pcbjam/docs/features/ysync-review/20-fix-miss09-collab-aware-undo.md

Fix 20 — Miss 09 implemented: local-ops-only undo (option 1)

Status: DONE, e2e-verified 2026-07-07 (5/5 firefox + collab/ysync regression suites) Design: 09-miss-undo-not-collab-aware.md option 1, feasibility per 19-undo-option1-feasibility.md

Remote applies no longer land on the receiving editor's undo stack: Ctrl+Z after a peer's edit reverts your own last op, never the peer's, and the adopt "undo bomb" is gone (adopt creates no undo entry at all — 09's option 3 history-barrier is moot).

What changed

KiCad fork

• eeschema/schematic_undo_redo.cpp — UUID stale-pointer guard in PutDataInPreviousState, mirroring pcbnew's: every picker (except DELETED, PAGESETTINGS, REPEAT_ITEM, and the root sheet, which ResolveItem cannot see) is existence-checked via SCHEMATIC::ResolveItem(uuid). Missing → picker dropped (not_found → wxLogWarning, no modal). Present-but-different-pointer (a remote apply replaced the object, same uuid) → the picker is re-anchored (SetPickedItem) and the restore targets the current live item. Without this, undoing an entry whose item a remote apply freed dereferenced a dangling pointer.
• eeschema/sch_commit.cpp — RecalculateConnections moved out of the !( aCommitFlags & SKIP_UNDO ) gate in pushSchEdit: a commit that skips undo still changes the model, and remote applies rely on the recalc (it was the whole point of applying through real commits). SaveCopyInUndoList stays gated.
• pcbnew/undo_redo.cpp — the "Incomplete undo/redo operation" wxMessageBox downgraded to wxLogWarning: dropped entries are routine in a collab session, and a blocking modal would hang the wasm modal pump.

wasm bindings

• eeschema_embind.cpp / pcbnew_embind.cpp — all four remote-apply Push sites (doApply + doApplyItems per editor) now push with SKIP_UNDO. Change detection is unaffected: emit suppression is keyed off s_applyingRemote, not undo entries.
• Removed-item ownership: under SKIP_UNDO no undo picker takes ownership of removed items (and the commit deletes the clone image), so the bindings free the detached items after Push — both the explicit removed[] uuids and the upsert's remove-old-before-re-add. Fields are excluded (CHT_REMOVE hides them; they stay owned by their parent). Freeing stays in the binding layer, NOT the fork commit classes, because existing SKIP_UNDO callers (DRC marker flows) manage their removed items' lifetimes themselves — freeing in the commit would double-free.
• Test hooks kicadCollabTestUndo (runs ACTIONS::undo on the main-loop/fiber stack) and kicadCollabTestUndoDepth, registered per-editor and in kicad_editor_embind.cpp's dispatcher — the merged image compiles out the per-app EMSCRIPTEN_BINDINGS registrations, so a shared-name hook that is not in the dispatcher silently vanishes from kicad_editor (build even forces the relink; it's the registration that's conditional).

Coverage — tests/kicad/collab-undo.spec.ts (5/5)

Scenario	Editors
Remote apply adds no undo entry; undo reverts own op, peer's delete survives	eeschema + pcbnew
Stranded CHANGED entry (remote replaced the item) — undo re-anchors by uuid, no crash	eeschema
Stranded entry (remote deleted the item) — picker dropped quietly (log, not modal), no resurrect	eeschema + pcbnew

Pre-fix, the stranded cases dereferenced freed memory (eeschema had no guard at all; pcbnew guarded existence but popped a blocking modal).

Accepted semantics (per doc 19)

• Undo restores the full item image → a peer's concurrent edit to another field of the same item is clobbered (LWW, converges; same trade-off as opt 14 granularity).
• Duplicate-KIID edge (local delete parked on undo + peer re-adds same uuid + undo) remains untested; the differ keys by uuid so it should reconcile — follow-up test.
• Pre-existing local entries that a big adopt strands are dropped on first undo.