Function start_ws_server 

pub fn start_ws_server(
    hub: Arc<WsHub>,
    sessions: Arc<SessionStore>,
    port: u16,
    snapshot_fetcher: Option<SnapshotFetcher>,
)

Start the WebSocket server on the given port.

The accept loop runs on the calling thread (blocking). Each accepted connection spawns a lightweight reader thread with a 64KB stack. Broadcast writes are handled by the shard worker threads, not by per-client threads.

The session store is required: every connection must present a valid bearer token (Authorization header or bearer.<token> subprotocol — browsers can’t set WS headers directly). Previously the notifier hub accepted any connection and streamed every ChangeEvent/presence event to it, which was a silent read-policy bypass.

snapshot_fetcher is optional — when present, the reader will ship the current CRDT snapshot to the subscribing client immediately on crdt-subscribe, so the new tab sees the latest converged state without waiting for the next write. When absent, subscribe is still recorded but the catch-up frame is skipped.