SyncTicket: a local-first issue tracker with a Durable Object relay

Problem & constraints

SyncTicket is an issue tracker in the style of Linear, built to take the hard parts of that problem seriously: the browser owns the data, edits work offline and merge without conflicts, two browsers stay in step in real time, and search needs no server. It is a portfolio piece that happens to be a real application, not a product looking for users. The people who open it are evaluators, so every claim has to be checkable in the running demo or the source. The name is a working title.

Three constraints shaped it. The budget was 0 EUR, so everything runs on Cloudflare’s free plan, whose ceilings (100,000 requests and 100,000 rows written a day, account-wide, and 2 MB per stored value) became design inputs rather than surprises. A visitor should be productive within a minute, so there are no accounts: the workspace link is the access. And the demo has to keep working with nobody watching it, so when it cannot do something it has to say so instead of failing silently.

It uses no LLM. Its only model is an optional sentence-embedding model for search, which runs in the visitor’s browser.

Architecture

SyncTicket is two Workers on Cloudflare’s free plan, live at syncticket.elbaymalik.com since 2026-10-22. The SvelteKit app Worker serves the pages and the self-hosted search model; a separate relay Worker holds one Durable Object room per workspace. They are separate because the stable SvelteKit adapter cannot export a Durable Object class.

In the browser, each workspace is one Yjs document: a map of issues, each issue a map of fields. y-indexeddb persists it to IndexedDB, and that document, not the server, is the source of truth. A Svelte 5 runes bridge observes it and patches a reactive projection that the UI reads; the UI never writes to the projection, only to the document. The Kanban board orders cards by fractional keys with a random suffix, so two browsers that create a card offline do not mint the same key, and a repair step heals equal keys that already exist.

The relay, y-partyserver on a hibernating Durable Object, passes updates between browsers and saves a snapshot of the document to the room’s SQLite storage, debounced at 2 s with a 5 s ceiling. Hibernation is what makes an idle room cost nothing, and it evicts the room’s memory: the document has to be rebuilt from SQLite on every wake, and the presence map starts empty. Search runs in a module Web Worker. FlexSearch answers from the first keystroke; when a user turns on meaning search, all-MiniLM-L6-v2 runs through Transformers.js on WebAssembly, and the two rankings are fused with Reciprocal Rank Fusion. With meaning search off, an end-to-end test records every request while queries are typed and asserts that there are none. The decisions behind it are logged below, each with the alternative it beat.

Where the libraries fell short

Three times, the installed package did not do what its documentation or the plan assumed. Only presence was a documented promise; the other two gaps were found by reading the installed code.

Presence: y-protocols documents that a peer not heard from within 30 seconds is dropped. y-partyserver clears the interval that does it, on the client and on the server, so a peer whose laptop lid closed stayed on screen forever. Hibernation made it worse, because a woken room has an empty presence map, and removing a peer from it reaches nobody. The client now owns liveness with a heartbeat and a staleness filter, gated so that a tab on its own sends nothing and lets the room sleep.

Connection: the provider writes the time of the last message it received and never reads it, so a socket that went quiet without closing was reported as connected and synced. The first design for a fix, calling disconnect() and then connect(), was broken twice over, as a probe against the installed provider showed before it shipped: connect() was a no-op, and disconnect() permanently unsubscribed the channel that keeps tabs of the same browser in sync. The shipped fix closes the suspect socket and lets the library’s own backoff reconnect.

Persistence: above Cloudflare’s 2 MB row cap the relay’s save throws, and the library swallows the error into a log line that the free plan keeps for three days. The room went on syncing in memory and would have lost everything since its last good save at the next eviction. Now the relay checks the size before it writes, keeps the last good snapshot, records the failure where it survives hibernation, and tells every client, including those that arrive later.

Outcomes

All 13 roadmap phases are done, and both Workers have been live on the free plan since 2026-10-22. The deploy was checked the way the repository’s runbook asks, not by the absence of an error: the connection popover settled on “Ready to share”, and an issue created in a second browser given only the share link appeared in the first. It is a permanent, open demo for evaluators, with no accounts by design: anyone with a workspace link can read and edit it, and the app says not to enter real data.

The figures above were measured locally. Virtualization took the list at 10,000 issues from 5,019 ms to 33 ms; FlexSearch answers a first keystroke in 0.005 ms against MiniSearch’s 3.96 ms; and two browsers on one machine converged through a local relay with medians of 29 to 30 ms, far under the 1 s target but not a production figure. A workspace stops being saved at about 6,130 issues, and the app says so. Search quality is not measured: there is no golden set, so these are speed numbers, not relevance numbers. The gates run locally with scripts/ci-local.sh, which mirrors the CI workflow step by step.

The open items are written down in the repository. The name is still a working title: the product got its own mark on 2026-10-22, but no name. The build still ships a second, byte-identical copy of the 23.6 MB ONNX WebAssembly file that is never served, and collapsing the two is an open follow-up. Silent loss through the daily row budget is reported only generically, because its error shape is unverified. A half-open connection that neither the browser’s offline event nor a return to the tab reveals is noticed only at the browser’s own TCP timeout. Board cursors from the plan were left out on purpose, because every pointer move would wake a sleeping room. And there is no export yet for getting data out of a workspace the relay can no longer save; the data is still in the visitor’s own IndexedDB.

Lessons

Read the installed package, not its documentation. Only one of the three gaps above broke a documented promise; the other two were behaviour that only the installed code showed, and the first fix for one of them would have shipped a silent regression. A throwaway probe against the package on disk cost less than any of them.

Measure before choosing. At 10,000 issues, the reactive layer cost 2 ms and the DOM 5 seconds, so the fix was one component instead of a rewrite of the query layer; the search engine was chosen on the first keystroke, not on an average query.

A limit stated beats a limit hidden. The free plan sets hard ceilings, and the one that would have hurt was the one that failed silently. Telling the user that a workspace is no longer being saved was cheaper and more honest than any storage scheme that pushed the wall further out.

A dry run is not a deploy. The deploy-target ADR expected small surprises at the first real deploy, and both were in the tooling: wrangler login reported a timeout after writing valid credentials, and a bare wrangler deploy only warned that the relay config carried an e2e environment without a rate limiter. Both relay deploy scripts now name their environment.