@agentshouse/mdruntime 0.1.0-alpha.22 → 0.1.0-alpha.24

package/dist/connection.js

@@ -1,4 +1,5 @@
 import { rawQuery } from './query.js';
+import { verify } from '@agentshouse/mdmodel';
 import { cached, modelTypes, NO_MODEL, sameModel } from './model.js';
 import { ROOM_CONTRACT_VERSION, VERSION_1_CAPABILITIES } from './adapter.js';
 import { bootstrapRoom } from './bootstrap.js';
@@ -6,13 +7,14 @@ import { changeSet, mergeChangeSets } from './change-set.js';
 import { createConversationStore } from './conversation.js';
 import { MD_MODEL, PRESENTED, validRoot } from './collection.js';
 import { createLog } from './log.js';
-import { queuedOutcome, refusalOf, refused, withheldUntilReset } from './outcome.js';
 import { refreshRoom } from './refresh.js';
 import { buildBatch } from './save.js';
-import { applyReturned, compositionOf, readConfirmed, replicaOf } from './replica.js';
+import { applyReturned, compositionOf, readConfirmed, replicaOf, withdrawals } from './replica.js';
+import { changedParts, changesOf, held, readParts, returnedInto, underneath } from './room-draft.js';
 import { settled, same, saving, STARTING, transferring } from './status.js';
 import { detectStorageLoss, nextGeneration } from './durability.js';
-import { beneath } from './paths.js';
+import { roomDraftRevision } from './identity.js';
+import { beneath, normalize } from './paths.js';
 import { openRuntimeStore } from './store.js';
 import { unconfirmed } from './transfer.js';
 const DEFAULT_DISCOVERY_INTERVAL_MS = 60_000;
@@ -38,10 +40,11 @@ export function createMdRuntime(options) {
     let opening;
     let store;
     const replicas = new Map();
-    const drafts = new Map();
+    const pendings = new Map();
+    const roomDrafts = new Map();
     const presentations = new Map();
     const outcomes = new Map();
-    const acceptedIn = new Map();
+    const outcomeRooms = new Map();
     let limits = [];
     let slots = [];
     let capabilities = [];
@@ -96,7 +99,7 @@ export function createMdRuntime(options) {
     const statusListeners = new Set();
     const querySubscriptions = new Set();
     const queueSubscriptions = new Set();
-    const draftListeners = new Set();
+    const roomDraftListeners = new Set();
     const presentationListeners = new Set();
     let withdrawConversations;
     let currencyQueued = false;
@@ -114,53 +117,49 @@ export function createMdRuntime(options) {
     const ready = new Promise((resolve)=>{
         notifyReady = resolve;
     });
-    function draftContent(locator, path) {
-        return drafts.get(locator)?.get(path);
+    function rememberRoomDraft(record) {
+        const room = roomDrafts.get(record.locator) ?? new Map();
+        room.set(record.path, record);
+        roomDrafts.set(record.locator, room);
     }
-    function rememberDraft(locator, path, content) {
-        const room = drafts.get(locator) ?? new Map();
-        room.set(path, content);
-        drafts.set(locator, room);
-    }
-    function forgetDraft(locator, path) {
-        const room = drafts.get(locator);
+    function forgetRoomDraft(locator, path) {
+        const room = roomDrafts.get(locator);
         if (room === undefined) return;
         room.delete(path);
-        if (room.size === 0) drafts.delete(locator);
+        if (room.size === 0) roomDrafts.delete(locator);
+    }
+    function roomDraftOf(record) {
+        return structuredClone({
+            room: record.locator,
+            path: record.path,
+            revision: record.revision,
+            parts: record.parts,
+            changedUnderneath: underneath(record.parts, record.path, replicas.get(record.locator)?.visible),
+            returned: record.returned
+        });
     }
-    function snapshotDrafts() {
-        const entries = [];
-        for (const [locator, room] of drafts){
-            for (const [path, content] of room){
-                entries.push({
-                    locator,
-                    path,
-                    content: structuredClone(content)
-                });
-            }
-        }
-        entries.sort((left, right)=>{
+    function snapshotRoomDrafts() {
+        const records = [
+            ...roomDrafts.values()
+        ].flatMap((room)=>[
+                ...room.values()
+            ]);
+        records.sort((left, right)=>{
             if (left.locator !== right.locator) return left.locator < right.locator ? -1 : 1;
             if (left.path !== right.path) return left.path < right.path ? -1 : 1;
             return 0;
         });
-        return entries;
+        return records.map(roomDraftOf);
     }
-    function publishDrafts(waitingOnly) {
+    function publishRoomDrafts(waitingOnly) {
         if (closed) return;
-        const value = snapshotDrafts();
-        for (const listener of draftListeners){
+        const value = snapshotRoomDrafts();
+        for (const listener of roomDraftListeners){
             if (waitingOnly && listener.ready) continue;
             listener.ready = true;
             listener.notify(value);
         }
     }
-    function emitDrafts() {
-        publishDrafts(false);
-    }
-    function releaseWaitingDrafts() {
-        publishDrafts(true);
-    }
     function presentationOf(app) {
         const value = presentations.get(app);
         return value === undefined ? null : structuredClone(value);
@@ -171,17 +170,6 @@ export function createMdRuntime(options) {
             if (listener.app === app && listener.ready) listener.notify(presentationOf(app));
         }
     }
-    function commitDraft(locator, path, work) {
-        return exclusive(async ()=>{
-            const local = await openLocal();
-            await work(local);
-            publishChangeSet(changeSet(locator, null, null, {
-                drafts: [
-                    path
-                ]
-            }));
-        });
-    }
     function pending() {
         return [
             ...replicas.values()
@@ -189,42 +177,33 @@ export function createMdRuntime(options) {
     }
     function attention() {
         const attentionRequired = [];
-        let reset = null;
-        for (const [locator, replica] of replicas){
-            const head = replica.queue[0];
-            if (head === undefined) continue;
-            const outcome = outcomes.get(head.id);
-            if (outcome?.kind === 'retryable-refusal') {
-                if (outcome.reset !== undefined && (reset === null || outcome.reset < reset)) {
-                    reset = outcome.reset;
-                }
-                continue;
-            }
-            if (!refused(outcome)) continue;
+        for (const record of [
+            ...roomDrafts.values()
+        ].flatMap((room)=>[
+                ...room.values()
+            ])){
+            if (record.returned === null) continue;
             attentionRequired.push({
-                locator,
-                batch: head.id,
-                outcome: outcome.kind,
-                refusal: refusalOf(outcome),
-                ...outcome.kind === 'conflicted' && outcome.roomVersion !== undefined ? {
-                    roomVersion: outcome.roomVersion
-                } : {}
+                room: record.locator,
+                path: record.path,
+                returned: structuredClone(record.returned)
             });
         }
+        attentionRequired.sort((left, right)=>{
+            if (left.room !== right.room) return left.room < right.room ? -1 : 1;
+            if (left.path !== right.path) return left.path < right.path ? -1 : 1;
+            return 0;
+        });
+        let reset = null;
+        for (const { submission } of pendings.values()){
+            if (submission.state !== 'reset') continue;
+            if (reset === null || submission.reset < reset) reset = submission.reset;
+        }
         return {
             attentionRequired,
             reset
         };
     }
-    async function persistQueue(local, replica, batches, changedOutcomes = []) {
-        await local.write({
-            next: replica.confirmed.record,
-            previous: replica.confirmed.record,
-            queue: batches,
-            previousQueue: replica.queue,
-            outcomes: changedOutcomes
-        });
-    }
     function listed() {
         return structuredClone([
             ...rooms.values()
@@ -300,12 +279,17 @@ export function createMdRuntime(options) {
             subscription.notify(visible(subscription.query));
         }
     }
+    function submissionOf(batch) {
+        return pendings.get(batch.id)?.submission ?? {
+            state: 'waiting'
+        };
+    }
     function entriesOf(locator) {
         const replica = replicas.get(locator);
         if (replica === undefined) return [];
         return replica.queue.map((batch)=>Object.freeze({
                 batch,
-                outcome: queuedOutcome(outcomes.get(batch.id))
+                ...submissionOf(batch)
             }));
     }
     function emitQueue(locator) {
@@ -318,7 +302,9 @@ export function createMdRuntime(options) {
         if (set.rooms.length > 0) emitRooms();
         if (set.documents.length > 0 || set.query) emitVisible();
         for (const locator of set.queues)emitQueue(locator);
-        if (set.drafts.length > 0) emitDrafts();
+        if (set.drafts.length > 0 || set.documents.some((change)=>roomDrafts.get(change.locator)?.has(change.path) === true)) {
+            publishRoomDrafts(false);
+        }
         for (const app of set.presentations)emitPresentation(app);
         conversations.changed(set);
         const cards = declaredCards();
@@ -449,7 +435,7 @@ export function createMdRuntime(options) {
         return [
             ...new Set([
                 ...rooms.keys(),
-                ...drafts.keys()
+                ...roomDrafts.keys()
             ])
         ].filter((locator)=>!listed.has(locator));
     }
@@ -458,9 +444,9 @@ export function createMdRuntime(options) {
         await exclusive(async ()=>{
             const unlisted = unlistedHeld(listed);
             await local.dropRooms(unlisted);
-            for (const [batch, locator] of acceptedIn){
+            for (const [batch, locator] of outcomeRooms){
                 if (listed.has(locator)) continue;
-                acceptedIn.delete(batch);
+                outcomeRooms.delete(batch);
                 outcomes.delete(batch);
             }
             const removed = unlisted.map((locator)=>changeSet(locator, replicas.get(locator) ?? null, null, {
@@ -468,14 +454,14 @@ export function createMdRuntime(options) {
                     queue: true,
                     query: true,
                     drafts: [
-                        ...drafts.get(locator)?.keys() ?? []
+                        ...roomDrafts.get(locator)?.keys() ?? []
                     ]
                 }));
             for (const locator of unlisted){
-                for (const batch of replicas.get(locator)?.queue ?? [])outcomes.delete(batch.id);
+                for (const batch of replicas.get(locator)?.queue ?? [])pendings.delete(batch.id);
                 replicas.delete(locator);
                 rooms.delete(locator);
-                drafts.delete(locator);
+                roomDrafts.delete(locator);
                 unreadable.delete(locator);
                 scopedRefusals.delete(locator);
                 for (const attached of [
@@ -516,7 +502,7 @@ export function createMdRuntime(options) {
             opened.all(),
             opened.queues(),
             opened.outcomes(),
-            opened.drafts(),
+            opened.roomDrafts(),
             opened.presentation(),
             opened.conversations(),
             opened.chatDrafts(),
@@ -528,20 +514,24 @@ export function createMdRuntime(options) {
         limits = declared;
         capabilities = named;
         slots = listedSlots;
-        drafts.clear();
-        for (const draft of kept)rememberDraft(draft.locator, draft.path, draft.content);
+        roomDrafts.clear();
+        for (const record of kept)rememberRoomDraft(record);
         presentations.clear();
         for (const record of presented)presentations.set(record.app, record.value);
         conversations.hydrate(held, chatDrafts);
         const queuedBatches = new Map(queues.map((queue)=>[
                 queue.locator,
-                queue.batches
+                queue.pending.map(({ batch })=>batch)
             ]));
+        pendings.clear();
+        for (const queue of queues){
+            for (const { batch, state } of queue.pending)pendings.set(batch.id, state);
+        }
         outcomes.clear();
-        acceptedIn.clear();
+        outcomeRooms.clear();
         for (const record of recordedOutcomes){
             outcomes.set(record.id, record.outcome);
-            if (record.outcome.kind === 'accepted') acceptedIn.set(record.id, record.locator);
+            outcomeRooms.set(record.id, record.locator);
         }
         const previousReplicas = new Map(replicas);
         replicas.clear();
@@ -589,7 +579,7 @@ export function createMdRuntime(options) {
             emitVisible();
         }
         for (const locator of locators)emitQueue(locator);
-        emitDrafts();
+        publishRoomDrafts(false);
         return lastCompleted;
     }
     async function open() {
@@ -631,6 +621,81 @@ export function createMdRuntime(options) {
         mutations = next.then(()=>undefined, ()=>undefined);
         return next;
     }
+    function withdrawable(batch) {
+        const state = pendings.get(batch.id);
+        return state !== undefined && state.submission.state !== 'submitted' && !state.lost;
+    }
+    async function settle(local, locator, before, confirmed, queue, settling = {}) {
+        const withdrawn = withdrawals(confirmed, queue, withdrawable, rewriting());
+        const kept = queue.filter((batch)=>!withdrawn.includes(batch));
+        const returning = [
+            ...withdrawn.map((batch)=>({
+                    batch,
+                    returned: {
+                        kind: 'withdrawn'
+                    }
+                })).reverse(),
+            ...settling.leaving === undefined ? [] : [
+                settling.leaving
+            ]
+        ];
+        const written = new Map();
+        for (const { batch, returned } of returning){
+            for (const saved of pendings.get(batch.id)?.drafts ?? []){
+                const existing = written.get(saved.path) ?? roomDrafts.get(locator)?.get(saved.path);
+                written.set(saved.path, {
+                    locator,
+                    path: saved.path,
+                    revision: roomDraftRevision(),
+                    parts: returnedInto(existing?.parts, saved.parts),
+                    returned
+                });
+            }
+        }
+        const settledOutcomes = [
+            ...settling.accepted === undefined ? [] : [
+                settling.accepted
+            ],
+            ...settling.leaving === undefined ? [] : [
+                {
+                    id: settling.leaving.batch.id,
+                    outcome: settling.leaving.outcome
+                }
+            ],
+            ...withdrawn.map((batch)=>({
+                    id: batch.id,
+                    outcome: {
+                        kind: 'withdrawn'
+                    }
+                }))
+        ];
+        await local.write({
+            next: confirmed.record,
+            previous: before?.confirmed.record ?? null,
+            queue: kept,
+            previousQueue: before?.queue ?? [],
+            outcomes: settledOutcomes,
+            roomDrafts: [
+                ...written.values()
+            ]
+        });
+        for (const { id, outcome } of settledOutcomes){
+            outcomes.set(id, outcome);
+            outcomeRooms.set(id, locator);
+            pendings.delete(id);
+        }
+        for (const record of written.values())rememberRoomDraft(record);
+        for (const batch of withdrawn)journal.record(`outcome ${locator} ${batch.id} withdrawn`);
+        replicas.set(locator, replicaOf(confirmed, kept, rewriting(), before));
+        return changeSet(locator, before ?? null, replicas.get(locator) ?? null, {
+            room: settling.room,
+            query: settling.query,
+            queue: kept.length !== (before?.queue.length ?? 0),
+            drafts: [
+                ...written.keys()
+            ]
+        });
+    }
     function publish(local, room, confirmed) {
         return exclusive(async ()=>{
             const prior = replicas.get(room.locator);
@@ -639,23 +704,28 @@ export function createMdRuntime(options) {
                 model: modelOf(room.locator),
                 selectionModel: modelOf(room.locator, 'typed-selection')
             }, prior?.confirmed);
-            if (retained !== null) {
-                await local.write({
-                    next: retained.record,
-                    previous: prior?.confirmed.record ?? null,
-                    queue: prior?.queue ?? []
-                });
-                unreadable.delete(room.locator);
-                replicas.set(room.locator, replicaOf(retained, prior?.queue ?? [], rewriting(), prior));
+            if (retained === null) {
+                list(room, true);
+                publishChangeSet(changeSet(room.locator, prior ?? null, prior ?? null, {
+                    room: true,
+                    query: true
+                }));
+                return;
             }
-            list(room, true);
-            publishChangeSet(changeSet(room.locator, prior ?? null, replicas.get(room.locator) ?? null, {
+            const set = await settle(local, room.locator, prior, retained, prior?.queue ?? [], {
                 room: true,
                 query: true
-            }));
+            });
+            unreadable.delete(room.locator);
+            list(room, true);
+            publishChangeSet(set);
+            moveTo({
+                ...status,
+                ...attention()
+            });
         });
     }
-    async function write(locator, changes, replacing, writtenBy) {
+    async function saveRoomDrafts(locator, named, writtenBy) {
         const local = await openLocal();
         const replica = replicas.get(locator);
         const room = rooms.get(locator);
@@ -666,54 +736,57 @@ export function createMdRuntime(options) {
             outcome: 'refused',
             rule: 'collection-root-mismatch'
         };
+        const saved = [];
+        for (const { path, revision } of named){
+            const record = roomDrafts.get(locator)?.get(path);
+            if (record === undefined || record.revision !== revision) {
+                return {
+                    outcome: 'refused',
+                    rule: 'stale',
+                    file: path
+                };
+            }
+            if (!saved.some((draft)=>draft.path === path)) saved.push({
+                path,
+                parts: record.parts
+            });
+        }
+        const changed = saved.flatMap(({ path, parts })=>changedParts(path, underneath(parts, path, replica.visible)));
+        if (changed.length > 0) return {
+            outcome: 'refused',
+            rule: 'changed-underneath',
+            parts: changed
+        };
+        const parts = saved.map(({ path, parts })=>changesOf(path, parts));
         const built = buildBatch({
             baseRoomVersion: replica.confirmed.record.roomVersion,
             composition: compositionFor(replica.confirmed.record),
             operations: room.operations,
-            binding: options.modelBinding,
             providerOwnedPaths: room.providerOwnedPaths,
             providerLimits: limits,
             rewriting: rewriting(),
             visible: replica.visible,
-            changes,
+            changes: parts.flatMap(({ changes })=>changes),
+            bases: parts.flatMap(({ bases })=>bases),
             writtenBy
         });
         if (built.kind === 'refused') return {
             outcome: 'refused',
             ...built.refusal
         };
-        const head = replica.queue[0];
-        if (replacing !== undefined) {
-            if (head === undefined || head.id !== replacing || !refused(outcomes.get(head.id))) {
-                return {
-                    outcome: 'refused',
-                    rule: 'no-refused-head'
-                };
-            }
-        }
-        const batches = replacing === undefined ? [
+        const batches = [
             ...replica.queue,
             built.batch
-        ] : [
-            built.batch,
-            ...replica.queue.slice(1)
-        ];
-        const consumed = [
-            ...new Set(changes.map((change)=>change.path))
         ];
+        const consumed = saved.map(({ path })=>path);
         try {
             await local.write({
                 next: replica.confirmed.record,
                 previous: replica.confirmed.record,
                 queue: batches,
                 previousQueue: replica.queue,
-                outcomes: replacing === undefined ? [] : [
-                    {
-                        id: replacing,
-                        outcome: null
-                    }
-                ],
-                consumedDrafts: consumed
+                saved,
+                consumedRoomDrafts: consumed
             });
         } catch  {
             return {
@@ -721,8 +794,14 @@ export function createMdRuntime(options) {
                 rule: 'durable-write'
             };
         }
-        if (replacing !== undefined) outcomes.delete(replacing);
-        for (const path of consumed)forgetDraft(locator, path);
+        pendings.set(built.batch.id, {
+            drafts: saved,
+            submission: {
+                state: 'waiting'
+            },
+            lost: false
+        });
+        for (const path of consumed)forgetRoomDraft(locator, path);
         replicas.set(locator, replicaOf(replica.confirmed, batches, rewriting(), replica));
         publishChangeSet(changeSet(locator, replica, replicas.get(locator) ?? null, {
             queue: true,
@@ -735,34 +814,28 @@ export function createMdRuntime(options) {
         void enqueue();
         return {
             outcome: 'saved',
-            id: built.batch.id
+            identifier: built.batch.id
         };
     }
-    async function discardHead(locator, identifier) {
-        const local = await openLocal();
-        const replica = replicas.get(locator);
-        const head = replica?.queue[0];
-        if (replica === undefined || head === undefined || head.id !== identifier || !refused(outcomes.get(head.id))) {
+    async function mark(local, locator, identifier, submission, lost) {
+        const state = pendings.get(identifier);
+        if (state === undefined || JSON.stringify(state.submission) === JSON.stringify(submission) && state.lost === lost) {
             return;
         }
-        const batches = replica.queue.slice(1);
-        await persistQueue(local, replica, batches, [
-            {
-                id: identifier,
-                outcome: null
-            }
-        ]);
-        outcomes.delete(identifier);
-        replicas.set(locator, replicaOf(replica.confirmed, batches, rewriting(), replica));
-        publishChangeSet(changeSet(locator, replica, replicas.get(locator) ?? null, {
+        await local.submit(locator, identifier, submission, lost);
+        pendings.set(identifier, {
+            ...state,
+            submission,
+            lost
+        });
+        const replica = replicas.get(locator);
+        if (replica !== undefined) publishChangeSet(changeSet(locator, replica, replica, {
             queue: true
         }));
         moveTo({
             ...status,
-            state: pending() ? 'pending' : status.state,
             ...attention()
         });
-        void enqueue();
     }
     async function readHistory(locator, path, query = {}) {
         if (closed || refusal !== null) return {
@@ -871,7 +944,7 @@ export function createMdRuntime(options) {
     }
     async function pullRefresh(authorized, confirmed) {
         try {
-            const result = await refreshRoom(options.adapter, authorized, confirmed, options.modelBinding);
+            const result = await refreshRoom(options.adapter, authorized, confirmed);
             const detail = result.kind === 'advanced' ? result.confirmed.record.roomVersion : result.kind;
             journal.record(`transfer refresh ${confirmed.record.locator} ${detail}`);
             return result;
@@ -885,7 +958,7 @@ export function createMdRuntime(options) {
             const result = await bootstrapRoom(options.adapter, authorized, room, {
                 collection: modelOf(room.locator),
                 selection: modelOf(room.locator, 'typed-selection')
-            }, options.modelBinding);
+            });
             const detail = result.kind === 'staged' ? result.confirmed.record.roomVersion : result.kind;
             journal.record(`transfer bootstrap ${room.locator} ${detail}`);
             return result;
@@ -918,36 +991,66 @@ export function createMdRuntime(options) {
         await publish(local, room, bootstrapped.confirmed);
         return null;
     }
-    function recordRefusal(result) {
-        if (result.kind === 'expired') return {
-            kind: 'expired'
-        };
-        if (result.kind === 'retryable-refusal') {
+    async function withhold(withheld, room, local, progress) {
+        progress.complete = false;
+        if (withheld.kind === 'scoped-refusal') {
+            await scoped(withheld, room, local);
+        } else if (withheld.kind === 'transport-uncertainty') {
+            progress.reachable = false;
+        } else if (withheld.kind === 'room-not-readable') {
+            unreadable.add(room.locator);
+            list(room, false);
+            emitRooms();
+        } else if (withheld.kind === 'revoked-authorization') {
+            await refuse('revoked-authorization');
+            return 'stop';
+        }
+        return null;
+    }
+    function leaving(batch, result) {
+        if (result.kind === 'expired') {
             return {
-                kind: 'retryable-refusal',
-                code: result.code,
-                fields: result.fields,
-                ...result.reset === undefined ? {} : {
-                    reset: result.reset
+                batch,
+                outcome: {
+                    kind: 'expired'
+                },
+                returned: {
+                    kind: 'expired'
                 }
             };
         }
+        const refusal = {
+            code: result.code,
+            fields: result.fields
+        };
         if (result.kind === 'conflicted') {
             return {
-                kind: 'conflicted',
-                ...result.roomVersion === undefined ? {} : {
-                    roomVersion: result.roomVersion
+                batch,
+                outcome: {
+                    kind: 'conflicted',
+                    ...result.roomVersion === undefined ? {} : {
+                        roomVersion: result.roomVersion
+                    },
+                    affected: result.affected,
+                    ...refusal
                 },
-                affected: result.affected,
-                code: result.code,
-                fields: result.fields
+                returned: {
+                    kind: 'conflicted',
+                    ...refusal
+                }
             };
         }
         return {
-            kind: 'rejected',
-            affected: result.affected,
-            code: result.code,
-            fields: result.fields
+            batch,
+            outcome: {
+                kind: 'rejected',
+                affected: result.affected,
+                ...refusal
+            },
+            returned: {
+                kind: 'rejected',
+                ...refusal
+            }
         };
     }
     async function commitAccept(room, local, submitted, accepted, base, overlay) {
@@ -962,7 +1065,7 @@ export function createMdRuntime(options) {
             selectionModel: modelOf(room.locator, 'typed-selection')
         }, base);
         if (retainedBase === null) return false;
-        const applied = overlay ? applyReturned(retainedBase, accepted.documents, accepted.revisions, accepted.removals, accepted.roomVersion, options.modelBinding) : retainedBase;
+        const applied = overlay ? applyReturned(retainedBase, accepted.documents, accepted.revisions, accepted.removals, accepted.roomVersion) : retainedBase;
         if (applied === null) return false;
         const acceptedOutcome = {
             kind: 'accepted',
@@ -974,28 +1077,21 @@ export function createMdRuntime(options) {
                 time: accepted.time
             }
         };
-        await local.write({
-            next: applied.record,
-            previous: current.confirmed.record,
-            queue: remaining,
-            previousQueue: current.queue,
-            outcomes: [
-                {
-                    id: submitted.id,
-                    outcome: acceptedOutcome
-                }
-            ]
+        const set = await settle(local, room.locator, current, applied, remaining, {
+            accepted: {
+                id: submitted.id,
+                outcome: acceptedOutcome
+            },
+            room: true,
+            query: true
         });
-        acceptedIn.set(submitted.id, room.locator);
-        outcomes.set(submitted.id, acceptedOutcome);
         unreadable.delete(room.locator);
-        replicas.set(room.locator, replicaOf(applied, remaining, rewriting(), current));
         list(room, true);
-        publishChangeSet(changeSet(room.locator, current, replicas.get(room.locator) ?? null, {
-            room: true,
-            queue: true,
-            query: true
-        }));
+        publishChangeSet(set);
+        moveTo({
+            ...status,
+            ...attention()
+        });
         journal.record(`outcome ${room.locator} ${submitted.id} accepted ${accepted.roomVersion}` + (accepted.author === undefined ? '' : ` author ${accepted.author}`) + (accepted.time === undefined ? '' : ` time ${accepted.time}`));
         return true;
     }
@@ -1004,39 +1100,22 @@ export function createMdRuntime(options) {
             const replica = replicas.get(room.locator);
             const head = replica?.queue[0];
             if (replica === undefined || head === undefined) return null;
-            const held = outcomes.get(head.id);
-            if (refused(held)) return null;
-            if (held?.kind === 'retryable-refusal') {
-                if (withheldUntilReset(held, Date.now())) {
-                    progress.complete = false;
-                    return null;
-                }
-                await exclusive(async ()=>{
-                    const current = replicas.get(room.locator);
-                    if (current === undefined || current.queue[0]?.id !== head.id) return;
-                    await persistQueue(local, current, current.queue, [
-                        {
-                            id: head.id,
-                            outcome: null
-                        }
-                    ]);
-                    outcomes.delete(head.id);
-                    publishChangeSet(changeSet(room.locator, current, current, {
-                        queue: true
-                    }));
-                    moveTo({
-                        ...status,
-                        ...attention()
-                    });
-                });
+            const { submission, lost: earlier } = pendings.get(head.id) ?? {
+                submission: {
+                    state: 'waiting'
+                },
+                lost: false
+            };
+            if (submission.state === 'reset' && Date.now() < Date.parse(submission.reset)) {
+                progress.complete = false;
+                return null;
             }
+            const lost = earlier || submission.state === 'submitted';
             let result;
             journal.record(`submission ${room.locator} ${head.id}`);
-            if (await local.markSubmitted(room.locator, head.id)) {
-                publishChangeSet(changeSet(room.locator, replica, replica, {
-                    queue: true
-                }));
-            }
+            await exclusive(()=>mark(local, room.locator, head.id, {
+                    state: 'submitted'
+                }, lost));
             try {
                 result = await options.adapter.mutate(authorized, {
                     locator: room.locator,
@@ -1072,29 +1151,37 @@ export function createMdRuntime(options) {
             if (result.kind === 'conflicted' || result.kind === 'rejected' || result.kind === 'expired' || result.kind === 'retryable-refusal') {
                 journal.record(`outcome ${room.locator} ${head.id} ${result.kind}` + (result.kind === 'conflicted' && result.roomVersion !== undefined ? ` ${result.roomVersion}` : ''));
                 if (result.kind !== 'expired') journal.record(`refusal ${result.kind} ${result.code}`);
-                if (result.kind === 'retryable-refusal') progress.complete = false;
+            }
+            if (result.kind === 'retryable-refusal') {
+                const reset = result.reset;
+                progress.complete = false;
+                await exclusive(()=>mark(local, room.locator, head.id, reset === undefined ? {
+                        state: 'waiting'
+                    } : {
+                        state: 'reset',
+                        reset
+                    }, lost));
+                return null;
+            }
+            if (result.kind === 'conflicted' || result.kind === 'rejected' || result.kind === 'expired') {
+                const left = leaving(head, result);
                 await exclusive(async ()=>{
                     const current = replicas.get(room.locator);
                     if (current === undefined || !current.queue.some((batch)=>batch.id === head.id)) {
                         return;
                     }
-                    const recorded = recordRefusal(result);
-                    await persistQueue(local, current, current.queue, [
-                        {
-                            id: head.id,
-                            outcome: recorded
-                        }
-                    ]);
-                    outcomes.set(head.id, recorded);
-                    publishChangeSet(changeSet(room.locator, current, current, {
-                        queue: true
-                    }));
+                    const set = await settle(local, room.locator, current, current.confirmed, current.queue.filter((batch)=>batch.id !== head.id), {
+                        leaving: left
+                    });
+                    publishChangeSet(set);
                     moveTo({
                         ...status,
                         ...attention()
                     });
                 });
-                return null;
+                const withheld = await advance(room, local, authorized);
+                if (withheld !== null) return withhold(withheld, room, local, progress);
+                continue;
             }
             const from = replicas.get(room.locator)?.confirmed;
             if (from === undefined) return null;
@@ -1279,15 +1366,16 @@ export function createMdRuntime(options) {
             });
             return;
         }
-        const verified = options.modelBinding?.verify(answer.snapshot);
-        await retainModel(local, room, attached, verified?.kind === 'verified' ? {
+        const verified = verify(answer.snapshot.definitions);
+        if (verified.verdict === 'refuse') journal.record(`model invalid ${room.locator} ${attached} ${verified.rule} ${verified.file}`);
+        await retainModel(local, room, attached, verified.verdict === 'accept' ? {
             status: 'current',
             snapshot: structuredClone(answer.snapshot),
             verifiedWith: MD_MODEL,
-            types: verified.types
+            types: verified.model.types
         } : {
             status: 'unavailable',
-            reason: verified === undefined ? 'binding-unavailable' : 'invalid'
+            reason: 'invalid'
         });
     }
     async function scoped(result, room, local) {
@@ -1355,25 +1443,7 @@ export function createMdRuntime(options) {
             }
             const withheld = await advance(room, local, authorization);
             if (withheld !== null) {
-                progress.complete = false;
-                if (withheld.kind === 'scoped-refusal') {
-                    await scoped(withheld, room, local);
-                    continue;
-                }
-                if (withheld.kind === 'transport-uncertainty') {
-                    progress.reachable = false;
-                    continue;
-                }
-                if (withheld.kind === 'room-not-readable') {
-                    unreadable.add(room.locator);
-                    list(room, false);
-                    emitRooms();
-                    continue;
-                }
-                if (withheld.kind === 'revoked-authorization') {
-                    await refuse('revoked-authorization');
-                    return;
-                }
+                if (await withhold(withheld, room, local, progress) === 'stop') return;
                 continue;
             }
             if (await submitRoom(room, local, authorization, progress) === 'stop') return;
@@ -1683,7 +1753,7 @@ export function createMdRuntime(options) {
         statusListeners.clear();
         querySubscriptions.clear();
         queueSubscriptions.clear();
-        draftListeners.clear();
+        roomDraftListeners.clear();
         presentationListeners.clear();
     }
     options.signal?.addEventListener('abort', close, {
@@ -1716,35 +1786,77 @@ export function createMdRuntime(options) {
         syncStatus () {
             return shown;
         },
-        draft: {
+        roomDraft: {
             list () {
                 return exclusive(async ()=>{
                     await openLocal();
-                    return snapshotDrafts();
-                }).then((entries)=>{
-                    releaseWaitingDrafts();
-                    return entries;
+                    return snapshotRoomDrafts();
+                }).then((listed)=>{
+                    publishRoomDrafts(true);
+                    return listed;
                 });
             },
-            read (locator, path) {
-                const content = draftContent(locator, path);
-                return content === undefined ? null : structuredClone(content);
+            read (room, path) {
+                const record = roomDrafts.get(room)?.get(path);
+                return record === undefined ? null : roomDraftOf(record);
             },
-            replace (locator, path, content) {
-                return commitDraft(locator, path, async (local)=>{
-                    const stored = structuredClone(content);
-                    await local.keep({
-                        locator,
+            write (room, path, revision, input) {
+                return exclusive(async ()=>{
+                    const parts = readParts(input);
+                    if (path === '' || normalize(path) !== path) throw new Error('room-draft-malformed');
+                    const local = await openLocal();
+                    const current = roomDrafts.get(room)?.get(path);
+                    if ((current?.revision ?? null) !== revision) {
+                        return {
+                            outcome: 'stale',
+                            current: current === undefined ? null : roomDraftOf(current)
+                        };
+                    }
+                    const record = {
+                        locator: room,
                         path,
-                        content: stored
-                    });
-                    rememberDraft(locator, path, stored);
+                        revision: roomDraftRevision(),
+                        parts: held(current?.parts, parts),
+                        returned: current?.returned ?? null
+                    };
+                    await local.keepRoomDraft(record);
+                    rememberRoomDraft(record);
+                    publishChangeSet(changeSet(room, null, null, {
+                        drafts: [
+                            path
+                        ]
+                    }));
+                    return {
+                        outcome: 'written',
+                        roomDraft: roomDraftOf(record)
+                    };
                 });
             },
-            discard (locator, path) {
-                return commitDraft(locator, path, async (local)=>{
-                    await local.discard(locator, path);
-                    forgetDraft(locator, path);
+            discard (room, path, revision) {
+                return exclusive(async ()=>{
+                    const local = await openLocal();
+                    const current = roomDrafts.get(room)?.get(path);
+                    if (current === undefined || current.revision !== revision) {
+                        return {
+                            outcome: 'stale',
+                            current: current === undefined ? null : roomDraftOf(current)
+                        };
+                    }
+                    await local.discardRoomDraft(room, path);
+                    forgetRoomDraft(room, path);
+                    publishChangeSet(changeSet(room, null, null, {
+                        drafts: [
+                            path
+                        ]
+                    }));
+                    moveTo({
+                        ...status,
+                        ...attention()
+                    });
+                    return {
+                        outcome: 'written',
+                        roomDraft: null
+                    };
                 });
             }
         },
@@ -1772,23 +1884,11 @@ export function createMdRuntime(options) {
                 });
             }
         },
-        save (locator, changes, replacing, writtenBy) {
-            return exclusive(()=>write(locator, changes, replacing, writtenBy));
+        save (room, named, writtenBy) {
+            return exclusive(()=>saveRoomDrafts(room, named, writtenBy));
         },
         outcome (identifier) {
-            const recorded = outcomes.get(identifier);
-            if (recorded !== undefined) return recorded;
-            for (const replica of replicas.values()){
-                if (replica.queue.some((batch)=>batch.id === identifier)) return {
-                    kind: 'pending'
-                };
-            }
-            return null;
-        },
-        queue: {
-            discard (locator, identifier) {
-                return exclusive(()=>discardHead(locator, identifier));
-            }
+            return outcomes.get(identifier) ?? null;
         },
         history (locator, path, query) {
             return readHistory(locator, path, query);
@@ -1806,23 +1906,23 @@ export function createMdRuntime(options) {
             return options.shell.persistentStorage;
         },
         observe (topic, second, third, fourth) {
-            if (topic === 'drafts') {
+            if (topic === 'room-drafts') {
                 const notify = second;
                 const listener = {
                     notify,
                     ready: false
                 };
-                draftListeners.add(listener);
+                roomDraftListeners.add(listener);
                 void exclusive(async ()=>{
                     await openLocal();
-                    if (closed || !draftListeners.has(listener)) return;
+                    if (closed || !roomDraftListeners.has(listener)) return;
                     listener.ready = true;
                 }).then(()=>{
-                    if (closed || !listener.ready || !draftListeners.has(listener)) return;
-                    listener.notify(snapshotDrafts());
+                    if (closed || !listener.ready || !roomDraftListeners.has(listener)) return;
+                    listener.notify(snapshotRoomDrafts());
                 }, ()=>{});
                 return ()=>{
-                    draftListeners.delete(listener);
+                    roomDraftListeners.delete(listener);
                 };
             }
             if (topic === 'conversation') {