@agent-native/core-corpus 0.214.0 → 0.216.0

package/corpus/templates/content/actions/restore-document-version.ts

@@ -11,10 +11,7 @@ import { requireDocumentRequestActor } from "../server/lib/document-attribution.
 import { bodyRevisionForContent } from "../server/lib/document-body-revision.js";
 import { documentChangeResource } from "../server/lib/document-change-resource.js";
 import { recordDocumentHistoryTransition } from "../server/lib/document-history.js";
-import {
-  lockDocumentMetadataDatabase,
-  nextDocumentMetadataUpdatedAt,
-} from "../server/lib/document-metadata-updated-at.js";
+import { nextDocumentMetadataUpdatedAt } from "../server/lib/document-metadata-updated-at.js";
 import { propagateDocumentTitle } from "../server/lib/document-title-propagation.js";
 import { nextDocumentUpdatedAt } from "../server/lib/document-updated-at.js";
 import {
@@ -29,10 +26,12 @@ import {
 import { reconcileInlineDatabasesForDocumentWithDb } from "./_content-database-lifecycle.js";
 import { listContentOrganizationMemberships } from "./_content-space-access.js";
 import {
+  assertEditableDocument,
   documentContentHash,
   documentRevisionToken,
 } from "./_document-edit-mutation.js";
 import { flushOpenDocumentEditorToSql } from "./_document-flush.js";
+import { lockDocumentForSave } from "./_document-save-locks.js";
 import { assertSourceAllowsPageEdit } from "./_document-source.js";
 
 function isLinkedLocalSource(
@@ -104,7 +103,10 @@ export default defineAction({
       )
       .limit(1);
     const [beforeFlush] = await db
-      .select({ updatedAt: schema.documents.updatedAt })
+      .select({
+        trashedAt: schema.documents.trashedAt,
+        updatedAt: schema.documents.updatedAt,
+      })
       .from(schema.documents)
       .where(
         and(
@@ -113,12 +115,7 @@ export default defineAction({
         ),
       )
       .limit(1);
-    if (!beforeFlush) {
-      throw new ActionContractError("Document not found.", {
-        errorCode: "DOCUMENT_NOT_FOUND",
-        statusCode: 404,
-      });
-    }
+    assertEditableDocument(beforeFlush);
     if (beforeFlush.updatedAt !== args.expectedUpdatedAt) {
       throw new ActionContractError(
         "The document changed after this restore was prepared.",
@@ -136,6 +133,7 @@ export default defineAction({
     const [afterFlush] = await db
       .select({
         title: schema.documents.title,
+        trashedAt: schema.documents.trashedAt,
         updatedAt: schema.documents.updatedAt,
       })
       .from(schema.documents)
@@ -146,12 +144,7 @@ export default defineAction({
         ),
       )
       .limit(1);
-    if (!afterFlush) {
-      throw new ActionContractError("Document not found.", {
-        errorCode: "DOCUMENT_NOT_FOUND",
-        statusCode: 404,
-      });
-    }
+    assertEditableDocument(afterFlush);
     const expectedUpdatedAt = afterFlush.updatedAt;
     const requestUserEmail = getRequestUserEmail();
     const titleOrganizationIds =
@@ -165,21 +158,15 @@ export default defineAction({
     let softDeletedDatabaseIds: string[] = [];
     const updated = await db.transaction(async (rawTx) => {
       const tx = rawTx as any;
-      const lockedDatabaseId = await lockDocumentMetadataDatabase({
-        db: tx as unknown as ReturnType<typeof getDb>,
+      const {
+        databaseId: lockedDatabaseId,
+        lockedDatabaseIds,
+        lockedMembershipIds,
+      } = await lockDocumentForSave(tx as unknown as ReturnType<typeof getDb>, {
         documentId,
         ownerEmail,
+        body: true,
       });
-      await tx
-        .select({ id: schema.documents.id })
-        .from(schema.documents)
-        .where(
-          and(
-            eq(schema.documents.id, documentId),
-            eq(schema.documents.ownerEmail, ownerEmail),
-          ),
-        )
-        .for("update");
       const [current] = await tx
         .select()
         .from(schema.documents)
@@ -190,12 +177,7 @@ export default defineAction({
           ),
         )
         .limit(1);
-      if (!current) {
-        throw new ActionContractError("Document not found.", {
-          errorCode: "DOCUMENT_NOT_FOUND",
-          statusCode: 404,
-        });
-      }
+      assertEditableDocument(current);
       if (isLinkedLocalSource(documentId, current)) {
         linkedLocalRestoreUnsupported();
       }
@@ -249,6 +231,7 @@ export default defineAction({
       const primaryBlocksFields = await lockPrimaryBlocksFields(
         tx as unknown as ReturnType<typeof getDb>,
         documentId,
+        { heldMembershipIds: lockedMembershipIds },
       );
       const applied = await tx
         .update(schema.documents)
@@ -316,6 +299,7 @@ export default defineAction({
             content: version.content,
             ownerEmail,
             now,
+            lockedDatabaseIds,
           });
       }
       const [restored] = await tx

package/corpus/templates/content/actions/restore-document.ts

@@ -3,6 +3,7 @@ import { writeAppState } from "@agent-native/core/application-state";
 import { z } from "zod";
 
 import { getDb } from "../server/db/index.js";
+import { documentChangeResource } from "../server/lib/document-change-resource.js";
 import { setupError } from "./_database-setup-mutation.js";
 import {
   assertPageLifecycleTarget,
@@ -15,8 +16,9 @@ import {
 } from "./_document-lifecycle.js";
 import { assertDocumentMutationAccess } from "./_document-mutation-access.js";
 import {
-  lockDatabasesForRestore,
+  lockLifecycleGroup,
   restoreDocumentSubtree,
+  retryRestoreOnMembershipChange,
 } from "./delete-document.js";
 
 const guardedRestoreSchema = z
@@ -50,61 +52,69 @@ async function restoreDocumentWithReceipt(
 ) {
   const access = await assertDocumentMutationAccess(input.id, "admin");
   const ownerEmail = access.resource.ownerEmail as string;
-  const result = await getDb().transaction(async (transaction) => {
-    const tx = transaction as unknown as ReturnType<typeof getDb>;
-    const lockedDatabaseIds = await lockDatabasesForRestore(
-      tx,
-      input.id,
-      ownerEmail,
-    );
-    const before = await lockLifecycleDocument(tx, input.id, ownerEmail);
-    const { claim, replay } = await claimDocumentLifecycleIntent(
-      tx,
-      "restore-document",
-      input.id,
-      input.idempotencyKey,
-      input,
-    );
-    if (replay) return replay;
-    await assertPageLifecycleTarget(tx, input.id, "restore-document");
-    if (!before.trashedAt)
-      return finishDocumentLifecycleIntent(tx, claim, "unchanged", before, []);
-    if (before.trashRootId !== input.id)
-      setupError(
-        "PARENT_IN_TRASH",
-        `This page moved to Trash with "${before.trashRootId}". Restore that Trash item instead.`,
-        400,
+  const result = await retryRestoreOnMembershipChange(() =>
+    getDb().transaction(async (transaction) => {
+      const tx = transaction as unknown as ReturnType<typeof getDb>;
+      const locks = await lockLifecycleGroup(tx, {
+        operation: "restore",
+        roots: [{ id: input.id, ownerEmail }],
+      });
+      const before = await lockLifecycleDocument(tx, input.id, ownerEmail);
+      const { claim, replay } = await claimDocumentLifecycleIntent(
+        tx,
+        "restore-document",
+        input.id,
+        input.idempotencyKey,
+        input,
       );
-    if (before.trashedAt !== input.expectedTrashedAt)
-      setupError(
-        "TRASH_REVISION_CONFLICT",
-        "The Trash item changed after you read it. List Trash again and retry with its current trashedAt.",
+      if (replay) return replay;
+      await assertPageLifecycleTarget(tx, input.id, "restore-document");
+      if (!before.trashedAt)
+        return finishDocumentLifecycleIntent(
+          tx,
+          claim,
+          "unchanged",
+          before,
+          [],
+        );
+      if (before.trashRootId !== input.id)
+        setupError(
+          "PARENT_IN_TRASH",
+          `This page moved to Trash with "${before.trashRootId}". Restore that Trash item instead.`,
+          400,
+        );
+      if (before.trashedAt !== input.expectedTrashedAt)
+        setupError(
+          "TRASH_REVISION_CONFLICT",
+          "The Trash item changed after you read it. List Trash again and retry with its current trashedAt.",
+        );
+      const restored = await restoreDocumentSubtree(
+        tx,
+        input.id,
+        ownerEmail,
+        locks,
       );
-    const restored = await restoreDocumentSubtree(
-      tx,
-      input.id,
-      ownerEmail,
-      lockedDatabaseIds,
-    );
-    const after = await lockLifecycleDocument(tx, input.id, ownerEmail);
-    if (after.trashedAt || !restored.includes(input.id))
-      setupError(
-        "READBACK_UNAVAILABLE",
-        "The page could not be verified as restored, so the change was rolled back.",
+      const after = await lockLifecycleDocument(tx, input.id, ownerEmail);
+      if (after.trashedAt || !restored.includes(input.id))
+        setupError(
+          "READBACK_UNAVAILABLE",
+          "The page could not be verified as restored, so the change was rolled back.",
+        );
+      return finishDocumentLifecycleIntent(
+        tx,
+        claim,
+        "restored",
+        after,
+        restored,
       );
-    return finishDocumentLifecycleIntent(
-      tx,
-      claim,
-      "restored",
-      after,
-      restored,
-    );
-  });
+    }),
+  );
   await refreshAfterDocumentLifecycle(result.receipt);
   return { success: true, ...result.value, receipt: result.receipt };
 }
 
 export default defineAction({
+  changeResource: (input) => documentChangeResource(input.id),
   description:
     "Restore one page and the sub-pages trashed with it from recoverable Trash, guarded by the item's exact trashedAt and an idempotency key. Pass the Trash root; returns a receipt with the restored page ids. Collections use restore-content-database.",
   mcpTool: true,
@@ -130,11 +140,13 @@ export default defineAction({
     // Checked as moving it to Trash is: whoever could trash the page, or is
     // offered Restore on its access screen, must be able to restore it.
     const access = await assertDocumentMutationAccess(id, "admin");
-    const restored = await getDb().transaction((tx) =>
-      restoreDocumentSubtree(
-        tx as unknown as ReturnType<typeof getDb>,
-        id,
-        access.resource.ownerEmail as string,
+    const restored = await retryRestoreOnMembershipChange(() =>
+      getDb().transaction((tx) =>
+        restoreDocumentSubtree(
+          tx as unknown as ReturnType<typeof getDb>,
+          id,
+          access.resource.ownerEmail as string,
+        ),
       ),
     );
     if (restored.length === 0) throw new Error("Document is not in Trash");

package/corpus/templates/content/actions/rollback-created-slash-document.ts

@@ -7,10 +7,7 @@ import { z } from "zod";
 import { getDb, schema } from "../server/db/index.js";
 import { requireDocumentRequestActor } from "../server/lib/document-attribution.js";
 import { assertDocumentMutationAccess } from "./_document-mutation-access.js";
-import {
-  lockDatabasesForTrash,
-  trashDocumentSubtree,
-} from "./delete-document.js";
+import { lockLifecycleGroup, trashDocumentSubtree } from "./delete-document.js";
 
 const ROLLBACK_WINDOW_MS = 5 * 60 * 1000;
 
@@ -81,6 +78,13 @@ export default defineAction({
     const db = getDb();
     const deletedIds = await db.transaction(async (transaction) => {
       const tx = transaction as unknown as ReturnType<typeof getDb>;
+      // The new page's collections, then it and its parent, in the one
+      // row-lock order Trash and restore use.
+      const locks = await lockLifecycleGroup(tx, {
+        operation: "trash",
+        roots: [{ id, ownerEmail }],
+        alsoLockDocumentIds: [parentId],
+      });
       const [parent] = await tx
         .select({ content: schema.documents.content })
         .from(schema.documents)
@@ -90,8 +94,7 @@ export default defineAction({
             eq(schema.documents.ownerEmail, ownerEmail),
             isNull(schema.documents.trashedAt),
           ),
-        )
-        .for("update");
+        );
       const [child] = await tx
         .select({
           createdBy: schema.documents.createdBy,
@@ -107,8 +110,7 @@ export default defineAction({
             eq(schema.documents.id, id),
             eq(schema.documents.ownerEmail, ownerEmail),
           ),
-        )
-        .for("update");
+        );
       if (!parent) {
         throw new ActionContractError(
           "The new page is unavailable for rollback.",
@@ -166,14 +168,7 @@ export default defineAction({
         hasDatabaseItems: !!databaseItem || !!database?.systemRole,
         now: Date.now(),
       });
-      const lockedDatabaseIds = await lockDatabasesForTrash(tx, id, ownerEmail);
-      return trashDocumentSubtree(
-        tx,
-        id,
-        ownerEmail,
-        undefined,
-        lockedDatabaseIds,
-      );
+      return trashDocumentSubtree(tx, id, ownerEmail, undefined, locks);
     });
     if (deletedIds.length > 0) {
       await writeAppState("refresh-signal", { ts: Date.now() });

package/corpus/templates/content/actions/set-document-property.ts

@@ -25,6 +25,8 @@ import {
 import { lockContentDatabaseMutation } from "./_content-database-mutation-lock.js";
 import { resolveContentDocumentAccess } from "./_content-document-access.js";
 import { lockDatabaseMemberships } from "./_database-membership-lock.js";
+import { assertEditableDocument } from "./_document-edit-mutation.js";
+import { NFM_CONTAINER_SYNTAX } from "./_nfm-syntax.js";
 import {
   getDatabaseById,
   listPropertiesForDatabaseDocuments,
@@ -32,6 +34,7 @@ import {
   normalizedValueJson,
 } from "./_property-utils.js";
 import { validateRelationWrite } from "./_relation-values.js";
+import { lockDocumentRows } from "./_row-lock-order.js";
 
 async function assertPropertyWritableByRowMutation(
   db: ReturnType<typeof getDb>,
@@ -93,7 +96,8 @@ export default defineAction({
     value: z
       .unknown()
       .describe(
-        "Value for the property type; Blocks fields take an NFM string (one block per line, <br> for hard breaks, <empty-block/> for empty paragraphs)",
+        "Value for the property type; Blocks fields take an NFM string: one block per line, <br> for hard breaks, <empty-block/> for empty paragraphs. " +
+          NFM_CONTAINER_SYNTAX,
       ),
     expectedBlocksFieldRevision: z
       .number()
@@ -185,6 +189,16 @@ export default defineAction({
           tx as unknown as ReturnType<typeof getDb>,
           documentId,
         );
+        // A Blocks value is the page's body or one of its fields, so a page
+        // in Trash refuses it as edit-document does.
+        await lockDocumentRows(tx as unknown as ReturnType<typeof getDb>, [
+          documentId,
+        ]);
+        const [lockedPage] = await tx
+          .select({ trashedAt: schema.documents.trashedAt })
+          .from(schema.documents)
+          .where(eq(schema.documents.id, documentId));
+        assertEditableDocument(lockedPage);
         const [lockedDefinition] = await tx
           .select()
           .from(schema.documentPropertyDefinitions)

package/corpus/templates/content/actions/share-local-file-document.ts

@@ -216,13 +216,15 @@ export default defineAction({
       });
 
       await ensureDocumentFilesMembership(db, existing.id, now);
-      await setFavoriteMembership({
-        db,
-        userEmail,
-        documentId: existing.id,
-        favorite: localDocument.isFavorite,
-        now,
-      });
+      await db.transaction((tx) =>
+        setFavoriteMembership({
+          db: tx,
+          userEmail,
+          documentId: existing.id,
+          favorite: localDocument.isFavorite,
+          now,
+        }),
+      );
 
       const [row] = await db
         .select()
@@ -293,13 +295,15 @@ export default defineAction({
           );
         });
         await ensureDocumentFilesMembership(db, documentId, now);
-        await setFavoriteMembership({
-          db,
-          userEmail,
-          documentId,
-          favorite: localDocument.isFavorite,
-          now,
-        });
+        await db.transaction((tx) =>
+          setFavoriteMembership({
+            db: tx,
+            userEmail,
+            documentId,
+            favorite: localDocument.isFavorite,
+            now,
+          }),
+        );
       },
     );
 

package/corpus/templates/content/actions/suggest-document-edit.ts

@@ -16,6 +16,7 @@ import { z } from "zod";
 
 import { resolveDocumentTextEdits } from "../shared/document-text-edits.js";
 import {
+  findReplaceSuggestionSummary,
   markdownSuggestionOperationsForFindReplace,
   markdownSuggestionOperationSummary,
 } from "../shared/suggestion-diff.js";
@@ -234,9 +235,7 @@ export default defineAction({
 
     const effectiveSummary =
       args.summary?.trim() ||
-      (args.replace
-        ? `Replace "${args.find.slice(0, 80)}" with "${args.replace.slice(0, 80)}"`
-        : `Delete "${args.find.slice(0, 80)}"`);
+      findReplaceSuggestionSummary(args.find, args.replace ?? "");
     if (args.idempotencyKey) {
       await ensureSuggestionTables();
       const receipt = await getSuggestionByCreationKey(

package/corpus/templates/content/actions/sync-local-folder-source.ts

@@ -24,7 +24,10 @@ import { setFavoriteMembership } from "./_content-favorites.js";
 import { ensureDocumentsFilesMembership } from "./_content-files.js";
 import { resolveContentSpaceAccess } from "./_content-space-access.js";
 import { provisionContentSpaces } from "./_content-spaces.js";
-import { lockDatabaseMemberships } from "./_database-membership-lock.js";
+import {
+  lockDatabaseMemberships,
+  lockExistingDatabaseMemberships,
+} from "./_database-membership-lock.js";
 import {
   LOCAL_FOLDER_SOURCE_TYPE,
   localFolderObservedRevision,
@@ -32,6 +35,7 @@ import {
   localFolderSourceIdentityFromMetadata,
   normalizeLocalFolderSourceIdentity,
 } from "./_local-folder-source.js";
+import { lockDocumentRows } from "./_row-lock-order.js";
 
 const MAX_SOURCE_FILES = 500;
 const MAX_SOURCE_FILE_BYTES = 2 * 1024 * 1024;
@@ -517,6 +521,36 @@ export default defineAction({
           (row) => !currentDocumentIds.has(row.documentId),
         );
         classifyPlans(transactionSnapshot);
+        // The pages' Files memberships, then the pages, each by id, as a save
+        // takes them: the writes below update pages before the memberships.
+        const existingPageIds = plans
+          .filter((plan) => !plan.conflict && plan.existing)
+          .map((plan) => plan.id);
+        const writtenPageIds = [
+          ...existingPageIds,
+          ...missingRows.map((row) => row.documentId),
+        ];
+        // Add a missing Files membership before locking any page. A page has
+        // one per Files database, so once this transaction holds or inserts
+        // it, a concurrent insert waits on this one; if it were added after
+        // the pages, the later membership lock would wait on its writer.
+        await ensureDocumentsFilesMembership(tx, existingPageIds, now);
+        if (writtenPageIds.length > 0) {
+          const memberships = await tx
+            .select({ id: schema.contentDatabaseItems.id })
+            .from(schema.contentDatabaseItems)
+            .where(
+              and(
+                eq(schema.contentDatabaseItems.databaseId, target.database.id),
+                inArray(schema.contentDatabaseItems.documentId, writtenPageIds),
+              ),
+            );
+          await lockExistingDatabaseMemberships(tx, [
+            ...memberships.map((membership: { id: string }) => membership.id),
+            ...missingRows.map((row) => row.databaseItemId),
+          ]);
+          await lockDocumentRows(tx, writtenPageIds);
+        }
         for (const plan of plans) {
           if (plan.conflict) {
             const changeSetId = opaqueId(

package/corpus/templates/content/actions/undo-content-import.ts

@@ -13,10 +13,7 @@ import { importedStateFingerprint } from "../server/lib/content-import.js";
 import { requireDocumentRequestActor } from "../server/lib/document-attribution.js";
 import { flushOpenDocumentEditorToSql } from "./_document-flush.js";
 import { assertDocumentMutationAccess } from "./_document-mutation-access.js";
-import {
-  lockDatabasesForTrash,
-  trashDocumentSubtree,
-} from "./delete-document.js";
+import { lockLifecycleGroup, trashDocumentSubtree } from "./delete-document.js";
 
 export default defineAction({
   description:
@@ -90,6 +87,19 @@ export default defineAction({
         );
       }
       const importedIds = new Set(records.map((record) => record.documentId));
+      // Collections before pages: every imported page and its subtree, in
+      // the one row-lock order Trash and restore use.
+      const owners = await tx
+        .select({
+          id: schema.documents.id,
+          ownerEmail: schema.documents.ownerEmail,
+        })
+        .from(schema.documents)
+        .where(inArray(schema.documents.id, [...importedIds]));
+      const locks = await lockLifecycleGroup(tx, {
+        operation: "trash",
+        roots: owners,
+      });
       const current = await tx
         .select({
           id: schema.documents.id,
@@ -104,8 +114,7 @@ export default defineAction({
           trashedAt: schema.documents.trashedAt,
         })
         .from(schema.documents)
-        .where(inArray(schema.documents.id, [...importedIds]))
-        .for("update");
+        .where(inArray(schema.documents.id, [...importedIds]));
       const collections = await tx
         .select({ documentId: schema.contentDatabases.documentId })
         .from(schema.contentDatabases)
@@ -133,17 +142,12 @@ export default defineAction({
         if (changed.includes(page)) continue;
         // The page's owner now, not at import: moving a page between
         // workspaces makes the mover its owner.
-        const lockedDatabaseIds = await lockDatabasesForTrash(
-          tx,
-          page.id,
-          page.ownerEmail,
-        );
         const subtree = await trashDocumentSubtree(
           tx,
           page.id,
           page.ownerEmail,
           undefined,
-          lockedDatabaseIds,
+          locks,
           ctx?.caller,
         );
         if (!subtree.includes(page.id)) {

package/corpus/templates/content/actions/update-content-database-view.ts

@@ -47,6 +47,8 @@ const filterSchema = z
     value: z.string(),
     filterGroupId: z.string().optional(),
     parentFilterGroupId: z.string().optional(),
+    filterGroupMode: z.enum(["and", "or"]).optional(),
+    parentFilterGroupMode: z.enum(["and", "or"]).optional(),
   })
   .strict();
 

package/corpus/templates/content/actions/update-document.ts

@@ -42,10 +42,7 @@ import {
 } from "../server/lib/document-body-intents.js";
 import { documentChangeResource } from "../server/lib/document-change-resource.js";
 import { recordDocumentHistoryTransition } from "../server/lib/document-history.js";
-import {
-  lockDocumentMetadataDatabase,
-  nextDocumentMetadataUpdatedAt,
-} from "../server/lib/document-metadata-updated-at.js";
+import { nextDocumentMetadataUpdatedAt } from "../server/lib/document-metadata-updated-at.js";
 import { propagateDocumentTitle } from "../server/lib/document-title-propagation.js";
 import { nextDocumentUpdatedAt } from "../server/lib/document-updated-at.js";
 import {
@@ -91,6 +88,7 @@ import {
 import { listContentOrganizationMemberships } from "./_content-space-access.js";
 import { provisionContentSpaces } from "./_content-spaces.js";
 import {
+  assertEditableDocument,
   documentContentHash,
   documentRevisionToken,
   parseDocumentRevisionToken,
@@ -99,6 +97,7 @@ import {
   assertDocumentMutationAccess,
   resolveDocumentAccessForMutation,
 } from "./_document-mutation-access.js";
+import { lockDocumentForSave } from "./_document-save-locks.js";
 import {
   assertSourceAllowsPageEdit,
   serializeDocumentSource,
@@ -955,6 +954,7 @@ const updateDocumentAction = defineAction({
           );
         }
       }
+      if (!favoriteOnly) assertEditableDocument(existing);
 
       const normalizeAuthoredContent = (value: string) => {
         if (args.preserveLeadingTitleHeading) return value;
@@ -1117,16 +1117,16 @@ const updateDocumentAction = defineAction({
         const mutate = async (tx: any) => {
           measurement.outcome = "unchanged";
           measurement.history_effect = "none";
-          const lockedDatabaseId = await lockDocumentMetadataDatabase({
-            db: tx as unknown as ReturnType<typeof getDb>,
-            documentId: id,
-            ownerEmail,
-          });
-          await tx
-            .select({ id: schema.documents.id })
-            .from(schema.documents)
-            .where(eq(schema.documents.id, id))
-            .for("update");
+          const mayWriteBody =
+            content !== undefined || authoredCandidateContent !== undefined;
+          const {
+            databaseId: lockedDatabaseId,
+            lockedDatabaseIds,
+            lockedMembershipIds,
+          } = await lockDocumentForSave(
+            tx as unknown as ReturnType<typeof getDb>,
+            { documentId: id, ownerEmail, body: mayWriteBody },
+          );
           access = favoriteOnly
             ? await resolveDocumentAccessForMutation(id, "id")
             : await assertDocumentMutationAccess(id, "editor", "id");
@@ -1164,6 +1164,9 @@ const updateDocumentAction = defineAction({
               return;
             }
           }
+          // After the replay check, so a retried save that already landed
+          // still gets its receipt. The page lock above makes this see Trash.
+          if (!favoriteOnly) assertEditableDocument(existing);
           if (settlesPreviewDraft) {
             await lockPreviewDocumentDraftSettlement({
               db: tx,
@@ -1486,6 +1489,7 @@ const updateDocumentAction = defineAction({
             ? await lockPrimaryBlocksFields(
                 tx as unknown as ReturnType<typeof getDb>,
                 id,
+                { heldMembershipIds: lockedMembershipIds },
               )
             : [];
           const applied = await commitCanonicalDocumentBodyMutation({
@@ -1698,6 +1702,7 @@ const updateDocumentAction = defineAction({
                 content,
                 ownerEmail,
                 now: updatedAt,
+                lockedDatabaseIds,
               });
           }
           if (