sync: the session's broadcast surface (client-side show)

[nyblnet]

The client-side kernel half of live broadcast (#293), under the kernel lock —
the surface slides' dispatched client builds against. Relay half is already on
main and deployed (#453, f997be57); this is what the presenter and audience
CLIENTS call.

The shape

A show is collaboration with a second key. The presenter's transport keeps the
room key and gains a per-show key Ke; an audience copy is a reader whose
own collab.key is Ke — so it decrypts the aud stream on the ordinary
path and only the presenter side needs the second key.

Session surface (kernel/src/sync/session.ts):

• startShow({ showKey, projectOp, snapshot }) installs Ke, waits for the
  socket to be writable, sends live, then a first audsnap. endShow() sends
  end and drops the key. session.show is the live verb surface
  (nav/black/laser), null when off. onShow(fn) delivers verb/count/
  checkpoint/closed as typed events.
• Each local op batch runs through the injected projectOp; survivors go under
  Ke tagged s:'aud'. The kernel never learns an app's field names —
  projectOp and snapshot are the app's (slides/src/audience.ts).

Two security-driven decisions, both from the projection review:

1. The audsnap state is a FRESH ADOPT of the projected doc, never the live
   or stampInto state. Those carry stash (dead-window values — a deleted
   slide's speaker notes) and the whole per-character text history, neither of
   which the projection removed. freshAudState rebuilds from the projected
   doc alone. Asserted byte-identical to an independent adopt, with stash and
   txt empty — while the live state carries both.
2. collab.role gains a distinct 'audience'. The audience transport
   connects on the chain with ivr=audience (the role the owner signed) and is
   receive-only: it puts no protocol frame on the wire, and acts on the
   relay's close codes — 4001/1008 terminal (no reconnect), 4002/4003 transient
   ("waiting for the presenter"). Aud frames bypass vouched() by design: a
   relay-routed, Ke-sealed stream is a different trust path from the room's
   read-only guarantee.

Rigs

• test-sync-show (28) — the session surface over a real Store. The
  fresh-adopt guard is mutation-caught two ways: audsnap from the live state
  → 3 red (stash, txt, and the secret slide leak); projection skipped → 1 red.
• test-sync-vouch gains the audience transport (30 total): receive-only
  proven by contrast with a normal reader whose send() does reach the wire
  (isolating the gate from write() buffering), plus close-code routing and
  aud→onShowOps. Removing the gate, the terminal-no-reconnect, or the
  close-surface each goes red.
• All sync/relay rigs green; test-relay-protocol 19 (broadcast is slides-only,
  not on dash's shared wire, so its verbs are correctly not compared);
  slides/spaces/type/dash typecheck; slides builds and passes shell-gate.

The two app commits

4212ddc widens collab.invite.role in slides/src/model.ts and
type/src/model.ts — one line each, app-owned, flagged like #452's dash
half. The kernel's CollabInvite.role gained 'audience'; each app pins its
own and would not compile otherwise. slides is already building the client half
on niemes/live-broadcast and will carry the identical line, so it merges
either order. The slides and type owners should accept or fold these in.

Deploy

No deploy of its own — the relay already speaks the verbs. This ships in the
client release with slides' present-side and audience code, which lands
separately and feature-detects on ready.bc.

---

Update — security review of the client half (in scope for this PR)

• Receive-only now holds for all four show senders, not just send().
  Security probed an audience transport: setShowKey + sendVerb/sendAud/
  sendAudSnap put five frames on the wire. Unreachable from the shipped boot
  (audience mode exposes no editor) and the relay drops them, but the guarantee
  should not rest on one sender of four. All four no-op in audience mode,
  audienceMode is decided in the constructor so it precedes any call,
  startShow refuses on an audience transport, and test-sync-vouch drives all
  four and asserts an empty wire (guards removed → red).
• Co-presenter edits reach the audience live. projectToAudience ran on
  local flush only; a co-presenter's edits arrived at the audience only at the
  next checkpoint. applyRemote now projects too — only the presenter has a
  show config, so it fires for that session alone.

Deploy order (ordering to state — the live relay already satisfies it)

A client release carrying this must follow the #453 relay (live as
f997be57). On a #452-era relay the room token is stored before the chain
check, so an audience socket landing first on a fresh room would poison the
token and 403 the presenter until the idle wipe; #453 skips the token store for
the audience role. No action — recorded so a future rollback of the relay below
#453 is known to break audiences.

[github-actions]

Build size

main (394b873) → kernel-show-session (8ba38a8)

app	base	PR	change
bento/slides	678.6 KiB	679.9 KiB	+1.3 KiB (+0.19%)
bento/spaces	271.6 KiB	272.9 KiB	+1.3 KiB (+0.48%)
bento/dash	424.4 KiB	424.4 KiB	0.0 KiB (0.00%)

Updated: 2026-09-13T08:30:48Z