the event is kept.
-          { name: 'editor_tx_ms', value: 10, docSize: 9_999_999_999 },
-          { name: 'editor_tx_ms', value: 20, docSize: -5 },
-          { name: 'editor_tx_ms', value: 30, docSize: 4096 },
-        ],
-      },
-      WS,
-    );
-    expect(rows).toHaveLength(3);
-    expect(rows[0].docSize).toBeNull();
-    expect(rows[1].docSize).toBeNull();
-    expect(rows[2].docSize).toBe(4096);
-  });
-
-  it('keeps a docSize exactly at the int4 max', () => {
-    const rows = svc.buildRows(
-      { events: [{ name: 'editor_tx_ms', value: 1, docSize: 2147483647 }] },
-      WS,
-    );
-    expect(rows[0].docSize).toBe(2147483647);
-  });
-});

apps/server/src/core/telemetry/vitals.service.ts

@@ -1,70 +0,0 @@
-import { Injectable } from '@nestjs/common';
-import { InjectKysely } from 'nestjs-kysely';
-import { KyselyDB } from '@docmost/db/types/kysely.types';
-import {
-  ClientMetricRow,
-  MAX_BODY_BYTES,
-  MAX_EVENTS_PER_BATCH,
-  sanitizeVitalEvent,
-} from './client-metrics.constants';
-
-@Injectable()
-export class VitalsService {
-  constructor(@InjectKysely() private readonly db: KyselyDB) {}
-
-  /**
-   * Turn a raw request body into the (bounded, whitelisted) rows to persist.
-   * Pure/synchronous so it is unit-testable without a DB. Returns [] for any
-   * malformed / oversized / foreign input — the caller still responds 200.
-   */
-  buildRows(body: unknown, workspaceId: string | null): ClientMetricRow[] {
-    if (!body || typeof body !== 'object') return [];
-
-    // Defence-in-depth body cap (~16KB): drop oversized batches wholesale.
-    try {
-      if (JSON.stringify(body).length > MAX_BODY_BYTES) return [];
-    } catch {
-      return [];
-    }
-
-    // Accept either a bare array or `{ events: [...] }`.
-    const events = Array.isArray(body)
-      ? body
-      : Array.isArray((body as { events?: unknown }).events)
-        ? ((body as { events: unknown[] }).events as unknown[])
-        : null;
-    if (!events) return [];
-
-    const rows: ClientMetricRow[] = [];
-    for (const event of events) {
-      if (rows.length >= MAX_EVENTS_PER_BATCH) break;
-      const row = sanitizeVitalEvent(event, workspaceId);
-      if (row) rows.push(row);
-    }
-    return rows;
-  }
-
-  /** Batch-insert the sanitised rows in a single statement. No-op on []. */
-  async insertRows(rows: ClientMetricRow[]): Promise<void> {
-    if (rows.length === 0) return;
-    await this.db
-      .insertInto('clientMetrics')
-      .values(
-        rows.map((r) => ({
-          name: r.name,
-          value: r.value,
-          rating: r.rating,
-          route: r.route,
-          attr: r.attr,
-          docSize: r.docSize,
-          workspaceId: r.workspaceId,
-        })),
-      )
-      .execute();
-  }
-
-  async ingest(body: unknown, workspaceId: string | null): Promise<void> {
-    const rows = this.buildRows(body, workspaceId);
-    await this.insertRows(rows);
-  }
-}

apps/server/src/core/workspace/dto/update-workspace.dto.ts

@@ -55,14 +55,6 @@ export class UpdateWorkspaceDto extends PartialType(CreateWorkspaceDto) {
   @IsBoolean()
   aiDictationStreaming: boolean;
 
-  // #184: detached/autonomous agent runs (settings.ai.autonomousRuns). When on, a
-  // chat turn becomes a server-side RUN that survives a browser disconnect; only
-  // an explicit /ai-chat/stop ends it. Off by default; single-instance-only in
-  // phase 1 (see AiChatRunService.warnIfMultiInstance / AGENTS.md).
-  @IsOptional()
-  @IsBoolean()
-  autonomousRuns: boolean;
-
   // Workspace master toggle that enables/disables the HTML embed block type.
   // Persisted at settings.htmlEmbed. ABSENT/false => OFF (default). The block
   // itself renders in a sandboxed iframe, so this is a feature switch, not a

apps/server/src/core/workspace/services/workspace.service.ts

@@ -526,20 +526,6 @@ export class WorkspaceService {
         );
       }
 
-      if (typeof updateWorkspaceDto.autonomousRuns !== 'undefined') {
-        const prev = settingsBefore?.ai?.autonomousRuns ?? false;
-        if (prev !== updateWorkspaceDto.autonomousRuns) {
-          before.autonomousRuns = prev;
-          after.autonomousRuns = updateWorkspaceDto.autonomousRuns;
-        }
-        await this.workspaceRepo.updateAiSettings(
-          workspaceId,
-          'autonomousRuns',
-          updateWorkspaceDto.autonomousRuns,
-          trx,
-        );
-      }
-
       if (typeof updateWorkspaceDto.htmlEmbed !== 'undefined') {
         const prev = settingsBefore?.htmlEmbed ?? false;
         if (prev !== updateWorkspaceDto.htmlEmbed) {
@@ -593,7 +579,6 @@ export class WorkspaceService {
       delete updateWorkspaceDto.aiChat;
       delete updateWorkspaceDto.aiDictation;
       delete updateWorkspaceDto.aiDictationStreaming;
-      delete updateWorkspaceDto.autonomousRuns;
       delete updateWorkspaceDto.htmlEmbed;
       delete updateWorkspaceDto.trackerHead;
       delete updateWorkspaceDto.aiPublicShareAssistant;

apps/server/src/database/database.module.ts

@@ -31,7 +31,6 @@ import { FavoriteRepo } from '@docmost/db/repos/favorite/favorite.repo';
 import { TemplateRepo } from '@docmost/db/repos/template/template.repo';
 import { AiChatRepo } from '@docmost/db/repos/ai-chat/ai-chat.repo';
 import { AiChatMessageRepo } from '@docmost/db/repos/ai-chat/ai-chat-message.repo';
-import { AiChatRunRepo } from '@docmost/db/repos/ai-chat/ai-chat-run.repo';
 import { AiChatPageSnapshotRepo } from '@docmost/db/repos/ai-chat/ai-chat-page-snapshot.repo';
 import { AiProviderCredentialsRepo } from '@docmost/db/repos/ai-chat/ai-provider-credentials.repo';
 import { AiMcpServerRepo } from '@docmost/db/repos/ai-chat/ai-mcp-server.repo';
@@ -41,11 +40,6 @@ import { PageListener } from '@docmost/db/listeners/page.listener';
 import { PostgresJSDialect } from 'kysely-postgres-js';
 import * as postgres from 'postgres';
 import { normalizePostgresUrl } from '../common/helpers';
-import {
-  observeDbQuery,
-  isMetricsEnabled,
-} from '../integrations/metrics/metrics.registry';
-import { firstSqlToken } from '../integrations/metrics/metrics.constants';
 
 @Global()
 @Module({
@@ -73,18 +67,6 @@ import { firstSqlToken } from '../integrations/metrics/metrics.constants';
         }),
         plugins: [new CamelCasePlugin()],
         log: (event: LogEvent) => {
-          // #355 — db_query_duration_seconds, labelled by the leading SQL token
-          // (bounded cardinality). Gated on isMetricsEnabled() so the token work
-          // (regex + Set lookup) is skipped entirely when metrics are OFF — not
-          // just observeDbQuery no-op'd — so a non-metrics deployment pays nothing
-          // per query. Runs independent of the dev-only debug logging below.
-          if (isMetricsEnabled()) {
-            observeDbQuery(
-              firstSqlToken(event.query.sql),
-              event.queryDurationMillis / 1000,
-            );
-          }
-
           if (environmentService.getNodeEnv() !== 'development') return;
           const logger = new Logger(DatabaseModule.name);
           if (process.env.DEBUG_DB?.toLowerCase() === 'true') {
@@ -123,7 +105,6 @@ import { firstSqlToken } from '../integrations/metrics/metrics.constants';
     TemplateRepo,
     AiChatRepo,
     AiChatMessageRepo,
-    AiChatRunRepo,
     AiChatPageSnapshotRepo,
     AiProviderCredentialsRepo,
     AiMcpServerRepo,
@@ -158,7 +139,6 @@ import { firstSqlToken } from '../integrations/metrics/metrics.constants';
     TemplateRepo,
     AiChatRepo,
     AiChatMessageRepo,
-    AiChatRunRepo,
     AiChatPageSnapshotRepo,
     AiProviderCredentialsRepo,
     AiMcpServerRepo,

apps/server/src/database/migrations/20260704T120000-client-metrics.ts

@@ -1,52 +0,0 @@
-import { type Kysely, sql } from 'kysely';
-
-/**
- * #355 — `client_metrics`: raw sink for client-side perf telemetry (web-vitals
- * + custom editor/page metrics) posted to /api/telemetry/vitals.
- *
- * The table/columns/indexes here are a FIXED contract shared with the deployed
- * Grafana infra (the `grafana_ro` role reads this table; a separate maintenance
- * container prunes rows >90d and re-GRANTs daily). No app-side retention is
- * added on purpose. Written as raw SQL to match that contract 1:1 (identity PK,
- * conditional GRANT).
- */
-export async function up(db: Kysely<any>): Promise<void> {
-  await sql`
-    CREATE TABLE client_metrics (
-      id bigint GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
-      created_at timestamptz NOT NULL DEFAULT now(),
-      name text NOT NULL,          -- INP|LCP|CLS|TTFB|editor_tx_ms|page_open_ms|longtask_ms
-      value double precision NOT NULL,
-      rating text,                 -- good|needs-improvement|poor (web-vitals only)
-      route text,                  -- templated: /s/:space/p/:slug — never raw slugs
-      attr text,                   -- attribution target, truncated to 120 chars
-      doc_size int,                -- editor_tx_ms only
-      workspace_id uuid
-    )
-  `.execute(db);
-
-  await sql`
-    CREATE INDEX idx_client_metrics_name_created
-      ON client_metrics (name, created_at)
-  `.execute(db);
-
-  await sql`
-    CREATE INDEX idx_client_metrics_created
-      ON client_metrics (created_at)
-  `.execute(db);
-
-  // The read-only Grafana role only exists in the deployed environment; guard so
-  // the migration still applies cleanly in dev/CI where the role is absent.
-  await sql`
-    DO $$
-    BEGIN
-      IF EXISTS (SELECT FROM pg_roles WHERE rolname = 'grafana_ro') THEN
-        GRANT SELECT ON client_metrics TO grafana_ro;
-      END IF;
-    END $$;
-  `.execute(db);
-}
-
-export async function down(db: Kysely<any>): Promise<void> {
-  await sql`DROP TABLE IF EXISTS client_metrics`.execute(db);
-}

apps/server/src/database/migrations/20260704T130000-ai-chat-runs.ts

@@ -1,106 +0,0 @@
-import { type Kysely, sql } from 'kysely';
-
-/**
- * `ai_chat_runs` — the agent RUN as a first-class, server-side lifecycle object
- * (#184 phase 1: autonomous agent runs detached from the browser window).
- *
- * Until now an agent turn lived ONLY as long as the HTTP request was open
- * (`res.hijack()` in ai-chat.controller.ts); a browser disconnect aborted it.
- * This table makes a turn a persistent object the server owns: it is created
- * when a run starts (inserted directly as 'running' in phase 1 — 'pending' is
- * only this column's default + a reserved value, never written by code yet) and
- * advances to succeeded|failed|aborted, surviving the subscriber (browser) going
- * away when it settles. The DB is the source of
- * truth — a later client reconnects/sees the result by reading this row plus the
- * assistant message it projects (`assistant_message_id`).
- *
- * The assistant message row (#183 step-granular durability) is the PROJECTION of
- * a run's output; this row is the run's LIFECYCLE. They are linked by
- * `assistant_message_id` (SET NULL if the message is later pruned).
- *
- * `status`  : 'pending' | 'running' | 'succeeded' | 'failed' | 'aborted'.
- * `trigger` : 'user' | 'autostart' | 'schedule' | 'api' | 'continue' — only
- *             'user' is produced in phase 1; the others are reserved for the
- *             autonomy triggers deferred to phase 2 so they need no later
- *             migration.
- *
- * ONE ACTIVE RUN PER CHAT is enforced by a partial unique index on `chat_id`
- * WHERE status IN ('pending','running'): an autonomous run and a user run can
- * never trample each other on the same chat. Settled runs (succeeded/failed/
- * aborted) are excluded from the index so a chat can accumulate any number of
- * historical runs.
- */
-export async function up(db: Kysely<any>): Promise<void> {
-  await db.schema
-    .createTable('ai_chat_runs')
-    .ifNotExists()
-    .addColumn('id', 'uuid', (col) =>
-      col.primaryKey().defaultTo(sql`gen_uuid_v7()`),
-    )
-    .addColumn('chat_id', 'uuid', (col) =>
-      col.references('ai_chats.id').onDelete('cascade').notNull(),
-    )
-    .addColumn('workspace_id', 'uuid', (col) =>
-      col.references('workspaces.id').onDelete('cascade').notNull(),
-    )
-    // The human who triggered the run (audit). SET NULL on user deletion so the
-    // run history outlives its author; NULL is also the natural value for a
-    // future system/cron/api trigger with no human actor.
-    .addColumn('created_by', 'uuid', (col) =>
-      col.references('users.id').onDelete('set null'),
-    )
-    // The assistant message this run materializes (the #183 projection). SET NULL
-    // if that message row is later deleted; nullable because the run row is
-    // created a moment BEFORE the assistant row is seeded.
-    .addColumn('assistant_message_id', 'uuid', (col) =>
-      col.references('ai_chat_messages.id').onDelete('set null'),
-    )
-    .addColumn('trigger', 'varchar(20)', (col) =>
-      col.notNull().defaultTo('user'),
-    )
-    .addColumn('status', 'varchar(20)', (col) =>
-      col.notNull().defaultTo('pending'),
-    )
-    // Terminal error message for a failed run (provider/transport cause),
-    // mirroring the assistant message's metadata.error.
-    .addColumn('error', 'text', (col) => col)
-    // Number of agent steps finished so far (kept monotonic with the projection).
-    .addColumn('step_count', 'integer', (col) => col.notNull().defaultTo(0))
-    // Set when an EXPLICIT user stop is requested (distinct from a mere browser
-    // disconnect, which never stops a run). The runner aborts the turn and the
-    // run settles as 'aborted'.
-    .addColumn('stop_requested_at', 'timestamptz', (col) => col)
-    .addColumn('started_at', 'timestamptz', (col) => col)
-    .addColumn('finished_at', 'timestamptz', (col) => col)
-    .addColumn('created_at', 'timestamptz', (col) =>
-      col.notNull().defaultTo(sql`now()`),
-    )
-    .addColumn('updated_at', 'timestamptz', (col) =>
-      col.notNull().defaultTo(sql`now()`),
-    )
-    .execute();
-
-  // Reconnect / "latest run for this chat" reads hit chat_id first.
-  await db.schema
-    .createIndex('ai_chat_runs_chat_id_idx')
-    .ifNotExists()
-    .on('ai_chat_runs')
-    .column('chat_id')
-    .execute();
-
-  // One ACTIVE run per chat (advisory at the DB level): a second pending/running
-  // run on the same chat is rejected, so a user turn and an autonomous turn can
-  // never race on the same chat. Partial so settled runs do not collide.
-  await db.schema
-    .createIndex('ai_chat_runs_one_active_per_chat')
-    .ifNotExists()
-    .on('ai_chat_runs')
-    .column('chat_id')
-    .unique()
-    .where(sql.ref('status'), 'in', sql`('pending','running')`)
-    .execute();
-}
-
-export async function down(db: Kysely<any>): Promise<void> {
-  await db.schema.dropTable('ai_chat_runs').execute();
-}

apps/server/src/database/repos/ai-chat/ai-chat-message.repo.ts

@@ -121,23 +121,6 @@ export class AiChatMessageRepo {
     return rows.reverse();
   }
 
-  /** Fetch a single message by id + workspace (e.g. a run's projection row for
-   *  the #184 reconnect read). Returns undefined when nothing matches. */
-  async findById(
-    id: string,
-    workspaceId: string,
-    trx?: KyselyTransaction,
-  ): Promise<AiChatMessage | undefined> {
-    const db = dbOrTx(this.db, trx);
-    return db
-      .selectFrom('aiChatMessages')
-      .select(this.baseFields)
-      .where('id', '=', id)
-      .where('workspaceId', '=', workspaceId)
-      .where('deletedAt', 'is', null)
-      .executeTakeFirst();
-  }
-
   async insert(
     insertable: InsertableAiChatMessage,
     trx?: KyselyTransaction,

apps/server/src/database/repos/ai-chat/ai-chat-run.repo.spec.ts

@@ -1,82 +0,0 @@
-import { AiChatRunRepo, SWEEP_RUN_STALE_MS } from './ai-chat-run.repo';
-import type { KyselyDB } from '../../types/kysely.types';
-
-/**
- * Unit coverage for AiChatRunRepo.sweepRunning over a chainable builder mock (no
- * live DB). The F1 invariant under test (DECISION C): the BOOT sweep is
- * UNCONDITIONAL — it adds NO `updatedAt <` predicate, so a fresh 'running' run
- * (updatedAt = now) IS settled rather than skipped by a staleness window. The
- * window is added ONLY when an explicit `staleMs` is supplied (the future phase-2
- * multi-instance timer sweep). We assert the EXACT predicates the spec mandates.
- */
-describe('AiChatRunRepo.sweepRunning', () => {
-  type Recorded = {
-    table?: string;
-    set?: Record<string, unknown>;
-    wheres: Array<[string, string, unknown]>;
-    returning?: string;
-  };
-
-  function makeDb(swept: Array<{ id: string }>): {
-    db: KyselyDB;
-    rec: Recorded;
-  } {
-    const rec: Recorded = { wheres: [] };
-    const builder: Record<string, unknown> = {};
-    builder.set = (v: Record<string, unknown>) => {
-      rec.set = v;
-      return builder;
-    };
-    builder.where = (col: string, op: string, val: unknown) => {
-      rec.wheres.push([col, op, val]);
-      return builder;
-    };
-    builder.returning = (col: string) => {
-      rec.returning = col;
-      return builder;
-    };
-    builder.execute = () => Promise.resolve(swept);
-    const db = {
-      updateTable: (table: string) => {
-        rec.table = table;
-        return builder;
-      },
-    } as unknown as KyselyDB;
-    return { db, rec };
-  }
-
-  it('F1: the boot sweep (no staleMs) is UNCONDITIONAL — only a status filter, NO updatedAt window', async () => {
-    const { db, rec } = makeDb([{ id: 'r1' }, { id: 'r2' }]);
-    const repo = new AiChatRunRepo(db);
-
-    const swept = await repo.sweepRunning();
-
-    expect(swept).toBe(2);
-    expect(rec.table).toBe('aiChatRuns');
-    // The status filter is always present...
-    expect(rec.wheres).toContainEqual([
-      'status',
-      'in',
-      expect.arrayContaining(['pending', 'running']),
-    ]);
-    // ...but a fresh 'running' run (updatedAt = now) must NOT be skipped: no
-    // updatedAt predicate at all on the boot path.
-    expect(rec.wheres.some(([col]) => col === 'updatedAt')).toBe(false);
-    // It flips to 'aborted' and stamps finishedAt.
-    expect(rec.set).toEqual(
-      expect.objectContaining({ status: 'aborted', finishedAt: expect.any(Date) }),
-    );
-  });
-
-  it('phase-2 path: an explicit staleMs reintroduces the updatedAt window', async () => {
-    const { db, rec } = makeDb([]);
-    const repo = new AiChatRunRepo(db);
-
-    await repo.sweepRunning({ staleMs: SWEEP_RUN_STALE_MS });
-
-    const updatedAtWhere = rec.wheres.find(([col]) => col === 'updatedAt');
-    expect(updatedAtWhere).toBeDefined();
-    expect(updatedAtWhere![1]).toBe('<');
-    expect(updatedAtWhere![2]).toBeInstanceOf(Date);
-  });
-});

apps/server/src/database/repos/ai-chat/ai-chat-run.repo.ts

@@ -1,212 +0,0 @@
-import { Injectable, Logger } from '@nestjs/common';
-import { InjectKysely } from 'nestjs-kysely';
-import { sql } from 'kysely';
-import { KyselyDB, KyselyTransaction } from '../../types/kysely.types';
-import { dbOrTx } from '../../utils';
-import {
-  AiChatRun,
-  InsertableAiChatRun,
-} from '@docmost/db/types/entity.types';
-
-// Statuses that count as "the run is still live" (an autonomous and a user run
-// must never both be live on one chat — enforced by the partial unique index and
-// checked here for friendly 409s before the insert races the constraint).
-export const ACTIVE_RUN_STATUSES = ['pending', 'running'] as const;
-
-// Crash-recovery sweep recency threshold (mirrors AiChatMessageRepo.sweepStreaming,
-// #183): when a staleness window is supplied, a 'running'/'pending' run is only
-// swept to 'aborted' once it has been UNTOUCHED for this long, so a sibling
-// replica's boot-sweep can never abort a run another replica is actively
-// executing. The runner bumps `updatedAt` on every step, so a live run never
-// matches. PHASE 1 is single-process and the boot sweep passes NO window (every
-// dangling run is settled unconditionally — see sweepRunning / F1). This constant
-// is the window to reintroduce for the phase-2 multi-instance timer sweep.
-export const SWEEP_RUN_STALE_MS = 10 * 60 * 1000; // 10 minutes
-
-/**
- * Repository for `ai_chat_runs` (#184 phase 1): the agent run as a first-class,
- * server-side lifecycle object detached from the HTTP request. The run row is the
- * point a client subscribes/reconnects to (by `id` or by chat); the assistant
- * message it links to (`assistantMessageId`) is the #183 projection of its output.
- */
-@Injectable()
-export class AiChatRunRepo {
-  private readonly logger = new Logger(AiChatRunRepo.name);
-
-  private baseFields: Array<keyof AiChatRun> = [
-    'id',
-    'chatId',
-    'workspaceId',
-    'createdBy',
-    'assistantMessageId',
-    'trigger',
-    'status',
-    'error',
-    'stepCount',
-    'stopRequestedAt',
-    'startedAt',
-    'finishedAt',
-    'createdAt',
-    'updatedAt',
-  ];
-
-  constructor(@InjectKysely() private readonly db: KyselyDB) {}
-
-  async insert(
-    insertable: InsertableAiChatRun,
-    trx?: KyselyTransaction,
-  ): Promise<AiChatRun> {
-    const db = dbOrTx(this.db, trx);
-    return db
-      .insertInto('aiChatRuns')
-      .values(insertable)
-      .returning(this.baseFields)
-      .executeTakeFirst();
-  }
-
-  async findById(
-    id: string,
-    workspaceId: string,
-    trx?: KyselyTransaction,
-  ): Promise<AiChatRun | undefined> {
-    const db = dbOrTx(this.db, trx);
-    return db
-      .selectFrom('aiChatRuns')
-      .select(this.baseFields)
-      .where('id', '=', id)
-      .where('workspaceId', '=', workspaceId)
-      .executeTakeFirst();
-  }
-
-  /** The currently-active (pending|running) run for a chat, if any. At most one
-   *  exists thanks to the partial unique index. */
-  async findActiveByChat(
-    chatId: string,
-    workspaceId: string,
-    trx?: KyselyTransaction,
-  ): Promise<AiChatRun | undefined> {
-    const db = dbOrTx(this.db, trx);
-    return db
-      .selectFrom('aiChatRuns')
-      .select(this.baseFields)
-      .where('chatId', '=', chatId)
-      .where('workspaceId', '=', workspaceId)
-      .where('status', 'in', ACTIVE_RUN_STATUSES as unknown as string[])
-      .executeTakeFirst();
-  }
-
-  /** The most-recent run for a chat (active or settled) — the reconnect target. */
-  async findLatestByChat(
-    chatId: string,
-    workspaceId: string,
-    trx?: KyselyTransaction,
-  ): Promise<AiChatRun | undefined> {
-    const db = dbOrTx(this.db, trx);
-    return db
-      .selectFrom('aiChatRuns')
-      .select(this.baseFields)
-      .where('chatId', '=', chatId)
-      .where('workspaceId', '=', workspaceId)
-      .orderBy('createdAt', 'desc')
-      .orderBy('id', 'desc')
-      .limit(1)
-      .executeTakeFirst();
-  }
-
-  /**
-   * Patch a run by id + workspace; always bumps `updatedAt`. Used for every
-   * lifecycle transition (mark running, link the assistant message, bump
-   * step_count, finalize succeeded/failed/aborted). Returns the updated row or
-   * undefined when nothing matched (e.g. a foreign workspace).
-   */
-  async update(
-    id: string,
-    workspaceId: string,
-    patch: Partial<{
-      status: string;
-      error: string | null;
-      stepCount: number;
-      assistantMessageId: string | null;
-      stopRequestedAt: Date | null;
-      startedAt: Date | null;
-      finishedAt: Date | null;
-    }>,
-    trx?: KyselyTransaction,
-  ): Promise<AiChatRun | undefined> {
-    const db = dbOrTx(this.db, trx);
-    return db
-      .updateTable('aiChatRuns')
-      .set({ ...(patch as Record<string, unknown>), updatedAt: new Date() })
-      .where('id', '=', id)
-      .where('workspaceId', '=', workspaceId)
-      .returning(this.baseFields)
-      .executeTakeFirst();
-  }
-
-  /**
-   * Mark an EXPLICIT stop request on an active run (distinct from a browser
-   * disconnect, which never stops a run). Stamps `stop_requested_at` ONLY while
-   * the run is still active, so a late stop on an already-settled run is a no-op.
-   * Returns the row when a stop was recorded, else undefined (nothing active).
-   */
-  async markStopRequested(
-    id: string,
-    workspaceId: string,
-    trx?: KyselyTransaction,
-  ): Promise<AiChatRun | undefined> {
-    const db = dbOrTx(this.db, trx);
-    return db
-      .updateTable('aiChatRuns')
-      .set({ stopRequestedAt: new Date(), updatedAt: new Date() })
-      .where('id', '=', id)
-      .where('workspaceId', '=', workspaceId)
-      .where('status', 'in', ACTIVE_RUN_STATUSES as unknown as string[])
-      .returning(this.baseFields)
-      .executeTakeFirst();
-  }
-
-  /**
-   * Crash-recovery sweep (mirrors AiChatMessageRepo.sweepStreaming): flip every
-   * run still left pending/running — a run whose process died before reaching a
-   * terminal status — to 'aborted', stamping `finished_at`. Returns the number
-   * swept. Workspace-wide on purpose (a crash can dangle runs in any workspace).
-   *
-   * F1 (DECISION C): the BOOT sweep is UNCONDITIONAL — it passes no `staleMs`, so
-   * EVERY dangling run is settled regardless of how recently it was touched. On a
-   * fresh single-process boot any pending|running run is definitionally hung (no
-   * runner is alive to own it), so a fast restart (deploy/OOM within minutes of
-   * the last step) no longer leaves a run stuck 'running' forever — which would
-   * make the one-active-run gate 409 every future turn in that chat.
-   *
-   * The optional `staleMs` window is reintroduced ONLY for the future phase-2
-   * multi-instance timer sweep (see {@link SWEEP_RUN_STALE_MS}): there a booting
-   * replica must NOT abort a run another replica is actively executing, so it
-   * sweeps only runs UNTOUCHED past the window. Phase 1 is single-process, so the
-   * boot path supplies no window.
-   */
-  async sweepRunning(
-    opts: { staleMs?: number } = {},
-    trx?: KyselyTransaction,
-  ): Promise<number> {
-    const db = dbOrTx(this.db, trx);
-    const now = new Date();
-    let query = db
-      .updateTable('aiChatRuns')
-      .set({
-        status: 'aborted',
-        finishedAt: now,
-        updatedAt: now,
-        error: sql`coalesce(error, ${'Run interrupted by a server restart.'})`,
-      })
-      .where('status', 'in', ACTIVE_RUN_STATUSES as unknown as string[]);
-    // Multi-instance (phase 2) only: skip runs touched within the window so a
-    // sibling replica's live run is never aborted. Omitted on the phase-1 boot
-    // sweep -> unconditional.
-    if (typeof opts.staleMs === 'number') {
-      const staleBefore = new Date(now.getTime() - opts.staleMs);
-      query = query.where('updatedAt', '<', staleBefore);
-    }
-    const rows = await query.returning('id').execute();
-    return rows.length;
-  }
-}

apps/server/src/database/types/db.d.ts

@@ -156,18 +156,6 @@ export interface Billing {
   workspaceId: string;
 }
 
-export interface ClientMetrics {
-  id: Generated<Int8>;
-  createdAt: Generated<Timestamp>;
-  name: string;
-  value: number;
-  rating: string | null;
-  route: string | null;
-  attr: string | null;
-  docSize: number | null;
-  workspaceId: string | null;
-}
-
 export interface Comments {
   aiChatId: string | null;
   content: Json | null;
@@ -659,35 +647,6 @@ export interface AiChatMessages {
   deletedAt: Timestamp | null;
 }
 
-// The agent RUN as a first-class server-side lifecycle object (#184 phase 1).
-// Mirrors migration 20260704T130000-ai-chat-runs.ts. A run is created when an
-// agent turn starts and survives the browser disconnecting; the DB is the source
-// of truth a later client reconnects to. `assistantMessageId` links to the #183
-// projection row (the assistant message this run materializes).
-export interface AiChatRuns {
-  id: Generated<string>;
-  chatId: string;
-  workspaceId: string;
-  // SET NULL on user deletion (the run history outlives its author); also NULL
-  // for a future non-human trigger (cron/api).
-  createdBy: string | null;
-  // The assistant message this run materializes; SET NULL if it is pruned.
-  assistantMessageId: string | null;
-  // 'user' | 'autostart' | 'schedule' | 'api' | 'continue' (only 'user' is
-  // produced in phase 1; the rest are reserved for the deferred autonomy triggers).
-  trigger: Generated<string>;
-  // 'pending' | 'running' | 'succeeded' | 'failed' | 'aborted'.
-  status: Generated<string>;
-  error: string | null;
-  stepCount: Generated<number>;
-  // Set when an EXPLICIT user stop is requested (distinct from a disconnect).
-  stopRequestedAt: Timestamp | null;
-  startedAt: Timestamp | null;
-  finishedAt: Timestamp | null;
-  createdAt: Generated<Timestamp>;
-  updatedAt: Generated<Timestamp>;
-}
-
 // Per-(chat,page) snapshot of the open page's Markdown at the END of the agent's
 // previous turn (#274). Mirrors migration 20260702T120000-ai-chat-page-snapshot.ts.
 // The next turn diffs the CURRENT Markdown against `contentMd` to surface edits a
@@ -724,7 +683,6 @@ export interface DB {
   aiAgentRoles: AiAgentRoles;
   aiChats: AiChats;
   aiChatMessages: AiChatMessages;
-  aiChatRuns: AiChatRuns;
   aiChatPageSnapshots: AiChatPageSnapshots;
   apiKeys: ApiKeys;
   attachments: Attachments;
@@ -733,7 +691,6 @@ export interface DB {
   authProviders: AuthProviders;
   backlinks: Backlinks;
   billing: Billing;
-  clientMetrics: ClientMetrics;
   comments: Comments;
   favorites: Favorites;
   fileTasks: FileTasks;

apps/server/src/database/types/entity.types.ts

@@ -3,7 +3,6 @@ import {
   AiAgentRoles,
   AiChats,
   AiChatMessages,
-  AiChatRuns,
   AiChatPageSnapshots,
   Attachments,
   Comments,
@@ -57,12 +56,10 @@ export type UpdatableAiChat = Updateable<Omit<AiChats, 'id'>>;
 // full-text search. It is omitted from the public type so it never leaks
 // into HTTP responses or the chat history fed to the language model.
 export type AiChatMessage = Omit<Selectable<AiChatMessages>, 'tsv'>;
-export type InsertableAiChatMessage = Omit<Insertable<AiChatMessages>, 'tsv'>;
+export type InsertableAiChatMessage = Omit<
-
+  Insertable<AiChatMessages>,
-// AI Chat Run (#184 phase 1): the agent run as a first-class lifecycle object,
+  'tsv'
-// detached from the HTTP request / browser window.
+>;
-export type AiChatRun = Selectable<AiChatRuns>;
-export type InsertableAiChatRun = Insertable<AiChatRuns>;
 
 // AI Chat Page Snapshot (#274): per-(chat,page) Markdown snapshot taken at the
 // end of the agent's previous turn, diffed against the current page next turn to
@@ -217,14 +214,11 @@ export type UpdatableFavorite = Updateable<Omit<Favorites, 'id'>>;
 // Page Transclusion
 export type PageTransclusion = Selectable<PageTransclusions>;
 export type InsertablePageTransclusion = Insertable<PageTransclusions>;
-export type UpdatablePageTransclusion = Updateable<
+export type UpdatablePageTransclusion = Updateable<Omit<PageTransclusions, 'id'>>;
-  Omit<PageTransclusions, 'id'>
->;
 
 // Page Transclusion Reference
 export type PageTransclusionReference = Selectable<PageTransclusionReferences>;
-export type InsertablePageTransclusionReference =
+export type InsertablePageTransclusionReference = Insertable<PageTransclusionReferences>;
-  Insertable<PageTransclusionReferences>;
 export type UpdatablePageTransclusionReference = Updateable<
   Omit<PageTransclusionReferences, 'id'>
 >;
@@ -294,9 +288,7 @@ export type UpdatablePagePermission = Updateable<Omit<_PagePermissions, 'id'>>;
 // Page Verification
 export type PageVerification = Selectable<_PageVerifications>;
 export type InsertablePageVerification = Insertable<_PageVerifications>;
-export type UpdatablePageVerification = Updateable<
+export type UpdatablePageVerification = Updateable<Omit<_PageVerifications, 'id'>>;
-  Omit<_PageVerifications, 'id'>
->;
 
 // Page Verifier
 export type PageVerifier = Selectable<_PageVerifiers>;

apps/server/src/integrations/environment/environment.service.ts

@@ -227,22 +227,6 @@ export class EnvironmentService {
     return compactTree === 'true';
   }
 
-  /**
-   * Operator toggle for the public client-telemetry sink (#355). DEFAULT OFF:
-   * the unauthenticated POST /api/telemetry/vitals endpoint + client vitals
-   * collection are only wired when this is explicitly true. Kept SEPARATE from
-   * METRICS_PORT (the server Prometheus half) because Grafana reads the
-   * `client_metrics` table directly, independent of the scrape port — and
-   * because `client_metrics` has no app-side retention, so an operator must opt
-   * in and run an external pruner.
-   */
-  isClientTelemetryEnabled(): boolean {
-    const enabled = this.configService
-      .get<string>('CLIENT_TELEMETRY_ENABLED', 'false')
-      .toLowerCase();
-    return enabled === 'true';
-  }
-
   getStripePublishableKey(): string {
     return this.configService.get<string>('STRIPE_PUBLISHABLE_KEY');
   }

apps/server/src/integrations/export/export-markdown.spec.ts

@@ -1,145 +0,0 @@
-// export.service.ts imports the ESM-only @sindresorhus/slugify (not in jest's
-// transform allowlist). It is irrelevant to the markdown-serialization path under
-// test (only used for page-mention link slugs on the DB path), so it is mocked
-// out to keep the module graph loadable under ts-jest (mirrors the import specs).
-jest.mock('@sindresorhus/slugify', () => ({
-  __esModule: true,
-  default: (input: string) => String(input),
-}));
-
-import { convertProseMirrorToMarkdown } from '@docmost/prosemirror-markdown';
-import { ExportService } from './export.service';
-import { ExportFormat } from './dto/export-dto';
-
-/**
- * STEP 1 golden test for issue #345: server MARKDOWN export runs DIRECTLY through
- * the canonical converter (`convertProseMirrorToMarkdown`) — no HTML intermediate
- * and no `@docmost/editor-ext` markdown layer — so the emitted markdown is in the
- * canonical package forms and is byte-identical to the git-sync vault body.
- *
- * These are the goldens the swap has to satisfy: they assert the CANONICAL
- * surface (callout `> [!type]`, inline footnote `^[…]`, lossless image
- * `<!--img …-->`) rather than the old editor-ext forms (`:::type`, `[^id]`,
- * lossy `![alt](src)`).
- *
- * `exportPage(..., singlePage=false)` takes no DB path (no mention rewriting), so
- * the service is constructed with null collaborators and only the pure
- * PM -> Markdown path is exercised.
- */
-
-function makeService(): ExportService {
-  return new ExportService(
-    null as any, // pageRepo
-    null as any, // pagePermissionRepo
-    null as any, // db
-    null as any, // storageService
-    null as any, // environmentService
-    null as any, // domainService
-  );
-}
-
-// A representative page exercising the node types whose canonical markdown form
-// changed with the move off the editor-ext layer: callout, inline footnote, and a
-// lossless image carrying width/align attrs that the old layer dropped.
-const REPRESENTATIVE_DOC = {
-  type: 'doc',
-  content: [
-    {
-      type: 'paragraph',
-      content: [
-        { type: 'text', text: 'Body ' },
-        { type: 'footnoteReference', attrs: { id: 'fn-1' } },
-        { type: 'text', text: ' end.' },
-      ],
-    },
-    {
-      type: 'callout',
-      attrs: { type: 'info', icon: null },
-      content: [
-        {
-          type: 'paragraph',
-          content: [{ type: 'text', text: 'Heads up' }],
-        },
-      ],
-    },
-    {
-      type: 'image',
-      attrs: {
-        src: '/files/pic.png',
-        alt: 'Pic',
-        width: 320,
-        align: 'left',
-      },
-    },
-    {
-      type: 'footnotesList',
-      content: [
-        {
-          type: 'footnoteDefinition',
-          attrs: { id: 'fn-1' },
-          content: [
-            {
-              type: 'paragraph',
-              content: [{ type: 'text', text: 'the note' }],
-            },
-          ],
-        },
-      ],
-    },
-  ],
-};
-
-describe('ExportService — markdown export via the canonical converter (#345)', () => {
-  it('emits canonical callout, inline footnote and lossless image forms', async () => {
-    const service = makeService();
-    const md = (await service.exportPage(ExportFormat.Markdown, {
-      title: '',
-      content: REPRESENTATIVE_DOC,
-    } as any)) as string;
-
-    // Callout: Obsidian `> [!type]`, NOT the legacy `:::type`.
-    expect(md).toContain('> [!info]');
-    expect(md).not.toContain(':::');
-
-    // Inline footnote: `^[…]`, NOT the reference `[^id]` form.
-    expect(md).toContain('^[the note]');
-    expect(md).not.toMatch(/\[\^/);
-
-    // Lossless image: trailing `<!--img …-->` carrying the dropped attrs.
-    expect(md).toContain('![Pic](/files/pic.png)');
-    expect(md).toContain('<!--img');
-    expect(md).toContain('"width":"320"');
-    expect(md).toContain('"align":"left"');
-  });
-
-  it('export body is byte-identical to the git-sync vault serializer (export == vault)', async () => {
-    const service = makeService();
-    // A title-less page: exportPage prepends NO heading, so the whole output is
-    // the page BODY — exactly what git-sync serializes (git-sync stores the title
-    // in frontmatter / the filename, never as an in-body H1).
-    const exported = (await service.exportPage(ExportFormat.Markdown, {
-      title: '',
-      content: REPRESENTATIVE_DOC,
-    } as any)) as string;
-
-    // The git-sync vault writer feeds this SAME converter (git-sync
-    // `stabilizePageBody` = convertProseMirrorToMarkdown(content) at the
-    // fixpoint). For an already-stable doc the single pass IS the fixpoint, so
-    // the two are byte-identical by construction — assert it.
-    const vaultBody = convertProseMirrorToMarkdown(REPRESENTATIVE_DOC);
-    expect(exported).toBe(vaultBody);
-  });
-
-  it('prepends the page title as an H1 heading (the one documented export/vault delta)', async () => {
-    const service = makeService();
-    const md = (await service.exportPage(ExportFormat.Markdown, {
-      title: 'My Page',
-      content: { type: 'doc', content: [] },
-    } as any)) as string;
-
-    // Export makes standalone files, so it prepends the title as an H1. This is
-    // the ONE deliberate difference from the vault body (which carries the title
-    // in frontmatter). The body below the heading still serializes canonically.
-    expect(md.startsWith('# My Page')).toBe(true);
-  });
-});

apps/server/src/integrations/export/export.service.ts

@@ -37,7 +37,7 @@ import {
   getAttachmentIds,
   getProsemirrorContent,
 } from '../../common/helpers/prosemirror/utils';
-import { convertProseMirrorToMarkdown } from '@docmost/prosemirror-markdown';
+import { htmlToMarkdown } from '@docmost/editor-ext';
 
 type AllowedAttachment = { id: string; fileName: string; filePath: string };
 
@@ -79,8 +79,9 @@ export class ExportService {
       prosemirrorJson.content.unshift(titleNode);
     }
 
+    const pageHtml = jsonToHtml(prosemirrorJson);
+
     if (format === ExportFormat.HTML) {
-      const pageHtml = jsonToHtml(prosemirrorJson);
       return `<!DOCTYPE html>
       <html>
         <head>
@@ -91,14 +92,11 @@ export class ExportService {
     }
 
     if (format === ExportFormat.Markdown) {
-      // Direct ProseMirror JSON -> Markdown via the canonical converter
+      const newPageHtml = pageHtml.replace(
-      // (`@docmost/prosemirror-markdown`). This is the SAME serializer the
+        /<colgroup[^>]*>[\s\S]*?<\/colgroup>/gim,
-      // git-sync vault writer feeds (see git-sync `stabilizePageBody`), so an
+        '',
-      // exported page body is byte-identical to its vault representation — no
+      );
-      // HTML intermediate, no second markdown layer, no format drift (issue
+      return htmlToMarkdown(newPageHtml);
-      // #345). The old `<colgroup>` scrub is gone with the HTML step: the
-      // converter emits GFM tables directly and never produces `<colgroup>`.
-      return convertProseMirrorToMarkdown(prosemirrorJson);
     }
 
     return;

apps/server/src/integrations/import/services/file-import-task.service.footnote-canonicalize.spec.ts

@@ -17,22 +17,6 @@ jest.mock('image-dimensions', () => ({
   __esModule: true,
   imageDimensionsFromData: () => undefined,
 }));
-// FileImportTaskService -> PageService -> collaboration.gateway ->
-// metrics.registry imports `prom-client`, which is not resolvable in this
-// workspace's node_modules (types-only stub, no runtime entry). Metrics are
-// disabled on this path, so a virtual no-op mock keeps the module graph loadable.
-jest.mock(
-  'prom-client',
-  () => ({
-    collectDefaultMetrics: () => undefined,
-    Registry: class {},
-    Histogram: class {},
-    Gauge: class {},
-    Counter: class {},
-    Summary: class {},
-  }),
-  { virtual: true },
-);
 
 import { promises as fs } from 'fs';
 import * as os from 'os';
@@ -42,17 +26,14 @@ import { ImportService } from './import.service';
 
 /**
  * Binding test for issue #228 / review #5: FileImportTaskService.processGenericImport
- * is a NON-editor write path, so a zip-imported `.md` page ends up with canonical
+ * is a NON-editor write path (markdownToHtml -> processHTML -> JSON, never runs
- * footnotes before persisting: ordered by first reference, reused refs deduped,
+ * footnoteSyncPlugin), so it canonicalizes footnotes before persisting. This pins
- * orphan definitions dropped.
+ * that binding — the same one import.service has a spec for — which previously had
+ * NO spec at all.
  *
- * Since #345 the `.md` parse runs `normalizeForeignMarkdown` ->
+ * The markdown -> HTML -> ProseMirror conversion is REAL (a real ImportService,
- * `markdownToProseMirror` -> `jsonToHtml` (feeding the shared HTML attachment /
+ * its createYdoc stubbed); the filesystem is a real temp dir with one .md file;
- * link pipeline) -> `processHTML` -> `canonicalizeFootnotes`. The parser assigns
+ * the DB transaction is stubbed to capture the persisted page content.
- * fresh `fn-*` ids, so we assert by definition BODY order rather than the source
- * labels. The conversion is REAL (a real ImportService, its createYdoc stubbed);
- * the filesystem is a real temp dir with one .md file; the DB transaction is
- * stubbed to capture the persisted page content.
  */
 
 // Out-of-order references (c, a, b), a REUSED reference ([^a] twice), and an
@@ -68,14 +49,13 @@ const MARKDOWN = [
   '[^z]: orphan note',
 ].join('\n');
 
-/** Definition body texts of the (single) footnotesList, in list order. */
+function footnoteListIds(content: any): string[] {
-function footnoteListBodies(content: any): string[] {
   const list = (content?.content ?? []).find(
     (n: any) => n.type === 'footnotesList',
   );
   return (list?.content ?? [])
     .filter((n: any) => n.type === 'footnoteDefinition')
-    .map((n: any) => n.content?.[0]?.content?.[0]?.text);
+    .map((n: any) => n.attrs?.id);
 }
 
 // A permissive chainable stub for the spaces lookup (selectFrom(...).select(...)
@@ -91,127 +71,80 @@ function chainable(result: any): any {
   return proxy;
 }
 
-/**
- * Run one markdown file through the REAL zip-import pipeline
- * (`processGenericImport` -> `markdownToProseMirror` -> `jsonToHtml` ->
- * `processHTML`/`htmlToJson`) and return the persisted page `content`. This is
- * the server-specific PM->HTML->PM hop that the package's own PM<->MD tests do
- * NOT cover.
- */
-async function runZipImport(markdown: string): Promise<any> {
-  const extractDir = await fs.mkdtemp(path.join(os.tmpdir(), 'fit-canon-'));
-  await fs.writeFile(path.join(extractDir, 'note.md'), markdown, 'utf-8');
-
-  const importService = new ImportService(
-    {} as any,
-    {} as any,
-    {} as any,
-    {} as any,
-  );
-  jest
-    .spyOn(importService as any, 'createYdoc')
-    .mockResolvedValue(Buffer.from([]) as any);
-
-  let captured: any = null;
-  const trx = {
-    insertInto: (table: string) => ({
-      values: (v: any) => {
-        if (table === 'pages') captured = v;
-        return { execute: async () => {} };
-      },
-    }),
-  };
-  const db: any = {
-    selectFrom: () => chainable({ slug: 'space-slug' }),
-    transaction: () => ({ execute: (fn: any) => fn(trx) }),
-  };
-
-  const importAttachmentService = {
-    processAttachments: async ({ html }: any) => html,
-  };
-  const service = new FileImportTaskService(
-    {} as any, // storageService
-    importService as any,
-    { nextPagePosition: async () => 'a0' } as any,
-    { insertBacklink: jest.fn() } as any,
-    db,
-    importAttachmentService as any,
-    { emit: jest.fn() } as any,
-    { logBatchWithContext: jest.fn() } as any,
-  );
-
-  const fileTask: any = {
-    id: 'task-1',
-    source: 'generic',
-    spaceId: 'space-1',
-    workspaceId: 'ws-1',
-    creatorId: 'user-1',
-  };
-
-  try {
-    await service.processGenericImport({ extractDir, fileTask });
-    expect(captured).toBeTruthy();
-    return captured.content;
-  } finally {
-    await fs.rm(extractDir, { recursive: true, force: true });
-  }
-}
-
-/** Find the first node of a given type anywhere in a PM content tree. */
-function findFirst(node: any, type: string): any {
-  if (!node || typeof node !== 'object') return null;
-  if (node.type === type) return node;
-  for (const child of node.content ?? []) {
-    const hit = findFirst(child, type);
-    if (hit) return hit;
-  }
-  return null;
-}
-
 describe('FileImportTaskService.processGenericImport — footnote canonicalization (#228)', () => {
   it('orders footnotes by first reference, dedupes reuse, and drops orphans on zip import', async () => {
-    const content = await runZipImport(MARKDOWN);
+    const extractDir = await fs.mkdtemp(path.join(os.tmpdir(), 'fit-canon-'));
-    // Definitions ordered by FIRST REFERENCE (C, A, B), NOT the markdown
+    await fs.writeFile(path.join(extractDir, 'note.md'), MARKDOWN, 'utf-8');
-    // definition order (A, B, C). Ids are the parser's fresh `fn-*`, so pin
+
-    // the BODIES.
+    // Real ImportService for the html -> JSON conversion; stub the yjs encode.
-    expect(footnoteListBodies(content)).toEqual(['note C', 'note A', 'note B']);
+    const importService = new ImportService(
-    // Orphan [^z] dropped; reused [^a] collapses to one definition; one list.
+      {} as any,
-    expect(footnoteListBodies(content)).not.toContain('orphan note');
+      {} as any,
-    const lists = (content.content ?? []).filter(
+      {} as any,
-      (n: any) => n.type === 'footnotesList',
+      {} as any,
     );
-    expect(lists).toHaveLength(1);
+    jest
-    expect(
+      .spyOn(importService as any, 'createYdoc')
-      footnoteListBodies(content).filter((b) => b === 'note A'),
+      .mockResolvedValue(Buffer.from([]) as any);
-    ).toHaveLength(1);
-  });
 
-  // #345 F4: the zip path routes markdown through jsonToHtml -> processHTML ->
+    let captured: any = null;
-  // htmlToJson (the shared HTML attachment pipeline). #345's headline is LOSSLESS
+    const trx = {
-  // image width/align via the `<!--img {...}-->` comment; a callout carries its
+      insertInto: (table: string) => ({
-  // `type`. This asserts those survive the PM->HTML->PM hop — the one hop the
+        values: (v: any) => {
-  // package's PM<->MD suite does not exercise.
+          if (table === 'pages') captured = v;
-  it('preserves image width/align and callout type through the PM->HTML->PM hop', async () => {
+          return { execute: async () => {} };
-    const md = [
+        },
-      '# Doc',
+      }),
-      '',
+    };
-      '![a picture](https://example.com/i.png) <!--img {"width":"320","align":"left"}-->',
+    const db: any = {
-      '',
+      selectFrom: () => chainable({ slug: 'space-slug' }),
-      ':::warning',
+      transaction: () => ({ execute: (fn: any) => fn(trx) }),
-      'Careful now.',
+    };
-      ':::',
-    ].join('\n');
 
-    const content = await runZipImport(md);
+    const importAttachmentService = {
+      processAttachments: async ({ html }: any) => html,
+    };
+    const backlinkRepo = { insertBacklink: jest.fn() };
+    const eventEmitter = { emit: jest.fn() };
+    const auditService = { logBatchWithContext: jest.fn() };
 
-    const image = findFirst(content, 'image');
+    const pageService = { nextPagePosition: async () => 'a0' };
-    expect(image).toBeTruthy();
-    // The lossless sizing/alignment must survive the HTML hop.
-    expect(String(image.attrs?.width)).toBe('320');
-    expect(image.attrs?.align).toBe('left');
 
-    const callout = findFirst(content, 'callout');
+    const service = new FileImportTaskService(
-    expect(callout).toBeTruthy();
+      {} as any, // storageService
-    expect(callout.attrs?.type).toBe('warning');
+      importService as any,
+      pageService as any,
+      backlinkRepo as any,
+      db,
+      importAttachmentService as any,
+      eventEmitter as any,
+      auditService as any,
+    );
+
+    const fileTask: any = {
+      id: 'task-1',
+      source: 'generic',
+      spaceId: 'space-1',
+      workspaceId: 'ws-1',
+      creatorId: 'user-1',
+    };
+
+    try {
+      await service.processGenericImport({ extractDir, fileTask });
+
+      expect(captured).toBeTruthy();
+      const content = captured.content;
+      // Reference order is c, a, b (NOT the markdown definition order a, b, c).
+      expect(footnoteListIds(content)).toEqual(['c', 'a', 'b']);
+      // Orphan [^z] dropped; reused [^a] collapses to one definition; one list.
+      expect(footnoteListIds(content)).not.toContain('z');
+      const lists = (content.content ?? []).filter(
+        (n: any) => n.type === 'footnotesList',
+      );
+      expect(lists).toHaveLength(1);
+      expect(footnoteListIds(content).filter((id) => id === 'a')).toHaveLength(1);
+    } finally {
+      await fs.rm(extractDir, { recursive: true, force: true });
+    }
   });
 });

apps/server/src/integrations/import/services/file-import-task.service.ts

@@ -1,9 +1,6 @@
 import { Inject, Injectable, Logger } from '@nestjs/common';
 import * as path from 'path';
-import {
+import { jsonToText } from '../../../collaboration/collaboration.util';
-  jsonToHtml,
-  jsonToText,
-} from '../../../collaboration/collaboration.util';
 import { InjectKysely } from 'nestjs-kysely';
 import { KyselyDB } from '@docmost/db/types/kysely.types';
 import {
@@ -21,11 +18,9 @@ import { generateSlugId } from '../../../common/helpers';
 import { v7 } from 'uuid';
 import { generateJitteredKeyBetween } from 'fractional-indexing-jittered';
 import { FileTask, InsertablePage } from '@docmost/db/types/entity.types';
-import { canonicalizeFootnotes } from '@docmost/editor-ext';
+import { markdownToHtml, canonicalizeFootnotes } from '@docmost/editor-ext';
-import { markdownToProseMirror } from '@docmost/prosemirror-markdown';
 import { getProsemirrorContent } from '../../../common/helpers/prosemirror/utils';
 import { formatImportHtml } from '../utils/import-formatter';
-import { normalizeForeignMarkdown } from '../utils/foreign-markdown';
 import {
   buildAttachmentCandidates,
   collectMarkdownAndHtmlFiles,
@@ -466,18 +461,7 @@ export class FileImportTaskService {
               content = await fs.readFile(absPath, 'utf-8');
 
               if (page.fileExtension.toLowerCase() === '.md') {
-                // Parse markdown with the single canonical converter
+                content = await markdownToHtml(content);
-                // (`@docmost/prosemirror-markdown`), after normalizing foreign
-                // reference footnotes, then serialize to HTML so the shared HTML
-                // pipeline below (processAttachments + formatImportHtml +
-                // processHTML) keeps handling `.md` and `.html` imports
-                // uniformly. The markdown PARSE no longer goes through the
-                // editor-ext markdown layer (issue #345) — the drift source is
-                // gone. The PM -> HTML -> PM hop that follows is lossless
-                // plumbing for attachment/link resolution, NOT a second parse.
-                content = jsonToHtml(
-                  await markdownToProseMirror(normalizeForeignMarkdown(content)),
-                );
               }
             } catch (err: any) {
               if (err?.code === 'ENOENT') {
@@ -516,12 +500,10 @@ export class FileImportTaskService {
               this.importService.extractTitleAndRemoveHeading(pmState);
 
             // Canonicalize footnote topology on this non-editor write path
-            // (the HTML pipeline's processHTML never runs footnoteSyncPlugin), so
+            // (markdownToHtml/processHTML never runs footnoteSyncPlugin), so a
-            // a zip-imported page's footnotes are reference-ordered, deduped, and
+            // zip-imported page's footnotes are reference-ordered, deduped, and
             // orphan-free like the editor's invariant (issue #228). Pure +
-            // idempotent + shape-safe; a footnote-free doc is unchanged. (For a
+            // idempotent + shape-safe; a footnote-free doc is unchanged.
-            // `.md` file the package parser already yields canonical footnotes,
-            // so this is a no-op there.)
             // (Future consolidation, architecture B: like import.service, this
             // path persists directly rather than via PageService — a shared
             // "prepare JSON for persist" helper would centralize this call.)

apps/server/src/integrations/import/services/import.service.footnote-canonicalize.spec.ts

@@ -12,19 +12,13 @@ import { canonicalizeFootnotes } from '@docmost/editor-ext';
 
 /**
  * Integration-ish test for the USER-FACING markdown import path
- * (`ImportService.importPage`). It exercises the REAL markdown -> ProseMirror
+ * (`ImportService.importPage`). It exercises the REAL markdown -> HTML -> JSON
- * conversion and asserts the stored page's footnotes are canonical: ordered by
+ * conversion and asserts that the stored page content has its footnotes
- * FIRST REFERENCE (not markdown definition order), reused references deduped to a
+ * canonicalized — the gap that issue #228 fixes: the import path builds
- * single definition, and orphan definitions dropped.
+ * ProseMirror JSON directly (never running the editor's footnoteSyncPlugin), so
- *
+ * before this wiring the stored footnotes kept the markdown's physical
- * Since #345 the markdown parse runs through the canonical package
+ * definition order (out of order vs. references), retained orphan definitions,
- * (`normalizeForeignMarkdown` -> `markdownToProseMirror`), which owns this
+ * and did not collapse reused references.
- * canonicalization: the input's GFM `[^id]` reference footnotes are normalized to
- * inline `^[…]`, and the parser assigns fresh sequential ids (`fn-*`) in
- * reference order while merging identical bodies — so we assert by definition
- * BODY order, not by the source labels. `canonicalizeFootnotes` remains wired as
- * an idempotent safety net (issue #228) and is a no-op on this already-canonical
- * output.
  *
  * The DB/ydoc side-effects are stubbed: `getNewPagePosition` (DB query) and
  * `createYdoc` (Yjs encode) are spied, and `pageRepo.insertPage` captures the
@@ -73,14 +67,24 @@ function makeService() {
 }
 
 /** List the footnote-definition ids of the (single) footnotesList, in order. */
-/** Definition body texts of the (single) footnotesList, in list order. */
+function footnoteListIds(content: any): string[] {
-function footnoteListBodies(content: any): string[] {
   const list = (content.content ?? []).find(
     (n: any) => n.type === 'footnotesList',
   );
-  return (list?.content ?? [])
+  if (!list) return [];
+  return (list.content ?? [])
     .filter((n: any) => n.type === 'footnoteDefinition')
-    .map((n: any) => n.content?.[0]?.content?.[0]?.text);
+    .map((n: any) => n.attrs?.id);
+}
+
+function definitionText(content: any, id: string): string | undefined {
+  const list = (content.content ?? []).find(
+    (n: any) => n.type === 'footnotesList',
+  );
+  const def = (list?.content ?? []).find(
+    (n: any) => n.type === 'footnoteDefinition' && n.attrs?.id === id,
+  );
+  return def?.content?.[0]?.content?.[0]?.text;
 }
 
 describe('ImportService.importPage — footnote canonicalization (#228)', () => {
@@ -97,23 +101,23 @@ describe('ImportService.importPage — footnote canonicalization (#228)', () =>
     const content = getCaptured().content;
     expect(content).toBeTruthy();
 
-    // Definitions ordered by FIRST REFERENCE (C, A, B) — NOT the markdown
+    // Reference order is c, a, b (NOT the markdown definition order a, b, c).
-    // definition order (A, B, C) — with the orphan [^z] dropped and the reused
+    expect(footnoteListIds(content)).toEqual(['c', 'a', 'b']);
-    // [^a] collapsed to a single definition. (Ids are the parser's fresh `fn-*`,
+
-    // so we pin the BODIES.)
+    // Definitions preserved and attached to the right ids.
-    expect(footnoteListBodies(content)).toEqual(['note C', 'note A', 'note B']);
+    expect(definitionText(content, 'c')).toBe('note C');
+    expect(definitionText(content, 'a')).toBe('note A');
+    expect(definitionText(content, 'b')).toBe('note B');
 
     // Orphan definition [^z] is dropped.
-    expect(footnoteListBodies(content)).not.toContain('orphan note');
+    expect(footnoteListIds(content)).not.toContain('z');
 
     // Reused [^a] yields exactly ONE definition, and exactly one list.
     const lists = (content.content ?? []).filter(
       (n: any) => n.type === 'footnotesList',
     );
     expect(lists).toHaveLength(1);
-    expect(
+    expect(footnoteListIds(content).filter((id) => id === 'a')).toHaveLength(1);
-      footnoteListBodies(content).filter((b) => b === 'note A'),
-    ).toHaveLength(1);
   });
 
   it('is idempotent: canonicalizing the stored output again is a no-op', async () => {
@@ -130,6 +134,6 @@ describe('ImportService.importPage — footnote canonicalization (#228)', () =>
     // time must not change it (safe to wire into every write path).
     const second = canonicalizeFootnotes(stored);
     expect(second).toEqual(stored);
-    expect(footnoteListBodies(second)).toEqual(['note C', 'note A', 'note B']);
+    expect(footnoteListIds(second)).toEqual(['c', 'a', 'b']);
   });
 });

apps/server/src/integrations/import/services/import.service.ts

@@ -17,9 +17,7 @@ import {
 import { generateJitteredKeyBetween } from 'fractional-indexing-jittered';
 import { TiptapTransformer } from '@hocuspocus/transformer';
 import * as Y from 'yjs';
-import { canonicalizeFootnotes } from '@docmost/editor-ext';
+import { markdownToHtml, canonicalizeFootnotes } from '@docmost/editor-ext';
-import { markdownToProseMirror } from '@docmost/prosemirror-markdown';
-import { normalizeForeignMarkdown } from '../utils/foreign-markdown';
 import {
   FileTaskStatus,
   FileTaskType,
@@ -87,13 +85,11 @@ export class ImportService {
 
     const extracted = this.extractTitleAndRemoveHeading(prosemirrorState);
     const title = extracted.title;
-    // The markdown path now canonicalizes footnotes itself (the package parser),
+    // Imported markdown/HTML is built via markdownToHtml -> htmlToJson, which
-    // but the HTML path (processHTML -> htmlToJson) does NOT run the editor's
+    // never runs the editor's footnoteSyncPlugin, so the footnote topology keeps
-    // footnoteSyncPlugin, so an imported HTML doc can keep its source's PHYSICAL
+    // the source's PHYSICAL definition order (out of order vs. references),
-    // definition order (out of order vs. references), retain orphan definitions,
+    // retains orphan definitions, and is not deduped. Canonicalize before
-    // and not be deduped. Canonicalize before persisting so the stored page
+    // persisting so the stored page matches the editor's invariant (issue #228).
-    // matches the editor's invariant (issue #228); it is an idempotent no-op on
-    // the already-canonical markdown output.
     // Pure + idempotent + shape-safe: a doc with no footnotes is unchanged.
     // (Future consolidation, architecture B: this import path persists directly
     // via pageRepo.insertPage rather than through PageService.createPage, so the
@@ -137,15 +133,12 @@ export class ImportService {
   }
 
   async processMarkdown(markdownInput: string): Promise<any> {
-    // Canonical markdown -> ProseMirror JSON directly via
+    try {
-    // `@docmost/prosemirror-markdown` (issue #345) — no HTML intermediate and no
+      const html = await markdownToHtml(markdownInput);
-    // second editor-ext markdown layer. Foreign markdown surfaces the strict
+      return this.processHTML(html);
-    // canonical parser does not accept (GFM `[^id]` reference footnotes) are
+    } catch (err) {
-    // rewritten to the canonical inline form by `normalizeForeignMarkdown` first.
+      throw err;
-    // The HTML-cleanup pass (`normalizeImportHtml`) is intentionally skipped here:
+    }
-    // it targets foreign *HTML* (Notion/XWiki), which only ever arrives on the
-    // `.html` path (`processHTML`), never as canonical markdown.
-    return markdownToProseMirror(normalizeForeignMarkdown(markdownInput));
   }
 
   async processHTML(htmlInput: string): Promise<any> {

apps/server/src/integrations/import/utils/foreign-markdown.spec.ts

@@ -1,218 +0,0 @@
-import {
-  convertProseMirrorToMarkdown,
-  markdownToProseMirror,
-} from '@docmost/prosemirror-markdown';
-import { normalizeForeignMarkdown } from './foreign-markdown';
-
-/**
- * STEP 2 goldens for issue #345: the foreign-markdown normalizer that runs at the
- * import boundary BEFORE the strict canonical parser (`markdownToProseMirror`).
- *
- * Two layers:
- *  1. PURE string→string cases pinning the normalizer's own behavior (GFM
- *     reference footnotes → inline `^[…]`).
- *  2. END-TO-END acceptance: for a foreign corpus, `normalizeForeignMarkdown`
- *     then `markdownToProseMirror` then `convertProseMirrorToMarkdown` must leave
- *     NO literal `[^id]` / `:::` garbage in the document and must re-export in the
- *     canonical forms.
- */
-
-describe('normalizeForeignMarkdown — GFM reference footnotes', () => {
-  it('inlines a single-line reference footnote and drops its definition', () => {
-    const out = normalizeForeignMarkdown(
-      'A note[^1] here.\n\n[^1]: The definition.',
-    );
-    expect(out).toBe('A note^[The definition.] here.\n');
-  });
-
-  it('inlines every reference to a reused id (downstream dedups)', () => {
-    const out = normalizeForeignMarkdown(
-      'X[^a] and Y[^a].\n\n[^a]: shared.',
-    );
-    expect(out).toBe('X^[shared.] and Y^[shared.].\n');
-  });
-
-  it('joins indented continuation lines of a definition with a space', () => {
-    const out = normalizeForeignMarkdown(
-      'See[^n].\n\n[^n]: line one\n    line two',
-    );
-    expect(out).toBe('See^[line one line two].\n');
-  });
-
-  it('never rewrites a reference inside a fenced code block', () => {
-    const out = normalizeForeignMarkdown(
-      '```\ncode[^1] here\n```\n\n[^1]: def.',
-    );
-    expect(out).toContain('code[^1] here');
-    // The (now orphaned) definition line is still removed.
-    expect(out).not.toContain('[^1]: def.');
-  });
-
-  it('never rewrites a reference inside an INLINE-code span (backticks)', () => {
-    // The `[^1]` inside backticks is literal code and must survive verbatim;
-    // the one outside is rewritten. (Bug #1: only fenced blocks were protected.)
-    const out = normalizeForeignMarkdown(
-      'Use `arr[^1]` in code but note[^1] in prose.\n\n[^1]: def.',
-    );
-    expect(out).toBe('Use `arr[^1]` in code but note^[def.] in prose.\n');
-  });
-
-  it('escapes brackets in a body so an unbalanced ] cannot truncate the footnote', () => {
-    // A foreign definition body with a stray `]` would, unescaped, close the
-    // canonical `^[...]` early and leak the tail as text (bug #2). The body's
-    // brackets are backslash-escaped so the footnote stays whole.
-    const out = normalizeForeignMarkdown(
-      'Ref[^1] here.\n\n[^1]: see item ] and [more] later',
-    );
-    expect(out).toBe('Ref^[see item \\] and \\[more\\] later] here.\n');
-    // The tokenizer must see exactly one unescaped closing bracket (our own).
-    expect(out.match(/(?<!\\)\]/g)).toHaveLength(1);
-  });
-
-  it('leaves a reference with no matching definition literal (no body to inline)', () => {
-    const out = normalizeForeignMarkdown('Dangling[^x] ref.');
-    expect(out).toBe('Dangling[^x] ref.');
-  });
-
-  it('returns the input unchanged when there are no reference footnotes', () => {
-    const md = '# Title\n\nJust text with `inline code` and a [link](/x).';
-    expect(normalizeForeignMarkdown(md)).toBe(md);
-  });
-
-  it('does NOT touch callout surfaces — the canonical parser handles them', () => {
-    const callouts = ':::info\nHi\n:::\n\n> [!warning]\n> Careful';
-    expect(normalizeForeignMarkdown(callouts)).toBe(callouts);
-  });
-
-  it('strips a leading YAML front-matter block (Obsidian/Hugo/git-sync files)', () => {
-    const out = normalizeForeignMarkdown(
-      '---\ntitle: My Page\ntags: [a, b]\n---\n\n# Heading\n\nBody.',
-    );
-    expect(out).toBe('# Heading\n\nBody.');
-    // The front-matter must not leak into the body as a setext heading.
-    expect(out).not.toContain('title: My Page');
-    expect(out).not.toContain('---');
-  });
-
-  it('does not strip a horizontal rule that is not leading front-matter', () => {
-    const md = 'Intro paragraph.\n\n---\n\nAfter the rule.';
-    expect(normalizeForeignMarkdown(md)).toBe(md);
-  });
-
-  it('is linear on a document with thousands of definitions (no quadratic blowup)', () => {
-    // F2(a): the pass-2 rewrite must be O(text), not O(text × defs). Build a
-    // pathological doc (many defs + many plain text lines) and assert it
-    // completes well under a second — a quadratic implementation took ~14s.
-    const N = 4000;
-    const refs = Array.from({ length: N }, (_, i) => `line ${i} plain text`).join('\n');
-    const defs = Array.from({ length: N }, (_, i) => `[^n${i}]: def ${i}`).join('\n');
-    const doc = `start[^n0] and[^n${N - 1}] end\n\n${refs}\n\n${defs}`;
-    const t0 = Date.now();
-    const out = normalizeForeignMarkdown(doc);
-    const elapsed = Date.now() - t0;
-    expect(elapsed).toBeLessThan(2000);
-    // Sanity: the two real references were still inlined.
-    expect(out).toContain('^[def 0]');
-    expect(out).toContain(`^[def ${N - 1}]`);
-  });
-
-  it('is bounded on a long unclosed backtick run (no inline-split ReDoS)', () => {
-    // F2(b): a huge unterminated backtick run must not cause quadratic
-    // backtracking in the inline-code split. Oversized lines skip the split
-    // entirely (left untouched), so this returns promptly.
-    const line = 'x' + '`'.repeat(200000);
-    const doc = `${line}\n\n[^1]: def`;
-    const t0 = Date.now();
-    normalizeForeignMarkdown(doc);
-    expect(Date.now() - t0).toBeLessThan(2000);
-  });
-
-  it('does not crash or slow down on thousands of prefix-chain definition ids', () => {
-    // F7: the rewrite must use a FIXED generic scanner, not an alternation built
-    // from the ids. A `(a|aa|aaa|…)` alternation over prefix-chain ids blows the
-    // V8 regex compiler (FATAL RegExpCompiler Allocation failed — uncatchable,
-    // kills the process). A fixed scanner has no id-dependent compilation cost.
-    const N = 4000;
-    const ids = Array.from({ length: N }, (_, i) => 'a'.repeat(i + 1));
-    const defs = ids.map((id) => `[^${id}]: body ${id.length}`).join('\n');
-    const doc = `ref[^${ids[0]}] and[^${ids[N - 1]}] end\n\n${defs}`;
-    const t0 = Date.now();
-    const out = normalizeForeignMarkdown(doc);
-    expect(Date.now() - t0).toBeLessThan(2000);
-    // Prefix disambiguation is correct: [^a] and [^aaaa...] inline their OWN body.
-    expect(out).toContain('^[body 1]');
-    expect(out).toContain(`^[body ${N}]`);
-  });
-
-  it('strips a CRLF (Windows) front-matter block, not just LF', () => {
-    // F9: the line-anchored regex needs LF after the opening `---`, so a Windows
-    // file (`---\r\n…`) would slip past the strip and leak the front-matter into
-    // the body. normalizeForeignMarkdown normalizes CRLF -> LF first.
-    const out = normalizeForeignMarkdown(
-      '---\r\ntitle: Foo\r\ntags: [a]\r\n---\r\n\r\n# Heading\r\n\r\nBody.',
-    );
-    expect(out).toBe('# Heading\n\nBody.');
-    expect(out).not.toContain('title: Foo');
-    expect(out).not.toContain('---');
-  });
-
-  it('strips front-matter whose value contains a triple-dash (line-anchored)', () => {
-    // F8: the block must close only on a `\n---` LINE, not the first inline
-    // `---`. A value like `title: Q1 --- Q2` must not truncate the front-matter
-    // and leak the rest (author/closing ---) into the body.
-    const out = normalizeForeignMarkdown(
-      '---\ntitle: Q1 --- Q2 results\nauthor: bob\n---\n\nReal body.',
-    );
-    expect(out).toBe('Real body.');
-    expect(out).not.toContain('author: bob');
-    expect(out).not.toContain('Q2 results');
-  });
-});
-
-describe('foreign markdown import acceptance (normalizer + canonical parser)', () => {
-  const FOREIGN = [
-    '# Doc',
-    '',
-    'Body refs [^c] and [^a] and [^b] and again [^a].',
-    '',
-    ':::info',
-    'A legacy callout.',
-    ':::',
-    '',
-    '| h1 | h2 |',
-    '| --- | --- |',
-    '| 1 | 2 |',
-    '',
-    '[^a]: note A',
-    '[^b]: note B',
-    '[^c]: note C',
-    '[^z]: orphan note',
-  ].join('\n');
-
-  it('leaves no literal [^id] or ::: in the imported doc and re-exports canonically', async () => {
-    const normalized = normalizeForeignMarkdown(FOREIGN);
-    const doc = await markdownToProseMirror(normalized);
-    const reexport = convertProseMirrorToMarkdown(doc);
-
-    // No foreign garbage leaks into the document.
-    expect(reexport).not.toMatch(/\[\^/); // no reference footnote refs/defs
-    expect(reexport).not.toContain(':::'); // no legacy callout fences
-
-    // Canonical forms are present.
-    expect(reexport).toContain('^[note C]');
-    expect(reexport).toContain('> [!info]');
-    expect(reexport).toContain('| h1 | h2 |');
-
-    // Footnotes: ordered by first reference (C, A, B), reused [^a] deduped to one,
-    // orphan [^z] dropped (it had no reference after normalization).
-    const list = doc.content.find((n: any) => n.type === 'footnotesList');
-    const bodies = list.content.map(
-      (d: any) => d.content[0].content[0].text,
-    );
-    expect(bodies).toEqual(['note C', 'note A', 'note B']);
-    expect(bodies).not.toContain('orphan note');
-    expect(
-      doc.content.filter((n: any) => n.type === 'footnotesList'),
-    ).toHaveLength(1);
-  });
-});

apps/server/src/integrations/import/utils/foreign-markdown.ts

@@ -1,265 +0,0 @@
-/**
- * Foreign-markdown normalizer — an input-liberal / output-canonical adapter that
- * runs at the IMPORT boundary, BEFORE the canonical parser
- * (`markdownToProseMirror` from `@docmost/prosemirror-markdown`).
- *
- * The canonical parser is deliberately STRICT: it only understands Docmost's
- * canonical markdown surface (Obsidian-style `> [!type]` callouts, Pandoc/Obsidian
- * inline footnotes `^[body]`, lossless `![alt](src) <!--img {...}-->` images, …).
- * Import, however, ingests FOREIGN files (GitHub/GFM, Notion, old Docmost
- * exports). Those use surfaces the canonical parser does not accept, most notably
- * GitHub-flavoured *reference* footnotes:
- *
- *     Text with a note[^1] and another[^long].
- *
- *     [^1]: The first definition.
- *     [^long]: A second one.
- *
- * Left untouched, the parser does NOT recognise `[^id]` (it only parses `^[body]`),
- * so the reference leaks as literal text — and worse, the trailing `[^id]: def`
- * line is a valid CommonMark *link-reference definition*, so `[^id]` is silently
- * rendered as a bogus link. This normalizer rewrites reference footnotes into the
- * canonical inline form so the parser materialises real footnote nodes.
- *
- * This is a TEXT pre-pass, NOT a second parser fork: it does not re-implement any
- * converter logic. Callout surfaces (`:::type` and `> [!type]`) are intentionally
- * NOT touched here — the canonical parser already accepts BOTH natively (its
- * `preprocessCallouts` pass), so normalizing them would be redundant and would
- * only risk degrading the parser's nesting/code-fence-aware handling.
- */
-
-/** Matches a fenced code block delimiter (``` or ~~~), capturing the marker run. */
-const CODE_FENCE_RE = /^(\s*)(`{3,}|~{3,})/;
-
-/**
- * Matches a GFM footnote DEFINITION line: `[^id]: body`. The id is any run of
- * non-`]` characters; the body is the remainder of the line (possibly empty).
- */
-const FOOTNOTE_DEF_RE = /^\[\^([^\]]+)\]:[ \t]?(.*)$/;
-
-/** True when a line is a code-fence delimiter that toggles fenced-code state. */
-function fenceMarker(line: string): string | null {
-  const m = line.match(CODE_FENCE_RE);
-  return m ? m[2] : null;
-}
-
-/** True when a line is indented (leading space/tab) and not blank — a continuation. */
-function isIndentedContinuation(line: string): boolean {
-  return /^[ \t]+\S/.test(line);
-}
-
-function escapeRegExp(value: string): string {
-  return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-}
-
-/**
- * Backslash-escape any square bracket in a footnote body before it is wrapped in
- * `^[...]`. The canonical inline-footnote tokenizer scans the body with bracket
- * balancing and closes on the first UNMATCHED `]`, so an unbalanced bracket in a
- * foreign definition (e.g. `[^1]: see item ] later`) would otherwise truncate the
- * footnote and leak the tail as literal text. Escaping every `[`/`]` makes the
- * body an inert run of characters — the tokenizer then closes only on our own
- * closing `]`. (A balanced `[link](url)` inside a body still round-trips because
- * the escaped form renders the literal brackets, which is the safe reading for a
- * footnote body; the alternative — brittle balance tracking — risks worse.)
- */
-function escapeFootnoteBody(body: string): string {
-  return body.replace(/[[\]]/g, '\\$&');
-}
-
-/**
- * Rewrite every `[^id]` reference on a line to its `^[body]` form, but ONLY in the
- * text OUTSIDE inline-code spans. A `[^id]` inside backticks is literal code
- * content and must be preserved verbatim (a footnote ref never lives inside code).
- * We split the line on inline-code spans (paired backtick runs) and rewrite only
- * the non-code segments.
- */
-// Above this length a single line is not split into inline-code spans (see
-// below). A genuine markdown line carrying a footnote reference is never tens of
-// KB; the cap only bypasses the inline-code protection for pathological lines.
-const INLINE_SPLIT_MAX_LINE = 8192;
-
-function rewriteRefsOutsideInlineCode(
-  line: string,
-  replace: (text: string) => string,
-): string {
-  // The inline-code split alternation `(`+)(?:(?!\1)[\s\S])*\1` backtracks
-  // quadratically on a long UNCLOSED backtick run (its middle can consume the
-  // rest of the line, then fail to find a closing run and retry from each
-  // position). On an untrusted import this is a request-thread ReDoS. A real
-  // footnote line is short, so for an oversized line we skip the inline-code
-  // protection entirely and leave the line UNTOUCHED (rewriting it wholesale
-  // could corrupt a `[^id]` that legitimately lives inside inline code). This is
-  // a conservative bypass: an over-8KB line simply does not get its reference
-  // footnotes inlined — acceptable for a pathological input.
-  if (line.length > INLINE_SPLIT_MAX_LINE) return line;
-
-  // Alternation: an inline-code span (one or more backticks, then anything up to
-  // the SAME run of backticks) OR a run of non-backtick text. Unterminated
-  // backticks fall through as ordinary text (matched by the second branch on the
-  // leftover), so a stray backtick never swallows the rest of the line.
-  const parts = line.match(/(`+)(?:(?!\1)[\s\S])*\1|[^`]+|`+/g);
-  if (!parts) return line;
-  return parts
-    .map((seg) => (seg.startsWith('`') ? seg : replace(seg)))
-    .join('');
-}
-
-/**
- * Convert GFM reference footnotes (`[^id]` + `[^id]: def`) into canonical inline
- * footnotes (`^[def]`).
- *
- * - Definitions are collected first (a leading `[^id]: text` line plus any
- *   immediately-following indented continuation lines, joined with a space) and
- *   removed from the output.
- * - Each in-text reference `[^id]` for which a definition was found is replaced by
- *   `^[def]`. References with no matching definition are left literal (there is no
- *   body to inline; the parser fails them open the same way).
- * - Code is respected on both passes: `[^id]` inside a fenced ``` / ~~~ block is
- *   never rewritten and a `[^id]:` line inside a fence is never a definition; and
- *   on the rewrite pass a `[^id]` inside an INLINE-code span (backticks) is left
- *   literal too.
- * - The inlined body is bracket-escaped so an unbalanced `[`/`]` in a foreign
- *   definition cannot truncate the resulting `^[...]` footnote.
- *
- * Deduplication / reference-ordering / orphan-dropping of the resulting footnotes
- * is handled downstream by the canonical parser (`assembleFootnotes`); this pass
- * only changes the surface syntax.
- */
-function convertReferenceFootnotes(markdown: string): string {
-  const lines = markdown.split('\n');
-
-  // Pass 1: collect definitions and mark their lines for removal.
-  const defs = new Map<string, string>();
-  const dropped = new Array<boolean>(lines.length).fill(false);
-  let inFence = false;
-  let fence = '';
-
-  for (let i = 0; i < lines.length; i++) {
-    const line = lines[i];
-    const marker = fenceMarker(line);
-    if (inFence) {
-      if (marker && marker[0] === fence[0] && marker.length >= fence.length) {
-        inFence = false;
-        fence = '';
-      }
-      continue;
-    }
-    if (marker) {
-      inFence = true;
-      fence = marker;
-      continue;
-    }
-
-    const def = line.match(FOOTNOTE_DEF_RE);
-    if (!def) continue;
-
-    const id = def[1];
-    const body: string[] = [def[2].trim()];
-    dropped[i] = true;
-
-    // Consume immediately-following indented continuation lines (GFM lazy
-    // continuation is not supported by design — keep it simple and predictable).
-    let j = i + 1;
-    while (j < lines.length && isIndentedContinuation(lines[j])) {
-      body.push(lines[j].trim());
-      dropped[j] = true;
-      j++;
-    }
-    i = j - 1;
-
-    // Last definition wins for a duplicated id (matches CommonMark link-ref
-    // semantics closely enough for a foreign-input adapter).
-    defs.set(id, body.filter((s) => s.length > 0).join(' '));
-  }
-
-  if (defs.size === 0) {
-    return markdown;
-  }
-
-  // ONE fixed, generic scanner regex — NOT one built from the definition ids.
-  // It matches ANY `[^id]` shape, and the replacer decides per match via a map
-  // lookup whether that id is a real definition (replace) or not (leave as-is).
-  // This is genuinely O(total text) with no per-document regex compilation.
-  //
-  // Do NOT rebuild this as an alternation over `[...defs.keys()]`: a giant
-  // `(id1|id2|...)` alternation over thousands of ids can blow the V8 regex
-  // compiler's stack — a fatal, UNCATCHABLE "RegExpCompiler Allocation failed"
-  // on prefix-chain ids (`a`, `aa`, `aaa`, ...) that kills the whole process
-  // (worse than the earlier per-def thread-hang). A fixed scanner has no
-  // id-dependent compilation cost and cannot blow up.
-  const refRe = /\[\^([^\]]+)\]/g;
-  const rewriteSegment = (segment: string): string =>
-    segment.replace(refRe, (whole, id: string) => {
-      const body = defs.get(id);
-      // Only real definitions are inlined; an unknown id is left literal (same as
-      // the old per-def loop, which simply never matched it).
-      return body === undefined ? whole : `^[${escapeFootnoteBody(body)}]`;
-    });
-
-  // Pass 2: rewrite in-text references, skipping fenced code and dropped lines.
-  const out: string[] = [];
-  inFence = false;
-  fence = '';
-  for (let i = 0; i < lines.length; i++) {
-    if (dropped[i]) continue;
-    let line = lines[i];
-
-    const marker = fenceMarker(line);
-    if (inFence) {
-      out.push(line);
-      if (marker && marker[0] === fence[0] && marker.length >= fence.length) {
-        inFence = false;
-        fence = '';
-      }
-      continue;
-    }
-    if (marker) {
-      inFence = true;
-      fence = marker;
-      out.push(line);
-      continue;
-    }
-
-    line = rewriteRefsOutsideInlineCode(line, rewriteSegment);
-    out.push(line);
-  }
-
-  return out.join('\n');
-}
-
-/**
- * Strip a single leading YAML front-matter block (`---\n…\n---`). Foreign files
- * from Obsidian / Hugo / Jekyll / Notion — and Docmost's OWN git-sync page files
- * — open with front-matter that the canonical parser does not consume, so
- * without this it leaks into the body (and `title: Foo` above the closing `---`
- * renders as a setext `<h2>` that `extractTitleAndRemoveHeading` can hijack as
- * the page title). It is a no-op for front-matter-free input.
- *
- * LINE-ANCHORED (the same shape the canonical parser uses in
- * prosemirror-markdown/page-file.ts): the block opens only on `---\n` at the
- * very start and closes only on a `\n---` line. The retired `markdownToHtml`
- * strip closed on the FIRST `---` ANYWHERE (an unanchored close), so a value
- * containing a triple-dash (e.g. `title: Q1 --- Q2`) truncated the front-matter
- * and leaked the rest into the body. An optional leading BOM is tolerated.
- */
-const YAML_FRONT_MATTER_RE = /^\uFEFF?---\n[\s\S]*?\n---\n?/;
-
-/**
- * Normalize a foreign markdown string into Docmost's canonical markdown surface
- * so the strict canonical parser accepts it losslessly: normalize line endings,
- * strip a leading YAML front-matter block, then rewrite GFM reference footnotes
- * into inline footnotes. Add further fixture-driven foreign-surface cases here as
- * they are found.
- */
-export function normalizeForeignMarkdown(markdown: string): string {
-  if (!markdown) return markdown;
-  // Normalize CRLF -> LF FIRST. The line-anchored front-matter regex requires a
-  // bare `\n` after the opening `---`, and convertReferenceFootnotes splits on
-  // `\n`; a Windows/CRLF foreign file (`---\r\n…`) would otherwise slip past the
-  // front-matter strip and leak into the body. The canonical parser
-  // (page-file.ts parsePageFile) normalizes the same way before its FRONTMATTER_RE.
-  const src = markdown.replace(/\r\n/g, '\n');
-  const withoutFrontMatter = src.replace(YAML_FRONT_MATTER_RE, '').trimStart();
-  return convertReferenceFootnotes(withoutFrontMatter);
-}

apps/server/src/integrations/metrics/http-metrics.hook.ts

@@ -1,46 +0,0 @@
-import { FastifyReply, FastifyRequest } from 'fastify';
-import { isStreamingResponse } from './metrics.constants';
-import { observeHttp } from './metrics.registry';
-
-/**
- * Resolve the BOUNDED route label for an HTTP response.
- *
- * HARD REQUIREMENT (#355): use the ROUTE TEMPLATE (`/pages/:id`), NEVER the raw
- * URL (`/pages/abc-123`), so label cardinality stays finite. Fastify exposes the
- * matched template on `req.routeOptions.url`. On 404s (no route matched) that is
- * missing → collapse to the literal `unknown`.
- */
-export function resolveRouteLabel(req: FastifyRequest): string {
-  const url = req.routeOptions?.url;
-  return typeof url === 'string' && url.length > 0 ? url : 'unknown';
-}
-
-/**
- * Fastify onResponse handler that records http_request_duration_seconds.
- * No-op when metrics are disabled (the hook is only registered when enabled,
- * but the observe helpers are also guarded). Never throws into the response
- * pipeline — telemetry must not break request handling.
- */
-export function recordHttpResponse(
-  req: FastifyRequest,
-  reply: FastifyReply,
-): void {
-  try {
-    const route = resolveRouteLabel(req);
-
-    // Exclude SSE/streaming responses: onResponse fires at connection close for
-    // those, so it would record the stream lifetime and poison p95/p99.
-    const contentType = reply.getHeader('content-type');
-    if (isStreamingResponse(contentType, route)) return;
-
-    observeHttp(
-      req.method,
-      route,
-      reply.statusCode,
-      // Fastify measures elapsed time in ms; the metric is in seconds.
-      reply.elapsedTime / 1000,
-    );
-  } catch {
-    // Swallow: a telemetry failure must never affect the served response.
-  }
-}

apps/server/src/integrations/metrics/metrics-bull.service.ts

@@ -1,146 +0,0 @@
-import {
-  Injectable,
-  Logger,
-  OnModuleDestroy,
-  OnModuleInit,
-} from '@nestjs/common';
-import { InjectQueue } from '@nestjs/bullmq';
-import { Queue, QueueEvents } from 'bullmq';
-import { QueueName } from '../queue/constants';
-import { EnvironmentService } from '../environment/environment.service';
-import { parseRedisUrl } from '../../common/helpers';
-import {
-  isMetricsEnabled,
-  observeJobDuration,
-  setQueueDepth,
-} from './metrics.registry';
-
-const POLL_INTERVAL_MS = 15_000;
-// Cap the in-flight start-time map so a job that never emits completed/failed
-// (worker crash) cannot leak memory unbounded. Well above realistic concurrency.
-const MAX_INFLIGHT = 10_000;
-
-/**
- * BullMQ instrumentation for #355:
- *  - `bullmq_queue_depth{queue}`: polled from getJobCounts() every 15s.
- *  - `bullmq_job_duration_seconds{queue}`: wall-clock time between a job going
- *    `active` and `completed`/`failed`, observed via per-queue QueueEvents.
- *
- * Queue names are a FINITE list (the QueueName enum), so labels are bounded — no
- * job ids ever enter a label. Everything is gated on METRICS_PORT: when metrics
- * are off, onModuleInit does nothing (no interval, no QueueEvents connections).
- */
-@Injectable()
-export class MetricsBullService implements OnModuleInit, OnModuleDestroy {
-  private readonly logger = new Logger(MetricsBullService.name);
-  private readonly queues: { label: string; queue: Queue }[];
-  private timer: NodeJS.Timeout | null = null;
-  private queueEvents: QueueEvents[] = [];
-  // jobId -> start timestamp (ms). Bounded by MAX_INFLIGHT.
-  private readonly inflight = new Map<string, number>();
-
-  constructor(
-    private readonly environmentService: EnvironmentService,
-    @InjectQueue(QueueName.EMAIL_QUEUE) emailQueue: Queue,
-    @InjectQueue(QueueName.ATTACHMENT_QUEUE) attachmentQueue: Queue,
-    @InjectQueue(QueueName.GENERAL_QUEUE) generalQueue: Queue,
-    @InjectQueue(QueueName.BILLING_QUEUE) billingQueue: Queue,
-    @InjectQueue(QueueName.FILE_TASK_QUEUE) fileTaskQueue: Queue,
-    @InjectQueue(QueueName.SEARCH_QUEUE) searchQueue: Queue,
-    @InjectQueue(QueueName.AI_QUEUE) aiQueue: Queue,
-    @InjectQueue(QueueName.HISTORY_QUEUE) historyQueue: Queue,
-    @InjectQueue(QueueName.NOTIFICATION_QUEUE) notificationQueue: Queue,
-    @InjectQueue(QueueName.AUDIT_QUEUE) auditQueue: Queue,
-  ) {
-    this.queues = [
-      { label: 'email', queue: emailQueue },
-      { label: 'attachment', queue: attachmentQueue },
-      { label: 'general', queue: generalQueue },
-      { label: 'billing', queue: billingQueue },
-      { label: 'file-task', queue: fileTaskQueue },
-      { label: 'search', queue: searchQueue },
-      { label: 'ai', queue: aiQueue },
-      { label: 'history', queue: historyQueue },
-      { label: 'notification', queue: notificationQueue },
-      { label: 'audit', queue: auditQueue },
-    ];
-  }
-
-  onModuleInit(): void {
-    if (!isMetricsEnabled()) return;
-
-    // Poll queue depth.
-    this.timer = setInterval(() => {
-      void this.pollDepths();
-    }, POLL_INTERVAL_MS);
-    // Do not keep the event loop alive solely for polling.
-    this.timer.unref?.();
-    void this.pollDepths();
-
-    // Wire per-queue job-duration events.
-    const redisConfig = parseRedisUrl(this.environmentService.getRedisUrl());
-    const connection = {
-      host: redisConfig.host,
-      port: redisConfig.port,
-      password: redisConfig.password,
-      db: redisConfig.db,
-      family: redisConfig.family,
-    };
-
-    for (const { label, queue } of this.queues) {
-      const events = new QueueEvents(queue.name, { connection });
-      events.on('active', ({ jobId }) => {
-        if (this.inflight.size >= MAX_INFLIGHT) {
-          // Drop the oldest tracked start to keep the map bounded.
-          const oldest = this.inflight.keys().next().value;
-          if (oldest !== undefined) this.inflight.delete(oldest);
-        }
-        this.inflight.set(jobId, Date.now());
-      });
-      const finalize = ({ jobId }: { jobId: string }) => {
-        const start = this.inflight.get(jobId);
-        if (start === undefined) return;
-        this.inflight.delete(jobId);
-        observeJobDuration(label, (Date.now() - start) / 1000);
-      };
-      events.on('completed', finalize);
-      events.on('failed', finalize);
-      events.on('error', (err) => {
-        this.logger.debug(`QueueEvents error (${label}): ${err?.message}`);
-      });
-      this.queueEvents.push(events);
-    }
-  }
-
-  private async pollDepths(): Promise<void> {
-    for (const { label, queue } of this.queues) {
-      try {
-        const counts = await queue.getJobCounts();
-        // "Depth" = jobs not yet finished (backlog + in-flight).
-        const depth =
-          (counts.waiting ?? 0) +
-          (counts.active ?? 0) +
-          (counts.delayed ?? 0) +
-          (counts.prioritized ?? 0) +
-          (counts.paused ?? 0);
-        setQueueDepth(label, depth);
-      } catch (err) {
-        this.logger.debug(
-          `Failed to read job counts for ${label}: ${(err as Error)?.message}`,
-        );
-      }
-    }
-  }
-
-  async onModuleDestroy(): Promise<void> {
-    if (this.timer) {
-      clearInterval(this.timer);
-      this.timer = null;
-    }
-    await Promise.all(
-      this.queueEvents.map((e) => e.close().catch(() => undefined)),
-    );
-    this.queueEvents = [];
-    this.inflight.clear();
-  }
-}

apps/server/src/integrations/metrics/metrics-server.lifecycle.ts

@@ -1,16 +0,0 @@
-import { Injectable, OnModuleDestroy } from '@nestjs/common';
-import { closeMetricsServer } from './metrics.server';
-
-/**
- * Ties the bare node:http metrics scrape server (started in main.ts after the
- * Fastify app is up, outside the DI container) into Nest's shutdown lifecycle.
- * With `app.enableShutdownHooks()`, onModuleDestroy fires on SIGTERM/SIGINT and
- * closes the listener so it is not left dangling (jest/e2e never exits, and a
- * prod restart doesn't leak the port). No-op when metrics are disabled.
- */
-@Injectable()
-export class MetricsServerLifecycle implements OnModuleDestroy {
-  async onModuleDestroy(): Promise<void> {
-    await closeMetricsServer();
-  }
-}

apps/server/src/integrations/metrics/metrics.constants.ts

@@ -1,84 +0,0 @@
-/**
- * Perf-metrics contract (#355). These names/labels are FIXED by the already
- * deployed scrape+dashboard infra (VictoriaMetrics scraping docmost:9464,
- * Grafana dashboards, alerts). Do NOT rename them.
- */
-export const METRIC_HTTP_REQUEST_DURATION = 'http_request_duration_seconds';
-export const METRIC_DB_QUERY_DURATION = 'db_query_duration_seconds';
-export const METRIC_BULLMQ_QUEUE_DEPTH = 'bullmq_queue_depth';
-export const METRIC_BULLMQ_JOB_DURATION = 'bullmq_job_duration_seconds';
-export const METRIC_COLLAB_STORE_DURATION = 'collab_store_duration_seconds';
-
-// Histogram buckets (seconds). Chosen to give useful p50/p95/p99 resolution
-// for typical web/DB latencies without exploding series cardinality.
-export const HTTP_BUCKETS = [
-  0.005, 0.01, 0.025, 0.05, 0.1, 0.25, 0.5, 1, 2.5, 5, 10,
-];
-export const DB_BUCKETS = [
-  0.001, 0.005, 0.01, 0.025, 0.05, 0.1, 0.25, 0.5, 1, 2.5,
-];
-export const COLLAB_BUCKETS = [
-  0.005, 0.01, 0.025, 0.05, 0.1, 0.25, 0.5, 1, 2.5, 5,
-];
-export const JOB_BUCKETS = [
-  0.01, 0.05, 0.1, 0.25, 0.5, 1, 2.5, 5, 10, 30, 60, 120,
-];
-
-/**
- * Extract the first SQL token (select/insert/update/delete/...) from a query,
- * lower-cased, to use as a BOUNDED label for db_query_duration_seconds. Using
- * the full query text would blow up label cardinality; the leading keyword is a
- * finite set. Unknown/empty queries collapse to `other`.
- */
-// The bounded set of SQL leading keywords used as db_query_duration_seconds
-// labels. Module-const so it is built ONCE, not per query (this runs on every DB
-// query when metrics are enabled).
-const KNOWN_SQL_TOKENS = new Set([
-  'select',
-  'insert',
-  'update',
-  'delete',
-  'with',
-  'begin',
-  'commit',
-  'rollback',
-  'alter',
-  'create',
-  'drop',
-  'truncate',
-  'explain',
-]);
-
-export function firstSqlToken(sql: string | undefined): string {
-  if (!sql) return 'other';
-  // Skip leading whitespace / comments and grab the first word.
-  const match = /^[\s(]*([a-zA-Z]+)/.exec(sql);
-  if (!match) return 'other';
-  const token = match[1].toLowerCase();
-  return KNOWN_SQL_TOKENS.has(token) ? token : 'other';
-}
-
-/**
- * Whether an HTTP response must be EXCLUDED from http_request_duration_seconds.
- *
- * SSE/streaming responses (the AI-chat `text/event-stream`) keep the connection
- * open for the whole conversation, so Fastify's onResponse fires only when the
- * client disconnects — recording the connection lifetime, not a response time,
- * which would poison p95/p99. We skip by content-type (authoritative) with a
- * route-suffix fallback for the two known stream endpoints.
- */
-export function isStreamingResponse(
-  contentType: unknown,
-  route: string | undefined,
-): boolean {
-  if (
-    typeof contentType === 'string' &&
-    contentType.toLowerCase().includes('text/event-stream')
-  ) {
-    return true;
-  }
-  // Fallback: the AI-chat stream routes (/api/ai-chat/stream,
-  // /api/shares/ai/stream) both end in `/stream`.
-  if (route && route.endsWith('/stream')) return true;
-  return false;
-}

apps/server/src/integrations/metrics/metrics.module.ts

@@ -1,15 +0,0 @@
-import { Module } from '@nestjs/common';
-import { MetricsBullService } from './metrics-bull.service';
-import { MetricsServerLifecycle } from './metrics-server.lifecycle';
-
-/**
- * Wires the BullMQ collectors (#355). The queues are provided by the @Global
- * QueueModule (which exports BullModule), so no re-registration is needed here.
- * The HTTP histogram, DB-query and collab-store collectors live in module-level
- * singletons (metrics.registry) and are wired directly at their call sites.
- * MetricsServerLifecycle closes the scrape server on shutdown.
- */
-@Module({
-  providers: [MetricsBullService, MetricsServerLifecycle],
-})
-export class MetricsModule {}

apps/server/src/integrations/metrics/metrics.registry.ts

@@ -1,126 +0,0 @@
-import {
-  collectDefaultMetrics,
-  Histogram,
-  Gauge,
-  Registry,
-} from 'prom-client';
-import {
-  COLLAB_BUCKETS,
-  DB_BUCKETS,
-  HTTP_BUCKETS,
-  JOB_BUCKETS,
-  METRIC_BULLMQ_JOB_DURATION,
-  METRIC_BULLMQ_QUEUE_DEPTH,
-  METRIC_COLLAB_STORE_DURATION,
-  METRIC_DB_QUERY_DURATION,
-  METRIC_HTTP_REQUEST_DURATION,
-} from './metrics.constants';
-
-/**
- * Process-wide perf-metrics registry (#355).
- *
- * This is a plain module singleton (NOT a Nest provider) because the collectors
- * are cross-cutting: the Kysely `log` callback (built in a DI factory), the
- * Fastify onResponse hook (main.ts, before the Nest container hands out
- * providers) and the collab persistence extension all need the SAME instruments
- * without threading DI through them.
- *
- * HARD CONTRACT: when `METRICS_PORT` is unset the whole subsystem is OFF — the
- * registry is never created, `collectDefaultMetrics` never runs, and every
- * observe/set helper is a cheap no-op. Nothing is exposed on :3000.
- */
-
-// Decided once at process start. Deliberately read here (not via
-// EnvironmentService) so the toggle is identical for the DI and non-DI callers.
-const enabled = Boolean(process.env.METRICS_PORT);
-
-let registry: Registry | null = null;
-let httpHist: Histogram<'method' | 'route' | 'status'> | null = null;
-let dbHist: Histogram<'op'> | null = null;
-let queueDepthGauge: Gauge<'queue'> | null = null;
-let jobHist: Histogram<'queue'> | null = null;
-let collabHist: Histogram | null = null;
-
-function init(): void {
-  if (registry || !enabled) return;
-
-  registry = new Registry();
-
-  // Node/runtime metrics: gives nodejs_eventloop_lag_p99_seconds, GC, heap, etc.
-  collectDefaultMetrics({ register: registry });
-
-  httpHist = new Histogram({
-    name: METRIC_HTTP_REQUEST_DURATION,
-    help: 'HTTP request duration in seconds, by method, route template and status',
-    labelNames: ['method', 'route', 'status'],
-    buckets: HTTP_BUCKETS,
-    registers: [registry],
-  });
-
-  dbHist = new Histogram({
-    name: METRIC_DB_QUERY_DURATION,
-    help: 'Database query duration in seconds, by leading SQL keyword',
-    labelNames: ['op'],
-    buckets: DB_BUCKETS,
-    registers: [registry],
-  });
-
-  queueDepthGauge = new Gauge({
-    name: METRIC_BULLMQ_QUEUE_DEPTH,
-    help: 'Number of not-yet-finished BullMQ jobs per queue',
-    labelNames: ['queue'],
-    registers: [registry],
-  });
-
-  jobHist = new Histogram({
-    name: METRIC_BULLMQ_JOB_DURATION,
-    help: 'BullMQ job processing duration in seconds, per queue',
-    labelNames: ['queue'],
-    buckets: JOB_BUCKETS,
-    registers: [registry],
-  });
-
-  collabHist = new Histogram({
-    name: METRIC_COLLAB_STORE_DURATION,
-    help: 'Collaboration onStoreDocument duration in seconds',
-    buckets: COLLAB_BUCKETS,
-    registers: [registry],
-  });
-}
-
-// Runs once when this module is first imported. Safe to call again (idempotent).
-init();
-
-export function isMetricsEnabled(): boolean {
-  return enabled;
-}
-
-/** The prom-client registry, or null when metrics are disabled. */
-export function getMetricsRegistry(): Registry | null {
-  return registry;
-}
-
-export function observeHttp(
-  method: string,
-  route: string,
-  status: number,
-  seconds: number,
-): void {
-  httpHist?.observe({ method, route, status }, seconds);
-}
-
-export function observeDbQuery(op: string, seconds: number): void {
-  dbHist?.observe({ op }, seconds);
-}
-
-export function setQueueDepth(queue: string, depth: number): void {
-  queueDepthGauge?.set({ queue }, depth);
-}
-
-export function observeJobDuration(queue: string, seconds: number): void {
-  jobHist?.observe({ queue }, seconds);
-}
-
-export function observeCollabStore(seconds: number): void {
-  collabHist?.observe(seconds);
-}

apps/server/src/integrations/metrics/metrics.server.ts

@@ -1,86 +0,0 @@
-import { createServer, Server } from 'node:http';
-import { Logger } from '@nestjs/common';
-import { getMetricsRegistry, isMetricsEnabled } from './metrics.registry';
-
-/**
- * Start the Prometheus scrape endpoint on a SEPARATE port, taken from
- * `METRICS_PORT`. There is NO default port: when `METRICS_PORT` is unset the
- * whole metrics subsystem is OFF and this returns null. This is a bare node:http
- * server, NOT part of the Fastify app, so `/metrics` never exists on the public
- * :3000 listener.
- *
- * Returns the http.Server (so callers can close it on shutdown) or null when
- * metrics are disabled. The reference is also kept module-side so the Nest
- * lifecycle (see MetricsModule) can close it on application shutdown without
- * threading the handle back through the non-DI bootstrap.
- */
-let metricsServer: Server | null = null;
-
-export function startMetricsServer(): Server | null {
-  if (!isMetricsEnabled()) return null;
-
-  const logger = new Logger('MetricsServer');
-  const register = getMetricsRegistry();
-  if (!register) return null;
-
-  const port = Number(process.env.METRICS_PORT);
-  if (!Number.isInteger(port) || port <= 0) {
-    logger.warn(
-      `Invalid METRICS_PORT="${process.env.METRICS_PORT}", metrics endpoint not started`,
-    );
-    return null;
-  }
-
-  const server = createServer(async (req, res) => {
-    if (req.method === 'GET' && req.url === '/metrics') {
-      try {
-        const body = await register.metrics();
-        res.setHeader('Content-Type', register.contentType);
-        res.statusCode = 200;
-        res.end(body);
-      } catch (err) {
-        res.statusCode = 500;
-        res.end(String((err as Error)?.message ?? 'error'));
-      }
-      return;
-    }
-    res.statusCode = 404;
-    res.end();
-  });
-
-  // Bind on all interfaces: the scraper (VictoriaMetrics) reaches this from
-  // another container as docmost:9464. The port is not published to the host.
-  server.listen(port, '0.0.0.0', () => {
-    logger.log(`Metrics endpoint listening on :${port}/metrics`);
-  });
-
-  server.on('error', (err) => {
-    logger.error(`Metrics server error: ${err?.message}`);
-  });
-
-  metricsServer = server;
-  return server;
-}
-
-/**
- * Close the metrics scrape server if one is running. Idempotent and safe to call
- * when metrics are disabled (no server was ever started). Wired into Nest's
- * shutdown lifecycle so the listener is not left dangling on shutdown.
- */
-export function closeMetricsServer(): Promise<void> {
-  const server = metricsServer;
-  metricsServer = null;
-  if (!server) return Promise.resolve();
-  return new Promise((resolve) => {
-    server.close(() => resolve());
-    // server.close() stops accepting NEW connections but its callback does not
-    // fire until existing keep-alive sockets drain. The scraper (VictoriaMetrics/
-    // vmagent) holds an idle HTTP keep-alive socket, so without this the callback
-    // — and thus shutdown — would hang until the scraper disconnects or the
-    // orchestrator escalates to SIGKILL on the kill-grace window. Force-close idle
-    // keep-alive sockets so close() completes immediately, and unref so this
-    // server never keeps the event loop alive on its own.
-    server.closeIdleConnections();
-    server.unref();
-  });
-}

apps/server/src/integrations/metrics/metrics.spec.ts

@@ -1,70 +0,0 @@
-import { FastifyRequest } from 'fastify';
-import { resolveRouteLabel } from './http-metrics.hook';
-import { firstSqlToken, isStreamingResponse } from './metrics.constants';
-
-describe('resolveRouteLabel (histogram route label)', () => {
-  it('uses the ROUTE TEMPLATE, never the raw URL', () => {
-    // routeOptions.url is the matched template; url is the raw path with the id.
-    const req = {
-      url: '/api/pages/abc-123-def',
-      routeOptions: { url: '/api/pages/:id' },
-    } as unknown as FastifyRequest;
-    expect(resolveRouteLabel(req)).toBe('/api/pages/:id');
-    expect(resolveRouteLabel(req)).not.toContain('abc-123-def');
-  });
-
-  it('falls back to "unknown" on a 404 (no matched route template)', () => {
-    const req = {
-      url: '/totally/unmatched/path',
-      routeOptions: {},
-    } as unknown as FastifyRequest;
-    expect(resolveRouteLabel(req)).toBe('unknown');
-  });
-
-  it('falls back to "unknown" when routeOptions is missing', () => {
-    const req = { url: '/x' } as unknown as FastifyRequest;
-    expect(resolveRouteLabel(req)).toBe('unknown');
-  });
-});
-
-describe('isStreamingResponse (SSE exclusion)', () => {
-  it('excludes text/event-stream responses by content-type', () => {
-    expect(isStreamingResponse('text/event-stream', '/api/ai-chat/stream')).toBe(
-      true,
-    );
-    expect(isStreamingResponse('text/event-stream; charset=utf-8', '/x')).toBe(
-      true,
-    );
-  });
-
-  it('excludes known /stream routes by suffix as a fallback', () => {
-    expect(isStreamingResponse('application/json', '/api/ai-chat/stream')).toBe(
-      true,
-    );
-    expect(isStreamingResponse(undefined, '/api/shares/ai/stream')).toBe(true);
-  });
-
-  it('does not exclude ordinary JSON responses', () => {
-    expect(isStreamingResponse('application/json', '/api/pages/:id')).toBe(
-      false,
-    );
-    expect(isStreamingResponse(undefined, '/api/pages/:id')).toBe(false);
-  });
-});
-
-describe('firstSqlToken (bounded db label)', () => {
-  it('returns the lower-cased leading keyword', () => {
-    expect(firstSqlToken('SELECT * FROM pages')).toBe('select');
-    expect(firstSqlToken('  insert into x values (1)')).toBe('insert');
-    expect(firstSqlToken('UPDATE pages SET a=1')).toBe('update');
-    expect(firstSqlToken('delete from pages')).toBe('delete');
-    expect(firstSqlToken('(SELECT 1)')).toBe('select');
-  });
-
-  it('collapses unknown/empty queries to "other"', () => {
-    expect(firstSqlToken('')).toBe('other');
-    expect(firstSqlToken(undefined)).toBe('other');
-    expect(firstSqlToken('123 not sql')).toBe('other');
-    expect(firstSqlToken('vacuum analyze')).toBe('other');
-  });
-});

apps/server/src/integrations/static/static.module.ts

@@ -50,10 +50,6 @@ export class StaticModule implements OnModuleInit {
           : undefined,
         POSTHOG_HOST: this.environmentService.getPostHogHost(),
         POSTHOG_KEY: this.environmentService.getPostHogKey(),
-        // #355 — mirrors the server-side CLIENT_TELEMETRY_ENABLED gate so the
-        // client only collects/sends vitals when the operator opts in.
-        CLIENT_TELEMETRY_ENABLED:
-          this.environmentService.isClientTelemetryEnabled(),
       };
 
       const windowScriptContent = `<script>window.CONFIG=${JSON.stringify(configString)};</script>`;

apps/server/src/integrations/throttle/throttle.module.ts

@@ -9,7 +9,6 @@ import {
   AI_CHAT_THROTTLER,
   PAGE_TEMPLATE_THROTTLER,
   PUBLIC_SHARE_AI_THROTTLER,
-  VITALS_THROTTLER,
 } from './throttler-names';
 
 @Module({
@@ -30,8 +29,6 @@ import {
             { name: PAGE_TEMPLATE_THROTTLER, ttl: 60_000, limit: 30 },
             // Anonymous public-share assistant: ~5 req/min per IP.
             { name: PUBLIC_SHARE_AI_THROTTLER, ttl: 60_000, limit: 5 },
-            // Anonymous client perf-telemetry sink: 120 batched posts/min per IP.
-            { name: VITALS_THROTTLER, ttl: 60_000, limit: 120 },
           ],
           errorMessage: 'Too many requests',
           // Pass ioredis options (not a pre-built Redis instance) so

apps/server/src/integrations/throttle/throttler-names.ts

@@ -6,7 +6,3 @@ export const PAGE_TEMPLATE_THROTTLER = 'page-template';
 // ThrottlerGuard tracker) to bound anonymous abuse — the workspace owner pays
 // for the tokens.
 export const PUBLIC_SHARE_AI_THROTTLER = 'public-share-ai';
-// IP-keyed throttler for the anonymous client perf-telemetry sink
-// (POST /api/telemetry/vitals). Browsers batch metrics, so the limit is
-// generous; it only exists to bound abuse of the public, unauthenticated route.
-export const VITALS_THROTTLER = 'vitals';

apps/server/src/main.ts

@@ -16,9 +16,6 @@ import { EnvironmentService } from './integrations/environment/environment.servi
 import { SANDBOX_API_PATH } from './integrations/sandbox/sandbox.constants';
 import { resolveFrameHeader } from './common/helpers';
 import { resolveTrustProxy } from './integrations/environment/trust-proxy.util';
-import { isMetricsEnabled } from './integrations/metrics/metrics.registry';
-import { recordHttpResponse } from './integrations/metrics/http-metrics.hook';
-import { startMetricsServer } from './integrations/metrics/metrics.server';
 
 async function bootstrap() {
   const app = await NestFactory.create<NestFastifyApplication>(
@@ -94,19 +91,6 @@ async function bootstrap() {
       done();
     });
 
-  // #355 — HTTP request-duration histogram. Registered ONLY when METRICS_PORT is
-  // set (otherwise no collector runs at all). Uses the bounded route template
-  // label and excludes SSE/streaming responses (see recordHttpResponse).
-  if (isMetricsEnabled()) {
-    app
-      .getHttpAdapter()
-      .getInstance()
-      .addHook('onResponse', (req, reply, done) => {
-        recordHttpResponse(req, reply);
-        done();
-      });
-  }
-
   app
     .getHttpAdapter()
     .getInstance()
@@ -143,9 +127,6 @@ async function bootstrap() {
         '/api/workspace/create',
         '/api/workspace/joined',
         '/api/workspace/find-by-email',
-        // Public client perf-telemetry sink: browsers post it without a
-        // resolved workspace host, so the workspace-resolution gate must not 404 it.
-        '/api/telemetry/vitals',
         // Anonymous in-RAM blob sandbox: a remote consumer fetches blobs by an
         // unguessable UUID without any workspace host context, so the
         // workspace-resolution gate must not apply.
@@ -194,11 +175,6 @@ async function bootstrap() {
       `Listening on http://127.0.0.1:${port} / ${process.env.APP_URL}`,
     );
   });
-
-  // #355 — Prometheus scrape endpoint on a SEPARATE port (METRICS_PORT),
-  // started after the app is up. No default port: a no-op when METRICS_PORT is
-  // unset. Closed on shutdown by MetricsServerLifecycle (MetricsModule).
-  startMetricsServer();
 }
 
 bootstrap();

apps/server/test/integration/ai-chat-run.int-spec.ts

@@ -1,304 +0,0 @@
-import { Kysely } from 'kysely';
-import {
-  AiChatRunRepo,
-  SWEEP_RUN_STALE_MS,
-} from '@docmost/db/repos/ai-chat/ai-chat-run.repo';
-import { AiChatMessageRepo } from '@docmost/db/repos/ai-chat/ai-chat-message.repo';
-import { AiChatRunService } from '../../src/core/ai-chat/ai-chat-run.service';
-import {
-  getTestDb,
-  destroyTestDb,
-  createWorkspace,
-  createUser,
-  createChat,
-} from './db';
-
-/**
- * Integration coverage for the #184 phase-1 durable agent run: real SQL against
- * docmost_test. Proves the core invariant primitives — a run is a first-class
- * lifecycle row, at most one is active per chat, a detached run's progress
- * survives with NO subscriber, an explicit stop settles it as aborted, a
- * reconnect read returns the persisted state, and a crash sweep recovers
- * dangling runs.
- */
-describe('AiChatRun durable lifecycle [integration]', () => {
-  let db: Kysely<any>;
-  let runRepo: AiChatRunRepo;
-  let messageRepo: AiChatMessageRepo;
-  let service: AiChatRunService;
-  let workspaceId: string;
-  let otherWorkspaceId: string;
-  let userId: string;
-  let chatId: string;
-
-  beforeAll(async () => {
-    db = getTestDb();
-    runRepo = new AiChatRunRepo(db as any);
-    messageRepo = new AiChatMessageRepo(db as any);
-    // Boot-sweep isn't triggered here; the isCloud stub is all the service needs
-    // for these direct-call integration cases (F7).
-    service = new AiChatRunService(runRepo, { isCloud: () => false } as never);
-    workspaceId = (await createWorkspace(db)).id;
-    otherWorkspaceId = (await createWorkspace(db)).id;
-    userId = (await createUser(db, workspaceId)).id;
-    chatId = (await createChat(db, { workspaceId, creatorId: userId })).id;
-  });
-
-  afterAll(async () => {
-    await destroyTestDb();
-  });
-
-  // Each test that creates an active run settles it (or uses its own chat) so the
-  // partial unique index does not bleed across tests.
-
-  it('insert + findById round-trips a run row, defaulting status/trigger', async () => {
-    const run = await runRepo.insert({
-      chatId,
-      workspaceId,
-      createdBy: userId,
-    });
-    expect(run.status).toBe('pending');
-    expect(run.trigger).toBe('user');
-    expect(run.stepCount).toBe(0);
-
-    const found = await runRepo.findById(run.id, workspaceId);
-    expect(found!.id).toBe(run.id);
-    // Workspace-scoped: a foreign workspace sees nothing.
-    expect(await runRepo.findById(run.id, otherWorkspaceId)).toBeUndefined();
-
-    // settle so it does not occupy the active slot
-    await runRepo.update(run.id, workspaceId, {
-      status: 'succeeded',
-      finishedAt: new Date(),
-    });
-  });
-
-  it('enforces ONE ACTIVE run per chat (partial unique index rejects a second)', async () => {
-    const activeChat = (
-      await createChat(db, { workspaceId, creatorId: userId })
-    ).id;
-    const first = await runRepo.insert({
-      chatId: activeChat,
-      workspaceId,
-      createdBy: userId,
-      status: 'running',
-    });
-    // A second pending/running run on the SAME chat must be rejected by the DB.
-    await expect(
-      runRepo.insert({
-        chatId: activeChat,
-        workspaceId,
-        createdBy: userId,
-        status: 'running',
-      }),
-    ).rejects.toThrow();
-
-    // findActiveByChat returns exactly the one active run.
-    const active = await runRepo.findActiveByChat(activeChat, workspaceId);
-    expect(active!.id).toBe(first.id);
-
-    // Once it settles, the slot frees and a new run may start.
-    await runRepo.update(first.id, workspaceId, {
-      status: 'succeeded',
-      finishedAt: new Date(),
-    });
-    expect(
-      await runRepo.findActiveByChat(activeChat, workspaceId),
-    ).toBeUndefined();
-    const second = await runRepo.insert({
-      chatId: activeChat,
-      workspaceId,
-      createdBy: userId,
-      status: 'running',
-    });
-    expect(second.id).not.toBe(first.id);
-    await runRepo.update(second.id, workspaceId, {
-      status: 'aborted',
-      finishedAt: new Date(),
-    });
-  });
-
-  it('DETACHED run: persists + finalizes succeeded with NO subscriber, reconnect returns state', async () => {
-    // A dedicated chat so the active-run slot is clean.
-    const runChat = (
-      await createChat(db, { workspaceId, creatorId: userId })
-    ).id;
-
-    // beginRun = the runner starts the turn (registers an in-memory controller).
-    const handle = await service.beginRun({
-      chatId: runChat,
-      workspaceId,
-      userId,
-    });
-    expect(handle.signal.aborted).toBe(false);
-    expect(service.isLocallyActive(handle.runId)).toBe(true);
-
-    // The assistant projection row (#183) is seeded + linked.
-    const seeded = await messageRepo.insert({
-      chatId: runChat,
-      workspaceId,
-      userId,
-      role: 'assistant',
-      content: '',
-      status: 'streaming',
-      metadata: { parts: [] } as never,
-    });
-    await service.linkAssistantMessage(handle.runId, workspaceId, seeded.id);
-
-    // Progress is persisted as steps finish — NO HTTP socket involved here at all.
-    await service.recordStep(handle.runId, workspaceId, 1);
-    await messageRepo.update(seeded.id, workspaceId, {
-      content: 'partial work',
-      metadata: { parts: [{ type: 'text', text: 'partial work' }] },
-    });
-
-    // The turn completes; finalize the projection then the run.
-    await messageRepo.update(seeded.id, workspaceId, {
-      content: 'final answer',
-      status: 'completed',
-    });
-    await service.finalizeRun(handle.runId, workspaceId, 'completed');
-
-    expect(service.isLocallyActive(handle.runId)).toBe(false);
-
-    // Reconnect: the latest run for the chat + its projected message, from the DB.
-    const run = await service.getLatestForChat(runChat, workspaceId);
-    expect(run!.status).toBe('succeeded');
-    expect(run!.stepCount).toBe(1);
-    expect(run!.assistantMessageId).toBe(seeded.id);
-    expect(run!.finishedAt).toBeTruthy();
-    const message = await messageRepo.findById(seeded.id, workspaceId);
-    expect(message!.status).toBe('completed');
-    expect(message!.content).toBe('final answer');
-  });
-
-  it('EXPLICIT stop aborts the run signal, marks the row, and settles as aborted', async () => {
-    const runChat = (
-      await createChat(db, { workspaceId, creatorId: userId })
-    ).id;
-    const handle = await service.beginRun({
-      chatId: runChat,
-      workspaceId,
-      userId,
-    });
-
-    // User presses Stop.
-    const stopped = await service.requestStop(handle.runId, workspaceId);
-    expect(stopped).toBe(true);
-    expect(handle.signal.aborted).toBe(true);
-
-    // The row carries the stop request (distinct from a disconnect, which would
-    // leave stop_requested_at NULL).
-    const afterStop = await runRepo.findById(handle.runId, workspaceId);
-    expect(afterStop!.stopRequestedAt).toBeTruthy();
-
-    // The terminal callback (onAbort) settles the run.
-    await service.finalizeRun(handle.runId, workspaceId, 'aborted');
-    const run = await service.getLatestForChat(runChat, workspaceId);
-    expect(run!.status).toBe('aborted');
-  });
-
-  it('markStopRequested is a no-op on an already-settled run (returns undefined)', async () => {
-    const runChat = (
-      await createChat(db, { workspaceId, creatorId: userId })
-    ).id;
-    const run = await runRepo.insert({
-      chatId: runChat,
-      workspaceId,
-      createdBy: userId,
-      status: 'running',
-    });
-    await runRepo.update(run.id, workspaceId, {
-      status: 'succeeded',
-      finishedAt: new Date(),
-    });
-    const marked = await runRepo.markStopRequested(run.id, workspaceId);
-    expect(marked).toBeUndefined();
-  });
-
-  it('sweepRunning aborts STALE dangling runs but not fresh or settled ones', async () => {
-    const sweepChat1 = (
-      await createChat(db, { workspaceId, creatorId: userId })
-    ).id;
-    const sweepChat2 = (
-      await createChat(db, { workspaceId, creatorId: userId })
-    ).id;
-    const sweepChat3 = (
-      await createChat(db, { workspaceId, creatorId: userId })
-    ).id;
-
-    const stale = await runRepo.insert({
-      chatId: sweepChat1,
-      workspaceId,
-      createdBy: userId,
-      status: 'running',
-    });
-    const fresh = await runRepo.insert({
-      chatId: sweepChat2,
-      workspaceId,
-      createdBy: userId,
-      status: 'running',
-    });
-    const settled = await runRepo.insert({
-      chatId: sweepChat3,
-      workspaceId,
-      createdBy: userId,
-      status: 'running',
-    });
-    await runRepo.update(settled.id, workspaceId, {
-      status: 'succeeded',
-      finishedAt: new Date(),
-    });
-    // Backdate the stale run's updatedAt past the 10-minute staleness window.
-    await db
-      .updateTable('aiChatRuns')
-      .set({ updatedAt: new Date(Date.now() - 20 * 60 * 1000) })
-      .where('id', '=', stale.id)
-      .execute();
-
-    // WINDOWED sweep (phase-2 multi-instance timer path): only runs older than the
-    // staleness window are aborted, so a sibling replica's fresh run survives. The
-    // no-arg boot sweep (variant C) is unconditional — covered separately below.
-    const swept = await runRepo.sweepRunning({ staleMs: SWEEP_RUN_STALE_MS });
-    expect(swept).toBeGreaterThanOrEqual(1);
-
-    expect((await runRepo.findById(stale.id, workspaceId))!.status).toBe(
-      'aborted',
-    );
-    // Fresh (recently-updated) running run survives the WINDOWED sweep — a sibling
-    // replica may still be executing it.
-    expect((await runRepo.findById(fresh.id, workspaceId))!.status).toBe(
-      'running',
-    );
-    expect((await runRepo.findById(settled.id, workspaceId))!.status).toBe(
-      'succeeded',
-    );
-
-    // cleanup active fresh run
-    await runRepo.update(fresh.id, workspaceId, {
-      status: 'aborted',
-      finishedAt: new Date(),
-    });
-  });
-
-  it('sweepRunning() with NO args (boot sweep / variant C) aborts even a FRESH running run', async () => {
-    // F1/DECISION C at the SQL level: the unconditional boot sweep has NO
-    // staleness window, so a run updated just now (a fast restart) is settled too
-    // — otherwise it would stay 'running' forever and 409 every future turn.
-    const bootChat = (
-      await createChat(db, { workspaceId, creatorId: userId })
-    ).id;
-    const fresh = await runRepo.insert({
-      chatId: bootChat,
-      workspaceId,
-      createdBy: userId,
-      status: 'running',
-    });
-    // updatedAt = now (fresh, untouched). The no-arg sweep settles it anyway.
-    const swept = await runRepo.sweepRunning();
-    expect(swept).toBeGreaterThanOrEqual(1);
-    expect((await runRepo.findById(fresh.id, workspaceId))!.status).toBe(
-      'aborted',
-    );
-  });
-});

apps/server/test/stubs/tiptap-react.js

@@ -1,23 +0,0 @@
-// Jest stub for @tiptap/react.
-//
-// The server export/import code paths transitively import editor-ext, whose node
-// extensions import from `@tiptap/react`. The real module re-exports all of
-// `@tiptap/core` (headless, safe under node) AND adds React view helpers
-// (`ReactNodeViewRenderer`, …) that eagerly pull in react-dom — which throws
-// `navigator is not defined` under jest's node environment.
-//
-// So this stub DELEGATES to the real `@tiptap/core` (keeping `mergeAttributes`,
-// `Node`, `Mark`, `nodeInputRule`, … working — they are used by
-// `jsonToHtml`/`htmlToJson` on the server) and overrides ONLY the React view
-// helpers with no-ops. Those helpers are referenced solely inside `addNodeView()`
-// — code that runs only in a live browser editor, never on the server; if any
-// were actually invoked here it would (correctly) surface as a test failure.
-const core = require('@tiptap/core');
-
-module.exports = {
-  ...core,
-  ReactNodeViewRenderer: () => () => ({}),
-  NodeViewWrapper: () => null,
-  NodeViewContent: () => null,
-  ReactRenderer: class {},
-};

packages/mcp/test-e2e.mjs

@@ -450,7 +450,7 @@ async function main() {
     // 8. get_page markdown round-trip sanity (table separator present)
     const md = await client.getPage(pageId);
     check("get_page md: table separator emitted", md.data.content.includes("| --- |"), "");
-    check("get_page md: callout exported as Obsidian '> [!info]'", md.data.content.includes("> [!info]"));
+    check("get_page md: callout exported as :::", md.data.content.includes(":::info"));
 
     // 9. comments: create / list / reply / update / check_new / delete
     const beforeComments = new Date(Date.now() - 1000).toISOString();