What the new app must do

Google OAuth only. Validate state and profile, rotate the session on sign-in, and require consent at sign-up.

This requirement means that:

• You sign in to FileLoveNote only with your Google account.
• The app checks that the Google response belongs to your sign-in attempt and that your Google profile is valid.
• After sign-in, your session receives a new ID so an old sign-in attempt cannot grant access.
• You accept the terms when signing up.
• You can sign out; this ends the app session without deleting your Drive files.

Create, select, edit, and reload through account-scoped IndexedDB; without Drive, no server note.

This requirement means that:

• You can create, open, and edit notes.
• Your notes are stored in this browser, separately for your account.
• After reloading, you can continue with your locally saved text.
• Without a Drive connection, the app server does not store a copy of your notes.

Headings, lists, task lists, quotes, code, links, bold/italic/underline/highlight, undo/redo, and an app-preserving Markdown round trip; plain exchange follows the explicit loss matrix.

This requirement means that:

• You can format text with headings, lists, task lists, quotes, code, and links.
• You can make text bold, italic, underlined, or highlighted.
• You can undo and redo an edit.
• Supported structured content and formatting remain intact through the app-preserving format. Plain Markdown export/import follows the declared compatibility matrix and warns about losses; it is not advertised as an exact rich-format round trip.

Edit tables; use the slash menu with the keyboard; @ references; leave a quote with Enter on an empty line.

This requirement means that:

• You can insert and edit tables.
• You can choose commands from the slash menu, including with the keyboard.
• You can use @ to refer to another note.
• Pressing Enter on an empty quote line lets you continue outside the quote.

Create, nest, and rename; move one or more items through menus or dragging. Immediate feedback with recovery on failure.

This requirement means that:

• You can create and rename folders and place them inside other folders.
• You can move one or more notes at once through a menu or by dragging.
• A move appears in the list immediately.
• If a move fails, only the failed item returns to its previous location.

Global search in note titles/text and folder names; exclude direct files and deleted items. The chosen result opens the correct note.

This requirement means that:

• Global search looks in note titles and text and in folder names.
• Direct files and deleted items do not appear in these search results.
• Choosing a result opens exactly the selected note.

Delete asks for one confirmation and permanently removes the selection. Late responses cannot revive items. Restore or purge old trash separately. Distinguish deleting a note/reference from deleting an original source; apply the deletion scope table.

This requirement means that:

• The Delete action asks for confirmation once for the entire selection.
• After confirmation, the selected items are permanently deleted.
• A delayed server response must not bring back a deleted item.
• You can separately restore or permanently remove previously stored trash items.

Simple default view; core settings for appearance, logout and connection status; light/dark; Cmd/Ctrl+K for actions; Markdown help, Escape, and correct focus restoration.

This requirement means that:

• The workspace opens in a simple view by default.
• You can use a light or dark theme.
• Cmd+K or Ctrl+K opens the action menu.
• You can read Markdown help and close windows with Escape; focus then returns to the correct place.
• Basic settings, sign-out and connection status are available in the core; advanced account reset/deletion remains optional FR-21.

Audio, video, images, PDF, and EPUB; list, preview, download, file-browser search, playback progress, and annotations.

This requirement means that:

• You can use audio, video, images, PDF files, and EPUB books.
• You can view files in a list, preview them, download them, and search in the file browser.
• The app remembers your playback position.
• You can add annotations to media.

Upload to Google Drive; resumable chunks, unique names for parallel uploads, and a placeholder when ffmpeg is missing.

This requirement means that:

• You upload files to your connected Google Drive, the only external file storage.
• A large upload can be sent in chunks and resumed after an interruption.
• Two simultaneous uploads with the same name do not overwrite each other.
• If ffmpeg cannot create a thumbnail, the app shows a placeholder.

OAuth separate from sign-in; account address visible; distinguish connected from active; FileLoveNote app folder, with FilesandNotes only as a migration alias.

This requirement means that:

• You can connect your own Google Drive separately from signing in to the app.
• The app shows which Google account is connected for Drive.
• The app distinguishes being connected from actively using Drive for note storage.
• Notes go in the FileLoveNote Drive folder; the old FilesandNotes name is recognized only during migration.

Durable note and folder queue, batched push, per-item status, and retention of new edits during a push; a button forces the queue.

This requirement means that:

• Changes to notes and folders first enter a durable local queue.
• The app automatically sends pending changes to Drive in batches and tracks the result for each item.
• Text you continue typing during a transfer remains saved for the next round.
• The Synchronize button sends the queue immediately.

Cache first; revisions/hasMore in batches of at most 40. Fetch only changed content; an error is not an empty list.

This requirement means that:

• The app first opens notes already stored in this browser.
• It then fetches only changed or missing versions from Drive, with at most forty notes per batch.
• If more notes remain, the app continues with the next batch.
• A retrieval error is not treated as an empty Drive.

Three-way merge using the base/etag; a controlled conflict copy where needed; account lock and BroadcastChannel.

This requirement means that:

• For simultaneous edits, the app compares the previous shared version, your local text, and the Drive version.
• Changes are merged when safe; a controlled copy remains for a real conflict.
• The app checks the Drive version before overwriting existing text.
• Tabs for the same account coordinate transfers and storage status.

AES-256-GCM, receipt ticket, background processing, result retrieval, and cleanup. A ticket is not Drive confirmation.

This requirement means that:

• The server may temporarily store an encrypted package containing your change to send it to Drive.
• The browser receives a receipt ticket and later retrieves the processing result.
• A receipt ticket does not mean the text is already stored in Drive.
• The temporary package is cleaned up after the Drive result has been retrieved.

Import, single-note export, and ZIP export; repeatable migration with a receipt when legacy data exists.

This requirement means that:

• You can import Markdown notes and export one note as Markdown.
• You can also export a ZIP file containing your notes.
• When old data needs to be transferred, you can safely repeat the transfer.
• Old source data is cleaned up only after receipt has been checked and confirmed.
• App-preserving export keeps supported structured blocks; plain Markdown export explains its losses using the compatibility matrix.

Local/external media and @ notes; /drive shows all file types and inserts one choice at the cursor; Drive source link.

This requirement means that:

• You can include local and external media and references to other notes in your text.
• With /drive, you can browse all file types in Drive and choose one file.
• The selected source is inserted at your saved cursor position.
• Connected Drive files include a link to open the original source in Drive.
• Use an existing GB-sized Drive source without uploading it again; write annotations in the note and reopen both after sync.
• Removing a source reference leaves the original file intact.

Create, move, edit, connect, zoom, and reopen text, note, and media cards.

This requirement means that:

• You can create text, note, and media cards on a canvas.
• You can edit and move cards and connect them with lines.
• You can zoom in and out to explore your ideas.
• When you reopen the canvas, the saved cards and connections remain available.

AI only on explicit request; answers/synthesis from selected context; YouTube search; no saved forced language or automatic paste translation.

This requirement means that:

• AI receives an instruction only when you request it.
• Answers and summaries use the context you choose for that request.
• You can search for sources through the YouTube integration.
• The app does not save a forced output language or automatically translate pasted text.

Optional local Whisper transcription with status and errors.

This requirement means that:

• If Whisper is configured locally, the app can create a transcript.
• During transcription, you can see the status and any error is clearly shown.

Optional account reset/deletion and administrator controls through configuration, with no hardcoded personal address. Basic theme, sign-out and connections belong to the core.

This requirement means that:

• The core already provides connections, theme and sign-out; this extension adds advanced account actions.
• There are separate actions to reset or delete your account.
• Administration actions are available only to accounts with the correct permissions.
• These permissions are configured; a personal email address is not hardcoded.

No readable note titles, text, editor content, questions, references, or base versions in server files, caches, or logs. A temporary encrypted package is allowed. This rule concerns editor-note copies; separate canvas/media-annotation storage is documented in Data Structure.

This requirement means that:

• The app server does not store a readable copy of note titles, text, editor content, questions, references, or previous content versions.
• This content is also kept out of persistent server caches and logs.
• For editor-note copies, only a temporary encrypted synchronization packet is allowed. Canvas documents and separate media annotations remain explicit server-side content stores; do not duplicate editor notes into them.

All stores, ID resolution, media, tickets, and request context are account-scoped. Unauthorized requests receive a sign-in redirect or 401; no other account data.

This requirement means that:

• The app keeps local storage, files, tickets, and requests separate for each account.
• A user cannot retrieve another account’s data through an ID or link.
• Without valid access, you are redirected to sign-in or the request receives a 401 response.
• The current browser-only database naming limitation is a required rebuild fix, not an accepted exception: use account-specific namespaces in both modes.

Persistent local queue, exact revision acknowledgment, and no loss caused by timeout/429/503/lost responses. Clearing the browser may remove unsent data.

This requirement means that:

• Pending changes remain saved locally if a request fails, takes too long, or returns no response.
• A change leaves the queue only when that exact version is confirmed.
• A later confirmation of an older version must not erase newer text.
• If you clear browser data yourself, text that has not yet been sent may be lost.

An available local note opens without waiting for Drive. No full serialization or network round trip per keystroke. Measure with a cache and slow Drive.

This requirement means that:

• A locally available note opens without first waiting for Drive.
• Typing does not trigger a complete note conversion or a network request for every keystroke.
• Speed is checked with a populated browser cache and a delayed Drive connection.
• Meet the warm-open and typing budgets under the fixed measurement baseline; record actual samples.

Bounded read/write concurrency; pagination; correct 206/416. Do not load large files entirely into RAM.

This requirement means that:

• The app limits how many read and write requests run at once.
• Long lists are fetched in pages.
• For media, the app can send the requested part of a file with the correct 206 or 416 status.
• Large files do not need to be loaded entirely into memory.
• Apply the bounded request/file limits and verify exact byte boundaries without losing queued work.

Clear plain English, visible focus, keyboard menus, Escape, focus restoration, touch targets ≥44px, and no horizontal page overflow on mobile.

This requirement means that:

• Buttons, explanations, and messages use clear plain English.
• Menus work with the keyboard and clearly show the current focus.
• Escape closes a window and focus then returns to the correct place.
• Touch targets are at least 44 × 44 pixels, and the whole page does not overflow horizontally on mobile.

Use the golden ratio as a guide; simple default, light/dark, and readable mobile view.

This requirement means that:

• The design uses calm proportions and whitespace, guided by the golden ratio.
• The default view stays simple and supports a light and dark theme.
• Text and controls remain readable and usable on a mobile screen.

Bun/CommonJS server, modular routes/services, no-build TS/ProseMirror; small focused changes and reproducible scripts/lockfile.

This requirement means that:

• The server uses Bun and CommonJS, with separate route and service modules.
• The browser uses TypeScript and ProseMirror without a required separate frontend build step.
• Changes stay small and focused on the requested function.
• Scripts and a lockfile make installation and execution repeatable.

No secrets in the repository; your own Google OAuth; HTTPS and secure cookies in production.

This requirement means that:

• Secret keys and other credentials are not stored in the repository.
• The builder uses their own Google OAuth configuration.
• Production uses HTTPS and session cookies sent only over a secure connection.

Every selected requirement has test evidence or an explicit open status. Local tests, live integration, and deployment are separate facts.

This requirement means that:

• Each selected requirement includes test evidence or clearly states which check remains open.
• A local test is reported separately from a test with a real external service.
• A working local app does not automatically prove that the same version has been published.