Reference

Limits

What the current tree implements, what the playground fakes, and which edges are still open. Read this before treating a demo behavior as a guarantee.

Implemented

Shared apply, shaped trees, overlays, snapshots, compaction in DO SQLite.
Generic extensions and stream lifecycle with canonical stream_end.
Bootstrap keep_last projection, want/have, optional artifacts.
Application authentication, pushed ACL replicas, input/output enforcement, private views.
UUID slice and mutation ids; per-mutation durable outbox; fresh hub connection ids.
Host observability with a console sink and optional custom emit.
Demo workspace: channels, documents, canvas, roles, raster cover.

Demo-only

Query-param identity (?as=, workspace=). Anyone who can open the Worker can pick a name.
Ada/Beau bootstrap, catalog slugs, reaction ids, and the chat workspace UI.
Point extension, stroke limits, and in-process PNG rasterization.
The textarea editor and canned document stream.
Development IndexedDB keys. Old prototype dumps are ignored. Current data is disposable; there is no migration of those dumps.

Custom shape registries are supplied at creation and persisted with state. Changing configuration does not automatically migrate existing custom-shaped domains.

Open edges

Area	Current behavior	Intended next contract
Elided body edits	A later update to an unloaded child can stall the client (`body_not_inline`).	Commit-stamped replacement hashes for unmaterialized subscribers; versioned hydration; keep a failed commit until repair.
Text editing	Whole-run replace preserves untouched prefix/suffix of finalized runs.	Stable positions, splittable runs, IME, and an editor binding. An established CRDT will replace the prototype.
Pending CRDT text	Rejected or snapshot-overwritten text is not fully reconciled.	Rebuild visible state from accepted base plus surviving pending ops. Discard rejected edits.
Text undo	Reinserting a tombstoned run id does nothing.	Fresh op identity or an explicit undo op; grouped user edits.
Reconnect	The library `Transport` reconnects with backoff, connection generations, catch-up, outbox replay and terminal close handling. The playground still drives raw sockets with a fixed retry delay.	Move the playground onto `Transport`.
Presence after hibernation	Heap peer map is not restored; stale cursors possible.	Re-announce or reset presence from attachments.
Live streams after hibernation	Unfinished prefixes are not checkpointed.	Explicit resume or terminal-abort policy.
Policy freshness	Silent stall can exceed the five-second operational target.	Optional freshness/failure-detection mode. Not a heartbeat by default.
keep_last	Limits bootstrap bodies, not an ongoing working set.	Continuous eviction with explicit cache/session policy.

Design vs implementation

Several fields on the long-term shape policy — reconcile mode, reliability lane, visibility, authority, predictability — are declared in the design note and not fully enforced. Text is selected by installed extension, not by those unused field policies. “CRDT operations never refuse” applies only to conflicts after admission, not to permissions, schema, or target checks.

A completed snapshot can expose plain text, but log replay must retain a terminal transition. Do not treat a snapshot as a substitute for stream_end.

Dedup records and full snapshots currently grow with history. There is no idempotency horizon and no production-scale fanout/backoff story in the host.

What will not be added just in case

A general plugin loader or code named by untrusted wire data.
An unused access battery inside core. Membership stays application schema plus host policy.
Per-action authorization RPC, leases, or principal-owned retry identities.
A second write path that uploads the tree on idle.
Engine auto-commit or presence TTL.

The next generalization pass should be driven by a second real extension or application, not by speculative framework work. The original design note is docs/design-spec.md.