feat(collab): one `yrs` room hosted on a Durable Object and on axum (spike 0005 first)

Start with spike 0005 at spikes/0005-collab-yrs-durable-objects.md and record whether each exit criterion passes, including the same room running on axum. The issue also points to crates/thrust-worker/src/durable.rs and crates/thrust-editor-doc/Cargo.toml; read ADR-0060 and ADR-0061 for the room and persistence requirements. Done means the report and acceptance checks cover both hosts, convergence, persistence, authorization, and the stated load target.

Context

P0 has no collaborative editing: descriptions and pages are plain saves (ADR-0060, round 6). The only room-shaped code is the spike's RoomDo (crates/thrust-worker/src/durable.rs:79-153): WebSocket hibernation plus SQLite storage, a text echo that ignores binary frames (:119-121), reachable only through /_test/room/... with test routes and the admin token (:159-176). yrs is already in the workspace for the editor conversions (crates/thrust-editor-doc/Cargo.toml:15). ADR-0060 (accepted) chose a Collab port with a Durable Object adapter and a Hocuspocus + Redis adapter (lines 31, 38); round 21 left the self-hosted adapter open between Hocuspocus + Redis (TypeScript) and a Rust axum + yrs service (line 115; Q-0061.2, QUESTIONS.md:103). Spike 0005 has not run (spikes/README.md:46).

Problem

• FR-15: Hocuspocus + Redis as the self-hosted adapter is a shipped TypeScript service with no exit plan, which ADR-0006's round-22 policy does not allow (bounded shims behind a port with an exit plan, ADR-0006 line 75).
• FR-05: it also brings Redis back into a twin that is otherwise one binary, and two different room implementations must be kept behaviour-identical (ADR-0060 line 66).
• The kept editor connects with HocuspocusProvider, so whatever hosts the room speaks Hocuspocus framing or the editor's collab provider changes, which Q-R2 allows (ADR-0060 line 60; QUESTIONS.md:260). Yjs sync uses binary frames, which RoomDo drops today.
• A Durable Object class must be exported from the same Wasm module as fetch (ADR-0060 round 26, line 123), so the room needs a Worker root of its own.

Proposal

• Spike 0005 first, with the round-29 exit criterion "the same room runs on axum" added to the existing ones: 50 editors with p95 update fan-out < 250 ms, no data loss on forced eviction, a P0-saved page opens unchanged, cost within the envelope (spikes/0005-collab-yrs-durable-objects.md:23-26). Its step 5 (Hocuspocus or a Rust service, line 19) is answered by ADR-0060 (round-29 note).
• One room crate (for example crates/thrust-collab): sync and awareness over yrs, Hocuspocus framing (or the provider swapped under Q-R2), the short-lived signed token on upgrade (ADR-0060 round 19), persistence through CollabPersistence over the core ports (ADR-0061). It is runtime-free and listed in CLEAN_CRATES (scripts/check-deps.sh:14).
• Two hosts of the same crate: a hibernating Durable Object in a collab Worker root, added when the room lands (ADR-0090 round-29 note, FR-11), and an axum WebSocket route in thrust-server. No Node service and no Redis.
• Pages open collaboratively from the P0 stored triple (#48); the binary for a work-item description is derived from its HTML on first open by thrust-editor-doc (research/0008 §8).

Acceptance criteria

• The spike 0005 report exists; each exit criterion, including "the same room runs on axum", is met, or the editor cap is recorded.
• The ADR-0060 Confirmation tests (lines 73-75) run on the worker-cf and native targets: two clients converge, awareness propagates, an unauthorized socket is refused, persistence receives the update. Control: a room that drops binary frames, as RoomDo does, fails the convergence test.
• scripts/check-deps.sh passes with the room crate in CLEAN_CRATES and fails when a worker or tokio dependency is added to it (control).
• The stock @plane/editor opens a P0-saved page in a room on both hosts with no data migration.
• A 50-editor load test on the Durable Object host has p95 fan-out < 250 ms (M5 exit criterion).
• ADR-0060 and the ARCHITECTURE §1c Collab row (ARCHITECTURE.md:92) read "one yrs room, two hosts"; Q-0061.2 is answered.

References

• Review: .agents/plans/contrail/reviews/2026-10-19-fable-architecture-review.md (FR-05, FR-15)
• crates/thrust-worker/src/durable.rs:79-176; crates/thrust-editor-doc/Cargo.toml:15; scripts/check-deps.sh:14
• ADR-0060 (lines 31, 38, 60, 66, 73-75, 115, 123; round-29 note), ADR-0061, ADR-0006 (line 75), ADR-0090 (round-29 note)
• spikes/0005-collab-yrs-durable-objects.md:19,23-26; research/0008-editor-conversions.md §8
• Q-0061.2, Q-R2, Q-G4.1, Q-0060.1; .agents/plans/contrail/ARCHITECTURE.md:92,157

Blocked by: #46

Finding: FR-05, FR-15