fix(sync): fan out the server's stamp with a commit; keep the author's doc, cursor and history consistent

[joepio]

What broke

Live collaboration stopped for the author of a document once a collaborator edited it. The server stamps lastCommit on the resource after applying a commit; Resource::set_unsafe is doc-first, so the stamp is a Loro op under the server's own peer. The websocket fan-out forwarded only commit.loro_update and skipped the author's connection, so no live subscriber ever got the stamp. A collaborator who loaded the stored snapshot built the next edit on top of it; the author parked that edit as pending and every later delta parked behind it. recoverFromIncompleteImport then refetched a snapshot and replaced the doc under loro-prosemirror, which threw Unreachable code from its cursor mapping.

This is the "ephemeral cursor" spec that has been red on CI since 2026-09-02, and locally documents › create document, edit, page title, websockets as well.

Server

• CommitResponse::broadcast_update: everything the stored doc gained during the apply (author ops plus the stamp), exported from the version captured before the import. fanout_delta() is what DbEvent::Changed and commit_monitor::encode_commit_frame send.
• Commit frames reach the author's connection too. skip_same_source stays for non-commit changes.
• Regression test: fanout_delta_lets_the_author_apply_a_peer_edit_built_on_the_stored_snapshot.

Client (@tomic/lib)

Delivering the echo exposed three assumptions, each with a unit test in gap-recovery.test.ts:

1. Echo dedup still imports. applyIncoming dedups by commit id but imports the bytes so the stamp lands.
2. Remote ops are not unsaved work. absorbImportedOpsIntoSaveCursor folds imported peers into the save cursor and markLoroSavedAt merges rather than replaces. Without this the drain re-committed an empty delta every 130 ms (syncInProgress never cleared; the quick-edit spec).
3. A pending edit keeps its history token whoever seals it. Loro commits pending ops without a message on import, export, and from loro-prosemirror's plugin init, which a re-render can trigger between two keystrokes. The staged token is armed as setNextCommitMessage on every write and used by sealPendingEdits() before imports and exports, and the drain reuses it. Without this the History page showed "Second Title" for both versions.

Verification

• cargo test -p atomic_lib --lib: 247 passed. cargo test -p atomic-server: 65 + 43 passed. cargo fmt clean.
• @tomic/lib vitest: 352 passed. lint, format, typecheck clean.
• Local e2e against this branch (server + vite dev): 174 passed, 4 failed, all four environmental on this machine (macOS ControlOrMeta+m, the sveltekit template port, and two Cloud Vault specs that talk to a stale control plane on :3030). history page, quick edit text typing ux, documents ×3, rename-regression re-run serially ×5: green.

Notes

• docs/src/websockets.md echo section updated.
• cargo clippy -p atomic_lib --all-targets -- -D warnings reports two pre-existing lints on develop (insert_propval_raw never used, an unused Result in expression.rs), untouched here.
• browser/data-browser typecheck has a pre-existing error in upgradeDocument.ts:221 on develop, untouched here.

CI follow-up

The first run failed only sync::iroh_e2e::e2e_new_resource_after_bulk_resync, which asserted that a new resource does not reach the other peer until a bulk resync. With the fan-out delta the live push now applies for a genesis too, so the test treats the bulk path as the fallback. The whole iroh_e2e module passes locally with --features iroh,db-redb (15 tests).