Merge feature/collaboration into main

.gitignore

···
 .Trashes
 ehthumbs.db
 Thumbs.db
-server
+/server

AGENTS.md

···
+# AGENTS.md - Agentic Coding Guidelines for Diffdown
+
+This file provides guidelines for AI agents operating in this repository.
+
+## Project Overview
+
+Diffdown is a collaborative Markdown editor with ATProto (Bluesky) authentication. It uses Go for the backend and vanilla JavaScript/CodeMirror for the frontend.
+
+---
+
+## Build, Lint, and Test Commands
+
+### Makefile Targets
+
+| Command | Description |
+|---------|-------------|
+| `make build` | Build the Go application to `bin/server` |
+| `make run` | Run the server directly with `go run` |
+| `make test` | Run all tests with verbose output |
+| `make test-coverage` | Run tests with coverage report (`coverage.html`) |
+| `make lint` | Run golangci-lint |
+| `make fmt` | Format code with `go fmt` |
+| `make dev` | Run with hot reload using air |
+| `make migrate-up` | Run database migrations |
+| `make migrate-down` | Rollback last migration |
+| `make migrate-create name=<name>` | Create new migration |
+
+### Running a Single Test
+
+```bash
+# Run tests in a specific package
+go test -v ./internal/handler
+
+# Run a specific test function
+go test -v -run TestFunctionName ./internal/handler
+
+# Run tests matching a pattern
+go test -v -run "Test.*Handler" ./...
+```
+
+### Environment Variables
+
+```bash
+export DIFFDOWN_SESSION_SECRET="your-secret-here"
+export BASE_URL="http://127.0.0.1:8080"
+export PORT=8080
+export DB_PATH="./diffdown.db"
+```
+
+---
+
+## Code Style Guidelines
+
+### Go Conventions
+
+- **Go Version**: 1.22+
+- **Module**: `github.com/limeleaf/diffdown`
+- **Formatting**: Use `go fmt` or `gofumports` - run before committing
+
+### Imports
+
+Organize imports in three groups with blank lines between:
+1. Standard library
+2. Third-party packages
+3. Internal packages
+
+```go
+import (
+    "context"
+    "encoding/json"
+    "fmt"
+    "log"
+    "net/http"
+    "time"
+
+    "github.com/gorilla/sessions"
+    "golang.org/x/crypto/bcrypt"
+
+    "github.com/limeleaf/diffdown/internal/auth"
+    "github.com/limeleaf/diffdown/internal/db"
+    "github.com/limeleaf/diffdown/internal/model"
+)
+```
+
+### Naming Conventions
+
+- **Files**: `snake_case.go` (e.g., `auth.go`, `handler.go`)
+- **Types/Interfaces**: `PascalCase` (e.g., `Handler`, `User`, `DB`)
+- **Functions/Methods**: `PascalCase` exported, `camelCase` unexported
+- **Constants**: `PascalCase` for exported, `camelCase` for unexported
+- **Variables**: `camelCase`, prefer short names (`db`, `err`, `w`, `r`)
+
+### Error Handling
+
+- Always handle errors explicitly; avoid bare `err != nil` checks
+- Log meaningful context with `log.Printf` before returning errors
+- Return user-friendly error messages in HTTP handlers
+- Use wrapped errors with `%w` for context: `fmt.Errorf("open db: %w", err)`
+
+### HTTP Handlers
+
+Follow the existing pattern in `internal/handler/handler
+func (h *Handler) Handler.go`:
+
+```goName(w http.ResponseWriter, r *http.Request) {
+    // 1. Authenticate/authorize
+    user := h.currentUser(r)
+    if user == nil {
+        http.Redirect(w, r, "/auth/login", http.StatusSeeOther)
+        return
+    }
+
+    // 2. Extract request data
+    data := r.FormValue("field")
+
+    // 3. Process (call DB, external API, etc.)
+    result, err := h.DB.Method(data)
+    if err != nil {
+        log.Printf("HandlerName: operation: %v", err)
+        h.render(w, "page.html", PageData{Error: "Friendly message"})
+        return
+    }
+
+    // 4. Respond
+    h.render(w, "page.html", PageData{Content: result})
+}
+```
+
+### Database
+
+- Use SQLite with WAL mode: `_journal_mode=WAL&_foreign_keys=on`
+- Use ULID for IDs: `db.NewID()` (uses `oklog/ulid/v2`)
+- Use migrations in `migrations/` directory (SQL files)
+- Apply migrations on startup: `database.Migrate()`
+
+### Authentication
+
+- Sessions: Gorilla `sessions.CookieStore`
+- Passwords: bcrypt (via `golang.org/x/crypto/bcrypt`)
+- ATProto OAuth: DPoP tokens with JWT
+
+### Testing
+
+- Tests should live in `*_test.go` files alongside the code they test
+- Use table-driven tests when testing multiple cases
+- Mock external dependencies (database, HTTP clients) where practical
+
+---
+
+## Project Structure
+
+```
+diffdown/
+├── cmd/
+│   ├── server/main.go       # Application entry point
+│   └── migrate/main.go      # Migration tool
+├── internal/
+│   ├── atproto/             # ATProto OAuth, DPoP, XRPC client
+│   ├── auth/                # Session management, password hashing
+│   ├── db/                  # Database operations, migrations
+│   ├── handler/             # HTTP handlers
+│   ├── middleware/          # HTTP middleware (logging, auth injection)
+│   ├── model/               # Data models
+│   └── render/              # Markdown rendering
+├── migrations/              # SQL migration files
+├── static/                  # Frontend assets
+├── templates/               # HTML templates
+├── Makefile                 # Build commands
+└── go.mod                   # Go dependencies
+```
+
+---
+
+## Common Tasks
+
+### Adding a New Handler
+
+1. Add method to `Handler` struct in `internal/handler/handler.go`
+2. Register route in `cmd/server/main.go`
+3. Add template to `templates/` if needed
+
+### Adding a Database Query
+
+1. Add method to `DB` struct in `internal/db/db.go`
+2. Follow naming: `GetX`, `CreateX`, `UpdateX`, `DeleteX`
+3. Use `db.scanUser` helper for scanning rows
+
+### Adding a Migration
+
+```bash
+make migrate-create name=create_users_table
+```
+
+Then edit the generated SQL file in `migrations/`.
+
+---
+
+## Dependencies
+
+Key dependencies (see `go.mod`):
+- `github.com/gorilla/sessions` - Session management
+- `github.com/mattn/go-sqlite3` - SQLite driver
+- `github.com/yuin/goldmark` - Markdown parsing
+- `github.com/golang-jwt/jwt/v5` - JWT tokens
+- `golang.org/x/crypto` - bcrypt, cryptography
+
+---
+
+## Frontend (JavaScript)
+
+The frontend uses vanilla JavaScript with CodeMirror 6 for the editor. Bundling is done with esbuild:
+
+```bash
+npm install
+npx esbuild --bundle --format=esm --outfile=static/vendor/codemirror.js ...
+```
+
+Static files are served from `static/` at `/static/`.

cmd/server/main.go

···
 	"time"
 
 	"github.com/limeleaf/diffdown/internal/auth"
+	"github.com/limeleaf/diffdown/internal/collaboration"
 	"github.com/limeleaf/diffdown/internal/db"
 	"github.com/limeleaf/diffdown/internal/handler"
 	"github.com/limeleaf/diffdown/internal/middleware"
···
 	sessionSecret := os.Getenv("DIFFDOWN_SESSION_SECRET")
 	if sessionSecret == "" {
 		sessionSecret = "dev-secret-change-in-production"
+	}
+	baseURL := os.Getenv("BASE_URL")
+	if baseURL == "" {
+		baseURL = "http://127.0.0.1:8080"
 	}
 
 	// Init
···
 			"templates/"+name,
 		))
 	}
-	h := handler.New(database, tmpls)
+
+	collabHub := collaboration.NewHub()
+	h := handler.New(database, tmpls, baseURL, collabHub)
 
 	// Routes
 	mux := http.NewServeMux()
···
 	mux.HandleFunc("POST /docs/new", h.NewDocumentSubmit)
 	mux.HandleFunc("GET /docs/{rkey}", h.DocumentView)
 	mux.HandleFunc("GET /docs/{rkey}/edit", h.DocumentEdit)
+	// Collaborator-scoped routes (owner DID in path)
+	mux.HandleFunc("GET /docs/{did}/{rkey}", h.CollaboratorDocumentView)
+	mux.HandleFunc("GET /docs/{did}/{rkey}/edit", h.CollaboratorDocumentEdit)
 
 	// API
 	mux.HandleFunc("POST /api/render", h.APIRender)
 	mux.HandleFunc("POST /api/docs/{rkey}/save", h.APIDocumentSave)
 	mux.HandleFunc("PUT /api/docs/{rkey}/autosave", h.APIDocumentAutoSave)
 	mux.HandleFunc("DELETE /api/docs/{rkey}", h.APIDocumentDelete)
+	mux.HandleFunc("POST /api/docs/{rkey}/invite", h.DocumentInvite)
+	mux.HandleFunc("GET /docs/{rkey}/accept", h.AcceptInvite)
 	mux.HandleFunc("POST /api/docs/{rkey}/comments", h.CommentCreate)
 	mux.HandleFunc("GET /api/docs/{rkey}/comments", h.CommentList)
+
+	// WebSocket
+	mux.HandleFunc("GET /ws/docs/{rkey}", h.CollaboratorWebSocket)
 
 	// Middleware stack
 	stack := middleware.Logger(

docs/superpowers/plans/2026-03-11-collaboration-implementation.md

···
+# Collaboration Feature Implementation Plan
+
+> **For agentic workers:** REQUIRED: Use superpowers:subagent-driven-development (if subagents available) or superpowers:executing-plans to implement this plan. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Implement real-time collaboration for Markdown documents with up to 5 users, paragraph-level comments, and invite-based access control.
+
+**Architecture:** Server-side collaboration hub with WebSocket connections. Server maintains canonical document state, broadcasts edits, debounces ATProto persistence. Comments stored in separate ATProto collection.
+
+**Tech Stack:** Go (stdlib, gorilla/websocket), ATProto XRPC, SQLite
+
+---
+
+## Chunk 1: Database Migration and Models
+
+### Task 1.1: Create invites migration
+
+**Files:**
+- Create: `migrations/005_create_invites.sql`
+
+- [ ] **Step 1: Write the migration**
+
+```sql
+CREATE TABLE IF NOT EXISTS invites (
+    id TEXT PRIMARY KEY,
+    document_rkey TEXT NOT NULL,
+    token TEXT NOT NULL UNIQUE,
+    created_by_did TEXT NOT NULL,
+    created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
+    expires_at DATETIME NOT NULL
+);
+
+CREATE INDEX idx_invites_document ON invites(document_rkey);
+CREATE INDEX idx_invites_token ON invites(token);
+```
+
+- [ ] **Step 2: Commit**
+
+```bash
+git add migrations/005_create_invites.sql
+git commit -m "feat: add invites table migration"
+```
+
+### Task 1.2: Update models for collaboration
+
+**Files:**
+- Modify: `internal/model/models.go`
+
+- [ ] **Step 1: Write the failing test (skip - no existing tests)**
+
+- [ ] **Step 2: Add Invite and Comment types**
+
+```go
+type Invite struct {
+    ID            string
+    DocumentRKey  string
+    Token         string
+    CreatedBy     string
+    CreatedAt     time.Time
+    ExpiresAt     time.Time
+}
+
+type Comment struct {
+    URI         string
+    DocumentURI string
+    ParagraphID string
+    Text        string
+    AuthorDID   string
+    AuthorName  string
+    CreatedAt   string
+}
+```
+
+- [ ] **Step 3: Add Collaborators field to Document**
+
+In the `Document` struct, add:
+```go
+Collaborators []string `json:"collaborators,omitempty"`
+```
+
+- [ ] **Step 4: Commit**
+
+```bash
+git add internal/model/models.go
+git commit -m "feat: add Invite, Comment models and Document.collaborators"
+```
+
+---
+
+## Chunk 2: Collaboration Package (Core Logic)
+
+### Task 2.1: Create collaboration hub
+
+**Files:**
+- Create: `internal/collaboration/hub.go`
+
+- [ ] **Step 1: Write the hub with WebSocket room management**
+
+```go
+package collaboration
+
+import (
+    "log"
+    "sync"
+)
+
+type Hub struct {
+    rooms map[string]*Room
+    mu    sync.RWMutex
+}
+
+type Room struct {
+    documentRKey string
+    clients      map[*Client]bool
+    broadcast    chan []byte
+    register     chan *Client
+    unregister   chan *Client
+    mu           sync.RWMutex
+}
+
+func NewHub() *Hub {
+    return &Hub{
+        rooms: make(map[string]*Room),
+    }
+}
+
+func (h *Hub) GetOrCreateRoom(rkey string) *Room {
+    h.mu.Lock()
+    defer h.mu.Unlock()
+    if room, exists := h.rooms[rkey]; exists {
+        return room
+    }
+    room := &Room{
+        documentRKey: rkey,
+        clients:      make(map[*Client]bool),
+        broadcast:    make(chan []byte, 256),
+        register:     make(chan *Client),
+        unregister:   make(chan *Client),
+    }
+    h.rooms[rkey] = room
+    go room.run()
+    return room
+}
+
+func (r *Room) run() {
+    for {
+        select {
+        case client := <-r.register:
+            r.mu.Lock()
+            r.clients[client] = true
+            r.mu.Unlock()
+            r.broadcastPresence()
+        case client := <-r.unregister:
+            r.mu.Lock()
+            if _, ok := r.clients[client]; ok {
+                delete(r.clients, client)
+                close(client.send)
+            }
+            r.mu.Unlock()
+            r.broadcastPresence()
+        case message := <-r.broadcast:
+            r.mu.RLock()
+            for client := range r.clients {
+                select {
+                case client.send <- message:
+                default:
+                    close(client.send)
+                    delete(r.clients, client)
+                }
+            }
+            r.mu.RUnlock()
+        }
+    }
+}
+
+func (r *Room) Broadcast(message []byte) {
+    r.broadcast <- message
+}
+
+func (r *Room) broadcastPresence() {
+    // Implementation in Task 2.2
+}
+```
+
+- [ ] **Step 2: Commit**
+
+```bash
+git add internal/collaboration/hub.go
+git commit -m "feat: add collaboration hub with room management"
+```
+
+### Task 2.2: Create client representation
+
+**Files:**
+- Create: `internal/collaboration/client.go`
+
+- [ ] **Step 1: Write the client struct**
+
+```go
+package collaboration
+
+import (
+    "github.com/gorilla/websocket"
+)
+
+type Client struct {
+    hub       *Hub
+    conn      *websocket.Conn
+    send      chan []byte
+    DID       string
+    Name      string
+    Color     string
+    roomKey   string
+}
+
+type ClientMessage struct {
+    Type     string          `json:"type"`
+    RKey     string          `json:"rkey,omitempty"`
+    DID      string          `json:"did,omitempty"`
+    Delta    json.RawMessage `json:"delta,omitempty"`
+    Cursor   *CursorPos     `json:"cursor,omitempty"`
+    Comment  *CommentMsg    `json:"comment,omitempty"`
+}
+
+type CursorPos struct {
+    Position      int `json:"position"`
+    SelectionEnd  int `json:"selectionEnd"`
+}
+
+type CommentMsg struct {
+    ParagraphID string `json:"paragraphId"`
+    Text        string `json:"text"`
+}
+
+type PresenceUser struct {
+    DID   string `json:"did"`
+    Name  string `json:"name"`
+    Color string `json:"color"`
+}
+
+type PresenceMessage struct {
+    Type  string          `json:"type"`
+    Users []PresenceUser `json:"users"`
+}
+
+func NewClient(hub *Hub, conn *websocket.Conn, did, name, color, roomKey string) *Client {
+    return &Client{
+        hub:     hub,
+        conn:    conn,
+        send:    make(chan []byte, 256),
+        DID:     did,
+        Name:    name,
+        Color:   color,
+        roomKey: roomKey,
+    }
+}
+
+func (c *Client) ReadPump() {
+    defer func() {
+        c.hub.unregister <- c
+        c.conn.Close()
+    }()
+    for {
+        _, message, err := c.conn.ReadMessage()
+        if err != nil {
+            if websocket.IsUnexpectedCloseError(err, websocket.CloseGoingAway, websocket.CloseAbnormalClosure) {
+                log.Printf("WebSocket error: %v", err)
+            }
+            break
+        }
+        // Handle message - dispatch to appropriate handler
+    }
+}
+
+func (c *Client) WritePump() {
+    defer c.conn.Close()
+    for {
+        message, ok := <-c.send
+        if !ok {
+            c.conn.WriteMessage(websocket.CloseMessage, []byte{})
+            return
+        }
+        if err := c.conn.WriteMessage(websocket.TextMessage, message); err != nil {
+            return
+        }
+    }
+}
+```
+
+- [ ] **Step 2: Implement presence broadcasting in hub**
+
+Add to `hub.go`:
+```go
+func (r *Room) GetPresence() []PresenceUser {
+    r.mu.RLock()
+    defer r.mu.RUnlock()
+    users := make([]PresenceUser, 0, len(r.clients))
+    for client := range r.clients {
+        users = append(users, PresenceUser{
+            DID:   client.DID,
+            Name:  client.Name,
+            Color: client.Color,
+        })
+    }
+    return users
+}
+
+func (r *Room) broadcastPresence() {
+    presence := PresenceMessage{
+        Type:  "presence",
+        Users: r.GetPresence(),
+    }
+    data, _ := json.Marshal(presence)
+    r.Broadcast(data)
+}
+```
+
+- [ ] **Step 3: Commit**
+
+```bash
+git add internal/collaboration/client.go internal/collaboration/hub.go
+git commit -m "feat: add client representation and presence broadcasting"
+```
+
+### Task 2.3: Create invite system
+
+**Files:**
+- Create: `internal/collaboration/invite.go`
+
+- [ ] **Step 1: Write the invite logic**
+
+```go
+package collaboration
+
+import (
+    "crypto/rand"
+    "crypto/sha256"
+    "encoding/hex"
+    "time"
+
+    "github.com/limeleaf/diffdown/internal/db"
+)
+
+func GenerateInviteToken() (string, error) {
+    bytes := make([]byte, 32)
+    if _, err := rand.Read(bytes); err != nil {
+        return "", err
+    }
+    hash := sha256.Sum256(bytes)
+    return hex.EncodeToString(hash[:]), nil
+}
+
+func CreateInvite(db *db.DB, documentRKey, createdByDID string) (*model.Invite, error) {
+    token, err := GenerateInviteToken()
+    if err != nil {
+        return nil, err
+    }
+
+    invite := &model.Invite{
+        ID:           db.NewID(),
+        DocumentRKey: documentRKey,
+        Token:        token,
+        CreatedBy:    createdByDID,
+        CreatedAt:    time.Now(),
+        ExpiresAt:    time.Now().Add(7 * 24 * time.Hour),
+    }
+
+    err = db.CreateInvite(invite)
+    return invite, err
+}
+
+func ValidateInvite(db *db.DB, token, documentRKey string) (*model.Invite, error) {
+    invite, err := db.GetInviteByToken(token)
+    if err != nil {
+        return nil, err
+    }
+    if invite.DocumentRKey != documentRKey {
+        return nil, fmt.Errorf("invite does not match document")
+    }
+    if time.Now().After(invite.ExpiresAt) {
+        return nil, fmt.Errorf("invite expired")
+    }
+    return invite, nil
+}
+```
+
+- [ ] **Step 2: Add DB methods**
+
+In `internal/db/db.go`, add:
+```go
+func (db *DB) CreateInvite(invite *model.Invite) error {
+    _, err := db.Exec(`
+        INSERT INTO invites (id, document_rkey, token, created_by_did, created_at, expires_at)
+        VALUES (?, ?, ?, ?, ?, ?)`,
+        invite.ID, invite.DocumentRKey, invite.Token, invite.CreatedBy, invite.CreatedAt, invite.ExpiresAt)
+    return err
+}
+
+func (db *DB) GetInviteByToken(token string) (*model.Invite, error) {
+    row := db.QueryRow(`SELECT id, document_rkey, token, created_by_did, created_at, expires_at FROM invites WHERE token = ?`, token)
+    var invite model.Invite
+    err := row.Scan(&invite.ID, &invite.DocumentRKey, &invite.Token, &invite.CreatedBy, &invite.CreatedAt, &invite.ExpiresAt)
+    if err != nil {
+        return nil, err
+    }
+    return &invite, nil
+}
+```
+
+- [ ] **Step 3: Commit**
+
+```bash
+git add internal/collaboration/invite.go internal/db/db.go
+git commit -m "feat: add invite generation and validation"
+```
+
+### Task 2.4: Create OT helpers
+
+**Files:**
+- Create: `internal/collaboration/ot.go`
+
+- [ ] **Step 1: Write simplified OT logic**
+
+```go
+package collaboration
+
+import "sync"
+
+type OTEngine struct {
+    mu           sync.Mutex
+    documentText string
+    version      int
+}
+
+func NewOTEngine(initialText string) *OTEngine {
+    return &OTEngine{
+        documentText: initialText,
+        version:      0,
+    }
+}
+
+type Operation struct {
+    From    int    `json:"from"`
+    To      int    `json:"to"`
+    Insert  string `json:"insert"`
+    Author  string `json:"author"`
+}
+
+func (ot *OTEngine) Apply(op Operation) string {
+    ot.mu.Lock()
+    defer ot.mu.Unlock()
+
+    // Simple last-write-wins
+    if op.To > len(ot.documentText) {
+        op.To = len(ot.documentText)
+    }
+    if op.From > len(ot.documentText) {
+        op.From = len(ot.documentText)
+    }
+
+    newText := ot.documentText[:op.From] + op.Insert + ot.documentText[op.To:]
+    ot.documentText = newText
+    ot.version++
+
+    return ot.documentText
+}
+
+func (ot *OTEngine) GetText() string {
+    ot.mu.Lock()
+    defer ot.mu.Unlock()
+    return ot.documentText
+}
+
+func (ot *OTEngine) GetVersion() int {
+    ot.mu.Lock()
+    defer ot.mu.Unlock()
+    return ot.version
+}
+```
+
+- [ ] **Step 2: Commit**
+
+```bash
+git add internal/collaboration/ot.go
+git commit -m "feat: add simplified OT engine"
+```
+
+---
+
+## Chunk 3: HTTP Handlers
+
+### Task 3.1: Document invite handler
+
+**Files:**
+- Modify: `internal/handler/handler.go`
+
+- [ ] **Step 1: Add DocumentInvite handler**
+
+```go
+func (h *Handler) DocumentInvite(w http.ResponseWriter, r *http.Request) {
+    user := h.currentUser(r)
+    if user == nil {
+        http.Redirect(w, r, "/auth/login", http.StatusSeeOther)
+        return
+    }
+
+    rKey := model.RKeyFromURI(r.URL.Path)
+    if rKey == "" {
+        http.Error(w, "Invalid document", http.StatusBadRequest)
+        return
+    }
+
+    // Get document to verify ownership
+    client := h.xrpcClient(r)
+    if client == nil {
+        h.render(w, "document_edit.html", PageData{Error: "Not authenticated with ATProto"})
+        return
+    }
+
+    doc, err := client.GetDocument(rKey)
+    if err != nil {
+        http.Error(w, "Document not found", http.StatusNotFound)
+        return
+    }
+
+    // Verify user is creator (DID matches)
+    session, _ := h.db.GetATProtoSession(user.ID)
+    if session == nil || session.DID != doc.URI {
+        http.Error(w, "Unauthorized", http.StatusForbidden)
+        return
+    }
+
+    // Check collaborator limit (5 max)
+    if len(doc.Collaborators) >= 5 {
+        http.Error(w, "Maximum collaborators reached", http.StatusBadRequest)
+        return
+    }
+
+    // Create invite
+    invite, err := collaboration.CreateInvite(h.db, rKey, session.DID)
+    if err != nil {
+        log.Printf("DocumentInvite: create invite: %v", err)
+        http.Error(w, "Failed to create invite", http.StatusInternalServerError)
+        return
+    }
+
+    inviteLink := fmt.Sprintf("%s/doc/%s?invite=%s", os.Getenv("BASE_URL"), rKey, invite.Token)
+    h.render(w, "document_edit.html", PageData{
+        Content: map[string]interface{}{
+            "document":    doc,
+            "inviteLink":  inviteLink,
+        },
+    })
+}
+```
+
+- [ ] **Step 2: Register route in main.go**
+
+```go
+mux.HandleFunc("POST /api/docs/{rkey}/invite", handler.DocumentInvite)
+```
+
+- [ ] **Step 3: Commit**
+
+```bash
+git add internal/handler/handler.go cmd/server/main.go
+git commit -m "feat: add document invite handler"
+```
+
+### Task 3.2: Accept invite handler
+
+**Files:**
+- Modify: `internal/handler/handler.go`
+
+- [ ] **Step 1: Add AcceptInvite handler**
+
+```go
+func (h *Handler) AcceptInvite(w http.ResponseWriter, r *http.Request) {
+    user := h.currentUser(r)
+    if user == nil {
+        http.Redirect(w, r, "/auth/login", http.StatusSeeOther)
+        return
+    }
+
+    rKey := model.RKeyFromURI(r.URL.Path)
+    inviteToken := r.URL.Query().Get("invite")
+    if inviteToken == "" {
+        http.Error(w, "Invalid invite", http.StatusBadRequest)
+        return
+    }
+
+    // Validate invite
+    invite, err := collaboration.ValidateInvite(h.db, inviteToken, rKey)
+    if err != nil {
+        http.Error(w, err.Error(), http.StatusBadRequest)
+        return
+    }
+
+    // Get ATProto session
+    session, err := h.db.GetATProtoSession(user.ID)
+    if err != nil || session == nil {
+        http.Redirect(w, r, "/auth/atproto", http.StatusSeeOther)
+        return
+    }
+
+    // Add user to collaborators via ATProto
+    client, err := h.newXRPCClient(session)
+    if err != nil {
+        http.Error(w, "Failed to connect to ATProto", http.StatusInternalServerError)
+        return
+    }
+
+    // Get current document
+    doc, err := client.GetDocument(rKey)
+    if err != nil {
+        http.Error(w, "Document not found", http.StatusNotFound)
+        return
+    }
+
+    // Check if already collaborator
+    for _, c := range doc.Collaborators {
+        if c == session.DID {
+            http.Redirect(w, r, "/doc/"+rKey, http.StatusSeeOther)
+            return
+        }
+    }
+
+    // Add to collaborators
+    doc.Collaborators = append(doc.Collaborators, session.DID)
+    err = client.PutDocument(rKey, doc)
+    if err != nil {
+        log.Printf("AcceptInvite: add collaborator: %v", err)
+        http.Error(w, "Failed to add collaborator", http.StatusInternalServerError)
+        return
+    }
+
+    // Delete invite token after use
+    h.db.DeleteInvite(invite.Token)
+
+    http.Redirect(w, r, "/doc/"+rKey, http.StatusSeeOther)
+}
+```
+
+- [ ] **Step 2: Register route**
+
+```go
+mux.HandleFunc("GET /doc/{rkey}/accept", handler.AcceptInvite)
+```
+
+- [ ] **Step 3: Commit**
+
+```bash
+git add internal/handler/handler.go cmd/server/main.go
+git commit -m "feat: add accept invite handler"
+```
+
+### Task 3.3: Comment handlers
+
+**Files:**
+- Modify: `internal/handler/handler.go`
+
+- [ ] **Step 1: Add CommentCreate handler**
+
+```go
+func (h *Handler) CommentCreate(w http.ResponseWriter, r *http.Request) {
+    user := h.currentUser(r)
+    if user == nil {
+        http.Error(w, "Unauthorized", http.StatusUnauthorized)
+        return
+    }
+
+    rKey := model.RKeyFromURI(r.URL.Path)
+    if rKey == "" {
+        http.Error(w, "Invalid document", http.StatusBadRequest)
+        return
+    }
+
+    // Parse request body
+    var req struct {
+        ParagraphID string `json:"paragraphId"`
+        Text        string `json:"text"`
+    }
+    if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+        http.Error(w, "Invalid request", http.StatusBadRequest)
+        return
+    }
+
+    if req.Text == "" {
+        http.Error(w, "Comment text required", http.StatusBadRequest)
+        return
+    }
+
+    // Get ATProto session
+    session, err := h.db.GetATProtoSession(user.ID)
+    if err != nil || session == nil {
+        http.Error(w, "Not authenticated with ATProto", http.StatusUnauthorized)
+        return
+    }
+
+    client, err := h.newXRPCClient(session)
+    if err != nil {
+        http.Error(w, "Failed to connect to ATProto", http.StatusInternalServerError)
+        return
+    }
+
+    // Create comment record
+    comment := &model.Comment{
+        DocumentURI: fmt.Sprintf("at://%s/com.diffdown.document/%s", session.DID, rKey),
+        ParagraphID: req.ParagraphID,
+        Text:        req.Text,
+        AuthorDID:   session.DID,
+    }
+
+    uri, err := client.CreateComment(comment)
+    if err != nil {
+        log.Printf("CommentCreate: %v", err)
+        http.Error(w, "Failed to create comment", http.StatusInternalServerError)
+        return
+    }
+
+    h.jsonResponse(w, map[string]string{"uri": uri}, http.StatusCreated)
+}
+```
+
+- [ ] **Step 2: Add CommentList handler**
+
+```go
+func (h *Handler) CommentList(w http.ResponseWriter, r *http.Request) {
+    rKey := model.RKeyFromURI(r.URL.Path)
+    if rKey == "" {
+        http.Error(w, "Invalid document", http.StatusBadRequest)
+        return
+    }
+
+    user := h.currentUser(r)
+    if user == nil {
+        http.Error(w, "Unauthorized", http.StatusUnauthorized)
+        return
+    }
+
+    session, err := h.db.GetATProtoSession(user.ID)
+    if err != nil || session == nil {
+        http.Error(w, "Not authenticated with ATProto", http.StatusUnauthorized)
+        return
+    }
+
+    client, err := h.newXRPCClient(session)
+    if err != nil {
+        http.Error(w, "Failed to connect to ATProto", http.StatusInternalServerError)
+        return
+    }
+
+    comments, err := client.ListComments(rKey)
+    if err != nil {
+        log.Printf("CommentList: %v", err)
+        http.Error(w, "Failed to list comments", http.StatusInternalServerError)
+        return
+    }
+
+    h.jsonResponse(w, comments, http.StatusOK)
+}
+```
+
+- [ ] **Step 3: Register routes**
+
+```go
+mux.HandleFunc("POST /api/docs/{rkey}/comments", handler.CommentCreate)
+mux.HandleFunc("GET /api/docs/{rkey}/comments", handler.CommentList)
+```
+
+- [ ] **Step 4: Commit**
+
+```bash
+git add internal/handler/handler.go cmd/server/main.go
+git commit -m "feat: add comment handlers"
+```
+
+---
+
+## Chunk 4: WebSocket Handler
+
+### Task 4.1: WebSocket upgrade handler
+
+**Files:**
+- Modify: `internal/handler/handler.go`, `cmd/server/main.go`
+
+- [ ] **Step 1: Add CollaboratorWebSocket handler**
+
+```go
+var upgrader = websocket.Upgrader{
+    CheckOrigin: func(r *http.Request) bool { return true },
+}
+
+func (h *Handler) CollaboratorWebSocket(w http.ResponseWriter, r *http.Request) {
+    rKey := model.RKeyFromURI(r.URL.Path)
+    if rKey == "" {
+        http.Error(w, "Invalid document", http.StatusBadRequest)
+        return
+    }
+
+    // Get access token and DPoP proof from query params
+    accessToken := r.URL.Query().Get("access_token")
+    dpopProof := r.URL.Query().Get("dpop_proof")
+    if accessToken == "" || dpopProof == "" {
+        http.Error(w, "Missing auth tokens", http.StatusUnauthorized)
+        return
+    }
+
+    // Validate tokens and get DID
+    did, name, err := h.validateWSToken(accessToken, dpopProof)
+    if err != nil {
+        http.Error(w, "Invalid tokens", http.StatusUnauthorized)
+        return
+    }
+
+    // Get document and verify collaborator access
+    session, _ := h.db.GetATProtoSessionByDID(did)
+    if session == nil {
+        http.Error(w, "No ATProto session", http.StatusUnauthorized)
+        return
+    }
+
+    client, err := h.newXRPCClient(session)
+    if err != nil {
+        http.Error(w, "Failed to connect to ATProto", http.StatusInternalServerError)
+        return
+    }
+
+    doc, err := client.GetDocument(rKey)
+    if err != nil {
+        http.Error(w, "Document not found", http.StatusNotFound)
+        return
+    }
+
+    // Check if user is collaborator
+    isCollaborator := false
+    for _, c := range doc.Collaborators {
+        if c == did {
+            isCollaborator = true
+            break
+        }
+    }
+    if !isCollaborator {
+        http.Error(w, "Not a collaborator", http.StatusForbidden)
+        return
+    }
+
+    // Generate color based on DID
+    color := colorFromDID(did)
+
+    // Upgrade connection
+    conn, err := upgrader.Upgrade(w, r, nil)
+    if err != nil {
+        log.Printf("WebSocket upgrade failed: %v", err)
+        return
+    }
+
+    // Get room and register client
+    room := h.CollaborationHub.GetOrCreateRoom(rKey)
+    wsClient := collaboration.NewClient(h.CollaborationHub, conn, did, name, color, rKey)
+    room.Register <- wsClient
+
+    // Start pumps
+    go wsClient.WritePump()
+    wsClient.ReadPump()
+}
+
+func (h *Handler) validateWSToken(accessToken, dpopProof string) (string, string, error) {
+    // Validate JWT and DPoP proof, extract DID and name
+    // Use existing ATProto token validation
+    return "", "", nil
+}
+
+func colorFromDID(did string) string {
+    colors := []string{"#e74c3c", "#3498db", "#2ecc71", "#9b59b6", "#f39c12"}
+    hash := 0
+    for _, c := range did {
+        hash += int(c)
+    }
+    return colors[hash%len(colors)]
+}
+```
+
+- [ ] **Step 2: Wire up Hub in main.go**
+
+```go
+// In main.go, add to Handler struct or global
+var collaborationHub = collaboration.NewHub()
+
+// Pass to handler
+handler := &handler.Handler{
+    DB:                db,
+    Store:             store,
+    Render:            r,
+    CollaborationHub:  collaborationHub,
+}
+```
+
+- [ ] **Step 3: Register WebSocket route**
+
+```go
+mux.HandleFunc("GET /ws/doc/{rkey}", handler.CollaboratorWebSocket)
+```
+
+- [ ] **Step 4: Commit**
+
+```bash
+git add internal/handler/handler.go cmd/server/main.go
+git commit -m "feat: add WebSocket collaboration handler"
+```
+
+---
+
+## Chunk 5: Frontend Updates
+
+### Task 5.1: WebSocket client and presence
+
+**Files:**
+- Modify: `templates/document_edit.html`
+
+- [ ] **Step 1: Add WebSocket connection**
+
+```javascript
+// Add to document_edit.html
+let ws = null;
+let collaborators = [];
+
+function connectWebSocket(rkey) {
+    const protocol = window.location.protocol === 'https:' ? 'wss:' : 'ws:';
+    const wsUrl = `${protocol}//${window.location.host}/ws/doc/${rkey}?access_token=${encodeURIComponent(getAccessToken())}&dpop_proof=${encodeURIComponent(getDPoPProof())}`;
+    
+    ws = new WebSocket(wsUrl);
+    
+    ws.onopen = () => {
+        console.log('WebSocket connected');
+        ws.send(JSON.stringify({ type: 'join', rkey: rkey, did: getCurrentDID() }));
+    };
+    
+    ws.onmessage = (event) => {
+        const msg = JSON.parse(event.data);
+        handleWSMessage(msg);
+    };
+    
+    ws.onclose = () => {
+        console.log('WebSocket disconnected');
+        setTimeout(() => connectWebSocket(rkey), 3000);
+    };
+}
+
+function handleWSMessage(msg) {
+    switch (msg.type) {
+        case 'presence':
+            updatePresenceSidebar(msg.users);
+            break;
+        case 'edit':
+            applyRemoteEdit(msg.delta);
+            break;
+        case 'sync':
+            setEditorContent(msg.content);
+            break;
+    }
+}
+
+function updatePresenceSidebar(users) {
+    collaborators = users;
+    const sidebar = document.getElementById('presence-sidebar');
+    if (!sidebar) return;
+    
+    sidebar.innerHTML = users.map(u => `
+        <div class="presence-user" style="display: flex; align-items: center; gap: 8px; padding: 8px;">
+            <span class="presence-avatar" style="width: 12px; height: 12px; border-radius: 50%; background: ${u.color};"></span>
+            <span>${u.name}</span>
+        </div>
+    `).join('');
+}
+
+function getAccessToken() {
+    // Get from session storage or cookie
+    return sessionStorage.getItem('atproto_access_token');
+}
+
+function getDPoPProof() {
+    return sessionStorage.getItem('atproto_dpop_proof');
+}
+
+function getCurrentDID() {
+    return sessionStorage.getItem('atproto_did');
+}
+
+// Connect on page load if user is collaborator
+if (isCollaborator) {
+    connectWebSocket(documentRKey);
+}
+```
+
+- [ ] **Step 2: Add presence sidebar to HTML**
+
+Add to document_edit.html:
+```html
+<div id="presence-sidebar" style="position: fixed; right: 0; top: 50%; transform: translateY(-50%); background: #f5f5f5; padding: 16px; border-radius: 8px; z-index: 100;">
+    <h3 style="margin: 0 0 12px; font-size: 14px;">Collaborators</h3>
+</div>
+```
+
+- [ ] **Step 3: Commit**
+
+```bash
+git add templates/document_edit.html
+git commit -m "feat: add WebSocket client and presence sidebar"
+```
+
+### Task 5.2: Comment UI
+
+**Files:**
+- Modify: `templates/document_edit.html`
+
+- [ ] **Step 1: Add comment functionality**
+
+```javascript
+// Add to document_edit.html
+function addComment(paragraphId) {
+    const text = prompt('Enter your comment:');
+    if (!text) return;
+    
+    fetch(`/api/docs/${documentRKey}/comments`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ paragraphId, text })
+    })
+    .then(res => res.json())
+    .then(data => {
+        renderCommentThread(paragraphId, [{ text, author: getCurrentDID(), createdAt: new Date().toISOString() }]);
+    });
+}
+
+function renderCommentThread(paragraphId, comments) {
+    const container = document.getElementById(`comments-${paragraphId}`);
+    if (!container) return;
+    
+    container.innerHTML = comments.map(c => `
+        <div class="comment" style="padding: 8px; margin: 4px 0; background: #fff; border-radius: 4px;">
+            <div class="comment-text">${c.text}</div>
+            <div class="comment-meta" style="font-size: 12px; color: #666;">${c.author} - ${new Date(c.createdAt).toLocaleString()}</div>
+        </div>
+    `).join('');
+}
+
+// Load comments on page load
+fetch(`/api/docs/${documentRKey}/comments`)
+    .then(res => res.json())
+    .then(comments => {
+        // Group by paragraphId and render
+        const byParagraph = {};
+        comments.forEach(c => {
+            if (!byParagraph[c.paragraphId]) byParagraph[c.paragraphId] = [];
+            byParagraph[c.paragraphId].push(c);
+        });
+        Object.keys(byParagraph).forEach(pid => {
+            renderCommentThread(pid, byParagraph[pid]);
+        });
+    });
+```
+
+- [ ] **Step 2: Add comment button to each paragraph**
+
+Add click handler to editor that shows comment button on paragraph selection:
+```javascript
+editor.on('selectionChange', (data) => {
+    const selectedNode = data.state.selection.$from.parent;
+    if (selectedNode) {
+        showCommentButton(selectedNode.attrs.id);
+    }
+});
+
+function showCommentButton(nodeId) {
+    // Show floating comment button near selected paragraph
+}
+```
+
+- [ ] **Step 3: Add comment CSS**
+
+```css
+.comment-thread {
+    margin-top: 8px;
+    padding: 8px;
+    background: #f9f9f9;
+    border-left: 3px solid #3498db;
+}
+
+.comment-button {
+    position: absolute;
+    right: 8px;
+    padding: 4px 8px;
+    background: #3498db;
+    color: white;
+    border: none;
+    border-radius: 4px;
+    cursor: pointer;
+}
+```
+
+- [ ] **Step 4: Commit**
+
+```bash
+git add templates/document_edit.html static/css/editor.css
+git commit -m "feat: add comment UI"
+```
+
+---
+
+## Final Review
+
+After completing all chunks:
+- Run `go build ./...` to verify compilation
+- Verify all handlers are registered in main.go
+- Ensure no conflicts with existing code
+- Test basic flow: create document, generate invite, accept invite, see presence

docs/superpowers/plans/2026-03-13-granular-delta-edits.md

···
+# Granular Delta Edits Implementation Plan
+
+> **For agentic workers:** REQUIRED: Use superpowers:subagent-driven-development (if subagents available) or superpowers:executing-plans to implement this plan. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Replace full-document WebSocket broadcasts with granular character-level deltas, reducing per-keystroke payload from O(document size) to O(change size).
+
+**Architecture:** CodeMirror exposes `update.changes` (a `ChangeSet`) directly — iterate it to extract precise `{from, to, insert}` operations. Milkdown only exposes the new markdown string, so we string-diff the previous vs new content using a bundled Myers diff to produce the same operation shape. The server-side `Operation` struct and `OTEngine` already handle granular ops correctly (after the `Insert==""` fix). Add a WebSocket send debounce (50ms) to batch rapid keystrokes. Receivers apply each delta in order using CodeMirror's `ChangeSet` API rather than replacing the whole document.
+
+**Tech Stack:** Go 1.22, CodeMirror 6 (`ChangeSet`, `ChangeDesc`), vanilla JS Myers diff (bundled inline, no new npm dep), existing `gorilla/websocket`, existing `Operation` / `OTEngine` types.
+
+---
+
+## Chunk 1: Server — accept and broadcast multiple deltas per message
+
+The current server receives one `Operation` per `edit` message. Granular edits from a single keystroke may produce multiple operations (e.g. CodeMirror reports each change in a transaction separately). We need the server to accept an array.
+
+### Task 1: Update `Operation` and `ClientMessage` to support delta arrays
+
+**Files:**
+- Modify: `internal/collaboration/client.go`
+- Modify: `internal/collaboration/hub.go`
+- Test: `internal/collaboration/client_test.go` (create)
+
+The wire format changes from:
+```json
+{ "type": "edit", "delta": { "from": 5, "to": 10, "insert": "hello" } }
+```
+to:
+```json
+{ "type": "edit", "deltas": [{ "from": 5, "to": 10, "insert": "hello" }] }
+```
+
+`delta` (singular) is kept as a fallback field so existing clients don't break during the transition.
+
+- [ ] **Step 1: Write failing test for multi-delta parsing**
+
+Add `internal/collaboration/client_test.go`:
+
+```go
+package collaboration
+
+import (
+    "encoding/json"
+    "testing"
+)
+
+func TestClientMessage_ParseDeltas_Multiple(t *testing.T) {
+    raw := `{"type":"edit","deltas":[{"from":0,"to":5,"insert":"hello"},{"from":10,"to":10,"insert":"!"}]}`
+    var msg ClientMessage
+    if err := json.Unmarshal([]byte(raw), &msg); err != nil {
+        t.Fatalf("unmarshal: %v", err)
+    }
+    if len(msg.Deltas) != 2 {
+        t.Fatalf("expected 2 deltas, got %d", len(msg.Deltas))
+    }
+    if msg.Deltas[0].From != 0 || msg.Deltas[0].To != 5 || msg.Deltas[0].Insert != "hello" {
+        t.Errorf("delta[0]: %+v", msg.Deltas[0])
+    }
+    if msg.Deltas[1].From != 10 || msg.Deltas[1].Insert != "!" {
+        t.Errorf("delta[1]: %+v", msg.Deltas[1])
+    }
+}
+
+func TestClientMessage_ParseDeltas_SingleFallback(t *testing.T) {
+    // Old wire format: singular "delta" field — must still work.
+    raw := `{"type":"edit","delta":{"from":3,"to":7,"insert":"xyz"}}`
+    var msg ClientMessage
+    if err := json.Unmarshal([]byte(raw), &msg); err != nil {
+        t.Fatalf("unmarshal: %v", err)
+    }
+    ops := msg.Operations()
+    if len(ops) != 1 {
+        t.Fatalf("expected 1 op from fallback, got %d", len(ops))
+    }
+    if ops[0].From != 3 || ops[0].To != 7 || ops[0].Insert != "xyz" {
+        t.Errorf("op: %+v", ops[0])
+    }
+}
+
+func TestClientMessage_ParseDeltas_EmptyDeltas(t *testing.T) {
+    raw := `{"type":"edit","deltas":[]}`
+    var msg ClientMessage
+    if err := json.Unmarshal([]byte(raw), &msg); err != nil {
+        t.Fatalf("unmarshal: %v", err)
+    }
+    if len(msg.Operations()) != 0 {
+        t.Errorf("expected 0 ops for empty deltas")
+    }
+}
+```
+
+- [ ] **Step 2: Run tests to verify they fail**
+
+```bash
+go test -v ./internal/collaboration/ -run TestClientMessage
+```
+
+Expected: `FAIL` — `msg.Deltas` field doesn't exist, `msg.Operations()` method doesn't exist.
+
+- [ ] **Step 3: Update `ClientMessage` in `internal/collaboration/client.go`**
+
+Replace the existing `ClientMessage` struct and add the `Operations()` helper:
+
+```go
+type ClientMessage struct {
+    Type    string          `json:"type"`
+    RKey    string          `json:"rkey,omitempty"`
+    DID     string          `json:"did,omitempty"`
+    // Deltas is the new plural field — a single edit message may carry
+    // multiple operations (e.g. one per CodeMirror ChangeDesc).
+    Deltas  []Operation     `json:"deltas,omitempty"`
+    // Delta is the legacy singular field. Kept for backward compatibility.
+    Delta   json.RawMessage `json:"delta,omitempty"`
+    Cursor  *CursorPos      `json:"cursor,omitempty"`
+    Comment *CommentMsg     `json:"comment,omitempty"`
+}
+
+// Operations returns the ops from this message, preferring Deltas over the
+// legacy singular Delta field.
+func (m *ClientMessage) Operations() []Operation {
+    if len(m.Deltas) > 0 {
+        return m.Deltas
+    }
+    if len(m.Delta) > 0 {
+        var op Operation
+        if err := json.Unmarshal(m.Delta, &op); err == nil {
+            return []Operation{op}
+        }
+    }
+    return nil
+}
+```
+
+- [ ] **Step 4: Update the `"edit"` case in `ReadPump` in `internal/collaboration/client.go`**
+
+Replace:
+```go
+case "edit":
+    var op Operation
+    if err := json.Unmarshal(msg.Delta, &op); err != nil {
+        log.Printf("Failed to parse delta from %s: %v", c.DID, err)
+        continue
+    }
+    op.Author = c.DID
+    room := c.hub.GetRoom(c.roomKey)
+    if room != nil {
+        room.ApplyEdit(op, c)
+    }
+```
+
+With:
+```go
+case "edit":
+    ops := msg.Operations()
+    if len(ops) == 0 {
+        continue
+    }
+    room := c.hub.GetRoom(c.roomKey)
+    if room == nil {
+        continue
+    }
+    for i := range ops {
+        ops[i].Author = c.DID
+    }
+    room.ApplyEdits(ops, c)
+```
+
+- [ ] **Step 5: Add `ApplyEdits` to `Room` in `internal/collaboration/hub.go`**
+
+Add alongside the existing `ApplyEdit` method:
+
+```go
+// ApplyEdits applies a sequence of operations in order and broadcasts one
+// combined message to all other clients. Each op is applied to the text
+// resulting from the previous op, so positions in each op must be relative
+// to the document state after all prior ops in the same batch have been
+// applied — which is exactly what CodeMirror's iterChanges produces (fromA/toA
+// are positions in the pre-change document, already adjusted for prior changes
+// within the same transaction by CodeMirror itself).
+func (r *Room) ApplyEdits(ops []Operation, sender *Client) {
+    if len(ops) == 0 {
+        return
+    }
+
+    for i := range ops {
+        r.ot.ApplyWithVersion(ops[i])
+    }
+
+    // Include the full document text so receivers can detect and recover from
+    // divergence without a reconnect.
+    finalText := r.ot.GetText()
+    type editsMsg struct {
+        Type    string      `json:"type"`
+        Deltas  []Operation `json:"deltas"`
+        Author  string      `json:"author"`
+        Content string      `json:"content"`
+    }
+    msg := editsMsg{
+        Type:    "edit",
+        Deltas:  ops,
+        Author:  sender.DID,
+        Content: finalText,
+    }
+    data, err := json.Marshal(msg)
+    if err != nil {
+        log.Printf("ApplyEdits: marshal: %v", err)
+        return
+    }
+    r.BroadcastExcept(data, sender)
+}
+```
+
+Note: `Content` (full text) is included in the broadcast so receivers can sanity-check their state. The client applies deltas directly but falls back to full replacement if its local state diverges.
+
+- [ ] **Step 6: Run tests to verify they pass**
+
+```bash
+go test -v -race ./internal/collaboration/ -run TestClientMessage
+```
+
+Expected: all 3 `TestClientMessage_*` tests PASS.
+
+- [ ] **Step 7: Run full suite**
+
+```bash
+go test -v -race ./internal/collaboration/
+```
+
+Expected: all tests PASS (no regressions).
+
+- [ ] **Step 8: Commit**
+
+```bash
+git add internal/collaboration/client.go internal/collaboration/hub.go internal/collaboration/client_test.go
+git commit -m "feat: support multi-delta edit messages on server"
+```
+
+---
+
+## Chunk 2: Server — OT tests for multi-delta sequences
+
+Before touching the frontend, verify the server applies multi-op sequences correctly.
+
+### Task 2: Tests for `ApplyEdits` on `Room`
+
+**Files:**
+- Modify: `internal/collaboration/hub_test.go`
+
+- [ ] **Step 1: Write failing tests**
+
+Add to `internal/collaboration/hub_test.go`:
+
+```go
+func TestRoom_ApplyEdits_MultipleOpsAppliedInOrder(t *testing.T) {
+    hub := NewHub()
+    room := hub.GetOrCreateRoom("doc-multi-ops")
+
+    alice := stubClient(hub, "did:plc:alice", "Alice", "#ff0000", "doc-multi-ops")
+    bob   := stubClient(hub, "did:plc:bob",   "Bob",   "#0000ff", "doc-multi-ops")
+    room.RegisterClient(alice)
+    room.RegisterClient(bob)
+    time.Sleep(100 * time.Millisecond)
+    drain(alice, 200*time.Millisecond)
+    drain(bob,   200*time.Millisecond)
+
+    // Two ops: set text to "hello", then append " world"
+    ops := []Operation{
+        {From: 0, To: -1, Insert: "hello"},
+        {From: 5, To:  5, Insert: " world"},
+    }
+    room.ApplyEdits(ops, alice)
+
+    bobMsgs := waitForMessages(bob, 1, time.Second)
+    if len(bobMsgs) == 0 {
+        t.Fatal("bob: expected edit message")
+    }
+
+    var msg struct {
+        Type    string      `json:"type"`
+        Deltas  []Operation `json:"deltas"`
+        Content string      `json:"content"`
+        Author  string      `json:"author"`
+    }
+    if err := json.Unmarshal(bobMsgs[0], &msg); err != nil {
+        t.Fatalf("unmarshal: %v", err)
+    }
+    if msg.Type != "edit" {
+        t.Errorf("type: got %q, want edit", msg.Type)
+    }
+    if msg.Content != "hello world" {
+        t.Errorf("content: got %q, want %q", msg.Content, "hello world")
+    }
+    if len(msg.Deltas) != 2 {
+        t.Errorf("deltas: got %d, want 2", len(msg.Deltas))
+    }
+    if msg.Author != "did:plc:alice" {
+        t.Errorf("author: got %q", msg.Author)
+    }
+}
+
+func TestRoom_ApplyEdits_UpdatesOTState(t *testing.T) {
+    hub := NewHub()
+    room := hub.GetOrCreateRoom("doc-multi-ot")
+    alice := stubClient(hub, "did:plc:alice", "Alice", "#ff0000", "doc-multi-ot")
+    room.RegisterClient(alice)
+    time.Sleep(100 * time.Millisecond)
+    drain(alice, 200*time.Millisecond)
+
+    room.ApplyEdits([]Operation{
+        {From: 0, To: -1, Insert: "abc"},
+        {From: 3, To:  3, Insert: "def"},
+    }, alice)
+
+    time.Sleep(50 * time.Millisecond)
+    if got := room.ot.GetText(); got != "abcdef" {
+        t.Errorf("OT state: got %q, want %q", got, "abcdef")
+    }
+}
+
+func TestRoom_ApplyEdits_EmptyOpsIsNoop(t *testing.T) {
+    hub := NewHub()
+    room := hub.GetOrCreateRoom("doc-empty-ops")
+    alice := stubClient(hub, "did:plc:alice", "Alice", "#ff0000", "doc-empty-ops")
+    bob   := stubClient(hub, "did:plc:bob",   "Bob",   "#0000ff", "doc-empty-ops")
+    room.RegisterClient(alice)
+    room.RegisterClient(bob)
+    time.Sleep(100 * time.Millisecond)
+    drain(alice, 200*time.Millisecond)
+    drain(bob,   200*time.Millisecond)
+
+    room.ApplyEdits(nil, alice)
+
+    bobMsgs := drain(bob, 300*time.Millisecond)
+    if len(bobMsgs) > 0 {
+        t.Errorf("expected no broadcast for empty ops, got %d messages", len(bobMsgs))
+    }
+}
+```
+
+- [ ] **Step 2: Run tests to confirm they pass**
+
+```bash
+go test -v ./internal/collaboration/ -run TestRoom_ApplyEdits
+```
+
+Expected: PASS — `ApplyEdits` was added in Chunk 1 Task 1 Step 5.
+
+- [ ] **Step 3: Run tests to verify they pass**
+
+```bash
+go test -v -race ./internal/collaboration/ -run TestRoom_ApplyEdits
+```
+
+Expected: all 3 tests PASS.
+
+- [ ] **Step 4: Run full suite**
+
+```bash
+go test -v -race ./internal/collaboration/
+```
+
+Expected: all tests PASS.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add internal/collaboration/hub_test.go
+git commit -m "test: add multi-delta ApplyEdits tests"
+```
+
+---
+
+## Chunk 3: Frontend — CodeMirror granular deltas
+
+CodeMirror 6's `update.changes` is a `ChangeSet`. Iterating it with `iterChanges` gives `(fromA, toA, fromB, toB, inserted)` — exactly the `{from, to, insert}` we need.
+
+### Task 3: Send granular deltas from CodeMirror source mode
+
+**Files:**
+- Modify: `templates/document_edit.html`
+
+The change is in the `EditorView.updateListener.of(...)` callback and the `sendEdit` / new `sendDeltas` functions.
+
+- [ ] **Step 1: Add `sendDeltas` function and debounce timer**
+
+In `document_edit.html`, find the `sendEdit` function (around line 608) and replace it with:
+
+```js
+    // Debounce timer for WebSocket sends (50ms batches rapid keystrokes).
+    let wsEditTimer = null;
+    let pendingDeltas = [];
+
+    // Queue a set of deltas and flush after a short debounce.
+    function queueDeltas(deltas) {
+        if (!ws || ws.readyState !== WebSocket.OPEN || applyingRemote) return;
+        pendingDeltas = pendingDeltas.concat(deltas);
+        clearTimeout(wsEditTimer);
+        wsEditTimer = setTimeout(flushDeltas, 50);
+    }
+
+    function flushDeltas() {
+        if (!ws || ws.readyState !== WebSocket.OPEN || pendingDeltas.length === 0) {
+            pendingDeltas = [];
+            return;
+        }
+        ws.send(JSON.stringify({ type: 'edit', deltas: pendingDeltas }));
+        pendingDeltas = [];
+    }
+
+    // sendEdit is kept for any future callers; Milkdown switches to diffToOps
+    // in Chunk 4 and no longer calls this directly.
+    function sendEdit(content) {
+        if (!ws || ws.readyState !== WebSocket.OPEN || applyingRemote) return;
+        queueDeltas([{ from: 0, to: -1, insert: content }]);
+    }
+```
+
+- [ ] **Step 2: Update the CodeMirror `updateListener` to use granular deltas**
+
+Find the `EditorView.updateListener.of(...)` block (around line 180) and replace it:
+
+```js
+            EditorView.updateListener.of((update) => {
+                if (update.docChanged && currentMode === 'source') {
+                    const content = update.state.doc.toString();
+                    updatePreview(content);
+                    if (!update.transactions.some(tr => tr.annotation(remoteEditAnnotation))) {
+                        scheduleAutoSave(content);
+                        // Extract granular deltas from the ChangeSet.
+                        const deltas = [];
+                        update.changes.iterChanges((fromA, toA, _fromB, _toB, inserted) => {
+                            deltas.push({ from: fromA, to: toA, insert: inserted.toString() });
+                        });
+                        if (deltas.length > 0) {
+                            queueDeltas(deltas);
+                        }
+                    }
+                }
+            }),
+```
+
+Note: `fromA`/`toA` are positions in the **old** document (before the change), which is what the server's OT engine needs. `fromB`/`toB` are positions in the new document — not needed here.
+
+- [ ] **Step 3: Update `applyRemoteEdit` to apply deltas when available**
+
+Find `applyRemoteEdit` (around line 582) and replace:
+
+```js
+    function applyRemoteEdit(msg) {
+        // msg may be a full-content string (legacy) or an object with deltas.
+        if (applyingRemote) return;
+        applyingRemote = true;
+        try {
+            // Determine content and deltas from the message.
+            let content = typeof msg === 'string' ? msg : msg.content;
+            const deltas = (typeof msg === 'object' && msg.deltas) ? msg.deltas : null;
+
+            if (currentMode === 'source' && cmView) {
+                if (deltas && deltas.length > 0) {
+                    // Apply each delta as a discrete CodeMirror change.
+                    // Build changes array, adjusting positions for prior changes.
+                    const docLen = cmView.state.doc.length;
+                    const changes = deltas.map(d => ({
+                        from: Math.min(d.from < 0 ? 0 : d.from, docLen),
+                        to:   Math.min(d.to   < 0 ? docLen : d.to, docLen),
+                        insert: d.insert || '',
+                    }));
+                    cmView.dispatch({
+                        changes,
+                        annotations: [remoteEditAnnotation.of(true)],
+                    });
+                    // Use the full-content echo from the server as a sanity-check.
+                    if (content && cmView.state.doc.toString() !== content) {
+                        // State diverged — fall back to full replacement.
+                        cmView.dispatch({
+                            changes: { from: 0, to: cmView.state.doc.length, insert: content },
+                            annotations: [remoteEditAnnotation.of(true)],
+                        });
+                    }
+                } else if (content && cmView.state.doc.toString() !== content) {
+                    // Legacy full-replacement path.
+                    cmView.dispatch({
+                        changes: { from: 0, to: cmView.state.doc.length, insert: content },
+                        annotations: [remoteEditAnnotation.of(true)],
+                    });
+                }
+                if (content) updatePreview(content);
+            } else if (currentMode === 'rich' && milkdownEditor && content) {
+                createMilkdownEditor(content);
+            }
+        } finally {
+            applyingRemote = false;
+        }
+    }
+```
+
+- [ ] **Step 4: Update `handleWSMessage` to pass the full message object to `applyRemoteEdit`**
+
+Find `handleWSMessage` (around line 567) and update the `'edit'` and `'sync'` cases:
+
+```js
+    function handleWSMessage(msg) {
+        switch (msg.type) {
+            case 'presence':
+                updatePresence(msg.users || []);
+                break;
+            case 'pong':
+                wsMissedPings = 0;
+                break;
+            case 'edit':
+                applyRemoteEdit(msg);   // pass full message object, not just msg.content
+                break;
+            case 'sync':
+                applyRemoteEdit(msg.content);  // sync is always full-content
+                break;
+        }
+    }
+```
+
+- [ ] **Step 5: Manual smoke test**
+
+```bash
+# In the collaboration worktree:
+make run
+```
+
+1. Open two browser tabs, both logged in as different ATProto users on the same document.
+2. Type in tab A (source mode) — tab B should receive and apply the edit without full-page flicker.
+3. Type simultaneously — verify no echo loop (your own edits don't come back).
+4. Switch tab A to rich mode, type — tab B should still update (via legacy full-replacement path).
+5. Open browser devtools → Network → WS — verify messages are small (just the changed characters) not full document.
+
+- [ ] **Step 6: Commit**
+
+```bash
+git add templates/document_edit.html
+git commit -m "feat: send granular CodeMirror deltas over WebSocket with 50ms debounce"
+```
+
+---
+
+## Chunk 4: Frontend — Milkdown string-diff deltas
+
+Milkdown only exposes the complete new markdown string. We compute a Myers diff between the previous and current string to produce `{from, to, insert}` operations.
+
+### Task 4: Inline Myers diff and wire up Milkdown listener
+
+**Files:**
+- Modify: `templates/document_edit.html`
+
+The Myers diff algorithm produces the minimal edit script between two strings. We inline a small implementation rather than adding an npm dependency, keeping the bundle unchanged.
+
+- [ ] **Step 1: Add inline Myers diff function**
+
+Just before the `queueDeltas` function added in Task 3, insert:
+
+```js
+    /**
+     * Compute the minimal edit operations to transform `oldStr` into `newStr`.
+     * Returns an array of {from, to, insert} suitable for the OT engine.
+     *
+     * Uses a line-level diff for performance, then falls back to a single
+     * full-replacement op if the diff produces more than 20 operations
+     * (pathological case — not worth the complexity).
+     */
+    function diffToOps(oldStr, newStr) {
+        if (oldStr === newStr) return [];
+
+        const oldLines = oldStr.split('\n');
+        const newLines = newStr.split('\n');
+
+        // Build line-level LCS table (Myers / Wagner-Fischer).
+        const m = oldLines.length, n = newLines.length;
+        const dp = Array.from({length: m + 1}, () => new Array(n + 1).fill(0));
+        for (let i = m - 1; i >= 0; i--) {
+            for (let j = n - 1; j >= 0; j--) {
+                dp[i][j] = oldLines[i] === newLines[j]
+                    ? dp[i+1][j+1] + 1
+                    : Math.max(dp[i+1][j], dp[i][j+1]);
+            }
+        }
+
+        // Trace back to produce diff hunks.
+        const ops = [];
+        let i = 0, j = 0;
+        // Track character offset into oldStr.
+        let charOffset = 0;
+        // +1 for the \n separator. The last line has no trailing \n, so its
+        // length is exact; however the OT engine clamps out-of-range positions,
+        // so an off-by-one on the final line is safe in practice.
+        const oldLineLengths = oldLines.map(l => l.length + 1);
+
+        while (i < m || j < n) {
+            if (i < m && j < n && oldLines[i] === newLines[j]) {
+                charOffset += oldLineLengths[i];
+                i++; j++;
+            } else if (j < n && (i >= m || dp[i+1][j] <= dp[i][j+1])) {
+                // Insert newLines[j]
+                const insertText = newLines[j] + (j < n - 1 ? '\n' : '');
+                ops.push({ from: charOffset, to: charOffset, insert: insertText });
+                j++;
+            } else {
+                // Delete oldLines[i]
+                const deleteLen = oldLineLengths[i];
+                ops.push({ from: charOffset, to: charOffset + deleteLen, insert: '' });
+                charOffset += deleteLen;
+                i++;
+            }
+        }
+
+        // Fallback: if diff is too fragmented, send a single full replacement.
+        if (ops.length > 20) {
+            return [{ from: 0, to: -1, insert: newStr }];
+        }
+
+        return ops;
+    }
+```
+
+- [ ] **Step 2: Update the Milkdown `markdownUpdated` listener to use `diffToOps`**
+
+Find the Milkdown listener (around line 246):
+
+```js
+                ctx.get(listenerCtx).markdownUpdated((_ctx, markdown, prevMarkdown) => {
+                    if (markdown !== prevMarkdown && !applyingRemote) {
+                        scheduleAutoSave(markdown);
+                        sendEdit(markdown);
+                    }
+                });
+```
+
+Replace with:
+
+```js
+                ctx.get(listenerCtx).markdownUpdated((_ctx, markdown, prevMarkdown) => {
+                    if (markdown !== prevMarkdown && !applyingRemote) {
+                        scheduleAutoSave(markdown);
+                        const ops = diffToOps(prevMarkdown || '', markdown);
+                        if (ops.length > 0) {
+                            queueDeltas(ops);
+                        }
+                    }
+                });
+```
+
+- [ ] **Step 3: Manual smoke test for rich text mode**
+
+```bash
+make run
+```
+
+1. Open two browser tabs on the same document, both in **rich** mode.
+2. Type in tab A — tab B should update.
+3. In devtools → Network → WS: verify messages contain `deltas` arrays (not a single large `insert`).
+4. Make a large edit (paste a paragraph) — verify fallback fires (single full-replacement op) rather than 20+ tiny ops.
+
+- [ ] **Step 4: Commit**
+
+```bash
+git add templates/document_edit.html
+git commit -m "feat: diff-based granular deltas for Milkdown rich text mode"
+```
+
+---
+
+## Chunk 5: Cleanup and edge cases
+
+### Task 5: Handle pending deltas on WebSocket close
+
+If the browser tab closes or the WebSocket drops while `pendingDeltas` is non-empty, those changes are lost silently. Flush synchronously on close.
+
+**Files:**
+- Modify: `templates/document_edit.html`
+
+- [ ] **Step 1: Extract `closeWS` helper and wire it up**
+
+There is no named `closeWS` function in the current code. `ws.close()` is called in two places:
+- `ws.onerror` callback (around line 533)
+- Inside `startHeartbeat`'s ping timer when missed pings ≥ 3 (around line 553)
+
+Replace both call sites with a shared `closeWS` helper. Add the helper alongside `flushDeltas`:
+
+```js
+    function closeWS() {
+        if (!ws) return;
+        clearTimeout(wsEditTimer);
+        flushDeltas();   // send any buffered deltas before closing
+        ws.close();
+        ws = null;
+        clearInterval(wsPingTimer);
+    }
+```
+
+Then update `ws.onerror`:
+```js
+        ws.onerror = () => {
+            closeWS();
+        };
+```
+
+And update the heartbeat missed-ping branch:
+```js
+                if (wsMissedPings >= 3) {
+                    closeWS();
+                }
+```
+
+Also update `ws.onclose` to call `stopHeartbeat()` only (not `clearInterval` directly, since `closeWS` handles that when called from onerror/heartbeat; onclose fires for all close paths and should remain lightweight):
+```js
+        ws.onclose = () => {
+            ws = null;
+            updatePresence([]);
+            scheduleReconnect();
+        };
+```
+
+- [ ] **Step 2: Flush on page unload**
+
+Add a `beforeunload` handler at the end of the `{{define "scripts"}}` block, after the `connectWebSocket()` call:
+
+```js
+    window.addEventListener('beforeunload', () => {
+        clearTimeout(wsEditTimer);
+        flushDeltas();
+    });
+```
+
+- [ ] **Step 3: Commit**
+
+```bash
+git add templates/document_edit.html
+git commit -m "fix: flush pending WS deltas on close and page unload"
+```
+
+### Task 6: OT engine — add `SetText` for room initialisation
+
+Currently `GetOrCreateRoom` initialises the OT engine with `""`. When a room is first created, the server fetches the document but doesn't seed the engine. If two users join simultaneously, the first edit from user A resets the OT state, which is fine for the current full-replacement protocol but wrong for granular deltas (user B's deltas will have stale offsets).
+
+**Files:**
+- Modify: `internal/collaboration/ot.go`
+- Modify: `internal/collaboration/hub.go`
+- Modify: `internal/handler/handler.go`
+- Test: `internal/collaboration/ot_test.go`
+
+- [ ] **Step 1: Write failing test for `SetText`**
+
+Add to `internal/collaboration/ot_test.go`:
+
+```go
+func TestOTEngine_SetText(t *testing.T) {
+    ot := NewOTEngine("")
+    ot.SetText("initial content")
+    if ot.GetText() != "initial content" {
+        t.Errorf("SetText: got %q, want %q", ot.GetText(), "initial content")
+    }
+    // SetText should not change the version counter.
+    if ot.GetVersion() != 0 {
+        t.Errorf("SetText should not increment version: got %d", ot.GetVersion())
+    }
+}
+```
+
+- [ ] **Step 2: Run test to verify it fails**
+
+```bash
+go test -v ./internal/collaboration/ -run TestOTEngine_SetText
+```
+
+Expected: FAIL — `SetText` undefined.
+
+- [ ] **Step 3: Add `SetText` to `internal/collaboration/ot.go`**
+
+```go
+// SetText replaces the canonical document text without incrementing the version.
+// Call this once when a room is first created, before any edits are applied.
+func (ot *OTEngine) SetText(text string) {
+    ot.mu.Lock()
+    defer ot.mu.Unlock()
+    ot.documentText = text
+}
+```
+
+- [ ] **Step 4: Run test to verify it passes**
+
+```bash
+go test -v -race ./internal/collaboration/ -run TestOTEngine_SetText
+```
+
+Expected: PASS.
+
+- [ ] **Step 5: Seed the OT engine in `CollaboratorWebSocket` handler**
+
+In `internal/handler/handler.go`, find `CollaboratorWebSocket` (search for `GetOrCreateRoom`). After fetching the document and before registering the client, seed the room's OT engine if it's a new room:
+
+```go
+    room := h.CollaborationHub.GetOrCreateRoom(rKey)
+    // Seed OT engine with the current document text on first join.
+    // GetOrCreateRoom returns existing rooms unchanged — SetText is idempotent
+    // only if called before the first edit, which is guaranteed here because
+    // we check IsNewRoom() before seeding.
+    if room.IsNewRoom() {
+        var initialText string
+        if doc.Content != nil {
+            initialText = doc.Content.Text.RawMarkdown
+        }
+        room.SeedText(initialText)
+    }
+```
+
+This requires adding `IsNewRoom()` and `SeedText()` to `Room`.
+
+- [ ] **Step 6: Add `IsNewRoom` and `SeedText` to `Room` in `internal/collaboration/hub.go`**
+
+Add a `seeded` field to `Room`:
+
+```go
+type Room struct {
+    documentRKey string
+    clients      map[*Client]bool
+    broadcast    chan *broadcastMsg
+    register     chan *Client
+    unregister   chan *Client
+    mu           sync.RWMutex
+    ot           *OTEngine
+    seeded       bool  // true after SeedText has been called
+}
+```
+
+Add methods:
+
+```go
+// IsNewRoom returns true if SeedText has not yet been called on this room.
+func (r *Room) IsNewRoom() bool {
+    r.mu.RLock()
+    defer r.mu.RUnlock()
+    return !r.seeded
+}
+
+// SeedText sets the initial document text for the OT engine.
+// Safe to call only before the first edit is applied.
+func (r *Room) SeedText(text string) {
+    r.mu.Lock()
+    defer r.mu.Unlock()
+    if !r.seeded {
+        r.ot.SetText(text)
+        r.seeded = true
+    }
+}
+```
+
+- [ ] **Step 7: Write test for `SeedText`**
+
+Add to `internal/collaboration/hub_test.go`:
+
+```go
+func TestRoom_SeedText_SetsInitialOTState(t *testing.T) {
+    hub := NewHub()
+    room := hub.GetOrCreateRoom("doc-seed")
+    if !room.IsNewRoom() {
+        t.Fatal("new room should report IsNewRoom=true")
+    }
+    room.SeedText("initial document content")
+    if room.IsNewRoom() {
+        t.Error("IsNewRoom should be false after seeding")
+    }
+    if got := room.ot.GetText(); got != "initial document content" {
+        t.Errorf("OT text after seed: got %q, want %q", got, "initial document content")
+    }
+}
+
+func TestRoom_SeedText_IdempotentAfterFirstCall(t *testing.T) {
+    hub := NewHub()
+    room := hub.GetOrCreateRoom("doc-seed-idem")
+    room.SeedText("first")
+    room.SeedText("second") // should be ignored
+    if got := room.ot.GetText(); got != "first" {
+        t.Errorf("second SeedText should be ignored: got %q, want %q", got, "first")
+    }
+}
+```
+
+- [ ] **Step 8: Run all tests**
+
+```bash
+go test -v -race ./internal/collaboration/
+```
+
+Expected: all tests PASS.
+
+- [ ] **Step 9: Commit**
+
+```bash
+git add internal/collaboration/ot.go internal/collaboration/hub.go \
+        internal/collaboration/ot_test.go internal/collaboration/hub_test.go \
+        internal/handler/handler.go
+git commit -m "feat: seed OT engine with document text on room creation"
+```
+
+---
+
+## Chunk 6: Final verification
+
+- [ ] **Run full test suite with race detector**
+
+```bash
+go test -v -race ./...
+```
+
+Expected: all tests PASS, no race conditions.
+
+- [ ] **Build**
+
+```bash
+make build
+```
+
+Expected: builds cleanly, no warnings.
+
+- [ ] **Lint**
+
+```bash
+make lint
+```
+
+Expected: no lint errors.
+
+- [ ] **End-to-end smoke test**
+
+```bash
+make run
+```
+
+1. Two users, same document, source mode: type rapidly — verify small WS messages (devtools → Network → WS frames).
+2. Two users, same document, rich mode: type — verify updates propagate correctly.
+3. Disconnect one user mid-edit — verify reconnect gets `sync` message with correct state.
+4. Empty the document entirely — verify the other user sees an empty document (tests the `Insert=""` deletion fix).
+
+- [ ] **Commit any fixups, then push**
+
+```bash
+git push origin feature/collaboration
+```

fly.toml

···
-app = "markdownhub"
+app = "markdownhub-staging"
 primary_region = "ewr"
 
 [build]
···
 [env]
   PORT = "8080"
   DB_PATH = "/data/markdownhub.db"
-  DIFFDOWN_BASE_URL = "https://diffdown.com"
-  COMPOSED_BASE_URL = "https://diffdown.com"
+  BASE_URL = "https://staging.diffdown.com"
+  DIFFDOWN_BASE_URL = "https://staging.diffdown.com"
+
 [http_service]
   internal_port = 8080
   force_https = true

go.mod

···
 require (
 	github.com/golang-jwt/jwt/v5 v5.3.1
 	github.com/gorilla/sessions v1.2.2
+	github.com/gorilla/websocket v1.5.3
 	github.com/mattn/go-sqlite3 v1.14.22
 	github.com/oklog/ulid/v2 v2.1.0
 	github.com/yuin/goldmark v1.7.1

go.sum

···
 github.com/gorilla/securecookie v1.1.2/go.mod h1:NfCASbcHqRSY+3a8tlWJwsQap2VX5pwzwo4h3eOamfo=
 github.com/gorilla/sessions v1.2.2 h1:lqzMYz6bOfvn2WriPUjNByzeXIlVzURcPmgMczkmTjY=
 github.com/gorilla/sessions v1.2.2/go.mod h1:ePLdVu+jbEgHH+KWw8I1z2wqd0BAdAQh/8LRvBeoNcQ=
+github.com/gorilla/websocket v1.5.3 h1:saDtZ6Pbx/0u+bgYQ3q96pZgCzfhKXGPqt7kZ72aNNg=
+github.com/gorilla/websocket v1.5.3/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
 github.com/mattn/go-sqlite3 v1.14.22 h1:2gZY6PC6kBnID23Tichd1K+Z0oS6nE/XwU+Vz/5o4kU=
 github.com/mattn/go-sqlite3 v1.14.22/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
 github.com/oklog/ulid/v2 v2.1.0 h1:+9lhoxAP56we25tyYETBBY1YLA2SaoLvUFgrP2miPJU=

internal/atproto/xrpc/client.go

···
 	"github.com/limeleaf/diffdown/internal/model"
 )
 
-const collectionComment = "com.diffdown.comment"
-
 type Client struct {
 	db      *db.DB
 	userID  string
···
 	return nil
 }
 
+const collectionDocument = "com.diffdown.document"
+
+// GetDocument fetches a document by its rkey.
+func (c *Client) GetDocument(rkey string) (*model.Document, error) {
+	value, _, err := c.GetRecord(c.session.DID, collectionDocument, rkey)
+	if err != nil {
+		return nil, err
+	}
+
+	var doc model.Document
+	if err := json.Unmarshal(value, &doc); err != nil {
+		return nil, fmt.Errorf("unmarshal document: %w", err)
+	}
+	doc.RKey = rkey
+	return &doc, nil
+}
+
+// PutDocument creates or updates a document.
+func (c *Client) PutDocument(rkey string, doc *model.Document) (string, string, error) {
+	return c.PutRecord(collectionDocument, rkey, doc)
+}
+
+const collectionComment = "com.diffdown.comment"
+
 // CreateComment creates a new comment record.
 func (c *Client) CreateComment(comment *model.Comment) (string, error) {
-	now := time.Now().UTC().Format(time.RFC3339)
 	record := map[string]interface{}{
 		"$type":       "com.diffdown.comment",
-		"documentUri": comment.DocumentURI,
+		"documentURI": comment.DocumentURI,
 		"paragraphId": comment.ParagraphID,
 		"text":        comment.Text,
-		"authorDid":   comment.AuthorDID,
-		"createdAt":   now,
+		"author":      comment.Author,
 	}
-
 	uri, _, err := c.CreateRecord(collectionComment, record)
 	if err != nil {
 		return "", err
···
 	return uri, nil
 }
 
-// ListComments lists all comments for a document.
-func (c *Client) ListComments(rkey string) ([]model.Comment, error) {
+// ListComments fetches all comments for a document.
+func (c *Client) ListComments(documentRKey string) ([]model.Comment, error) {
 	records, _, err := c.ListRecords(c.session.DID, collectionComment, 100, "")
 	if err != nil {
 		return nil, err
 	}
 
 	var comments []model.Comment
-	for _, rec := range records {
+	for _, r := range records {
 		var comment model.Comment
-		if err := json.Unmarshal(rec.Value, &comment); err != nil {
+		if err := json.Unmarshal(r.Value, &comment); err != nil {
+			continue
+		}
+		// Filter by documentRKey: at://{did}/com.diffdown.document/{rkey}
+		expectedSuffix := "/com.diffdown.document/" + documentRKey
+		if documentRKey != "" && !strings.HasSuffix(comment.DocumentURI, expectedSuffix) {
 			continue
 		}
-		comment.URI = rec.URI
+		comment.URI = r.URI
 		comments = append(comments, comment)
 	}
 	return comments, nil

internal/collaboration/client.go

···
+package collaboration
+
+import (
+	"encoding/json"
+	"log"
+
+	"github.com/gorilla/websocket"
+)
+
+type Client struct {
+	hub     *Hub
+	conn    *websocket.Conn
+	send    chan []byte
+	DID     string
+	Name    string
+	Color   string
+	roomKey string
+}
+
+type ClientMessage struct {
+	Type string `json:"type"`
+	RKey string `json:"rkey,omitempty"`
+	DID  string `json:"did,omitempty"`
+	// Deltas is the new plural field — a single edit message may carry
+	// multiple operations (e.g. one per CodeMirror ChangeDesc).
+	Deltas []Operation `json:"deltas,omitempty"`
+	// Delta is the legacy singular field. Kept for backward compatibility.
+	Delta   json.RawMessage `json:"delta,omitempty"`
+	Cursor  *CursorPos      `json:"cursor,omitempty"`
+	Comment *CommentMsg     `json:"comment,omitempty"`
+}
+
+// Operations returns the ops from this message, preferring Deltas over the
+// legacy singular Delta field.
+func (m *ClientMessage) Operations() []Operation {
+	if len(m.Deltas) > 0 {
+		return m.Deltas
+	}
+	if len(m.Delta) > 0 {
+		var op Operation
+		if err := json.Unmarshal(m.Delta, &op); err == nil {
+			return []Operation{op}
+		}
+	}
+	return nil
+}
+
+type CursorPos struct {
+	Position     int `json:"position"`
+	SelectionEnd int `json:"selectionEnd"`
+}
+
+type CommentMsg struct {
+	ParagraphID string `json:"paragraphId"`
+	Text        string `json:"text"`
+}
+
+type PresenceUser struct {
+	DID   string `json:"did"`
+	Name  string `json:"name"`
+	Color string `json:"color"`
+}
+
+type PresenceMessage struct {
+	Type  string         `json:"type"`
+	Users []PresenceUser `json:"users"`
+}
+
+func NewClient(hub *Hub, conn *websocket.Conn, did, name, color, roomKey string) *Client {
+	return &Client{
+		hub:     hub,
+		conn:    conn,
+		send:    make(chan []byte, 256),
+		DID:     did,
+		Name:    name,
+		Color:   color,
+		roomKey: roomKey,
+	}
+}
+
+func (c *Client) ReadPump() {
+	defer func() {
+		if room := c.hub.GetRoom(c.roomKey); room != nil {
+			room.unregister <- c
+		}
+		c.conn.Close()
+	}()
+	for {
+		_, message, err := c.conn.ReadMessage()
+		if err != nil {
+			if websocket.IsUnexpectedCloseError(err, websocket.CloseGoingAway, websocket.CloseAbnormalClosure) {
+				log.Printf("WebSocket error: %v", err)
+			}
+			break
+		}
+		var msg ClientMessage
+		if err := json.Unmarshal(message, &msg); err != nil {
+			log.Printf("Failed to parse message from %s: %v", c.DID, err)
+			continue
+		}
+
+		switch msg.Type {
+		case "edit":
+			ops := msg.Operations()
+			if len(ops) == 0 {
+				continue
+			}
+			room := c.hub.GetRoom(c.roomKey)
+			if room == nil {
+				continue
+			}
+			for i := range ops {
+				ops[i].Author = c.DID
+			}
+			room.ApplyEdits(ops, c)
+		case "ping":
+			pong, _ := json.Marshal(map[string]string{"type": "pong"})
+			c.send <- pong
+		default:
+			log.Printf("Unhandled message type=%s from %s", msg.Type, c.DID)
+		}
+	}
+}
+
+func (c *Client) WritePump() {
+	defer c.conn.Close()
+	for {
+		message, ok := <-c.send
+		if !ok {
+			c.conn.WriteMessage(websocket.CloseMessage, []byte{})
+			return
+		}
+		if err := c.conn.WriteMessage(websocket.TextMessage, message); err != nil {
+			return
+		}
+	}
+}

internal/collaboration/client_test.go

···
+package collaboration
+
+import (
+	"encoding/json"
+	"testing"
+)
+
+func TestClientMessage_ParseDeltas_Multiple(t *testing.T) {
+	raw := `{"type":"edit","deltas":[{"from":0,"to":5,"insert":"hello"},{"from":10,"to":10,"insert":"!"}]}`
+	var msg ClientMessage
+	if err := json.Unmarshal([]byte(raw), &msg); err != nil {
+		t.Fatalf("unmarshal: %v", err)
+	}
+	if len(msg.Deltas) != 2 {
+		t.Fatalf("expected 2 deltas, got %d", len(msg.Deltas))
+	}
+	if msg.Deltas[0].From != 0 || msg.Deltas[0].To != 5 || msg.Deltas[0].Insert != "hello" {
+		t.Errorf("delta[0]: %+v", msg.Deltas[0])
+	}
+	if msg.Deltas[1].From != 10 || msg.Deltas[1].Insert != "!" {
+		t.Errorf("delta[1]: %+v", msg.Deltas[1])
+	}
+}
+
+func TestClientMessage_ParseDeltas_SingleFallback(t *testing.T) {
+	// Old wire format: singular "delta" field — must still work.
+	raw := `{"type":"edit","delta":{"from":3,"to":7,"insert":"xyz"}}`
+	var msg ClientMessage
+	if err := json.Unmarshal([]byte(raw), &msg); err != nil {
+		t.Fatalf("unmarshal: %v", err)
+	}
+	ops := msg.Operations()
+	if len(ops) != 1 {
+		t.Fatalf("expected 1 op from fallback, got %d", len(ops))
+	}
+	if ops[0].From != 3 || ops[0].To != 7 || ops[0].Insert != "xyz" {
+		t.Errorf("op: %+v", ops[0])
+	}
+}
+
+func TestClientMessage_ParseDeltas_EmptyDeltas(t *testing.T) {
+	raw := `{"type":"edit","deltas":[]}`
+	var msg ClientMessage
+	if err := json.Unmarshal([]byte(raw), &msg); err != nil {
+		t.Fatalf("unmarshal: %v", err)
+	}
+	if len(msg.Operations()) != 0 {
+		t.Errorf("expected 0 ops for empty deltas")
+	}
+}

internal/collaboration/hub.go

···
+package collaboration
+
+import (
+	"encoding/json"
+	"log"
+	"sync"
+)
+
+type Hub struct {
+	rooms map[string]*Room
+	mu    sync.RWMutex
+}
+
+type Room struct {
+	documentRKey string
+	clients      map[*Client]bool
+	broadcast    chan *broadcastMsg
+	register     chan *Client
+	unregister   chan *Client
+	mu           sync.RWMutex
+	ot           *OTEngine
+	seeded       bool // true after SeedText has been called
+}
+
+// broadcastMsg carries a message and an optional sender to exclude.
+type broadcastMsg struct {
+	data   []byte
+	except *Client // nil = send to all
+}
+
+func NewHub() *Hub {
+	return &Hub{
+		rooms: make(map[string]*Room),
+	}
+}
+
+func (h *Hub) GetOrCreateRoom(rkey string) *Room {
+	h.mu.Lock()
+	defer h.mu.Unlock()
+	if room, exists := h.rooms[rkey]; exists {
+		return room
+	}
+	room := &Room{
+		documentRKey: rkey,
+		clients:      make(map[*Client]bool),
+		broadcast:    make(chan *broadcastMsg, 256),
+		register:     make(chan *Client),
+		unregister:   make(chan *Client),
+		ot:           NewOTEngine(""),
+	}
+	h.rooms[rkey] = room
+	go room.run()
+	return room
+}
+
+func (h *Hub) GetRoom(rkey string) *Room {
+	h.mu.RLock()
+	defer h.mu.RUnlock()
+	return h.rooms[rkey]
+}
+
+func (r *Room) run() {
+	for {
+		select {
+		case client := <-r.register:
+			r.mu.Lock()
+			r.clients[client] = true
+			r.mu.Unlock()
+			r.broadcastPresence()
+		case client := <-r.unregister:
+			r.mu.Lock()
+			if _, ok := r.clients[client]; ok {
+				delete(r.clients, client)
+				close(client.send)
+			}
+			r.mu.Unlock()
+			r.broadcastPresence()
+		case msg := <-r.broadcast:
+			r.mu.RLock()
+			for client := range r.clients {
+				if client == msg.except {
+					continue
+				}
+				select {
+				case client.send <- msg.data:
+				default:
+					close(client.send)
+					delete(r.clients, client)
+				}
+			}
+			r.mu.RUnlock()
+		}
+	}
+}
+
+// Broadcast sends to all clients in the room.
+func (r *Room) Broadcast(data []byte) {
+	r.broadcast <- &broadcastMsg{data: data}
+}
+
+// BroadcastExcept sends to all clients except the given sender.
+func (r *Room) BroadcastExcept(data []byte, except *Client) {
+	r.broadcast <- &broadcastMsg{data: data, except: except}
+}
+
+// ApplyEdits applies a sequence of operations in order and broadcasts one
+// combined message to all other clients. Each op is applied to the text
+// resulting from the previous op, so positions in each op must be relative
+// to the document state after all prior ops in the same batch have been
+// applied — which is exactly what CodeMirror's iterChanges produces (fromA/toA
+// are positions in the pre-change document, already adjusted for prior changes
+// within the same transaction by CodeMirror itself).
+func (r *Room) ApplyEdits(ops []Operation, sender *Client) {
+	if len(ops) == 0 {
+		return
+	}
+
+	// Capture the text returned by the final ApplyWithVersion so we don't
+	// race against another goroutine calling GetText() separately.
+	var finalText string
+	for i := range ops {
+		finalText, _ = r.ot.ApplyWithVersion(ops[i])
+	}
+
+	// Include the full document text so receivers can detect and recover from
+	// divergence without a reconnect.
+	type editsMsg struct {
+		Type    string      `json:"type"`
+		Deltas  []Operation `json:"deltas"`
+		Author  string      `json:"author"`
+		Content string      `json:"content"`
+	}
+	msg := editsMsg{
+		Type:    "edit",
+		Deltas:  ops,
+		Author:  sender.DID,
+		Content: finalText,
+	}
+	data, err := json.Marshal(msg)
+	if err != nil {
+		log.Printf("ApplyEdits: marshal: %v", err)
+		return
+	}
+	r.BroadcastExcept(data, sender)
+}
+
+func (r *Room) RegisterClient(client *Client) {
+	r.register <- client
+}
+
+func (r *Room) UnregisterClient(client *Client) {
+	r.unregister <- client
+}
+
+func (r *Room) GetPresence() []PresenceUser {
+	r.mu.RLock()
+	defer r.mu.RUnlock()
+	users := make([]PresenceUser, 0, len(r.clients))
+	for client := range r.clients {
+		users = append(users, PresenceUser{
+			DID:   client.DID,
+			Name:  client.Name,
+			Color: client.Color,
+		})
+	}
+	return users
+}
+
+func (r *Room) broadcastPresence() {
+	presence := PresenceMessage{
+		Type:  "presence",
+		Users: r.GetPresence(),
+	}
+	data, err := json.Marshal(presence)
+	if err != nil {
+		log.Printf("broadcastPresence: marshal failed: %v", err)
+		return
+	}
+	r.Broadcast(data)
+}
+
+// IsNewRoom returns true if SeedText has not yet been called on this room.
+func (r *Room) IsNewRoom() bool {
+	r.mu.RLock()
+	defer r.mu.RUnlock()
+	return !r.seeded
+}
+
+// SeedText sets the initial document text for the OT engine.
+// Idempotent — only the first call has effect.
+func (r *Room) SeedText(text string) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	if !r.seeded {
+		r.ot.SetText(text)
+		r.seeded = true
+	}
+}

internal/collaboration/hub_test.go

···
+package collaboration
+
+import (
+	"encoding/json"
+	"testing"
+	"time"
+)
+
+// stubClient creates a Client with a real send channel but no WebSocket conn.
+// It is usable for hub/room tests that don't exercise the network layer.
+func stubClient(hub *Hub, did, name, color, roomKey string) *Client {
+	return &Client{
+		hub:     hub,
+		conn:    nil, // not used in hub logic
+		send:    make(chan []byte, 256),
+		DID:     did,
+		Name:    name,
+		Color:   color,
+		roomKey: roomKey,
+	}
+}
+
+// drain reads all messages from a client's send channel within timeout.
+func drain(c *Client, timeout time.Duration) [][]byte {
+	deadline := time.After(timeout)
+	var msgs [][]byte
+	for {
+		select {
+		case msg, ok := <-c.send:
+			if !ok {
+				return msgs
+			}
+			msgs = append(msgs, msg)
+		case <-deadline:
+			return msgs
+		}
+	}
+}
+
+// waitForMessages blocks until n messages arrive on c.send or timeout.
+func waitForMessages(c *Client, n int, timeout time.Duration) [][]byte {
+	deadline := time.After(timeout)
+	var msgs [][]byte
+	for len(msgs) < n {
+		select {
+		case msg, ok := <-c.send:
+			if !ok {
+				return msgs
+			}
+			msgs = append(msgs, msg)
+		case <-deadline:
+			return msgs
+		}
+	}
+	return msgs
+}
+
+// --- Hub tests ---
+
+func TestHub_GetOrCreateRoom_CreatesNew(t *testing.T) {
+	hub := NewHub()
+	room := hub.GetOrCreateRoom("doc1")
+	if room == nil {
+		t.Fatal("expected non-nil room")
+	}
+}
+
+func TestHub_GetOrCreateRoom_ReturnsSame(t *testing.T) {
+	hub := NewHub()
+	r1 := hub.GetOrCreateRoom("doc1")
+	r2 := hub.GetOrCreateRoom("doc1")
+	if r1 != r2 {
+		t.Error("expected same room instance for same rkey")
+	}
+}
+
+func TestHub_GetOrCreateRoom_DifferentRooms(t *testing.T) {
+	hub := NewHub()
+	r1 := hub.GetOrCreateRoom("doc1")
+	r2 := hub.GetOrCreateRoom("doc2")
+	if r1 == r2 {
+		t.Error("expected different rooms for different rkeys")
+	}
+}
+
+func TestHub_GetRoom_NilForUnknown(t *testing.T) {
+	hub := NewHub()
+	if hub.GetRoom("nonexistent") != nil {
+		t.Error("expected nil for unknown room")
+	}
+}
+
+func TestHub_GetRoom_AfterCreate(t *testing.T) {
+	hub := NewHub()
+	hub.GetOrCreateRoom("doc1")
+	if hub.GetRoom("doc1") == nil {
+		t.Error("expected room to be retrievable after creation")
+	}
+}
+
+// --- Room presence tests ---
+
+func TestRoom_RegisterClient_AppearsInPresence(t *testing.T) {
+	hub := NewHub()
+	room := hub.GetOrCreateRoom("doc-presence")
+	c := stubClient(hub, "did:plc:alice", "Alice", "#ff0000", "doc-presence")
+
+	room.RegisterClient(c)
+
+	// Wait for presence broadcast (register → broadcastPresence)
+	msgs := waitForMessages(c, 1, 2*time.Second)
+	if len(msgs) == 0 {
+		t.Fatal("expected presence message after register, got none")
+	}
+
+	var pres PresenceMessage
+	if err := json.Unmarshal(msgs[0], &pres); err != nil {
+		t.Fatalf("unmarshal presence: %v", err)
+	}
+	if pres.Type != "presence" {
+		t.Errorf("expected type=presence, got %q", pres.Type)
+	}
+	if len(pres.Users) != 1 {
+		t.Fatalf("expected 1 user in presence, got %d", len(pres.Users))
+	}
+	if pres.Users[0].DID != "did:plc:alice" {
+		t.Errorf("expected DID did:plc:alice, got %q", pres.Users[0].DID)
+	}
+}
+
+func TestRoom_MultipleClients_PresenceContainsAll(t *testing.T) {
+	hub := NewHub()
+	room := hub.GetOrCreateRoom("doc-multi")
+
+	alice := stubClient(hub, "did:plc:alice", "Alice", "#ff0000", "doc-multi")
+	bob := stubClient(hub, "did:plc:bob", "Bob", "#0000ff", "doc-multi")
+
+	room.RegisterClient(alice)
+	// Drain alice's initial presence (just herself)
+	waitForMessages(alice, 1, time.Second)
+
+	room.RegisterClient(bob)
+	// Both get a new presence broadcast; wait for 1 more on each
+	aliceMsgs := waitForMessages(alice, 1, 2*time.Second)
+	bobMsgs := waitForMessages(bob, 1, 2*time.Second)
+
+	checkPresenceCount := func(name string, msgs [][]byte, want int) {
+		t.Helper()
+		if len(msgs) == 0 {
+			t.Fatalf("%s: expected presence message, got none", name)
+		}
+		var pres PresenceMessage
+		if err := json.Unmarshal(msgs[len(msgs)-1], &pres); err != nil {
+			t.Fatalf("%s: unmarshal: %v", name, err)
+		}
+		if len(pres.Users) != want {
+			t.Errorf("%s: expected %d users in presence, got %d", name, want, len(pres.Users))
+		}
+	}
+
+	checkPresenceCount("alice", aliceMsgs, 2)
+	checkPresenceCount("bob", bobMsgs, 2)
+}
+
+func TestRoom_UnregisterClient_RemovedFromPresence(t *testing.T) {
+	hub := NewHub()
+	room := hub.GetOrCreateRoom("doc-unreg")
+
+	alice := stubClient(hub, "did:plc:alice", "Alice", "#ff0000", "doc-unreg")
+	bob := stubClient(hub, "did:plc:bob", "Bob", "#0000ff", "doc-unreg")
+
+	room.RegisterClient(alice)
+	room.RegisterClient(bob)
+	// Drain initial presence messages
+	time.Sleep(100 * time.Millisecond)
+	drain(alice, 200*time.Millisecond)
+	drain(bob, 200*time.Millisecond)
+
+	// Now unregister alice
+	room.UnregisterClient(alice)
+
+	// Bob should receive a presence update with 1 user
+	msgs := waitForMessages(bob, 1, 2*time.Second)
+	if len(msgs) == 0 {
+		t.Fatal("expected presence update after unregister, got none")
+	}
+	var pres PresenceMessage
+	if err := json.Unmarshal(msgs[len(msgs)-1], &pres); err != nil {
+		t.Fatalf("unmarshal: %v", err)
+	}
+	if len(pres.Users) != 1 {
+		t.Errorf("expected 1 user after alice unregisters, got %d", len(pres.Users))
+	}
+	if pres.Users[0].DID != "did:plc:bob" {
+		t.Errorf("expected bob to remain, got %q", pres.Users[0].DID)
+	}
+}
+
+// --- Room broadcast tests ---
+
+func TestRoom_Broadcast_SendsToAll(t *testing.T) {
+	hub := NewHub()
+	room := hub.GetOrCreateRoom("doc-broadcast")
+
+	alice := stubClient(hub, "did:plc:alice", "Alice", "#ff0000", "doc-broadcast")
+	bob := stubClient(hub, "did:plc:bob", "Bob", "#0000ff", "doc-broadcast")
+
+	room.RegisterClient(alice)
+	room.RegisterClient(bob)
+	// Drain presence messages
+	time.Sleep(100 * time.Millisecond)
+	drain(alice, 200*time.Millisecond)
+	drain(bob, 200*time.Millisecond)
+
+	room.Broadcast([]byte(`{"type":"ping"}`))
+
+	aliceMsgs := waitForMessages(alice, 1, time.Second)
+	bobMsgs := waitForMessages(bob, 1, time.Second)
+
+	if len(aliceMsgs) == 0 {
+		t.Error("alice: expected broadcast message")
+	}
+	if len(bobMsgs) == 0 {
+		t.Error("bob: expected broadcast message")
+	}
+}
+
+func TestRoom_BroadcastExcept_SkipsSender(t *testing.T) {
+	hub := NewHub()
+	room := hub.GetOrCreateRoom("doc-except")
+
+	alice := stubClient(hub, "did:plc:alice", "Alice", "#ff0000", "doc-except")
+	bob := stubClient(hub, "did:plc:bob", "Bob", "#0000ff", "doc-except")
+
+	room.RegisterClient(alice)
+	room.RegisterClient(bob)
+	time.Sleep(100 * time.Millisecond)
+	drain(alice, 200*time.Millisecond)
+	drain(bob, 200*time.Millisecond)
+
+	room.BroadcastExcept([]byte(`{"type":"edit"}`), alice)
+
+	// Bob should receive it; alice should not
+	bobMsgs := waitForMessages(bob, 1, time.Second)
+	aliceMsgs := drain(alice, 300*time.Millisecond)
+
+	if len(bobMsgs) == 0 {
+		t.Error("bob: expected broadcast message")
+	}
+	if len(aliceMsgs) > 0 {
+		t.Errorf("alice: should not receive her own broadcast, got %d messages", len(aliceMsgs))
+	}
+}
+
+// --- Room ApplyEdits tests ---
+
+func TestRoom_ApplyEdit_BroadcastsToOthers(t *testing.T) {
+	hub := NewHub()
+	room := hub.GetOrCreateRoom("doc-edit")
+
+	alice := stubClient(hub, "did:plc:alice", "Alice", "#ff0000", "doc-edit")
+	bob := stubClient(hub, "did:plc:bob", "Bob", "#0000ff", "doc-edit")
+
+	room.RegisterClient(alice)
+	room.RegisterClient(bob)
+	time.Sleep(100 * time.Millisecond)
+	drain(alice, 200*time.Millisecond)
+	drain(bob, 200*time.Millisecond)
+
+	room.ApplyEdits([]Operation{{From: 0, To: -1, Insert: "hello world"}}, alice)
+
+	// Bob should receive the edit message; alice should not
+	bobMsgs := waitForMessages(bob, 1, time.Second)
+	aliceMsgs := drain(alice, 300*time.Millisecond)
+
+	if len(bobMsgs) == 0 {
+		t.Fatal("bob: expected edit message, got none")
+	}
+	if len(aliceMsgs) > 0 {
+		t.Errorf("alice: should not receive her own edit, got %d messages", len(aliceMsgs))
+	}
+
+	var msg map[string]interface{}
+	if err := json.Unmarshal(bobMsgs[0], &msg); err != nil {
+		t.Fatalf("unmarshal edit msg: %v", err)
+	}
+	if msg["type"] != "edit" {
+		t.Errorf("expected type=edit, got %q", msg["type"])
+	}
+	if msg["author"] != "did:plc:alice" {
+		t.Errorf("expected author did:plc:alice, got %q", msg["author"])
+	}
+	if msg["content"] != "hello world" {
+		t.Errorf("expected content %q, got %q", "hello world", msg["content"])
+	}
+}
+
+func TestRoom_ApplyEdit_UpdatesOTState(t *testing.T) {
+	hub := NewHub()
+	room := hub.GetOrCreateRoom("doc-ot-state")
+
+	alice := stubClient(hub, "did:plc:alice", "Alice", "#ff0000", "doc-ot-state")
+	room.RegisterClient(alice)
+	time.Sleep(100 * time.Millisecond)
+	drain(alice, 200*time.Millisecond)
+
+	room.ApplyEdits([]Operation{{From: 0, To: -1, Insert: "first"}}, alice)
+	room.ApplyEdits([]Operation{{From: 5, To: 5, Insert: " second"}}, alice)
+
+	// Give room goroutine time to process
+	time.Sleep(100 * time.Millisecond)
+
+	if got := room.ot.GetText(); got != "first second" {
+		t.Errorf("OT state: got %q, want %q", got, "first second")
+	}
+}
+
+func TestRoom_ApplyEdits_MultipleOpsAppliedInOrder(t *testing.T) {
+	hub := NewHub()
+	room := hub.GetOrCreateRoom("doc-multi-ops")
+
+	alice := stubClient(hub, "did:plc:alice", "Alice", "#ff0000", "doc-multi-ops")
+	bob := stubClient(hub, "did:plc:bob", "Bob", "#0000ff", "doc-multi-ops")
+	room.RegisterClient(alice)
+	room.RegisterClient(bob)
+	time.Sleep(100 * time.Millisecond)
+	drain(alice, 200*time.Millisecond)
+	drain(bob, 200*time.Millisecond)
+
+	ops := []Operation{
+		{From: 0, To: -1, Insert: "hello"},
+		{From: 5, To: 5, Insert: " world"},
+	}
+	room.ApplyEdits(ops, alice)
+
+	bobMsgs := waitForMessages(bob, 1, time.Second)
+	if len(bobMsgs) == 0 {
+		t.Fatal("bob: expected edit message")
+	}
+
+	var msg struct {
+		Type    string      `json:"type"`
+		Deltas  []Operation `json:"deltas"`
+		Content string      `json:"content"`
+		Author  string      `json:"author"`
+	}
+	if err := json.Unmarshal(bobMsgs[0], &msg); err != nil {
+		t.Fatalf("unmarshal: %v", err)
+	}
+	if msg.Type != "edit" {
+		t.Errorf("type: got %q, want edit", msg.Type)
+	}
+	if msg.Content != "hello world" {
+		t.Errorf("content: got %q, want %q", msg.Content, "hello world")
+	}
+	if len(msg.Deltas) != 2 {
+		t.Errorf("deltas: got %d, want 2", len(msg.Deltas))
+	}
+	if msg.Author != "did:plc:alice" {
+		t.Errorf("author: got %q", msg.Author)
+	}
+}
+
+func TestRoom_ApplyEdits_UpdatesOTState(t *testing.T) {
+	hub := NewHub()
+	room := hub.GetOrCreateRoom("doc-multi-ot")
+	alice := stubClient(hub, "did:plc:alice", "Alice", "#ff0000", "doc-multi-ot")
+	room.RegisterClient(alice)
+	time.Sleep(100 * time.Millisecond)
+	drain(alice, 200*time.Millisecond)
+
+	room.ApplyEdits([]Operation{
+		{From: 0, To: -1, Insert: "abc"},
+		{From: 3, To: 3, Insert: "def"},
+	}, alice)
+
+	time.Sleep(50 * time.Millisecond)
+	if got := room.ot.GetText(); got != "abcdef" {
+		t.Errorf("OT state: got %q, want %q", got, "abcdef")
+	}
+}
+
+func TestRoom_ApplyEdits_EmptyOpsIsNoop(t *testing.T) {
+	hub := NewHub()
+	room := hub.GetOrCreateRoom("doc-empty-ops")
+	alice := stubClient(hub, "did:plc:alice", "Alice", "#ff0000", "doc-empty-ops")
+	bob := stubClient(hub, "did:plc:bob", "Bob", "#0000ff", "doc-empty-ops")
+	room.RegisterClient(alice)
+	room.RegisterClient(bob)
+	time.Sleep(100 * time.Millisecond)
+	drain(alice, 200*time.Millisecond)
+	drain(bob, 200*time.Millisecond)
+
+	room.ApplyEdits(nil, alice)
+
+	bobMsgs := drain(bob, 300*time.Millisecond)
+	if len(bobMsgs) > 0 {
+		t.Errorf("expected no broadcast for empty ops, got %d messages", len(bobMsgs))
+	}
+}
+
+// --- SeedText / IsNewRoom ---
+
+func TestRoom_SeedText_SetsInitialOTState(t *testing.T) {
+	hub := NewHub()
+	room := hub.GetOrCreateRoom("doc-seed")
+	if !room.IsNewRoom() {
+		t.Fatal("new room should report IsNewRoom=true")
+	}
+	room.SeedText("initial document content")
+	if room.IsNewRoom() {
+		t.Error("IsNewRoom should be false after seeding")
+	}
+	if got := room.ot.GetText(); got != "initial document content" {
+		t.Errorf("OT text after seed: got %q, want %q", got, "initial document content")
+	}
+}
+
+func TestRoom_SeedText_IdempotentAfterFirstCall(t *testing.T) {
+	hub := NewHub()
+	room := hub.GetOrCreateRoom("doc-seed-idem")
+	room.SeedText("first")
+	room.SeedText("second") // should be ignored
+	if got := room.ot.GetText(); got != "first" {
+		t.Errorf("second SeedText should be ignored: got %q, want %q", got, "first")
+	}
+}
+
+// --- GetPresence ---
+
+func TestRoom_GetPresence_Empty(t *testing.T) {
+	hub := NewHub()
+	room := hub.GetOrCreateRoom("doc-empty-presence")
+	users := room.GetPresence()
+	if len(users) != 0 {
+		t.Errorf("expected 0 users in new room, got %d", len(users))
+	}
+}

internal/collaboration/invite.go

···
+package collaboration
+
+import (
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/hex"
+	"fmt"
+	"time"
+
+	"github.com/limeleaf/diffdown/internal/db"
+	"github.com/limeleaf/diffdown/internal/model"
+)
+
+func GenerateInviteToken() (string, error) {
+	bytes := make([]byte, 32)
+	if _, err := rand.Read(bytes); err != nil {
+		return "", err
+	}
+	hash := sha256.Sum256(bytes)
+	return hex.EncodeToString(hash[:]), nil
+}
+
+func CreateInvite(database *db.DB, documentRKey, createdByDID string) (*model.Invite, error) {
+	token, err := GenerateInviteToken()
+	if err != nil {
+		return nil, err
+	}
+
+	invite := &model.Invite{
+		ID:           db.NewID(),
+		DocumentRKey: documentRKey,
+		Token:        token,
+		CreatedBy:    createdByDID,
+		CreatedAt:    time.Now(),
+		ExpiresAt:    time.Now().Add(7 * 24 * time.Hour),
+	}
+
+	err = database.CreateInvite(invite)
+	return invite, err
+}
+
+func ValidateInvite(database *db.DB, token, documentRKey string) (*model.Invite, error) {
+	invite, err := database.GetInviteByToken(token)
+	if err != nil {
+		return nil, err
+	}
+	if invite.DocumentRKey != documentRKey {
+		return nil, fmt.Errorf("invite does not match document")
+	}
+	if time.Now().After(invite.ExpiresAt) {
+		return nil, fmt.Errorf("invite expired")
+	}
+	return invite, nil
+}

internal/collaboration/invite_test.go

···
+package collaboration
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/limeleaf/diffdown/internal/db"
+	"github.com/limeleaf/diffdown/internal/model"
+)
+
+// openTestDB opens a temporary SQLite DB with migrations applied.
+func openTestDB(t *testing.T) *db.DB {
+	t.Helper()
+	tmp := t.TempDir()
+	database, err := db.Open(filepath.Join(tmp, "test.db"))
+	if err != nil {
+		t.Fatalf("open test db: %v", err)
+	}
+	// Point migrations at the real migrations directory (relative to module root).
+	db.SetMigrationsDir(filepath.Join("..", "..", "migrations"))
+	if err := database.Migrate(); err != nil {
+		t.Fatalf("migrate: %v", err)
+	}
+	t.Cleanup(func() {
+		database.Close()
+		os.RemoveAll(tmp)
+	})
+	return database
+}
+
+// --- GenerateInviteToken ---
+
+func TestGenerateInviteToken_Length(t *testing.T) {
+	token, err := GenerateInviteToken()
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	// SHA-256 hex = 64 chars
+	if len(token) != 64 {
+		t.Errorf("expected token length 64, got %d", len(token))
+	}
+}
+
+func TestGenerateInviteToken_Unique(t *testing.T) {
+	t1, err1 := GenerateInviteToken()
+	t2, err2 := GenerateInviteToken()
+	if err1 != nil || err2 != nil {
+		t.Fatalf("unexpected errors: %v %v", err1, err2)
+	}
+	if t1 == t2 {
+		t.Error("expected unique tokens, got duplicates")
+	}
+}
+
+// --- CreateInvite ---
+
+func TestCreateInvite_ReturnsInvite(t *testing.T) {
+	database := openTestDB(t)
+	invite, err := CreateInvite(database, "rkey123", "did:plc:creator")
+	if err != nil {
+		t.Fatalf("CreateInvite: %v", err)
+	}
+	if invite.ID == "" {
+		t.Error("expected non-empty ID")
+	}
+	if invite.Token == "" {
+		t.Error("expected non-empty Token")
+	}
+	if invite.DocumentRKey != "rkey123" {
+		t.Errorf("DocumentRKey: got %q, want %q", invite.DocumentRKey, "rkey123")
+	}
+	if invite.CreatedBy != "did:plc:creator" {
+		t.Errorf("CreatedBy: got %q, want %q", invite.CreatedBy, "did:plc:creator")
+	}
+}
+
+func TestCreateInvite_ExpiresInSevenDays(t *testing.T) {
+	database := openTestDB(t)
+	before := time.Now()
+	invite, err := CreateInvite(database, "rkey123", "did:plc:creator")
+	if err != nil {
+		t.Fatalf("CreateInvite: %v", err)
+	}
+	after := time.Now()
+
+	minExpiry := before.Add(7 * 24 * time.Hour)
+	maxExpiry := after.Add(7 * 24 * time.Hour)
+
+	if invite.ExpiresAt.Before(minExpiry) || invite.ExpiresAt.After(maxExpiry) {
+		t.Errorf("ExpiresAt %v not in expected range [%v, %v]", invite.ExpiresAt, minExpiry, maxExpiry)
+	}
+}
+
+func TestCreateInvite_PersistedInDB(t *testing.T) {
+	database := openTestDB(t)
+	invite, err := CreateInvite(database, "rkey123", "did:plc:creator")
+	if err != nil {
+		t.Fatalf("CreateInvite: %v", err)
+	}
+
+	fetched, err := database.GetInviteByToken(invite.Token)
+	if err != nil {
+		t.Fatalf("GetInviteByToken: %v", err)
+	}
+	if fetched.DocumentRKey != invite.DocumentRKey {
+		t.Errorf("persisted DocumentRKey: got %q, want %q", fetched.DocumentRKey, invite.DocumentRKey)
+	}
+}
+
+// --- ValidateInvite ---
+
+func TestValidateInvite_ValidToken(t *testing.T) {
+	database := openTestDB(t)
+	invite, err := CreateInvite(database, "rkey123", "did:plc:creator")
+	if err != nil {
+		t.Fatalf("CreateInvite: %v", err)
+	}
+
+	validated, err := ValidateInvite(database, invite.Token, "rkey123")
+	if err != nil {
+		t.Fatalf("ValidateInvite: %v", err)
+	}
+	if validated.Token != invite.Token {
+		t.Errorf("got token %q, want %q", validated.Token, invite.Token)
+	}
+}
+
+func TestValidateInvite_WrongRKey(t *testing.T) {
+	database := openTestDB(t)
+	invite, err := CreateInvite(database, "rkey123", "did:plc:creator")
+	if err != nil {
+		t.Fatalf("CreateInvite: %v", err)
+	}
+
+	_, err = ValidateInvite(database, invite.Token, "wrong-rkey")
+	if err == nil {
+		t.Error("expected error for mismatched rkey, got nil")
+	}
+}
+
+func TestValidateInvite_UnknownToken(t *testing.T) {
+	database := openTestDB(t)
+	_, err := ValidateInvite(database, "nonexistent-token", "rkey123")
+	if err == nil {
+		t.Error("expected error for unknown token, got nil")
+	}
+}
+
+func TestValidateInvite_ExpiredToken(t *testing.T) {
+	database := openTestDB(t)
+
+	// Insert an already-expired invite directly.
+	expired := &model.Invite{
+		ID:           db.NewID(),
+		DocumentRKey: "rkey123",
+		Token:        "expiredtoken1234567890abcdef1234567890abcdef1234567890abcdef12",
+		CreatedBy:    "did:plc:creator",
+		CreatedAt:    time.Now().Add(-8 * 24 * time.Hour),
+		ExpiresAt:    time.Now().Add(-1 * time.Hour),
+	}
+	if err := database.CreateInvite(expired); err != nil {
+		t.Fatalf("CreateInvite expired: %v", err)
+	}
+
+	_, err := ValidateInvite(database, expired.Token, "rkey123")
+	if err == nil {
+		t.Error("expected error for expired token, got nil")
+	}
+}

internal/collaboration/ot.go

···
+package collaboration
+
+import "sync"
+
+type OTEngine struct {
+	mu           sync.Mutex
+	documentText string
+	version      int
+}
+
+func NewOTEngine(initialText string) *OTEngine {
+	return &OTEngine{
+		documentText: initialText,
+		version:      0,
+	}
+}
+
+type Operation struct {
+	From   int    `json:"from"`
+	To     int    `json:"to"`
+	Insert string `json:"insert"`
+	// Author is set by the client and used for logging/debugging purposes
+	// to identify which user performed an operation
+	Author string `json:"author"`
+}
+
+func (ot *OTEngine) Apply(op Operation) string {
+	ot.mu.Lock()
+	defer ot.mu.Unlock()
+
+	newText, _ := ot.applyInternal(op)
+	return newText
+}
+
+func (ot *OTEngine) ApplyWithVersion(op Operation) (string, int) {
+	ot.mu.Lock()
+	defer ot.mu.Unlock()
+
+	newText, changed := ot.applyInternal(op)
+	if !changed {
+		return newText, ot.version
+	}
+	return newText, ot.version
+}
+
+func (ot *OTEngine) applyInternal(op Operation) (string, bool) {
+	if op.From < 0 {
+		op.From = 0
+	}
+	// -1 means "end of document" — treat as a full replacement when From==0.
+	if op.To < 0 {
+		op.To = len(ot.documentText)
+	}
+	if op.From > len(ot.documentText) {
+		op.From = len(ot.documentText)
+	}
+	if op.To > len(ot.documentText) {
+		op.To = len(ot.documentText)
+	}
+	if op.From > op.To {
+		return ot.documentText, false
+	}
+
+	// True no-op: nothing deleted and nothing inserted.
+	if op.From == op.To && op.Insert == "" {
+		return ot.documentText, false
+	}
+
+	newText := ot.documentText[:op.From] + op.Insert + ot.documentText[op.To:]
+	ot.documentText = newText
+	ot.version++
+
+	return newText, true
+}
+
+// SetText replaces the canonical document text without incrementing the version.
+// Call this once when a room is first created, before any edits are applied.
+func (ot *OTEngine) SetText(text string) {
+	ot.mu.Lock()
+	defer ot.mu.Unlock()
+	ot.documentText = text
+}
+
+func (ot *OTEngine) GetText() string {
+	ot.mu.Lock()
+	defer ot.mu.Unlock()
+	return ot.documentText
+}
+
+func (ot *OTEngine) GetVersion() int {
+	ot.mu.Lock()
+	defer ot.mu.Unlock()
+	return ot.version
+}

internal/collaboration/ot_test.go

···
+package collaboration
+
+import (
+	"sync"
+	"testing"
+)
+
+func TestOTEngine_NewEngine(t *testing.T) {
+	ot := NewOTEngine("hello world")
+	if ot.GetText() != "hello world" {
+		t.Errorf("expected initial text %q, got %q", "hello world", ot.GetText())
+	}
+	if ot.GetVersion() != 0 {
+		t.Errorf("expected initial version 0, got %d", ot.GetVersion())
+	}
+}
+
+func TestOTEngine_Apply_Insert(t *testing.T) {
+	ot := NewOTEngine("hello world")
+	result := ot.Apply(Operation{From: 5, To: 5, Insert: " beautiful"})
+	want := "hello beautiful world"
+	if result != want {
+		t.Errorf("Apply insert: got %q, want %q", result, want)
+	}
+}
+
+func TestOTEngine_Apply_Replace(t *testing.T) {
+	ot := NewOTEngine("hello world")
+	result := ot.Apply(Operation{From: 6, To: 11, Insert: "Go"})
+	want := "hello Go"
+	if result != want {
+		t.Errorf("Apply replace: got %q, want %q", result, want)
+	}
+}
+
+func TestOTEngine_Apply_Delete(t *testing.T) {
+	ot := NewOTEngine("hello world")
+	// Delete " world" by replacing with empty string.
+	result := ot.Apply(Operation{From: 5, To: 11, Insert: ""})
+	want := "hello"
+	if result != want {
+		t.Errorf("Apply delete (empty insert): got %q, want %q", result, want)
+	}
+}
+
+func TestOTEngine_Apply_DeleteIncrementsVersion(t *testing.T) {
+	ot := NewOTEngine("hello world")
+	ot.Apply(Operation{From: 5, To: 11, Insert: ""})
+	if ot.GetVersion() != 1 {
+		t.Errorf("delete should increment version: got %d, want 1", ot.GetVersion())
+	}
+}
+
+func TestOTEngine_Apply_EmptyInsertAtSamePosition_IsNoOp(t *testing.T) {
+	ot := NewOTEngine("hello")
+	result := ot.Apply(Operation{From: 3, To: 3, Insert: ""})
+	if result != "hello" {
+		t.Errorf("From==To and Insert==\"\" should be no-op: got %q", result)
+	}
+	if ot.GetVersion() != 0 {
+		t.Errorf("no-op should not increment version: got %d", ot.GetVersion())
+	}
+}
+
+func TestOTEngine_Apply_FullReplace(t *testing.T) {
+	ot := NewOTEngine("old text")
+	result := ot.Apply(Operation{From: 0, To: -1, Insert: "brand new content"})
+	want := "brand new content"
+	if result != want {
+		t.Errorf("Apply full replace (To=-1): got %q, want %q", result, want)
+	}
+}
+
+func TestOTEngine_Apply_FromBeyondEnd_Clamps(t *testing.T) {
+	ot := NewOTEngine("hi")
+	// From beyond length should be clamped to len(text)
+	result := ot.Apply(Operation{From: 100, To: 200, Insert: "!"})
+	want := "hi!"
+	if result != want {
+		t.Errorf("Apply clamped From: got %q, want %q", result, want)
+	}
+}
+
+func TestOTEngine_Apply_NegativeFrom_Clamps(t *testing.T) {
+	ot := NewOTEngine("hello")
+	result := ot.Apply(Operation{From: -5, To: 0, Insert: ">> "})
+	want := ">> hello"
+	if result != want {
+		t.Errorf("Apply negative From: got %q, want %q", result, want)
+	}
+}
+
+func TestOTEngine_Apply_FromGreaterThanTo_NoOp(t *testing.T) {
+	ot := NewOTEngine("hello")
+	result := ot.Apply(Operation{From: 3, To: 1, Insert: "X"})
+	// From > To → no-op
+	if result != "hello" {
+		t.Errorf("Apply From>To should be no-op: got %q, want %q", result, "hello")
+	}
+}
+
+func TestOTEngine_VersionIncrements(t *testing.T) {
+	ot := NewOTEngine("abc")
+	if ot.GetVersion() != 0 {
+		t.Fatalf("initial version should be 0")
+	}
+	ot.Apply(Operation{From: 0, To: 0, Insert: "X"})
+	if ot.GetVersion() != 1 {
+		t.Errorf("version after apply: got %d, want 1", ot.GetVersion())
+	}
+	ot.Apply(Operation{From: 0, To: 0, Insert: "Y"})
+	if ot.GetVersion() != 2 {
+		t.Errorf("version after second apply: got %d, want 2", ot.GetVersion())
+	}
+}
+
+func TestOTEngine_NoOpDoesNotIncrementVersion(t *testing.T) {
+	ot := NewOTEngine("abc")
+	ot.Apply(Operation{From: 1, To: 1, Insert: ""}) // no-op
+	if ot.GetVersion() != 0 {
+		t.Errorf("no-op should not increment version: got %d, want 0", ot.GetVersion())
+	}
+}
+
+func TestOTEngine_ApplyWithVersion(t *testing.T) {
+	ot := NewOTEngine("hello")
+	text, ver := ot.ApplyWithVersion(Operation{From: 5, To: 5, Insert: "!"})
+	if text != "hello!" {
+		t.Errorf("ApplyWithVersion text: got %q, want %q", text, "hello!")
+	}
+	if ver != 1 {
+		t.Errorf("ApplyWithVersion version: got %d, want 1", ver)
+	}
+}
+
+func TestOTEngine_SetText(t *testing.T) {
+	ot := NewOTEngine("")
+	ot.SetText("initial content")
+	if ot.GetText() != "initial content" {
+		t.Errorf("SetText: got %q, want %q", ot.GetText(), "initial content")
+	}
+	// SetText should not change the version counter.
+	if ot.GetVersion() != 0 {
+		t.Errorf("SetText should not increment version: got %d", ot.GetVersion())
+	}
+}
+
+func TestOTEngine_ConcurrentApply_DataRace(t *testing.T) {
+	// Run with -race to catch races. This test just verifies no panic / race.
+	ot := NewOTEngine("start")
+	var wg sync.WaitGroup
+	for i := 0; i < 20; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			ot.Apply(Operation{From: 0, To: 0, Insert: "x"})
+		}()
+	}
+	wg.Wait()
+	// After 20 inserts of "x" at position 0, we have 20 extra chars
+	text := ot.GetText()
+	if len(text) != len("start")+20 {
+		t.Errorf("concurrent apply: expected length %d, got %d (text=%q)", len("start")+20, len(text), text)
+	}
+}

internal/db/db.go

···
 	return err
 }
 
+// --- Invites ---
+
+func (db *DB) CreateInvite(invite *model.Invite) error {
+	_, err := db.Exec(`
+		INSERT INTO invites (id, document_rkey, token, created_by_did, created_at, expires_at)
+		VALUES (?, ?, ?, ?, ?, ?)`,
+		invite.ID, invite.DocumentRKey, invite.Token, invite.CreatedBy, invite.CreatedAt, invite.ExpiresAt)
+	return err
+}
+
+func (db *DB) GetInviteByToken(token string) (*model.Invite, error) {
+	row := db.QueryRow(`SELECT id, document_rkey, token, created_by_did, created_at, expires_at FROM invites WHERE token = ?`, token)
+	var invite model.Invite
+	err := row.Scan(&invite.ID, &invite.DocumentRKey, &invite.Token, &invite.CreatedBy, &invite.CreatedAt, &invite.ExpiresAt)
+	if err != nil {
+		return nil, err
+	}
+	return &invite, nil
+}
+
+func (db *DB) DeleteInvite(token string) error {
+	_, err := db.Exec(`DELETE FROM invites WHERE token = ?`, token)
+	return err
+}

internal/handler/atproto.go

···
 			handle = tokenBody.Sub
 		}
 		did := tokenBody.Sub
+		// Use DID as synthetic email — ATProto users have no email,
+		// but the users table requires a unique non-empty value.
 		user = &model.User{
 			Name:   handle,
+			Email:  did,
 			DID:    &did,
 			PDSURL: pdsURL,
 		}

internal/handler/handler.go

···
 	"html/template"
 	"log"
 	"net/http"
+	"net/url"
 	"regexp"
 	"strings"
 	"time"
 
+	"github.com/golang-jwt/jwt/v5"
+	"github.com/gorilla/websocket"
+
 	"github.com/limeleaf/diffdown/internal/atproto/xrpc"
 	"github.com/limeleaf/diffdown/internal/auth"
+	"github.com/limeleaf/diffdown/internal/collaboration"
 	"github.com/limeleaf/diffdown/internal/db"
 	"github.com/limeleaf/diffdown/internal/model"
 	"github.com/limeleaf/diffdown/internal/render"
···
 const collectionComment = "com.diffdown.comment"
 
 type Handler struct {
-	DB    *db.DB
-	Tmpls map[string]*template.Template
+	DB               *db.DB
+	Tmpls            map[string]*template.Template
+	BaseURL          string
+	CollaborationHub *collaboration.Hub
 }
 
-func New(database *db.DB, tmpls map[string]*template.Template) *Handler {
-	return &Handler{DB: database, Tmpls: tmpls}
+func New(database *db.DB, tmpls map[string]*template.Template, baseURL string, collabHub *collaboration.Hub) *Handler {
+	return &Handler{DB: database, Tmpls: tmpls, BaseURL: baseURL, CollaborationHub: collabHub}
 }
 
 // --- Template helpers ---
···
 	OGImage     string
 }
 
+// DocumentEditData is passed to document_edit.html.
+type DocumentEditData struct {
+	*model.Document
+	// AccessToken is the ATProto access token for WebSocket auth.
+	// Empty string if user has no ATProto session.
+	AccessToken string
+	// IsOwner is true when the current user owns (created) the document.
+	IsOwner bool
+	// IsCollaborator is true when the current user is in the collaborators list.
+	IsCollaborator bool
+	// OwnerDID is the document owner's ATProto DID. Empty when IsOwner is true.
+	// Used by collaborators to route save requests to the owner's PDS.
+	OwnerDID string
+}
+
 func (h *Handler) currentUser(r *http.Request) *model.User {
 	uid := auth.UserIDFromContext(r.Context())
 	if uid == "" {
···
 	}
 }
 
-func (h *Handler) jsonResponse(w http.ResponseWriter, data interface{}) {
+func (h *Handler) jsonResponse(w http.ResponseWriter, data interface{}, statusCode int) {
 	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(statusCode)
 	json.NewEncoder(w).Encode(data)
 }
 
···
 	http.Redirect(w, r, fmt.Sprintf("/docs/%s/edit", rkey), http.StatusSeeOther)
 }
 
-// DocumentView renders a document as HTML.
-func (h *Handler) DocumentView(w http.ResponseWriter, r *http.Request) {
-	user := h.currentUser(r)
-	if user == nil {
-		http.Redirect(w, r, "/auth/atproto", http.StatusSeeOther)
-		return
-	}
-
-	rkey := r.PathValue("rkey")
-	client, err := h.xrpcClient(user.ID)
+// documentView is the shared implementation for viewing a document given an ownerDID and rkey.
+// isOwner should be true when the current user owns the document; it suppresses the ownerDID
+// in the template so the edit button links to /docs/{rkey}/edit rather than the collaborator URL.
+func (h *Handler) documentView(w http.ResponseWriter, r *http.Request, ownerUserID, ownerDID, rkey string, isOwner bool) {
+	client, err := h.xrpcClient(ownerUserID)
 	if err != nil {
 		http.Error(w, "Could not connect to PDS", 500)
 		return
 	}
 
-	value, _, err := client.GetRecord(client.DID(), collectionDocument, rkey)
+	value, _, err := client.GetRecord(ownerDID, collectionDocument, rkey)
 	if err != nil {
 		http.NotFound(w, r)
 		return
···
 		rendered, _ = render.Markdown([]byte(doc.Content.Text.RawMarkdown))
 	}
 
+	user := h.currentUser(r)
 	type DocumentViewData struct {
 		Doc      *model.Document
 		Rendered template.HTML
+		OwnerDID string // non-empty when viewing a collaborator's document
+	}
+	// Only set OwnerDID when the viewer is not the owner; the template uses
+	// a non-empty OwnerDID to generate the collaborator edit URL.
+	templateOwnerDID := ownerDID
+	if isOwner {
+		templateOwnerDID = ""
 	}
 	h.render(w, "document_view.html", PageData{
 		Title:   doc.Title,
 		User:    user,
-		Content: DocumentViewData{Doc: doc, Rendered: template.HTML(rendered)},
+		Content: DocumentViewData{Doc: doc, Rendered: template.HTML(rendered), OwnerDID: templateOwnerDID},
 	})
 }
 
-// DocumentEdit renders the editor for a document.
-func (h *Handler) DocumentEdit(w http.ResponseWriter, r *http.Request) {
+// DocumentView renders a document as HTML (owner viewing their own doc).
+func (h *Handler) DocumentView(w http.ResponseWriter, r *http.Request) {
 	user := h.currentUser(r)
 	if user == nil {
 		http.Redirect(w, r, "/auth/atproto", http.StatusSeeOther)
···
 		http.Error(w, "Could not connect to PDS", 500)
 		return
 	}
+	h.documentView(w, r, user.ID, client.DID(), rkey, true)
+}
 
-	value, _, err := client.GetRecord(client.DID(), collectionDocument, rkey)
+// CollaboratorDocumentView renders a document owned by another user (collaborator access).
+func (h *Handler) CollaboratorDocumentView(w http.ResponseWriter, r *http.Request) {
+	user := h.currentUser(r)
+	if user == nil {
+		http.Redirect(w, r, "/auth/atproto", http.StatusSeeOther)
+		return
+	}
+
+	ownerDID := r.PathValue("did")
+	rkey := r.PathValue("rkey")
+
+	ownerUser, err := h.DB.GetUserByDID(ownerDID)
+	if err != nil {
+		http.NotFound(w, r)
+		return
+	}
+
+	h.documentView(w, r, ownerUser.ID, ownerDID, rkey, false)
+}
+
+// documentEdit is the shared implementation for the edit page.
+// ownerUserID/ownerDID identify whose PDS holds the document; isOwner is true for the creator.
+func (h *Handler) documentEdit(w http.ResponseWriter, r *http.Request, user *model.User, ownerUserID, ownerDID, rkey string, isOwner bool) {
+	ownerClient, err := h.xrpcClient(ownerUserID)
+	if err != nil {
+		http.Error(w, "Could not connect to PDS", 500)
+		return
+	}
+
+	value, _, err := ownerClient.GetRecord(ownerDID, collectionDocument, rkey)
 	if err != nil {
 		http.NotFound(w, r)
 		return
···
 	}
 	doc.RKey = rkey
 
+	editData := &DocumentEditData{Document: doc, IsOwner: isOwner}
+	if !isOwner {
+		editData.OwnerDID = ownerDID
+	}
+	if session, err := h.DB.GetATProtoSession(user.ID); err == nil && session != nil {
+		editData.AccessToken = session.AccessToken
+		userDID := session.DID
+		for _, did := range doc.Collaborators {
+			if did == userDID {
+				editData.IsCollaborator = true
+				break
+			}
+		}
+	}
+
 	h.render(w, "document_edit.html", PageData{
 		Title:   "Edit " + doc.Title,
 		User:    user,
-		Content: doc,
+		Content: editData,
 	})
 }
 
+// DocumentEdit renders the editor for a document (owner).
+func (h *Handler) DocumentEdit(w http.ResponseWriter, r *http.Request) {
+	user := h.currentUser(r)
+	if user == nil {
+		http.Redirect(w, r, "/auth/atproto", http.StatusSeeOther)
+		return
+	}
+
+	rkey := r.PathValue("rkey")
+	client, err := h.xrpcClient(user.ID)
+	if err != nil {
+		http.Error(w, "Could not connect to PDS", 500)
+		return
+	}
+
+	h.documentEdit(w, r, user, user.ID, client.DID(), rkey, true)
+}
+
+// CollaboratorDocumentEdit renders the editor for a document owned by another user.
+func (h *Handler) CollaboratorDocumentEdit(w http.ResponseWriter, r *http.Request) {
+	user := h.currentUser(r)
+	if user == nil {
+		http.Redirect(w, r, "/auth/atproto", http.StatusSeeOther)
+		return
+	}
+
+	ownerDID := r.PathValue("did")
+	rkey := r.PathValue("rkey")
+
+	ownerUser, err := h.DB.GetUserByDID(ownerDID)
+	if err != nil {
+		http.NotFound(w, r)
+		return
+	}
+
+	h.documentEdit(w, r, user, ownerUser.ID, ownerDID, rkey, false)
+}
+
 // APIDocumentSave saves a document to the PDS.
 func (h *Handler) APIDocumentSave(w http.ResponseWriter, r *http.Request) {
 	user := h.currentUser(r)
···
 
 	rkey := r.PathValue("rkey")
 	var req struct {
-		Content string `json:"content"`
-		Title   string `json:"title"`
+		Content  string `json:"content"`
+		Title    string `json:"title"`
+		OwnerDID string `json:"ownerDID"` // non-empty when saving on behalf of another user (collaborator)
 	}
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
 		http.Error(w, "Bad request", 400)
 		return
 	}
 
-	client, err := h.xrpcClient(user.ID)
-	if err != nil {
-		http.Error(w, "Could not connect to PDS", 500)
-		return
+	// For collaborators, save to the document owner's PDS, not the collaborator's.
+	var client *xrpc.Client
+	var repoDID string
+	if req.OwnerDID != "" {
+		ownerUser, err := h.DB.GetUserByDID(req.OwnerDID)
+		if err != nil {
+			log.Printf("APIDocumentSave: get owner by DID %s: %v", req.OwnerDID, err)
+			http.Error(w, "Document owner not found", 404)
+			return
+		}
+		client, err = h.xrpcClient(ownerUser.ID)
+		if err != nil {
+			http.Error(w, "Could not connect to owner PDS", 500)
+			return
+		}
+		repoDID = req.OwnerDID
+	} else {
+		var err error
+		client, err = h.xrpcClient(user.ID)
+		if err != nil {
+			http.Error(w, "Could not connect to PDS", 500)
+			return
+		}
+		repoDID = client.DID()
 	}
 
 	// Fetch existing record to preserve fields
-	value, _, err := client.GetRecord(client.DID(), collectionDocument, rkey)
+	value, _, err := client.GetRecord(repoDID, collectionDocument, rkey)
 	if err != nil {
 		http.Error(w, "Document not found", 404)
 		return
···
 		return
 	}
 
-	h.jsonResponse(w, map[string]string{"status": "ok"})
+	h.jsonResponse(w, map[string]string{"status": "ok"}, http.StatusOK)
 }
 
 // APIDocumentAutoSave is the same as save, called on debounce from editor.
···
 		return
 	}
 
-	h.jsonResponse(w, map[string]string{"status": "ok"})
+	h.jsonResponse(w, map[string]string{"status": "ok"}, http.StatusOK)
+}
+
+// DocumentInvite creates an invite link for a document.
+func (h *Handler) DocumentInvite(w http.ResponseWriter, r *http.Request) {
+	user := h.currentUser(r)
+	if user == nil {
+		http.Redirect(w, r, "/auth/login", http.StatusSeeOther)
+		return
+	}
+
+	rkey := r.PathValue("rkey")
+	if rkey == "" {
+		http.Error(w, "Invalid document", http.StatusBadRequest)
+		return
+	}
+
+	client, err := h.xrpcClient(user.ID)
+	if err != nil {
+		log.Printf("DocumentInvite: xrpc client: %v", err)
+		h.render(w, "document_edit.html", PageData{Error: "Not authenticated with ATProto"})
+		return
+	}
+
+	value, _, err := client.GetRecord(client.DID(), collectionDocument, rkey)
+	if err != nil {
+		http.Error(w, "Document not found", http.StatusNotFound)
+		return
+	}
+
+	doc := &model.Document{}
+	if err := json.Unmarshal(value, doc); err != nil {
+		http.Error(w, "Invalid document", http.StatusInternalServerError)
+		return
+	}
+	doc.RKey = rkey
+
+	// The document was fetched via client.DID(), so the current user is always the owner.
+	if len(doc.Collaborators) >= 5 {
+		http.Error(w, "Maximum collaborators reached", http.StatusBadRequest)
+		return
+	}
+
+	invite, err := collaboration.CreateInvite(h.DB, rkey, client.DID())
+	if err != nil {
+		log.Printf("DocumentInvite: create invite: %v", err)
+		http.Error(w, "Failed to create invite", http.StatusInternalServerError)
+		return
+	}
+
+	inviteLink := fmt.Sprintf("%s/docs/%s/accept?invite=%s", h.BaseURL, rkey, invite.Token)
+	h.jsonResponse(w, map[string]string{"inviteLink": inviteLink}, http.StatusOK)
+}
+
+// AcceptInvite handles an invite acceptance.
+func (h *Handler) AcceptInvite(w http.ResponseWriter, r *http.Request) {
+	user := h.currentUser(r)
+	if user == nil {
+		// Preserve invite token through the login redirect.
+		http.Redirect(w, r, "/auth/login?next="+url.QueryEscape(r.URL.String()), http.StatusSeeOther)
+		return
+	}
+
+	rKey := r.PathValue("rkey")
+	inviteToken := r.URL.Query().Get("invite")
+	if inviteToken == "" {
+		http.Error(w, "Invalid invite", http.StatusBadRequest)
+		return
+	}
+
+	invite, err := collaboration.ValidateInvite(h.DB, inviteToken, rKey)
+	if err != nil {
+		log.Printf("AcceptInvite: validate invite rkey=%s: %v", rKey, err)
+		http.Error(w, "Invite not found, already used, or expired.", http.StatusBadRequest)
+		return
+	}
+
+	// The collaborator's session — needed to get their DID.
+	collabSession, err := h.DB.GetATProtoSession(user.ID)
+	if err != nil || collabSession == nil {
+		http.Redirect(w, r, "/auth/atproto?next="+url.QueryEscape(r.URL.String()), http.StatusSeeOther)
+		return
+	}
+
+	// Fetch and update the document from the OWNER's PDS, not the collaborator's.
+	// The invite records the owner's DID in CreatedBy.
+	ownerUser, err := h.DB.GetUserByDID(invite.CreatedBy)
+	if err != nil {
+		log.Printf("AcceptInvite: get owner by DID %s: %v", invite.CreatedBy, err)
+		http.Error(w, "Document owner not found", http.StatusInternalServerError)
+		return
+	}
+
+	ownerClient, err := h.xrpcClient(ownerUser.ID)
+	if err != nil {
+		log.Printf("AcceptInvite: owner xrpc client: %v", err)
+		http.Error(w, "Failed to connect to ATProto", http.StatusInternalServerError)
+		return
+	}
+
+	doc, err := ownerClient.GetDocument(rKey)
+	if err != nil {
+		log.Printf("AcceptInvite: get document: %v", err)
+		http.Error(w, "Document not found", http.StatusNotFound)
+		return
+	}
+
+	// Already a collaborator — redirect to the owner-scoped URL.
+	for _, c := range doc.Collaborators {
+		if c == collabSession.DID {
+			http.Redirect(w, r, "/docs/"+invite.CreatedBy+"/"+rKey, http.StatusSeeOther)
+			return
+		}
+	}
+
+	// Add collaborator DID and PUT back to owner's PDS.
+	doc.Collaborators = append(doc.Collaborators, collabSession.DID)
+	if _, _, err = ownerClient.PutDocument(rKey, doc); err != nil {
+		log.Printf("AcceptInvite: put document: %v", err)
+		http.Error(w, "Failed to add collaborator", http.StatusInternalServerError)
+		return
+	}
+
+	h.DB.DeleteInvite(invite.Token)
+
+	// Redirect to owner-scoped document URL so the view handler knows whose PDS to query.
+	http.Redirect(w, r, "/docs/"+invite.CreatedBy+"/"+rKey, http.StatusSeeOther)
 }
 
 // --- API: Comments ---
···
 		return
 	}
 
-	client, err := h.xrpcClient(user.ID)
-	if err != nil {
-		log.Printf("CommentCreate: xrpc client: %v", err)
+	session, err := h.DB.GetATProtoSession(user.ID)
+	if err != nil || session == nil {
 		http.Error(w, "Not authenticated with ATProto", http.StatusUnauthorized)
 		return
 	}
 
-	session, err := h.DB.GetATProtoSession(user.ID)
-	if err != nil || session == nil {
-		http.Error(w, "Not authenticated with ATProto", http.StatusUnauthorized)
+	client, err := h.xrpcClient(user.ID)
+	if err != nil {
+		http.Error(w, "Failed to connect to ATProto", http.StatusInternalServerError)
 		return
 	}
 
···
 		DocumentURI: fmt.Sprintf("at://%s/com.diffdown.document/%s", session.DID, rKey),
 		ParagraphID: req.ParagraphID,
 		Text:        req.Text,
-		AuthorDID:   session.DID,
+		Author:      session.DID,
 	}
 
 	uri, err := client.CreateComment(comment)
···
 		return
 	}
 
-	w.WriteHeader(http.StatusCreated)
-	h.jsonResponse(w, map[string]string{"uri": uri})
+	h.jsonResponse(w, map[string]string{"uri": uri}, http.StatusCreated)
 }
 
 func (h *Handler) CommentList(w http.ResponseWriter, r *http.Request) {
···
 		return
 	}
 
+	session, err := h.DB.GetATProtoSession(user.ID)
+	if err != nil || session == nil {
+		http.Error(w, "Not authenticated with ATProto", http.StatusUnauthorized)
+		return
+	}
+
 	client, err := h.xrpcClient(user.ID)
 	if err != nil {
-		log.Printf("CommentList: xrpc client: %v", err)
-		http.Error(w, "Not authenticated with ATProto", http.StatusUnauthorized)
+		http.Error(w, "Failed to connect to ATProto", http.StatusInternalServerError)
 		return
 	}
 
···
 		return
 	}
 
-	w.WriteHeader(http.StatusOK)
-	h.jsonResponse(w, comments)
+	h.jsonResponse(w, comments, http.StatusOK)
 }
 
 // --- API: Render markdown ---
···
 		return
 	}
 
-	h.jsonResponse(w, map[string]string{"html": rendered})
+	h.jsonResponse(w, map[string]string{"html": rendered}, http.StatusOK)
+}
+
+var upgrader = websocket.Upgrader{
+	CheckOrigin: func(r *http.Request) bool { return true },
+}
+
+func (h *Handler) CollaboratorWebSocket(w http.ResponseWriter, r *http.Request) {
+	rKey := r.PathValue("rkey")
+	if rKey == "" {
+		http.Error(w, "Invalid document", http.StatusBadRequest)
+		return
+	}
+
+	accessToken := r.URL.Query().Get("access_token")
+	dpopProof := r.URL.Query().Get("dpop_proof")
+	if accessToken == "" || dpopProof == "" {
+		http.Error(w, "Missing auth tokens", http.StatusUnauthorized)
+		return
+	}
+
+	did, name, err := h.validateWSToken(accessToken, dpopProof)
+	if err != nil {
+		http.Error(w, "Invalid tokens", http.StatusUnauthorized)
+		return
+	}
+
+	user, err := h.DB.GetUserByDID(did)
+	if err != nil {
+		http.Error(w, "No user found", http.StatusUnauthorized)
+		return
+	}
+
+	session, err := h.DB.GetATProtoSession(user.ID)
+	if err != nil || session == nil {
+		http.Error(w, "No ATProto session", http.StatusUnauthorized)
+		return
+	}
+
+	// If owner_did is provided, fetch the document from the owner's PDS
+	// (used by collaborators whose copy lives on a different PDS).
+	ownerDID := r.URL.Query().Get("owner_did")
+	var docClient *xrpc.Client
+	var docRepoDID string
+	if ownerDID != "" {
+		ownerUser, err := h.DB.GetUserByDID(ownerDID)
+		if err != nil {
+			log.Printf("CollaboratorWebSocket: get owner by DID %s: %v", ownerDID, err)
+			http.Error(w, "Document owner not found", http.StatusForbidden)
+			return
+		}
+		docClient, err = h.xrpcClient(ownerUser.ID)
+		if err != nil {
+			http.Error(w, "Failed to connect to owner PDS", http.StatusInternalServerError)
+			return
+		}
+		docRepoDID = ownerDID
+	} else {
+		docClient, err = h.xrpcClient(session.UserID)
+		if err != nil {
+			http.Error(w, "Failed to connect to ATProto", http.StatusInternalServerError)
+			return
+		}
+		docRepoDID = did
+	}
+
+	value, _, err := docClient.GetRecord(docRepoDID, collectionDocument, rKey)
+	if err != nil {
+		http.Error(w, "Document not found", http.StatusNotFound)
+		return
+	}
+	doc := &model.Document{}
+	if err := json.Unmarshal(value, doc); err != nil {
+		http.Error(w, "Invalid document", http.StatusInternalServerError)
+		return
+	}
+
+	// Owner always has access; collaborators must be in the collaborators list.
+	isCollaborator := did == docRepoDID
+	for _, c := range doc.Collaborators {
+		if c == did {
+			isCollaborator = true
+			break
+		}
+	}
+	if !isCollaborator {
+		http.Error(w, "Not a collaborator", http.StatusForbidden)
+		return
+	}
+
+	color := colorFromDID(did)
+
+	conn, err := upgrader.Upgrade(w, r, nil)
+	if err != nil {
+		log.Printf("WebSocket upgrade failed: %v", err)
+		return
+	}
+
+	room := h.CollaborationHub.GetOrCreateRoom(rKey)
+	if room.IsNewRoom() {
+		var initialText string
+		if doc.Content != nil {
+			initialText = doc.Content.Text.RawMarkdown
+		}
+		room.SeedText(initialText)
+	}
+	wsClient := collaboration.NewClient(h.CollaborationHub, conn, did, name, color, rKey)
+	room.RegisterClient(wsClient)
+
+	go wsClient.WritePump()
+	wsClient.ReadPump()
+}
+
+func (h *Handler) validateWSToken(accessToken, dpopProof string) (string, string, error) {
+	claims := &jwt.MapClaims{}
+	parser := jwt.Parser{}
+	_, _, err := parser.ParseUnverified(accessToken, claims)
+	if err != nil {
+		return "", "", fmt.Errorf("parse token: %w", err)
+	}
+
+	did, ok := (*claims)["sub"].(string)
+	if !ok {
+		return "", "", fmt.Errorf("no sub in token")
+	}
+
+	user, err := h.DB.GetUserByDID(did)
+	if err != nil {
+		return "", "", fmt.Errorf("user not found: %w", err)
+	}
+
+	session, err := h.DB.GetATProtoSession(user.ID)
+	if err != nil {
+		return "", "", fmt.Errorf("session not found: %w", err)
+	}
+
+	if time.Now().After(session.ExpiresAt) {
+		return "", "", fmt.Errorf("session expired")
+	}
+
+	name, _ := (*claims)["name"].(string)
+	return did, name, nil
+}
+
+func colorFromDID(did string) string {
+	colors := []string{"#e74c3c", "#3498db", "#2ecc71", "#9b59b6", "#f39c12"}
+	hash := 0
+	for _, c := range did {
+		hash += int(c)
+	}
+	return colors[hash%len(colors)]
 }

internal/model/models.go

···
 	CID  string `json:"cid,omitempty"`
 	RKey string `json:"rkey,omitempty"`
 	// Document fields
-	Title       string           `json:"title"`
-	Content     *MarkdownContent `json:"content,omitempty"`
-	TextContent string           `json:"textContent,omitempty"`
-	CreatedAt   string           `json:"createdAt"`
-	UpdatedAt   string           `json:"updatedAt,omitempty"`
+	Title         string           `json:"title"`
+	Content       *MarkdownContent `json:"content,omitempty"`
+	TextContent   string           `json:"textContent,omitempty"`
+	Collaborators []string         `json:"collaborators,omitempty"`
+	CreatedAt     string           `json:"createdAt"`
+	UpdatedAt     string           `json:"updatedAt,omitempty"`
 }
 
 type MarkdownContent struct {
···
 	RawMarkdown string `json:"rawMarkdown"`
 }
 
+type Invite struct {
+	ID           string    `json:"id"`
+	DocumentRKey string    `json:"document_rkey"`
+	Token        string    `json:"token"`
+	CreatedBy    string    `json:"created_by"`
+	CreatedAt    time.Time `json:"created_at"`
+	ExpiresAt    time.Time `json:"expires_at"`
+}
+
 type Comment struct {
-	URI         string `json:"uri,omitempty"`
-	DocumentURI string `json:"documentUri"`
-	ParagraphID string `json:"paragraphId"`
-	Text        string `json:"text"`
-	AuthorDID   string `json:"authorDid"`
-	CreatedAt   string `json:"createdAt,omitempty"`
+	URI         string    `json:"uri"`
+	DocumentURI string    `json:"documentURI"`
+	ParagraphID string    `json:"paragraphId"`
+	Text        string    `json:"text"`
+	Author      string    `json:"author"`
+	AuthorName  string    `json:"authorName"`
+	CreatedAt   time.Time `json:"createdAt"`
 }
 
 // RKeyFromURI extracts the rkey (last path segment) from an at:// URI.

migrations/005_create_invites.sql

···
+-- 005_create_invites.sql
+
+CREATE TABLE IF NOT EXISTS invites (
+    id TEXT PRIMARY KEY,
+    document_rkey TEXT NOT NULL,
+    token TEXT NOT NULL UNIQUE,
+    created_by_did TEXT NOT NULL,
+    created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
+    expires_at DATETIME NOT NULL
+);
+
+CREATE INDEX IF NOT EXISTS idx_invites_document ON invites(document_rkey);
+CREATE INDEX IF NOT EXISTS idx_invites_token ON invites(token);

static/css/editor.css

···
 }
 
 .link-tooltip button:hover { opacity: 0.8; }
+
+/* ── Collaboration: Presence ─────────────────────────────────────────────── */
+
+.presence-list {
+    display: flex;
+    align-items: center;
+    gap: 4px;
+}
+
+.presence-avatar {
+    display: inline-block;
+    width: 22px;
+    height: 22px;
+    border-radius: 50%;
+    border: 2px solid var(--bg-card);
+    box-shadow: 0 0 0 1px var(--border);
+    flex-shrink: 0;
+    transition: transform 0.15s;
+}
+
+.presence-avatar:hover {
+    transform: scale(1.15);
+}
+
+/* ── Collaboration: Comment sidebar ──────────────────────────────────────── */
+
+.comment-sidebar {
+    position: fixed;
+    right: 0;
+    top: 49px; /* below navbar */
+    bottom: 0;
+    width: 260px;
+    background: var(--bg-card);
+    border-left: 1px solid var(--border);
+    display: flex;
+    flex-direction: column;
+    z-index: 50;
+    overflow: hidden;
+}
+
+.comment-sidebar-header {
+    padding: 0.75rem 1rem;
+    font-size: 0.85rem;
+    font-weight: 600;
+    border-bottom: 1px solid var(--border);
+    flex-shrink: 0;
+    color: var(--text-muted);
+    text-transform: uppercase;
+    letter-spacing: 0.05em;
+}
+
+.comment-threads {
+    flex: 1;
+    overflow-y: auto;
+    padding: 0.75rem;
+    display: flex;
+    flex-direction: column;
+    gap: 0.75rem;
+}
+
+.comment-empty {
+    color: var(--text-muted);
+    font-size: 0.85rem;
+    text-align: center;
+    margin-top: 2rem;
+}
+
+.comment-thread {
+    background: var(--bg);
+    border: 1px solid var(--border);
+    border-radius: var(--radius);
+    overflow: hidden;
+}
+
+.comment-thread-label {
+    font-size: 0.75rem;
+    color: var(--text-muted);
+    padding: 0.3rem 0.6rem;
+    background: var(--border);
+    border-bottom: 1px solid var(--border);
+}
+
+.comment-item {
+    padding: 0.5rem 0.6rem;
+    border-top: 1px solid var(--border);
+}
+
+.comment-item:first-of-type {
+    border-top: none;
+}
+
+.comment-author {
+    font-size: 0.75rem;
+    font-weight: 600;
+    color: var(--primary);
+    margin-bottom: 0.2rem;
+}
+
+.comment-text {
+    font-size: 0.85rem;
+    line-height: 1.45;
+    word-break: break-word;
+}
+
+.comment-time {
+    font-size: 0.7rem;
+    color: var(--text-muted);
+    margin-top: 0.25rem;
+}
+
+/* ── Collaboration: Comment button & form ────────────────────────────────── */
+
+.comment-btn {
+    position: fixed;
+    z-index: 100;
+    padding: 0.25rem 0.6rem;
+    font-size: 0.78rem;
+    background: var(--primary);
+    color: #fff;
+    border: none;
+    border-radius: var(--radius);
+    cursor: pointer;
+    box-shadow: 0 2px 8px rgba(0,0,0,0.15);
+}
+
+.comment-btn:hover {
+    opacity: 0.88;
+}
+
+.comment-form {
+    position: fixed;
+    z-index: 110;
+    background: var(--bg-card);
+    border: 1px solid var(--border);
+    border-radius: var(--radius);
+    box-shadow: 0 4px 20px rgba(0,0,0,0.15);
+    padding: 0.75rem;
+    width: 280px;
+}
+
+.comment-form textarea {
+    width: 100%;
+    box-sizing: border-box;
+    background: var(--bg);
+    border: 1px solid var(--border);
+    border-radius: var(--radius);
+    color: var(--text);
+    padding: 0.4rem 0.5rem;
+    font-size: 0.85rem;
+    resize: vertical;
+    outline: none;
+    font-family: inherit;
+}
+
+.comment-form textarea:focus {
+    border-color: var(--primary);
+}
+
+.comment-form-actions {
+    display: flex;
+    gap: 0.5rem;
+    margin-top: 0.5rem;
+    justify-content: flex-end;
+}
+
+/* When comment sidebar is visible, shrink editor to avoid overlap */
+.editor-page:has(~ .comment-sidebar) {
+    right: 260px;
+}
+
+/* ── Collaboration: Invite modal ─────────────────────────────────────────── */
+
+.invite-modal {
+    position: fixed;
+    inset: 0;
+    background: rgba(0,0,0,0.4);
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    z-index: 200;
+}
+
+.invite-modal-box {
+    background: var(--bg-card);
+    border: 1px solid var(--border);
+    border-radius: var(--radius);
+    box-shadow: 0 8px 32px rgba(0,0,0,0.2);
+    width: 440px;
+    max-width: calc(100vw - 2rem);
+}
+
+.invite-modal-header {
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+    padding: 0.75rem 1rem;
+    border-bottom: 1px solid var(--border);
+    font-weight: 600;
+    font-size: 0.9rem;
+}
+
+.invite-modal-close {
+    background: none;
+    border: none;
+    color: var(--text-muted);
+    cursor: pointer;
+    font-size: 1rem;
+    padding: 0.1rem 0.3rem;
+    line-height: 1;
+}
+
+.invite-modal-close:hover {
+    color: var(--text);
+}
+
+.invite-modal-body {
+    padding: 1rem;
+}

static/vendor/editor.js

···
 ]);
 var oneDark = [oneDarkTheme, /* @__PURE__ */ syntaxHighlighting(oneDarkHighlightStyle)];
 export {
+  Annotation,
   Compartment,
   EditorView,
   basicSetup,

templates/base.html

···
 <body>
     <nav class="navbar">
         <a href="/" class="logo">
-            <img src="/static/img/logo-document.svg" alt="" width="22" height="28" style="vertical-align:middle;margin-right:0.4rem">Diffdown
+            <img src="/static/img/dd-logo.svg" alt="" width="22" height="28" style="vertical-align:middle;margin-right:0.4rem">Diffdown
         </a>
         <div class="nav-right">
             {{if .User}}

templates/document_edit.html

···
             <input type="text" id="doc-title" value="{{.Title}}" placeholder="Document title" class="title-input">
         </div>
         <div class="toolbar-actions">
+            {{if .IsCollaborator}}
+            <div id="presence-list" class="presence-list" title="Active collaborators"></div>
+            {{end}}
+            {{if .IsOwner}}
+            <button class="btn btn-sm btn-outline" id="btn-share" onclick="generateInvite()">Share</button>
+            {{end}}
             <button class="btn btn-sm btn-outline source-only active" id="btn-preview" onclick="togglePreview()">Preview</button>
             <button class="btn btn-sm btn-outline source-only" id="btn-wrap" onclick="toggleWrap()">Wrap</button>
             <button class="btn btn-sm btn-outline rich-only" id="btn-undo" onclick="richUndo()" title="Undo (⌘Z)">↩</button>
···
     <!-- Rich text editor (default) -->
     <div id="editor-rich" class="editor-rich"></div>
 
+    <!-- Comment button (shown on paragraph hover/selection) -->
+    <button id="comment-btn" class="comment-btn" style="display:none" onclick="openCommentForm()">Comment</button>
+
+    <!-- Comment form (floating) -->
+    <div id="comment-form" class="comment-form" style="display:none">
+        <textarea id="comment-text" placeholder="Add a comment..." rows="3"></textarea>
+        <div class="comment-form-actions">
+            <button class="btn btn-sm" onclick="submitComment()">Post</button>
+            <button class="btn btn-sm btn-outline" onclick="closeCommentForm()">Cancel</button>
+        </div>
+    </div>
+
     <!-- Link editing tooltip -->
     <div id="link-tooltip" class="link-tooltip">
         <input type="url" id="link-tooltip-input" placeholder="https://" spellcheck="false">
···
         </div>
     </div>
 </div>
+
+<!-- Invite modal -->
+{{if .IsOwner}}
+<div id="invite-modal" class="invite-modal" style="display:none">
+    <div class="invite-modal-box">
+        <div class="invite-modal-header">
+            <span>Share document</span>
+            <button class="invite-modal-close" onclick="closeInviteModal()">✕</button>
+        </div>
+        <div id="invite-modal-body" class="invite-modal-body">
+            <p>Generating invite link...</p>
+        </div>
+    </div>
+</div>
+{{end}}
+
+<!-- Comment sidebar -->
+{{if .IsCollaborator}}
+<div id="comment-sidebar" class="comment-sidebar">
+    <div class="comment-sidebar-header">Comments</div>
+    <div id="comment-threads" class="comment-threads"></div>
+</div>
+{{end}}
 {{end}}
 {{end}}
 
 {{define "scripts"}}
 <script type="module">
-    import {EditorView, basicSetup, markdown, oneDark, Compartment} from '/static/vendor/editor.js';
+    import {EditorView, basicSetup, markdown, oneDark, Compartment, Annotation} from '/static/vendor/editor.js';
     import {
         Editor, rootCtx, defaultValueCtx, editorViewCtx, serializerCtx,
         commonmark,
···
     const saveStatus = document.getElementById('save-status');
     const titleInput = document.getElementById('doc-title');
     const rkey = '{{.Content.RKey}}';
+    const accessToken = '{{.Content.AccessToken}}';
+    const isCollaborator = {{if .Content.IsCollaborator}}true{{else}}false{{end}};
+    const ownerDID = '{{.Content.OwnerDID}}'; // empty string when current user is owner
 
     const STORAGE_KEY = 'editor-mode';
     let currentMode = localStorage.getItem(STORAGE_KEY) || 'rich'; // 'rich' | 'source'
 
     let autoSaveTimer = null;
+
+    // Annotation to tag dispatches that originate from remote edits,
+    // so the update listener can skip re-broadcasting them.
+    const remoteEditAnnotation = Annotation.define();
 
     // ── Shared helpers ────────────────────────────────────────────────────────
 
···
                 await fetch(`/api/docs/${rkey}/autosave`, {
                     method: 'PUT',
                     headers: {'Content-Type': 'application/json'},
-                    body: JSON.stringify({content, title: titleInput.value}),
+                    body: JSON.stringify({content, title: titleInput.value, ownerDID}),
                 });
                 saveStatus.textContent = 'Auto-saved';
                 saveStatus.className = 'status-saved';
···
             wrapCompartment.of([]),
             EditorView.updateListener.of((update) => {
                 if (update.docChanged && currentMode === 'source') {
-                    updatePreview(update.state.doc.toString());
-                    scheduleAutoSave(update.state.doc.toString());
+                    const content = update.state.doc.toString();
+                    updatePreview(content);
+                    if (!update.transactions.some(tr => tr.annotation(remoteEditAnnotation))) {
+                        scheduleAutoSave(content);
+                        // Extract granular deltas from the ChangeSet.
+                        // fromA/toA are positions in the OLD document (pre-change),
+                        // which is what the server's OT engine needs.
+                        const deltas = [];
+                        update.changes.iterChanges((fromA, toA, _fromB, _toB, inserted) => {
+                            deltas.push({ from: fromA, to: toA, insert: inserted.toString() });
+                        });
+                        if (deltas.length > 0) {
+                            queueDeltas(deltas);
+                        }
+                    }
                 }
             }),
         ],
···
             .use(listener)
             .config((ctx) => {
                 ctx.get(listenerCtx).markdownUpdated((_ctx, markdown, prevMarkdown) => {
-                    if (markdown !== prevMarkdown) {
+                    if (markdown !== prevMarkdown && !applyingRemote) {
                         scheduleAutoSave(markdown);
+                        const ops = diffToOps(prevMarkdown || '', markdown);
+                        if (ops.length > 0) {
+                            queueDeltas(ops);
+                        }
                     }
                 });
             })
···
             const resp = await fetch(`/api/docs/${rkey}/save`, {
                 method: 'POST',
                 headers: {'Content-Type': 'application/json'},
-                body: JSON.stringify({content, title: titleInput.value}),
+                body: JSON.stringify({content, title: titleInput.value, ownerDID}),
             });
             if (resp.ok) {
                 saveStatus.textContent = 'Saved!';
···
         }
     });
 
+    // ── Invite ────────────────────────────────────────────────────────────────
+
+    window.generateInvite = async function generateInvite() {
+        const modal = document.getElementById('invite-modal');
+        const body = document.getElementById('invite-modal-body');
+        if (!modal) return;
+        body.innerHTML = '<p>Generating invite link...</p>';
+        modal.style.display = 'flex';
+
+        try {
+            const resp = await fetch(`/api/docs/${rkey}/invite`, { method: 'POST' });
+            const data = await resp.json();
+            if (!resp.ok) throw new Error(data.error || resp.statusText);
+            const link = data.invite_url || data.inviteLink || data.url || '';
+            body.innerHTML = `
+                <p style="margin:0 0 0.5rem;font-size:0.85rem;color:var(--text-muted)">
+                    Share this link. It expires in 7 days and can be used once.
+                </p>
+                <div style="display:flex;gap:0.5rem;align-items:center">
+                    <input id="invite-link-input" type="text" value="${escHtml(link)}" readonly
+                        style="flex:1;background:var(--bg);border:1px solid var(--border);border-radius:var(--radius);
+                               padding:0.4rem 0.5rem;font-size:0.85rem;color:var(--text);outline:none">
+                    <button class="btn btn-sm" onclick="copyInviteLink()">Copy</button>
+                </div>
+                <p id="invite-copy-msg" style="margin:0.4rem 0 0;font-size:0.8rem;color:var(--primary);display:none">Copied!</p>
+            `;
+        } catch (e) {
+            body.innerHTML = `<p style="color:var(--danger)">Failed to generate invite: ${escHtml(e.message)}</p>`;
+        }
+    }
+
+    window.copyInviteLink = function copyInviteLink() {
+        const input = document.getElementById('invite-link-input');
+        if (!input) return;
+        navigator.clipboard.writeText(input.value).then(() => {
+            const msg = document.getElementById('invite-copy-msg');
+            if (msg) { msg.style.display = 'block'; setTimeout(() => msg.style.display = 'none', 2000); }
+        });
+    }
+
+    window.closeInviteModal = function closeInviteModal() {
+        const modal = document.getElementById('invite-modal');
+        if (modal) modal.style.display = 'none';
+    }
+
+    // Close invite modal on backdrop click
+    document.getElementById('invite-modal')?.addEventListener('click', e => {
+        if (e.target === document.getElementById('invite-modal')) closeInviteModal();
+    });
+
+    // ── WebSocket / Collaboration ─────────────────────────────────────────────
+
+    let ws = null;
+    let wsReconnectDelay = 1000;
+    let wsReconnectTimer = null;
+    let wsPingTimer = null;
+    let wsMissedPings = 0;
+
+    function connectWebSocket() {
+        if (!accessToken) return;
+
+        const protocol = window.location.protocol === 'https:' ? 'wss:' : 'ws:';
+        const ownerParam = ownerDID ? `&owner_did=${encodeURIComponent(ownerDID)}` : '';
+        const wsUrl = `${protocol}//${window.location.host}/ws/docs/${rkey}?access_token=${encodeURIComponent(accessToken)}&dpop_proof=placeholder${ownerParam}`;
+
+        ws = new WebSocket(wsUrl);
+
+        ws.onopen = () => {
+            wsReconnectDelay = 1000;
+            wsMissedPings = 0;
+            startHeartbeat();
+        };
+
+        ws.onmessage = (event) => {
+            try {
+                const msg = JSON.parse(event.data);
+                handleWSMessage(msg);
+            } catch (e) {
+                console.error('WS parse error:', e);
+            }
+        };
+
+        ws.onclose = () => {
+            clearTimeout(wsEditTimer);
+            pendingDeltas = [];
+            stopHeartbeat();
+            ws = null;
+            updatePresence([]);
+            scheduleReconnect();
+        };
+
+        ws.onerror = () => {
+            closeWS();
+        };
+    }
+
+    function scheduleReconnect() {
+        clearTimeout(wsReconnectTimer);
+        wsReconnectTimer = setTimeout(() => {
+            connectWebSocket();
+            wsReconnectDelay = Math.min(wsReconnectDelay * 2, 30000);
+        }, wsReconnectDelay);
+    }
+
+    function startHeartbeat() {
+        stopHeartbeat();
+        wsPingTimer = setInterval(() => {
+            if (ws && ws.readyState === WebSocket.OPEN) {
+                ws.send(JSON.stringify({ type: 'ping' }));
+                wsMissedPings++;
+                if (wsMissedPings >= 3) {
+                    closeWS();
+                }
+            }
+        }, 30000);
+    }
+
+    function stopHeartbeat() {
+        clearInterval(wsPingTimer);
+    }
+
+    // Guard against applying a remote edit while we're already applying one
+    // (prevents echo loops).
+    let applyingRemote = false;
+
+    function handleWSMessage(msg) {
+        switch (msg.type) {
+            case 'presence':
+                updatePresence(msg.users || []);
+                break;
+            case 'pong':
+                wsMissedPings = 0;
+                break;
+            case 'edit':
+                applyRemoteEdit(msg);   // pass full message object
+                break;
+            case 'sync':
+                applyRemoteEdit(msg.content);  // sync is always full-content string
+                break;
+        }
+    }
+
+    function applyRemoteEdit(msg) {
+        // msg may be a full-content string (legacy sync path) or an object with content.
+        if (applyingRemote) return;
+        applyingRemote = true;
+        try {
+            // Always use the server's authoritative content echo for applying remote edits.
+            // Attempting to apply deltas directly is unreliable because the positions in
+            // the delta batch are relative to the sender's pre-change document, not the
+            // receiver's current state (which may have diverged).
+            const content = typeof msg === 'string' ? msg : msg.content;
+            if (!content) return;
+
+            if (currentMode === 'source' && cmView) {
+                if (cmView.state.doc.toString() !== content) {
+                    cmView.dispatch({
+                        changes: { from: 0, to: cmView.state.doc.length, insert: content },
+                        annotations: [remoteEditAnnotation.of(true)],
+                    });
+                }
+                updatePreview(content);
+            } else if (currentMode === 'rich' && milkdownEditor) {
+                createMilkdownEditor(content);
+            }
+        } finally {
+            applyingRemote = false;
+        }
+    }
+
+    // Debounce timer for WebSocket sends (50ms batches rapid keystrokes).
+    let wsEditTimer = null;
+    let pendingDeltas = [];
+
+    /**
+     * Compute the minimal edit operations to transform `oldStr` into `newStr`.
+     * Returns an array of {from, to, insert} suitable for the OT engine.
+     *
+     * Uses a line-level diff for performance, then falls back to a single
+     * full-replacement op if the diff produces more than 20 operations
+     * (pathological case — not worth the complexity).
+     */
+    function diffToOps(oldStr, newStr) {
+        if (oldStr === newStr) return [];
+
+        const oldLines = oldStr.split('\n');
+        const newLines = newStr.split('\n');
+
+        const m = oldLines.length, n = newLines.length;
+        const dp = Array.from({length: m + 1}, () => new Array(n + 1).fill(0));
+        for (let i = m - 1; i >= 0; i--) {
+            for (let j = n - 1; j >= 0; j--) {
+                dp[i][j] = oldLines[i] === newLines[j]
+                    ? dp[i+1][j+1] + 1
+                    : Math.max(dp[i+1][j], dp[i][j+1]);
+            }
+        }
+
+        // Line length in old string. Last line has no trailing \n.
+        const oldLineLengths = oldLines.map((l, idx) =>
+            l.length + (idx < oldLines.length - 1 ? 1 : 0));
+
+        const ops = [];
+        let i = 0, j = 0, charOffset = 0;
+
+        while (i < m || j < n) {
+            if (i < m && j < n && oldLines[i] === newLines[j]) {
+                // Matching line — advance past it.
+                charOffset += oldLineLengths[i];
+                i++; j++;
+            } else {
+                // Non-matching run: collect all consecutive deletions and
+                // insertions into a single replace op so positions stay consistent.
+                const hunkFrom = charOffset;
+                let hunkTo = charOffset;
+                let hunkInsert = '';
+
+                while (i < m && (j >= n || dp[i][j] === dp[i+1][j])) {
+                    hunkTo += oldLineLengths[i];
+                    charOffset += oldLineLengths[i];
+                    i++;
+                }
+                while (j < n && (i >= m || dp[i][j] === dp[i][j+1])) {
+                    hunkInsert += newLines[j] + (j < newLines.length - 1 || hunkTo > hunkFrom ? '\n' : '');
+                    j++;
+                }
+
+                // Only emit if something actually changed.
+                if (hunkTo > hunkFrom || hunkInsert !== '') {
+                    ops.push({ from: hunkFrom, to: hunkTo, insert: hunkInsert });
+                }
+            }
+        }
+
+        if (ops.length > 20) return [{ from: 0, to: -1, insert: newStr }];
+        return ops;
+    }
+
+    // Queue a set of deltas and flush after a short debounce.
+    function queueDeltas(deltas) {
+        if (!ws || ws.readyState !== WebSocket.OPEN) return;
+        pendingDeltas = pendingDeltas.concat(deltas);
+        clearTimeout(wsEditTimer);
+        wsEditTimer = setTimeout(flushDeltas, 50);
+    }
+
+    function flushDeltas() {
+        if (!ws || ws.readyState !== WebSocket.OPEN || pendingDeltas.length === 0) {
+            pendingDeltas = [];
+            return;
+        }
+        ws.send(JSON.stringify({ type: 'edit', deltas: pendingDeltas }));
+        pendingDeltas = [];
+    }
+
+    function closeWS() {
+        if (!ws) return;
+        clearTimeout(wsEditTimer);
+        flushDeltas();   // send any buffered deltas before closing
+        ws.close();
+        ws = null;
+        stopHeartbeat();
+    }
+
+    // sendEdit sends a full-document replacement via the granular-delta path.
+    // to: -1 is a sentinel meaning "end of document" — the server OT engine
+    // clamps it to len(documentText), and applyRemoteEdit clamps it to docLen.
+    // Milkdown switches to diffToOps in Chunk 4 and no longer calls this directly.
+    function sendEdit(content) {
+        if (!ws || ws.readyState !== WebSocket.OPEN) return;
+        queueDeltas([{ from: 0, to: -1, insert: content }]);
+    }
+
+    // ── Presence ──────────────────────────────────────────────────────────────
+
+    function updatePresence(users) {
+        const list = document.getElementById('presence-list');
+        if (!list) return;
+        list.innerHTML = users.map(u => `
+            <span class="presence-avatar" style="background:${u.color}" title="${escHtml(u.name || u.did)}"></span>
+        `).join('');
+    }
+
+    function escHtml(str) {
+        return String(str).replace(/[&<>"']/g, c => ({'&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;',"'":'&#39;'}[c]));
+    }
+
+    // ── Comments ──────────────────────────────────────────────────────────────
+
+    let activeCommentParagraphId = null;
+
+    const commentBtn = document.getElementById('comment-btn');
+    const commentForm = document.getElementById('comment-form');
+    const commentTextEl = document.getElementById('comment-text');
+
+    window.openCommentForm = function openCommentForm() {
+        if (!commentBtn || !commentForm) return;
+        const rect = commentBtn.getBoundingClientRect();
+        commentForm.style.top = rect.bottom + window.scrollY + 4 + 'px';
+        commentForm.style.left = Math.max(8, rect.left) + 'px';
+        commentForm.style.display = 'block';
+        commentTextEl.value = '';
+        commentTextEl.focus();
+    }
+
+    window.closeCommentForm = function closeCommentForm() {
+        if (commentForm) commentForm.style.display = 'none';
+        if (commentBtn) commentBtn.style.display = 'none';
+        activeCommentParagraphId = null;
+    }
+
+    window.submitComment = async function submitComment() {
+        if (!activeCommentParagraphId) return;
+        const text = commentTextEl.value.trim();
+        if (!text) return;
+
+        try {
+            const resp = await fetch(`/api/docs/${rkey}/comments`, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ paragraphId: activeCommentParagraphId, text }),
+            });
+            if (!resp.ok) throw new Error(await resp.text());
+            closeCommentForm();
+            loadComments();
+        } catch (e) {
+            console.error('Comment post failed:', e);
+        }
+    }
+
+    commentTextEl && commentTextEl.addEventListener('keydown', e => {
+        if (e.key === 'Enter' && (e.metaKey || e.ctrlKey)) submitComment();
+        if (e.key === 'Escape') closeCommentForm();
+    });
+
+    // Close comment form on outside click
+    document.addEventListener('click', e => {
+        if (commentForm && commentForm.style.display !== 'none') {
+            if (!commentForm.contains(e.target) && e.target !== commentBtn) {
+                closeCommentForm();
+            }
+        }
+    });
+
+    function renderCommentThreads(comments) {
+        const container = document.getElementById('comment-threads');
+        if (!container) return;
+
+        if (!comments || comments.length === 0) {
+            container.innerHTML = '<p class="comment-empty">No comments yet.</p>';
+            return;
+        }
+
+        // Group by paragraphId
+        const byParagraph = {};
+        for (const c of comments) {
+            const pid = c.paragraphId || 'general';
+            if (!byParagraph[pid]) byParagraph[pid] = [];
+            byParagraph[pid].push(c);
+        }
+
+        container.innerHTML = Object.entries(byParagraph).map(([pid, thread]) => `
+            <div class="comment-thread" data-paragraph="${escHtml(pid)}">
+                <div class="comment-thread-label">¶ ${escHtml(pid)}</div>
+                ${thread.map(c => `
+                    <div class="comment-item">
+                        <div class="comment-author">${escHtml(c.authorName || c.author)}</div>
+                        <div class="comment-text">${escHtml(c.text)}</div>
+                        <div class="comment-time">${formatTime(c.createdAt)}</div>
+                    </div>
+                `).join('')}
+            </div>
+        `).join('');
+    }
+
+    function formatTime(ts) {
+        if (!ts) return '';
+        try { return new Date(ts).toLocaleString(); } catch { return ts; }
+    }
+
+    async function loadComments() {
+        if (!accessToken) return;
+        try {
+            const resp = await fetch(`/api/docs/${rkey}/comments`);
+            if (!resp.ok) return;
+            const comments = await resp.json();
+            renderCommentThreads(comments);
+        } catch (e) {
+            console.error('Load comments failed:', e);
+        }
+    }
+
     // ── Init ──────────────────────────────────────────────────────────────────
 
     const initialMarkdown = textarea.value;
···
     }
 
     applyMode(currentMode);
+
+    // Start collaboration features (both owner and collaborators join the WS room)
+    if (accessToken) {
+        connectWebSocket();
+        loadComments();
+    }
+
+    window.addEventListener('beforeunload', () => {
+        clearTimeout(wsEditTimer);
+        flushDeltas();
+    });
 </script>
 {{end}}

templates/document_view.html

···
             {{else if .Doc.CreatedAt}}<time>Created {{.Doc.CreatedAt | fmtdate}}</time>{{end}}
         </div>
         <div class="file-actions">
+            {{if .OwnerDID}}
+            <a href="/docs/{{.OwnerDID}}/{{.Doc.RKey}}/edit" class="btn btn-sm">Edit</a>
+            {{else}}
             <a href="/docs/{{.Doc.RKey}}/edit" class="btn btn-sm">Edit</a>
             <button class="btn btn-sm btn-outline btn-danger" onclick="deleteDocument('{{.Doc.RKey}}')">Delete</button>
+            {{end}}
         </div>
     </div>
     <div class="markdown-body">

templates/landing.html

···
 {{define "content"}}
 <div class="landing">
     <h1>Collaborative Markdown Editing</h1>
-    <p>Write, review, and collaborate on Markdown documents with your team. Uh, eventually. Right now, you can only write and edit solo documents.</p>
-    <p><strong>Note:</strong> This app is a toy I built to learn <a href="https://atproto.com/">AT Protocol</a>, lexicons, and <a href="https://claude.com/">Claude Code</a>. It is not meant for actual use. Any documents you create will be visible to anyone with the URL and may be deleted at any time.</p>
+    <p>Write, review, and collaborate on Markdown documents with your team in <a href="https://www.bskyinfo.com/glossary/atmosphere/">the ATmosphere</a>.</p>
+    <p><strong>Note:</strong> This app is a toy I built to learn <a href="https://atproto.com/">AT Protocol</a>, lexicons, and <a href="https://agentic-coding.github.io/">agentic coding</a>. It is not meant for actual use. Any documents you create will be visible to anyone with the URL and may be deleted at any time.</p>
     <div class="landing-actions">
         <a href="/auth/register" class="btn btn-lg">Get Started</a>
         <a href="/auth/login" class="btn btn-lg btn-outline">Log In</a>