fix(files): drop late sync frames once fatal; file-doc join error suppression + retry-budget reset

Final safety-audit findings:
- CRITICAL: FileDocProvider.handleMessage had no fatal guard. After the connect
  deadline latched fatal and the editor fell back to a read-only local seed, a
  late SyncStep2 (slow server / flaky network / deploy) was still applied — merging
  server state into the seeded doc (content duplication) and flipping synced=true,
  which un-gated autosave and would persist the duplicate to the real file. fatal
  guarded (re)join but not inbound sync. Now handleMessage returns early when fatal.
  +test (late SyncStep2 after the deadline is ignored, doc stays empty + gated).
- file-doc join catch now suppresses the client-facing error when superseded
  (matches workflow/tables/workspace-files) so a retryable error for an abandoned
  file can't make a client re-join and cancel the newer one.
- table/workspace-files room hooks reset the retry budget on (re)connect so a prior
  full exhaustion doesn't block retries after a reconnect.
- presence-visibility: corrected a stale TTL comment.

Gates: tsc (sim/realtime) 0, 209 realtime + collab/hooks suites, biome, boundaries, prune.

Author: waleedlatif1

apps/realtime/src/handlers/file-doc.ts

@@ -434,6 +434,9 @@ export function setupWorkspaceFileDocHandlers(
   let currentFileId: string | null = null
 
   socket.on(FILE_DOC_EVENTS.JOIN, async ({ fileId, clientId }: JoinFileDocPayload) => {
+    // Hoisted so the catch can tell whether this join was superseded (a switch to another file)
+    // before surfacing a retryable error for the abandoned one.
+    let generation: number | undefined
     try {
       const userId = socket.userId
       const userName = socket.userName
@@ -460,7 +463,7 @@ export function setupWorkspaceFileDocHandlers(
 
       // Claim this JOIN's generation before the async authorize below, and record the file the
       // socket now intends to edit so a leave for it can cancel this join if it's still in-flight.
-      const generation = (joinGeneration.get(socket.id) ?? 0) + 1
+      generation = (joinGeneration.get(socket.id) ?? 0) + 1
       joinGeneration.set(socket.id, generation)
       currentFileId = fileId
 
@@ -582,6 +585,15 @@ export function setupWorkspaceFileDocHandlers(
         if (socketToRoomName.get(socket.id) === name) cleanupFileDocForSocket(socket.id, io)
         destroyRoomIfIdle(name)
       } catch {}
+      // Suppress the client-facing error when this join was already superseded (a switch to another
+      // file, or a disconnect): the rollback above still ran, but a retryable error naming the
+      // abandoned file could make a client re-join it and cancel the newer one (matches the sibling
+      // handlers).
+      if (
+        socket.disconnected ||
+        (generation !== undefined && joinGeneration.get(socket.id) !== generation)
+      )
+        return
       emitJoinError(socket, fileId, 'Failed to join file document', 'JOIN_FAILED', true)
     }
   })

apps/realtime/src/rooms/presence-visibility.ts

@@ -4,9 +4,10 @@ import type { IRoomManager, UserPresence } from '@/rooms/types'
 
 /**
  * How stale a not-live presence entry must be before a join-time sweep reclaims
- * it. Kept above the 1h socket-key TTL so a normally-idle collaborator is never
- * evicted; only genuinely-orphaned entries (e.g. a crashed pod that never fired
- * `disconnecting`) are cleared. Matches the workflow join sweep.
+ * it. The `liveIds` gate (not this threshold) is what protects an active
+ * collaborator; the threshold only bounds how long a genuinely-orphaned entry
+ * (e.g. a crashed pod that never fired `disconnecting`) lingers. Matches the
+ * workflow join sweep.
  */
 const STALE_PRESENCE_THRESHOLD_MS = 75 * 60 * 1000
 

apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/collaboration/file-doc-provider.test.ts

@@ -324,4 +324,31 @@ describe('FileDocProvider', () => {
       vi.useRealTimers()
     }
   })
+
+  it('ignores a late SyncStep2 that arrives after the connect deadline (no merge, stays gated)', () => {
+    vi.useFakeTimers()
+    try {
+      const { provider, doc, fire } = createProvider(true)
+      fire(FILE_DOC_EVENTS.JOIN_SUCCESS, { fileId: 'file-1' })
+
+      // Deadline lapses with no first sync → fatal fallback (editor falls back to a read-only seed).
+      vi.advanceTimersByTime(12_000)
+      expect(provider.joinError).toEqual(expect.objectContaining({ code: 'CONNECT_TIMEOUT' }))
+
+      // A delayed SyncStep2 finally arrives. Applying it would merge server content into the
+      // already-seeded doc (duplication) and flip synced→true (un-gating autosave), so it MUST be
+      // dropped once fatal.
+      const remote = new Y.Doc()
+      remote.getText('default').insert(0, 'server content')
+      const encoder = encoding.createEncoder()
+      encoding.writeVarUint(encoder, FILE_DOC_MESSAGE_TYPE.SYNC)
+      syncProtocol.writeSyncStep2(encoder, remote)
+      fire(FILE_DOC_EVENTS.MESSAGE, encoding.toUint8Array(encoder))
+
+      expect(provider.synced).toBe(false)
+      expect(doc.getText('default').toString()).toBe('')
+    } finally {
+      vi.useRealTimers()
+    }
+  })
 })

apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/collaboration/file-doc-provider.ts

@@ -183,6 +183,13 @@ export class FileDocProvider extends ObservableV2<FileDocProviderEvents> {
   }
 
   private handleMessage = (data: unknown) => {
+    // Once we've given up (a non-retryable rejection, or the connect deadline lapsed and the editor
+    // fell back to a read-only local seed), ignore ALL inbound frames. A late SyncStep2 arriving
+    // after the deadline would otherwise merge the server's state into the already-seeded doc —
+    // duplicating content — and flip `synced` true, which un-gates autosave and would persist the
+    // duplicate back to the real file. `fatal` guarding (re)join alone is not enough; it must also
+    // stop applying sync here.
+    if (this.fatal) return
     const bytes = toFileDocBytes(data)
     if (!bytes) return
 

apps/sim/app/workspace/[workspaceId]/files/hooks/use-workspace-files-room.ts

@@ -40,6 +40,13 @@ export function useWorkspaceFilesRoom(workspaceId: string): void {
 
     const join = () => socket.emit('join-workspace-files', { workspaceId })
 
+    // A fresh (re)connect gets a fresh retry budget, so a prior full exhaustion doesn't leave the
+    // socket unable to retry a failed re-join until the next success.
+    const handleConnect = () => {
+      retries = 0
+      join()
+    }
+
     const handleJoinSuccess = (data: { workspaceId: string }) => {
       if (data.workspaceId !== workspaceId) return
       retries = 0
@@ -68,14 +75,14 @@ export function useWorkspaceFilesRoom(workspaceId: string): void {
 
     // Join now if the socket is already connected; `connect` covers (re)connects.
     if (socket.connected) join()
-    socket.on('connect', join)
+    socket.on('connect', handleConnect)
     socket.on('join-workspace-files-success', handleJoinSuccess)
     socket.on('join-workspace-files-error', handleJoinError)
     socket.on('workspace-files-changed', handleChanged)
 
     return () => {
       if (retryTimer) clearTimeout(retryTimer)
-      socket.off('connect', join)
+      socket.off('connect', handleConnect)
       socket.off('join-workspace-files-success', handleJoinSuccess)
       socket.off('join-workspace-files-error', handleJoinError)
       socket.off('workspace-files-changed', handleChanged)

apps/sim/app/workspace/[workspaceId]/tables/[tableId]/hooks/use-table-room.ts

@@ -75,6 +75,13 @@ export function useTableRoom(tableId: string): UseTableRoomResult {
       socket.emit(TABLE_PRESENCE_EVENTS.JOIN, { tableId, tabSessionId: tabSessionIdRef.current })
     }
 
+    // A fresh (re)connect gets a fresh retry budget, so a prior full exhaustion doesn't leave the
+    // socket unable to retry a failed re-join until the next success.
+    const handleConnect = () => {
+      retries = 0
+      join()
+    }
+
     const handleJoinSuccess = (data: JoinTableSuccess) => {
       if (data.tableId !== tableId) return
       retries = 0
@@ -128,15 +135,15 @@ export function useTableRoom(tableId: string): UseTableRoomResult {
 
     // Join now if the socket is already connected; `connect` covers (re)connects.
     if (socket.connected) join()
-    socket.on('connect', join)
+    socket.on('connect', handleConnect)
     socket.on(TABLE_PRESENCE_EVENTS.JOIN_SUCCESS, handleJoinSuccess)
     socket.on(TABLE_PRESENCE_EVENTS.JOIN_ERROR, handleJoinError)
     socket.on(TABLE_PRESENCE_UPDATE_EVENT, handlePresence)
     socket.on(TABLE_PRESENCE_EVENTS.CELL_SELECTION, handleCellSelection)
 
     return () => {
       if (retryTimer) clearTimeout(retryTimer)
-      socket.off('connect', join)
+      socket.off('connect', handleConnect)
       socket.off(TABLE_PRESENCE_EVENTS.JOIN_SUCCESS, handleJoinSuccess)
       socket.off(TABLE_PRESENCE_EVENTS.JOIN_ERROR, handleJoinError)
       socket.off(TABLE_PRESENCE_UPDATE_EVENT, handlePresence)