# Immediate native documents

New reserves an account-bound window and opens a local untitled replica. The
initial paragraph and first editable generation are ready before the text view
is exposed; no server request blocks the editor. Attachment preserves the
window ID, text view, replica, generations, and selection.

The draft owns a UUID creation token. POST /documents accepts creation_token;
migration 0008 adds a nullable token with a unique (owner_id, creation_token)
index. Creation and lookup run under the writer transaction. Replays return the
existing document and never overwrite a later title. The token is not authority:
creation still requires membership and derives its owner from the session.

Drafts count as unsaved before initialization. Save/close awaits creation and
queued content/title writes; failure retains the draft and token for retry.
Discard changes the epoch so late responses cannot attach or upload discarded
content. A server may already have created an empty document before cancellation.
Local draft state is held in memory with the existing close/quit guards.

Double-clicking the title or File > Rename document opens the same title input.
The model owns that buffer so Save/close also commits it; Escape cancels it.
Titles over 1024 UTF-8 bytes remain editable with an error. Rename uses the
existing document write authorization inside the authenticated, CSRF-protected
POST /d/{sqid}/title route. Pending titles survive capability refreshes.

Deploy the backend migration/routes before publishing the native client. Older
servers do not provide idempotent creation. Tests are documented in
smoke/document-window/README.md. Design and implementation reviewed by GPT-6 Astra.