07 / 15 · Sources & decisions
What this package does and does not specify
This package is a readable rebuild specification compiled from the local repository and existing project documentation.
Origin and use
Package revision: 28 October 2026. Initial source snapshot: 23 October 2026, repository filelovenote, HEAD ef209d4. UI/data/API/Markdown/setup were rechecked against local reference 867ca8d on 26 October 2026. FR-01 includes the Google-only login change introduced on 23 October. This is not a check of the current production version. The specifications and prompts in this folder can be used on their own and contain no links that require the original checkout.
FileLoveNote is the product name. notesandfiles, mytube and FilesandNotes still appear in older files and compatibility names. Do not create separate products or new storage folders for them.
Dependency and test maintenance · 28 October 2026
The original product/API/UI snapshot remains the historical source described above. This revision additionally checks cbc3baa with the 28 October maintenance changes: 12 direct package upgrades, removal of bcrypt/password configuration and its hash script, refreshed Neo test fixtures, and the corrected local root-folder parent ID. The new portable baseline pins all 19 remaining direct packages and preserves the maintained app's resolved dependency graph.
The reference app passed 1,843 Bun tests and seven isolated BrowserOS Neo tests; browser bundles compiled and the application lockfile installed frozen. The dependency audit reported no known vulnerabilities across 64 audited packages. The portable manifest/lock pair was separately installed twice in a new temporary directory with lifecycle scripts disabled. These checks do not prove a clean Linux install, real Google token exchange, live Drive sync or an independent reconstruction. Deployment evidence belongs to the release of a specific commit.
Source areas consulted
| Source in the original repository | Used for |
|---|---|
| docs/SOLUTION_INTENT.md | Product purpose, current storage boundaries and automatic sync. |
| docs/SOLUTION_DESIGN.md | Data flows, privacy, tickets, merges, selection, search and UI contracts. |
| package.json; server.js; src/http/runtime-server.js | Bun, dependencies, modules, scripts and the actual server architecture. |
| client/paper/drive-sync-button.ts; src/services/drive-notes-service.js | Automatic sync status, incremental routes, tickets and temporary read context. |
| src/services/encrypted-sync-station.js; src/routes/google-drive-routes.js | Encrypted packets, idempotency, ticket results, Drive status and uploads. |
| src/routes/auth-routes.js; src/config/env.js; .env.example | Login, configuration names and the separation of development and production settings. |
| client/paper/; tests/; docs/components/ | Editor and store boundaries; scenarios for races, upload integrity and sync failures. |
| README.md; docs/REQUIREMENTS.md; docs/API.md; docs/REBUILD_PROMPT.md | Broad inventory; historical details checked against recent design and code. |
Where this package corrects older instructions
| Older description | Decision in this package |
|---|---|
| New notes stored as documents/<id>.md on the server | Browser/Drive-only note storage; old server files are migration sources only. |
| Global search across all media and transcripts | Global search covers notes and folders only; Files has its own search. |
| Delete always moves items to Trash first | Delete is permanent after confirmation; existing Trash contents are handled separately. |
| Manual Save to Drive as the goal of an older plan | Current design and sync button: automatic sync, with a button to send the queue immediately. |
| Note sync as an optional final step | Local saving is mandatory from P01 onward; Drive sync is part of P04 for the complete web core. |
| Authentication in an older agent brief | Google OAuth only; the web server has no alternative login route. |
| Everything works perfectly in one session / absolute zero data loss | Phases and verifiable criteria; explicit limits of browser storage, network access and timing. |
| Outdated Express/single-file description | Actual Bun.serve with modular services, routes and renderers. |
| Automatic translation or forced language | No stored forced language; AI follows the explicit request. |
Confidence and limits
- This package captures behavior and design intent at a high level, with record fields in 10 Data Structure, concrete wire examples in 11 API Contracts and the Markdown matrix in chapter 13. Hidden compatibility routes are not required rebuild features. Test shared schemas on both sides.
- The FR/NFR requirement IDs in this folder form a new, consistent structure. They do not map one-to-one to the IDs in the older REQUIREMENTS.md.
- Acceptance criteria are testable goals. The complete application has not been regenerated to prove that a single model can follow all these prompts independently without errors.
- An exact visual clone is not promised. This package contains design rules and flows, rather than a complete set of screenshots and pixel measurements.
- This package is self-contained. A live Ernst HQ/PostgreSQL connection is not required for reconstruction.
- FR-01 was narrowed to Google OAuth only on 23 October 2026. The web server and configuration were updated accordingly. This historical statement concerns the original 23 October specification, not current production status. The 26 October contract additions did not deploy or regenerate the app.
Document ownership and precedence
This package is the complete reconstruction input. Source-file paths record evidence; they are not required dependencies in the new folder. English user-facing copy is required for the reconstruction. Preserve technical IDs and filenames.
| Topic | Canonical owner | Rule |
|---|---|---|
| Purpose and selected scope | 01 Intent + 03 Requirements | Core FR-01–17 is mandatory. FR-18–21 are optional. Stories explain user outcomes; they do not silently narrow requirements. |
| Record identity/storage | 10 Data Structure + document.schema.json | Browser/Drive editor-note content; separate server canvas/media annotation scope. Account isolation is required in both storage modes. |
| Transport | 11 API Contracts | Exact payload fields, result correlation, limits and retry envelopes. |
| Failure/lifecycle | 12 Failure & Recovery | UI states and deletion/disconnect/reset scope take precedence over a generic “Delete” label. |
| Editor interchange | 13 Markdown Compatibility | Supported nodes/attrs/defaults and explicit plain-format losses; no silent content loss. |
| Execution/deployment | 14 Setup & Operations + baseline/ | Pinned dependencies and operations; required startup corrections are not claimed existing protections. |
| Appearance | 09 Design | App tokens/layouts; documentation cream/green/serif styling is not the app design. |
| Verification | 15 Acceptance & Fixtures + 06 Verification | Machine-readable acceptance-targets.json owns numerical budgets; A/V scenarios own expected outcomes, not actual pass claims. |
Explicit Required rebuild rules override incompatible Existing source observation behavior. Reproduce compatibility only when needed to read old data; never copy a known isolation or data-loss limitation as desired behavior. Security protections marked missing must be implemented/tested before claiming them. Build prompts order the work; they do not override the topic owners. If two normative owners still conflict, stop the affected step and record the unresolved decision rather than guessing.
Baselines and budgets are chosen reconstruction inputs, not production benchmarks. Source snapshot, documentation revision, generated-build SHA, live integration result and deployment SHA are separate facts. Use one actual evidence ledger in the generated project.
Published reference package
The reference app links this package from its marketing footer as Build guide, at /prompt/index.html. Only the reviewed HTML, synthetic fixtures and baseline files are public. No source checkout, credentials or user data is exposed by that publication route. Copy the whole package for a local rebuild; publication of a newly generated app remains a separate action.
Updating this package later
Keep Data Structure synchronized when record fields, ownership, relationships or migrations change. First update the specification that owns the topic: Intent for purpose, Design for technology, Requirements for requirements and User stories for user behavior. Then update the linked prompts and scenarios. Keep IDs when their meaning stays the same. Change the snapshot date only after checking the sources. Never copy a local .env file, personal accounts, content logs or user notes into this package.