@@ -3,13 +3,26 @@ import localFont from 'next/font/local'
 /**
  * Season Sans variable font configuration
  * Uses variable font file to support any weight from 300-800
+ *
+ * `display: 'block'`, not `swap`: this is the document font, so a swap is not a cosmetic change of
+ * typeface — the fallback's glyph advances differ, so paragraphs re-wrap and everything below them
+ * moves. In long-form prose (the Files editor) that reads as the line and paragraph spacing visibly
+ * correcting itself a beat after the text appears, on every hard refresh (a normal reload serves the
+ * font from cache and never swaps). `swap` is the setting that says "painting the wrong font first is
+ * fine"; for a brand face it is not.
+ *
+ * The block period costs nothing here because delivery is already optimal: `preload` emits a
+ * `Link: rel=preload` RESPONSE header, so the fetch starts before the HTML is parsed, and the file is
+ * one same-origin, immutably-cached 87KB woff2. The metric-adjusted Arial below stays as the safety
+ * net for the >3s tail, where the browser gives up blocking and swaps — i.e. the worst case is
+ * today's behavior, not a regression.
  */
 export const season = localFont({
   src: [
     // Variable font - supports all weights from 300 to 800
     { path: './SeasonSansUprightsVF.woff2', weight: '300 800', style: 'normal' },
   ],
-  display: 'swap',
+  display: 'block',
   preload: true,
   variable: '--font-season',
   fallback: ['system-ui', 'Segoe UI', 'Roboto', 'Helvetica Neue', 'Arial', 'Noto Sans'],
 
@@ -0,0 +1,35 @@
+'use client'
+
+import { File as FileIcon } from '@sim/emcn/icons'
+import { noop } from '@sim/utils/helpers'
+import {
+  type BreadcrumbItem,
+  ResourceChromeFallback,
+} from '@/app/workspace/[workspaceId]/components'
+import { FOLDERED_RESOURCE_HEADERS } from '@/app/workspace/[workspaceId]/components/folders/foldered-resources'
+
+const FILES_HEADER = FOLDERED_RESOURCE_HEADERS.file
+
+/**
+ * Transcribes the trail the loaded page shows while its record resolves (`loadingBreadcrumbs` in
+ * `files.tsx`): the root crumb plus a terminal `…`, with no icon on the leaf — so the fallback and
+ * the page paint the same two crumbs and only the label changes.
+ */
+const BREADCRUMBS: BreadcrumbItem[] = [
+  { label: FILES_HEADER.rootLabel, icon: FileIcon, onClick: noop },
+  { label: '…', terminal: true },
+]
+
+/**
+ * Fallback for the file DETAIL route. Without it the segment inherits the Files list fallback, which
+ * paints an options bar and a table header row that a document page does not have — chrome that has
+ * to be torn down a frame later. A detail page is header + body, so this is the header alone.
+ *
+ * Header actions are deliberately omitted: they are a function of the open file (a previewable
+ * non-markdown file gets a mode toggle, an editable one gets Share/Delete), which is exactly what is
+ * not yet known here. Chips appearing beside the title reads as content arriving; chips appearing
+ * and then changing reads as a glitch.
+ */
+export default function FilesFileLoading() {
+  return <ResourceChromeFallback icon={FileIcon} breadcrumbs={BREADCRUMBS} />
+}
@@ -1,17 +1,48 @@
 import { Suspense } from 'react'
+import { dehydrate, HydrationBoundary } from '@tanstack/react-query'
 import type { Metadata } from 'next'
+import { getSession } from '@/lib/auth'
+import { getQueryClient } from '@/app/_shell/providers/get-query-client'
+import FilesFileLoading from '@/app/workspace/[workspaceId]/files/[fileId]/loading'
 import { Files } from '@/app/workspace/[workspaceId]/files/files'
-import FilesLoading from '@/app/workspace/[workspaceId]/files/loading'
+import { prefetchFilesBrowser } from '@/app/workspace/[workspaceId]/files/prefetch'
 
 export const metadata: Metadata = {
   title: 'Files',
   robots: { index: false },
 }
 
-export default function FilesFilePage() {
+/**
+ * File detail entry. `Files` resolves the open file out of the workspace file LIST, so this route
+ * needs the same prefetch its sibling list page does — without it the server can only ever render
+ * the "resolving the record" spinner, and the real header (breadcrumbs, actions) has to pop in a
+ * frame later on the client.
+ *
+ * It also removes a whole class of hydration mismatch: which branch `Files` renders is decided by
+ * whether that list is in the cache, so a server render without it and a client render with it
+ * disagree on the header's markup (a static `…` crumb vs. the file's dropdown crumb). Prefetching
+ * here makes both sides read the same cache and pick the same branch by construction.
+ *
+ * `Files` reads URL query params via nuqs (`useSearchParams` internally), so it must sit under a
+ * Suspense boundary; the fallback is the detail chrome, matching the route's own `loading.tsx`.
+ */
+export default async function FilesFilePage({
+  params,
+}: {
+  params: Promise<{ workspaceId: string; fileId: string }>
+}) {
+  const [{ workspaceId }, session] = await Promise.all([params, getSession()])
+
+  const queryClient = getQueryClient()
+  if (session?.user?.id) {
+    await prefetchFilesBrowser(queryClient, workspaceId, session.user.id)
+  }
+
   return (
-    <Suspense fallback={<FilesLoading />}>
-      <Files />
-    </Suspense>
+    <HydrationBoundary state={dehydrate(queryClient)}>
+      <Suspense fallback={<FilesFileLoading />}>
+        <Files />
+      </Suspense>
+    </HydrationBoundary>
   )
 }
@@ -2,10 +2,8 @@ import type { Editor } from '@tiptap/core'
 import { Node as PMNode } from '@tiptap/pm/model'
 import { initProseMirrorDoc, updateYFragment, ySyncPluginKey } from '@tiptap/y-tiptap'
 import * as Y from 'yjs'
-import { parseMarkdownToDoc } from '../markdown-parse'
-
-/** The Yjs fragment name TipTap's Collaboration extension binds to (its default `field`). */
-const COLLAB_DOC_FIELD = 'default'
+import { COLLAB_DOC_FIELD } from '@/lib/collab-doc/field'
+import { editorNormalForm } from '../markdown-parse'
 
 /**
  * Transaction origin for agent-streamed writes into a live collaborative doc. It is deliberately NOT
@@ -63,7 +61,11 @@ export function applyAgentStreamFrame(
 ): boolean {
   const binding = ySyncPluginKey.getState(editor.state)?.binding
   if (!binding) return false
-  const target = PMNode.fromJSON(editor.schema, parseMarkdownToDoc(body))
+  // Through the editor's normal form, like every other writer to the shared document. A frame whose
+  // body ends on a list, heading, table, or rule parses WITHOUT the editor's trailing paragraph, so
+  // reconciling toward the bare parse deletes the one the seed put there — and the next client to bind
+  // writes it back, which is the divergence this normalization exists to prevent.
+  const target = PMNode.fromJSON(editor.schema, editorNormalForm(body))
   let delta: Uint8Array | null = null
   const capture = (update: Uint8Array, origin: unknown) => {
     if (origin === AGENT_STREAM_ORIGIN) delta = update
 
@@ -164,7 +164,7 @@ describe('collab streaming integration — moving pieces', () => {
     reopened.destroy()
   })
 
-  it('EMPTY-COLLAPSE ON THE STREAM PATH: an agent body with a huge blank run does not strand empties', () => {
+  it('EMPTY-BOUND ON THE STREAM PATH: an agent body with a huge blank run does not strand empties', () => {
     const A = makeCollabEditor()
     A.editor.commands.setContent(parseMarkdownToDoc('# Title\n\nintro'), { contentType: 'json' })
     const session = beginAgentStream(A.editor)!
@@ -173,9 +173,11 @@ describe('collab streaming integration — moving pieces', () => {
     endAgentStream(session)
 
     console.log(
-      `\n[STREAM-COLLAPSE] text=${JSON.stringify(A.editor.state.doc.textContent)} empty=${emptyParas(A.editor)}`
+      `\n[STREAM-BOUND] text=${JSON.stringify(A.editor.state.doc.textContent)} empty=${emptyParas(A.editor)}`
     )
-    expect(emptyParas(A.editor)).toBe(0) // collapse protects the live streaming path, not just static open
+    // ~200 blank paragraphs' worth of run arrives; the parse bound caps what reaches the live doc, so the
+    // streaming path is protected exactly like a static open — no unbounded node explosion in the CRDT.
+    expect(emptyParas(A.editor)).toBe(20)
     expect(A.editor.state.doc.textContent).toContain('tail paragraph')
   })
 
@@ -197,4 +199,45 @@ describe('collab streaming integration — moving pieces', () => {
     expect(D.editor.state.doc.textContent).toContain('streamed body')
     expect(emptyParas(D.editor)).toBe(0)
   })
+
+  /**
+   * Every writer to the shared document has to produce the editor's normal form, or the one that does
+   * not silently removes what the others add. A frame whose body ends on a list, heading, table, or rule
+   * parses WITHOUT the trailing paragraph the seed puts there — reconciling toward that bare parse
+   * deleted it from the live room, and the next client to bind wrote it back, reopening the
+   * placeholder-vs-live divergence the seed normalization exists to close.
+   */
+  it.each([
+    ['ends on a list', ['# T\n\nintro\n\n- a', '# T\n\nintro\n\n- a\n- b']],
+    ['ends on a heading', ['# T\n\nintro\n\n## Sec', '# T\n\nintro\n\n## Section']],
+    ['ends on a table', ['# T\n\n| a |\n| --- |\n| 1 |']],
+  ])('AGENT STREAM KEEPS THE EDITOR NORMAL FORM: %s', (_label, frames) => {
+    const doc = markdownToYDoc('# T\n\nintro\n\n- seed')
+    const awareness = new Awareness(doc)
+    const editor = new Editor({
+      extensions: createMarkdownEditorExtensions({
+        placeholder: '',
+        collaboration: {
+          doc,
+          awareness,
+          user: { name: 'U', color: '#fff', clientId: doc.clientID },
+        },
+      }),
+    })
+    const trailingIsEmptyParagraph = () => {
+      const fragment = doc.getXmlFragment('default')
+      const last = fragment.get(fragment.length - 1)
+      return last instanceof Y.XmlElement && last.nodeName === 'paragraph' && last.length === 0
+    }
+    expect(trailingIsEmptyParagraph()).toBe(true)
+
+    const session = beginAgentStream(editor)!
+    for (const frame of frames) applyAgentStreamFrame(editor, session, frame)
+    endAgentStream(session)
+
+    expect(trailingIsEmptyParagraph()).toBe(true)
+    editor.destroy()
+    awareness.destroy()
+    doc.destroy()
+  })
 })
@@ -4,33 +4,48 @@
 import { describe, expect, it } from 'vitest'
 import { type CollabReadinessInputs, nextCollabReadiness } from './readiness'
 
+/** An observation, with the healthy defaults filled in so each case states only what it exercises. */
+const at = (input: Partial<CollabReadinessInputs>): CollabReadinessInputs => ({
+  synced: false,
+  seeded: false,
+  offlineSeed: false,
+  fatal: false,
+  ...input,
+})
+
 /** Drive a sequence of observations through the latch, returning the readiness at each step. */
-function run(steps: CollabReadinessInputs[]): boolean[] {
+function run(steps: Partial<CollabReadinessInputs>[]): boolean[] {
   let syncedOnce = false
-  return steps.map((input) => {
-    const next = nextCollabReadiness(syncedOnce, input)
+  return steps.map((step) => {
+    const next = nextCollabReadiness(syncedOnce, at(step))
     syncedOnce = next.syncedOnce
     return next.ready
   })
 }
 
 describe('nextCollabReadiness', () => {
   it('is not ready before syncing or seeding', () => {
-    const { syncedOnce, ready } = nextCollabReadiness(false, {
-      synced: false,
-      seeded: false,
-      offlineSeed: false,
-    })
+    const { syncedOnce, ready } = nextCollabReadiness(
+      false,
+      at({
+        synced: false,
+        seeded: false,
+        offlineSeed: false,
+      })
+    )
     expect(syncedOnce).toBe(false)
     expect(ready).toBe(false)
   })
 
   it('is not ready when synced but not yet seeded', () => {
-    const { syncedOnce, ready } = nextCollabReadiness(false, {
-      synced: true,
-      seeded: false,
-      offlineSeed: false,
-    })
+    const { syncedOnce, ready } = nextCollabReadiness(
+      false,
+      at({
+        synced: true,
+        seeded: false,
+        offlineSeed: false,
+      })
+    )
     expect(syncedOnce).toBe(true) // latched
     expect(ready).toBe(false) // waits for the seed
   })
@@ -50,11 +65,14 @@ describe('nextCollabReadiness', () => {
   it('opens even if the seed lands before we ever observed synced (server seed proves a sync)', () => {
     // If the flap beat our first observation, the seed flag alone (not the offline fallback) proves a
     // completed sync happened.
-    const { syncedOnce, ready } = nextCollabReadiness(false, {
-      synced: false,
-      seeded: true,
-      offlineSeed: false,
-    })
+    const { syncedOnce, ready } = nextCollabReadiness(
+      false,
+      at({
+        synced: false,
+        seeded: true,
+        offlineSeed: false,
+      })
+    )
     expect(syncedOnce).toBe(true)
     expect(ready).toBe(true)
   })
@@ -74,4 +92,33 @@ describe('nextCollabReadiness', () => {
     ])
     expect(readiness).toEqual([true, true])
   })
+  /**
+   * The reported bug. A brand-new file syncs EMPTY (latching `syncedOnce`), its server seed never
+   * lands, and the readiness deadline fires: the provider goes fatal and drops `synced` precisely so
+   * this gate closes. The offline fallback then seeds locally — and the sticky latch used to re-open
+   * the gate on that, handing back an editable editor bound to a document the provider had abandoned.
+   * Every keystroke was dropped (the provider ignores frames and never rejoins) and client autosave
+   * stayed off (collaboration is nominally on), so the edits vanished on reload with no error shown.
+   */
+  it('stays read-only after the readiness deadline goes fatal, even though a sync was latched', () => {
+    const readiness = run([
+      { synced: false },
+      { synced: true }, // initial EMPTY sync — latches syncedOnce
+      { synced: false, fatal: true }, // deadline: provider drops synced and gives up
+      { seeded: true, offlineSeed: true, fatal: true }, // fallback seeds locally
+    ])
+    expect(readiness).toEqual([false, false, false, false])
+  })
+
+  /**
+   * The same revocation on an ALREADY-ready doc: access is withdrawn mid-session, the provider goes
+   * fatal, and readiness must be taken back rather than left latched open.
+   */
+  it('revokes readiness when a live document turns fatal', () => {
+    const readiness = run([
+      { synced: true, seeded: true }, // ready
+      { synced: false, seeded: true, fatal: true }, // access revoked mid-session
+    ])
+    expect(readiness).toEqual([true, false])
+  })
 })
@@ -22,16 +22,32 @@ export interface CollabReadinessInputs {
   seeded: boolean
   /** Whether the seed flag was set by the offline fallback (no server sync) rather than the server. */
   offlineSeed: boolean
+  /**
+   * Whether the provider has GIVEN UP on this document — a non-retryable rejection, an access
+   * revocation, or the readiness deadline lapsing. A fatal provider ignores every inbound frame and
+   * never rejoins, so nothing typed after this point reaches the server.
+   */
+  fatal: boolean
 }
 
 /**
  * Pure transition for the readiness latch. `syncedOnce` is the sticky prior state — pass the returned
  * `syncedOnce` back in on the next call. `ready` is whether the doc is synced-and-seeded.
+ *
+ * `fatal` overrides the latch, and that override is the whole reason it is an input. The latch is
+ * sticky on purpose, but stickiness must not outlive the document: a doc that syncs empty and never
+ * receives its server seed trips the readiness deadline, and the provider answers by dropping `synced`
+ * so this gate closes. The latch ignored that — `syncedOnce` was already set by the empty sync — so the
+ * offline fallback's seed flag re-opened the gate and handed back an EDITABLE editor on a document the
+ * provider had already abandoned. Nothing typed into it could persist: the provider drops every frame
+ * and never rejoins, and the client's own autosave stays gated off because collaboration is nominally
+ * on. The user types, sees no error, and loses the edits on reload. Revoking readiness on `fatal` is
+ * what makes the fallback what it is documented to be — a READ-ONLY view of the stored content.
  */
 export function nextCollabReadiness(
   syncedOnce: boolean,
   input: CollabReadinessInputs
 ): { syncedOnce: boolean; ready: boolean } {
   const next = syncedOnce || input.synced || (input.seeded && !input.offlineSeed)
-  return { syncedOnce: next, ready: next && input.seeded }
+  return { syncedOnce: next, ready: next && input.seeded && !input.fatal }
 }
@@ -173,10 +173,11 @@ function stripEmptyListItemLines(markdown: string): string {
  * round-trip ({@link stripEmptyListItemLines}), restores callout markers the serializer
  * backslash-escapes (`> \[!NOTE\]` → `> [!NOTE]`), and collapses trailing blank lines to a single
  * newline. Interior blank runs are NOT collapsed here — blank lines inside a fenced code block (or a
- * verbatim raw-markdown-snippet) are significant, and a global collapse would corrupt them. Spurious
- * interior blank runs between top-level blocks are removed upstream instead, by
- * {@link parseMarkdownToDoc} stripping empty paragraphs, so a doc that has been through the editor
- * never serializes with an interior blank run outside code in the first place. The table serializer's
+ * verbatim raw-markdown-snippet) are significant, and a global collapse would corrupt them. An interior
+ * run between top-level blocks is significant too: it is how an empty paragraph is written, and
+ * {@link parseMarkdownToDoc} reads exactly the count back out, so collapsing it here would delete the
+ * document's spacing. Only the TRAILING run is collapsed — it can carry no paragraph (see
+ * `clampEmptyParagraphs`) and would otherwise churn the file on every save. The table serializer's
  * spurious surrounding blank lines are trimmed at the source (PipeSafeTable), so no global
  * leading-newline strip is needed here — avoiding clobbering content that legitimately begins with
  * whitespace.