Overview

Synapse is a real-time collaborative canvas built on one idea: the client holds the truth (a Yjs CRDT), the server is a blind pipe (ciphertext only), and the time machine is just the update log replayed. Open it in two windows, go offline on one, keep editing in both, come back online — the documents merge perfectly with no conflicts. Then drag the time slider and watch the whole board rewind and replay.

Tech Stack

Challenges

• Origin discipline: applying a remote CRDT update also fires the local "update" event, so a naïve relay re-sends it and the room melts into a broadcast storm. (That bug ate three days.)
• Real offline durability — close the tab, lose Wi-Fi, keep editing, and have everything merge cleanly on reconnect.
• Keeping the server genuinely unable to read anything while still letting late joiners catch up on full history.
• Remote cursors arrive at packet rate and look broken if you render each raw position.

Solution

Each client keeps the truth in a Yjs CRDT persisted to IndexedDB; a custom EncryptedProvider seals every update with AES-256-GCM before it leaves the device and ships ciphertext to a ~230-line blind relay that understands nothing about canvases. The broadcast-storm fix is two lines — tag every applied network update with the provider as its transaction origin, and bail in the local handler when you see your own origin. Cursors interpolate off the React path, written straight to the DOM, so presence feels alive. Time-travel is free: the ordered CRDT update log is the history, so replaying updates[0..t] into a throwaway doc reconstructs any past state.

Outcome

Two windows, airplane-mode on one, edits flying in both, then a clean conflict-free merge on reconnect — and a scrubber that rewinds the board and replays it. A headless smoke test speaks the exact encrypted wire protocol and asserts both clients converge (plus a late joiner reconstructing history), so the marquee claim isn't hand-waved — if convergence ever regresses, it goes red.

What I'd do differently

E2EE here means the relay can't read your canvas — it does not protect against anyone you share the link with (the key is in the link) or traffic-analysis metadata. Over-claiming security is worse than scoping it honestly. Next up: per-room key rotation, a WebRTC P2P transport with a relay↔P2P toggle, and a per-character text CRDT for concurrent editing inside a single node.