OpenMerch SDK

Adversarial review done: an independent gpt-5.5 pass produced 20 evidence-backed findings; all folded into the spec. Biggest upgrades: a save-state machine where "Saved" only ever means an acknowledged write, versioned document schema with migrations, full undo/history semantics (batching, branch-aware, selection excluded), typed + redacted error envelopes on every provider seam, and a hard ordering rule — the SDK save path must prove save→reload parity before Yjs gets deleted. Now scaffolding @openmerch/* and the headless core.

All three surfaces baselined with reports + ~70 screenshots (committed + pushed). Headline finds: /design autosave is silently broken — saves ride the Yjs websocket, the client falls back to an anonymous token before the user session hydrates, and the worker rejects every connection; the UI shows "Saving…" forever and a reload loses your edits. Strongest possible validation of the "delete Yjs, save through an explicit persistence adapter" decision. Also root-caused the editor boot hang: worker-editor was missing its Printify API key (env drift — fixed, boot passes now). /customize has a squeezed order-summary line + hardcoded "tee" CTA; studio's hex input mangles 3-digit colors; /design's crop inputs render garbled digits. Full defect tables live in harness/evidence/openmerch-baseline/.

Found your pnpm dev next-app had died (port 3000 is your MedicalTextbook dev server); tilpas now runs on :3005 against the hosted dev Supabase. Provisioned QA fixture user qa-openmerch@tilpas.test via admin API. Three parallel QA agents are now exercising /customize, /tilpas/studio, and /design end to end with screenshot evidence, while a fourth maps all editor code for the SDK spec.

Repo cleaned: recovered the uncommitted buyer-pack task, deploy hygiene, and docs into three grouped commits on codex/sota-garment-twin-plan, then branched feat/openmerch-sdk. Code-map agent is sweeping all editor code; baseline QA of the three surfaces starts now.