@@ -308,6 +308,13 @@ This file is the product changelog. The webapp package keeps [`apps/webapp/CHANG
   analytics tables or call the admin, cron and notification helper functions.
   Monthly view tables now have row security on
   ([#314](https://github.com/docs-plus/docs.plus/issues/314)).
+- Keep the access token out of the document page data. The offline cache
+  keeps that data, so the next person on a shared device could read the token
+  ([#429](https://github.com/docs-plus/docs.plus/issues/429)).
+- Clear chat drafts on sign-out. A draft belongs to a chat, not to a person,
+  so the next person on a shared browser could see unsent text. Sign-out also
+  removes four old document keys from browser storage
+  ([#444](https://github.com/docs-plus/docs.plus/issues/444)).
 
 ### Removed
 
 
@@ -545,6 +545,17 @@ plus the house order in [`RELEASE_POLICY.md`](../../RELEASE_POLICY.md).
 - **A notification click opens same-origin URLs only.** The service worker
   opens `/` for any other `action_url`
   ([#417](https://github.com/docs-plus/docs.plus/issues/417)).
+- **Document page props carry no access token.** `documentServerSideProps`
+  sends `isAuthed` in its place, and the WS `token` callback reads
+  `getSession()` only. The service worker caches page props, and its header
+  rule cannot see a token in a body
+  ([#429](https://github.com/docs-plus/docs.plus/issues/429)).
+- **Sign-out clears chat drafts and the old document keys.** Once
+  `signOut()` leaves no session, `useSignOut` awaits `clearAllComposerDrafts()`.
+  It cancels queued draft writes first, so the pagehide flush cannot write one
+  back. Sign-out also removes the unused `docId`, `padName`, `slug` and
+  `title` keys, and `useDocumentMetadata` is deleted
+  ([#444](https://github.com/docs-plus/docs.plus/issues/444)).
 - **A live chat message takes its author's avatar from the profile, not from
   presence.** Any client can send a presence payload. A forged one could change
   the avatar on another user's live messages, and the name and avatar in the
 
@@ -206,7 +206,7 @@ Follow industry overlay UX (Material, Apple HIG, Radix/shadcn) and dim-not-lift
 - Workbox `urlPattern` matchers must be self-contained (next-pwa serializes via `Function.toString()` — no module-scope refs). Verify a matcher change under **Node** (the actual Next build runtime), never `bun -e`. Bun's `Function.prototype.toString()` re-serializes with `const` bindings inlined. A matcher that reads `const isSameOrigin = …; return !isSameOrigin` therefore reads back mutated, and throws a false serialization/assertion failure that Node (source-accurate) passes.
 - Deploy-boundary chunk/SW GlitchTip noise: `chunkLoadRecovery.ts` one-shot reload (10s `sessionStorage` cooldown) + `instrumentation-client.ts` `beforeSend` drops SW-lifecycle and auto-recovered chunk errors. Keep the chunk pattern lists in sync across both. Rebuild the webapp for `sw.js` changes.
 - **PWA path guards (epic #249).** Keep #257, #259, #260 and #261 open as standing "do not build" cards. Do not add `capture` or a camera UI to the profile photo. Do not add folders; Settings → Documents is the one library, and Home and Command jump are doors into it. Do not add visit-based Recents; Last opened stays an owner-only stamp. The REST list sorts by it on the Owner live list and the Merged list. There, a row the caller does not own sorts as never opened. Joined lists memberships, not visits. Open pads with `router.push`, never `_blank`, so `launch_handler: navigate-existing` holds.
-- **Workbox rule 0 keeps authenticated requests out of Cache Storage.** Any request with a `token` or `Authorization` header is `NetworkOnly`. supabase-js sends `Authorization` even when signed out, so every Supabase REST GET skips the cache. Keep the rule first in `workbox-runtime-caching.js`, ahead of the adapted defaults. The MCP status probe (`/.well-known/oauth-protected-resource`) is `NetworkOnly` right after it, so a cached answer never shows Online while the server is down.
+- **Workbox rule 0 keeps authenticated requests out of Cache Storage.** Any request with a `token` or `Authorization` header is `NetworkOnly`. supabase-js sends `Authorization` even when signed out, so every Supabase REST GET skips the cache. Keep the rule first in `workbox-runtime-caching.js`, ahead of the adapted defaults. The MCP status probe (`/.well-known/oauth-protected-resource`) is `NetworkOnly` right after it, so a cached answer never shows Online while the server is down. The rule reads request headers only. Page props sit in the `others` cache, so they must never carry a token or another secret (#429).
 - **Inbound share is `/receive`.** The manifest `share_target` posts there. `public/service-worker.js` handles only `POST /receive`: it stashes the file and redirects. `/receive` is a utility route and a reserved slug, so it never becomes a pad. Do not add `file_handlers` or change manifest `id` or `launch_handler`.
 
 ### Next Product APIs
@@ -369,7 +369,7 @@ Follow industry overlay UX (Material, Apple HIG, Radix/shadcn) and dim-not-lift
 - **The patch-versus-invalidate rule.** A remove or an in-place patch keeps the loaded rows equal to a server prefix, so it patches. An insert whose server position the client cannot know must refetch instead. **Duplicate is that case and it must NOT patch.** `duplicateDocument` never writes `lastOpenedAt`, and `documents.service.ts` sorts that column `nulls: 'last'`, so under `lastOpenedAt_desc` a copy belongs at the end, past the loaded window. A patch put it near the top and the refetch then removed it, so the row flashed and vanished. `addDuplicate()` takes no argument for that reason.
 - **A debounce guarding a NETWORK write must `flush()` on unmount. A debounce guarding LOCAL state must `cancel()`.** `NotificationsSection.tsx` cancelled a preference write, and `ModalContent` unmounts its children on close, so closing the panel inside 500 ms discarded the patch silently. Its line is the only caller of `updateNotificationPreferences` in the webapp, so nothing rescued it. `DocumentsSection.tsx` and `ProfileSection.tsx` both cancel correctly, because both guard local state. A sweep that unifies the three would reintroduce the data loss.
   - The cleanup body must stay braced. The flushed function is `async`, so an expression-bodied arrow hands React a Promise as a cleanup value.
-  - **Sign-out flushes a pending patch first, and `keepalive` is NOT the fix.** After `signOut()` the session is gone, and `update_notification_preferences` raises `42501 unauthenticated`, so no transport option can save it. The fix is ordering. The open `NotificationsSection` registers its debounced save in `components/settings/utils/pendingPreferenceWrites.ts`, and `useSignOut` awaits `flushPendingPreferenceWrites()` before `signOut()`. Keep that order. Sign-out also unregisters this device's push subscription (`unregisterPushSubscription`) before `signOut()`, best effort, because that RPC needs the session too (#417).
+  - **Sign-out flushes a pending patch first, and `keepalive` is NOT the fix.** After `signOut()` the session is gone, and `update_notification_preferences` raises `42501 unauthenticated`, so no transport option can save it. The fix is ordering. The open `NotificationsSection` registers its debounced save in `components/settings/utils/pendingPreferenceWrites.ts`, and `useSignOut` awaits `flushPendingPreferenceWrites()` before `signOut()`. Keep that order. Sign-out also unregisters this device's push subscription (`unregisterPushSubscription`) before `signOut()`, best effort, because that RPC needs the session too (#417). Once `signOut()` leaves no session, `useSignOut` awaits `clearAllComposerDrafts()` and removes the four old localStorage keys (`docId`, `padName`, `slug`, `title`). Only then does it reload (#444).
 - **A setting saved anywhere reaches every open tab and device of that person** (2026-09-30). `hooks/useProfileSync.ts` listens on the private `profile:<uid>` topic and also refreshes on `visibilitychange`, because Realtime keeps no backlog. It copies only `SYNCED_FIELDS` into `authStore.profile`, never `status`, and only from the newest read. It invalidates `notificationPreferencesKey(userId)`, keyed by user so one person never sees another's cache. It mounts as the null `ProfileSync` inside `AppQueryClientRoot`'s provider, above the lazy `DocumentShellInner`, so sync starts with the page. Private topics subscribe through `utils/supabase/subscribePrivateTopic.ts`, because realtime-js `channel()` returns a same-topic channel that is still leaving.
   - **Notifications reads the `useNotificationPreferences` query, never `profile_data`.** Unconfirmed edits sit in `localEdits` and win over the query, so a refetch or the writer's own echo never flips a toggle back. The RPC's merged return goes into the cache with `setQueryData`, after `cancelQueries` stops any read that began before the commit; the writer's own echo refetches. The controls stay live while a save is in flight. `DEFAULT_PREFERENCES` mirrors the SQL fallbacks and leaves out `timezone`, so a missing timezone still reads as missing and gets written.
   - **`ProfileSection` takes a remote change only into a field the person has not edited.** The theme is per browser: `themeStore` rehydrates on the `storage` event and repaints through `applyThemeToDom`. Push subscription and notification permission are per browser too, and never sync.
 
@@ -89,6 +89,7 @@ if (adapted !== EXPECTED_ADAPTED) {
 // A request with a token or Authorization header never enters Cache Storage.
 // supabase-js always sends Authorization. Sign-out does not clear the cache.
 // It sits first so rule 13 never sees these.
+// This rule reads request headers only, so page props must never carry a token.
 const credentialedRequestRule = {
   urlPattern: ({ request }) =>
     Boolean(request?.headers?.has('token') || request?.headers?.has('authorization')),
 
@@ -73,7 +73,7 @@ Moved verbatim out of the repo-root [AGENTS.md](../../../../../AGENTS.md) so it
 - After submit, `cleanupAfterSubmit` in `useComposerSubmit` decides the refocus. On a phone or tablet, `keepKeyboardAfterSubmit` (`isMobile`) is true, so the editor always refocuses. On desktop it refocuses only if the editor was the active element. Neither path refocuses while the emoji panel or the link dialog is open. Enter-key submits keep focus naturally.
 - `useEditor(...)` in `components/chatroom/components/MessageComposer/hooks/useTiptapEditor.ts` is built once per mount. Its `onUpdate` reads `workspaceId` and `channelId` from `draftCtxRef.current`, and an effect keeps that ref current. Do not capture either id in the closure, or drafts cross channels.
 - `prepareOutboundContent` must return stable `htmlChunks: string[]` / `textChunks: string[]` fields on both the happy and empty paths, so callers never need an `as` cast. It must not return a nested `chunks` wrapper.
-- **Draft vs mode memory.** Text/HTML drafts live in IndexedDB (`messageComposerDB` via `syncComposerDraft` / `discardComposerDraft`). When IndexedDB fails to open, `messageComposerDB` keeps them in a module-level `Map` instead. Zustand `*MessageMemory` holds reply/edit/comment UI modes only — do not reintroduce `messageDraftMemory`. Edit and comment modes never write the saved draft. When either mode ends, the composer loads the saved draft again. An edit has its own attachment list under the `::edit` key, so an edit never touches the draft's attachments or their uploads. A comment shows the saved draft's tiles, but the files it adds never enter the saved draft.
+- **Draft vs mode memory.** Text/HTML drafts live in IndexedDB (`messageComposerDB` via `syncComposerDraft` / `discardComposerDraft`). When IndexedDB fails to open, `messageComposerDB` keeps them in a module-level `Map` instead. Zustand `*MessageMemory` holds reply/edit/comment UI modes only — do not reintroduce `messageDraftMemory`. Edit and comment modes never write the saved draft. When either mode ends, the composer loads the saved draft again. An edit has its own attachment list under the `::edit` key, so an edit never touches the draft's attachments or their uploads. A comment shows the saved draft's tiles, but the files it adds never enter the saved draft. The draft key has no user id on purpose. Sign-out clears every draft through `clearAllComposerDrafts`, which cancels queued writes first, because the pagehide flush would write them back (#444).
 - **Mode edges come from one table.** `useComposerModeEdge` turns the mode kind (`none`, `reply`, `edit`, `comment`) into one edge per change. The first edge of a mount starts from `mount`. The pure `composerModeEdgeAction` decides the draft load (`keep`, `fill`, `replace`) and the upload discard. `useComposerAttachmentLifecycle` reads that edge. `useComposerDraft` reads a second edge in which reply counts as none, so a reply toggle never re-runs the draft load. The draft load and the reply and comment upload discard come from the table; do not infer them from a previous-mode ref again. Leaving edit still cancels the `::edit` list through its own effect on `editMessageMemory`.
   - An edge that leaves reply or comment deletes the uploads that the mode added. A switch between reply and comment counts as leaving.
   - Entering a mode never discards, because the failed-comment restore records its files again after the `await`.
 
@@ -1,7 +1,6 @@
 import HeadSeo from '@components/HeadSeo'
 import DocumentLayouts from '@components/pages/document/layouts/DocumentLayouts'
 import { GlobalDialog } from '@components/ui/GlobalDialog'
-import useDocumentMetadata from '@hooks/useDocumentMetadata'
 import useInitiateDocumentAndWorkspace from '@hooks/useInitiateDocumentAndWorkspace'
 import useJoinWorkspace from '@hooks/useJoinWorkspace'
 import useMapDocumentAndWorkspace from '@hooks/useMapDocumentAndWorkspace'
@@ -11,37 +10,26 @@ import { GoogleOneTapLayout } from '@layouts'
 import { closeOpenChatRoom } from '@services/openHeadingChatroom'
 import { useStore } from '@stores'
 import { ensureEmojiData } from '@utils/ensureEmojiData'
-import { useRouter } from 'next/router'
 import { useEffect, useLayoutEffect } from 'react'
 
 type DocumentPageProps = {
   docMetadata: any
   isMobile: boolean
   deviceType?: 'desktop' | 'mobile' | 'tablet'
-  accessToken?: string | null
 }
 
-const DocumentPage = ({
-  docMetadata,
-  isMobile,
-  deviceType = 'desktop',
-  accessToken
-}: DocumentPageProps) => {
-  const router = useRouter()
-  const slugs = (router.query.slugs as string[]) || []
+const DocumentPage = ({ docMetadata, isMobile, deviceType = 'desktop' }: DocumentPageProps) => {
   const { loading: channelsLoading } = useMapDocumentAndWorkspace(docMetadata)
 
   // The page's single gate: set synchronously at provider creation (no network wait),
   // nulled on destroy (doc switch). Channel, join, and sync state must never re-gate
   // this tree — once the layout mounts, the editor is never unmounted for the same doc.
   const provider = useStore((state) => state.settings.hocuspocusProvider)
 
-  useDocumentMetadata(slugs, docMetadata)
   useInitiateDocumentAndWorkspace(docMetadata)
   useYdocAndProvider({
     documentId: docMetadata.documentId,
     slug: docMetadata.slug,
-    accessToken: accessToken ?? '',
     deviceType
   })
   useJoinWorkspace({ documentId: docMetadata.documentId, channelsLoading })
 
@@ -1,5 +1,6 @@
 import { signOut } from '@api'
 import * as toast from '@components/toast'
+import { clearAllComposerDrafts } from '@db/messageComposerDB'
 import { isPushSupported, unregisterPushSubscription } from '@utils/push-notifications'
 import { supabaseClient } from '@utils/supabase'
 import { useState } from 'react'
@@ -29,6 +30,14 @@ export const useSignOut = () => {
         return
       }
     }
+    // After signOut, so a failed sign-out keeps the drafts. The four keys are no longer
+    // written; this removes them from browsers that still hold them.
+    await clearAllComposerDrafts()
+    try {
+      for (const key of ['docId', 'padName', 'slug', 'title']) localStorage.removeItem(key)
+    } catch {
+      // Blocked storage holds no keys to remove.
+    }
     // The returning-person row survives sign-out, or it would almost never appear.
     // "Not you?" on that row drops it.
     // Consume the takeover's history entry first, or back after reload re-lands on it.
 
@@ -277,3 +277,19 @@ export function cancelPendingWrites(): void {
   debouncedWriters.forEach((debouncedFn) => debouncedFn.cancel())
   debouncedWriters.clear()
 }
+
+/**
+ * The draft key has no user id, so the next person on this browser would see these drafts.
+ * Cancel first, or the pagehide flush writes a queued draft back after the clear.
+ */
+export async function clearAllComposerDrafts(): Promise<void> {
+  cancelPendingWrites()
+  memory.clear()
+  try {
+    const db = await getDB()
+    await db.composer.clear()
+  } catch (err) {
+    // Drafts may remain on disk. With no IndexedDB, the memory map was the only store.
+    console.warn('[composerDB] clear failed', err)
+  }
+}
@@ -46,14 +46,12 @@ const requestPersistentStorage = () => {
 interface UseYdocAndProviderProps {
   documentId: string
   slug: string
-  accessToken: string
   deviceType?: DeviceType
 }
 
 const useYdocAndProvider = ({
   documentId,
   slug,
-  accessToken,
   deviceType = 'desktop'
 }: UseYdocAndProviderProps): void => {
   const ydocRef = useRef(new Y.Doc())
@@ -122,7 +120,7 @@ const useYdocAndProvider = ({
           )
         connectedWithSessionRef.current = Boolean(data.session?.user)
         return JSON.stringify({
-          accessToken: data.session?.access_token ?? (error ? '' : (accessToken ?? '')),
+          accessToken: data.session?.access_token ?? '',
           slug,
           deviceType
         })