1. Setting the exported snapshot buffer to undefined should encourage the GC to remove it from memory later. A noticeable improvement occured.
2. A genuinely significant improvement would be to exchange the snapshots over socketio instead of the node-phantomjs library's bridge (which is seriously inefficient and a minefield of memory leaks).

Getting OTP would be wonderful. I do own a Yubikey Edge, which is configured for OATH-HOTP and Challenge-Response HMAC-SHA1 (and U2F). I do use Challenge-Response for offline things like keepass, LUKS or Laptop-Login.

Unscientific observations so far:

I haven't come across WebDAV servers that support ACLs yet, so the access control in Manticore so far is the best I could do.

In T67#5815, @grote wrote:

would we require including the ability to invite people to edit documents they do not have the appropriate (IMAP-level) write access to?

All other collaboration features require local accounts, so can this one for the time being.