@agentshouse/mdruntime 0.1.0-alpha.5 → 0.1.0-alpha.50

package/dist/connection.js

@@ -1,36 +1,117 @@
-import { query as evaluate } from '@agentshouse/query';
+import { verify } from '@agentshouse/mdmodel';
+import { cached, modelTypes, NO_MODEL, sameModel } from './model.js';
+import { opened } from './observation.js';
+import { filterOf, identityOf, planOf } from './query.js';
+import { createReadSide } from './read-side.js';
+import { createSearchIndex, searchPlanOf } from './search.js';
 import { ROOM_CONTRACT_VERSION, VERSION_1_CAPABILITIES } from './adapter.js';
 import { bootstrapRoom } from './bootstrap.js';
-import { MD_MODEL, PRESENTED } from './collection.js';
+import { changeSet, mergeChangeSets } from './change-set.js';
+import { createConversationStore } from './conversation.js';
+import { MD_MODEL, parseCollection, validRoot } from './collection.js';
 import { createLog } from './log.js';
-import { queuedOutcome, refused } from './outcome.js';
 import { refreshRoom } from './refresh.js';
 import { buildBatch } from './save.js';
-import { applyReturned, readConfirmed, replicaOf } from './replica.js';
+import { applyReturned, compositionOf, landed, readConfirmed, readReclassified, replicaOf, sameMembership, withdrawals } from './replica.js';
+import { changedParts, changesOf, held, readParts, returnedInto, underneath } from './room-draft.js';
 import { settled, same, saving, STARTING, transferring } from './status.js';
 import { detectStorageLoss, nextGeneration } from './durability.js';
-import { openReplicaStore } from './store.js';
+import { roomDraftRevision } from './identity.js';
+import { beneath, normalize } from './paths.js';
+import { openRuntimeStore } from './store.js';
 import { unconfirmed } from './transfer.js';
 const DEFAULT_DISCOVERY_INTERVAL_MS = 60_000;
+const EMPTY_SCHEMA = {
+    verdict: 'accept',
+    model: {
+        types: {}
+    }
+};
 const knownCapabilities = new Set(VERSION_1_CAPABILITIES);
+function within(root, path) {
+    return root === '' || beneath(root, path);
+}
+function declaredIdentity(model) {
+    if (model === undefined) return false;
+    if (model === null) return true;
+    return typeof model.identity === 'string' && model.identity.length > 0 && typeof model.version === 'string' && model.version.length > 0;
+}
+function declaredSelection(room) {
+    const selection = room.typedSelection;
+    if (selection === undefined) return true;
+    if (!Array.isArray(selection.roots) || selection.roots.length === 0) return false;
+    if (!declaredIdentity(selection.attachedModel)) return false;
+    return selection.roots.every((root, index)=>validRoot(root) && root !== '' && selection.roots.every((other, at)=>at === index || !within(other, root)));
+}
+function declaredUntypedFolders(room) {
+    const roots = room.untypedFolders;
+    if (roots === undefined) return true;
+    if (!Array.isArray(roots) || roots.length === 0) return false;
+    const selected = room.typedSelection?.roots ?? [];
+    return roots.every((root, index)=>validRoot(root) && root !== '' && roots.every((other, at)=>at === index || !within(other, root)) && selected.every((other)=>!within(other, root) && !within(root, other)));
+}
 export function createMdRuntime(options) {
+    return composeRuntime(options).md;
+}
+export function composeRuntime(options) {
     const period = options.discoveryIntervalMs ?? DEFAULT_DISCOVERY_INTERVAL_MS;
     let authorization = options.authorization;
     let opening;
     let store;
     const replicas = new Map();
-    const drafts = new Map();
+    const pendings = new Map();
+    const roomDrafts = new Map();
+    const presentations = new Map();
     const outcomes = new Map();
+    const outcomeRooms = new Map();
+    const wanted = new Map();
     let limits = [];
+    let slots = [];
     let capabilities = [];
+    function rewriting() {
+        return capabilities.some((capability)=>capability.name === 'move-reference-rewrites') ? 'provider' : 'runtime';
+    }
     const rooms = new Map();
     const unreadable = new Set();
+    const models = new Map();
+    const liveModels = new Map();
+    const invalidModels = new Set();
+    const modelEpoch = new Map();
+    const discovered = new Map();
+    let roomsListed = false;
+    const scopedRefusals = new Map();
+    const sourceRefusals = new Map();
+    const declarationRefusals = new Set();
+    function modelKey(locator, attached) {
+        return `${attached} ${locator}`;
+    }
+    function modelOf(locator, attached = 'collection') {
+        return models.get(modelKey(locator, attached)) ?? NO_MODEL;
+    }
+    function savedModel(locator, attached) {
+        return invalidModels.has(modelKey(locator, attached)) ? {
+            status: 'unavailable',
+            reason: 'revoked'
+        } : modelOf(locator, attached);
+    }
+    function compositionFor(record) {
+        return compositionOf({
+            ...record,
+            model: savedModel(record.locator, 'collection'),
+            selectionModel: savedModel(record.locator, 'typed-selection')
+        });
+    }
     let refusal = null;
     let storageLoss = null;
     let status = STARTING;
+    let shown = STARTING;
     let discoveryPaused = false;
     let timer;
     let closed = false;
+    let stopping = false;
+    let withdrawNotifications;
+    let handed;
+    const notices = new Map();
     let chain = Promise.resolve();
     let mutations = Promise.resolve();
     let inflight = false;
@@ -39,19 +120,93 @@ export function createMdRuntime(options) {
     const refusalListeners = new Set();
     const storageLossListeners = new Set();
     const statusListeners = new Set();
-    const querySubscriptions = new Set();
     const queueSubscriptions = new Set();
+    const roomDraftListeners = new Set();
+    const presentationListeners = new Set();
+    const readSide = createReadSide();
+    let withdrawConversations;
+    let currencyQueued = false;
+    let serviceMode = 'open';
+    let haltedRefusal = false;
+    let openSignals = 0;
+    const serviceModeListeners = new Set();
+    const conversations = createConversationStore({
+        cards: declaredCards,
+        documents: (locator)=>readSide.query(planOf({
+                rooms: [
+                    locator
+                ],
+                select: 'all'
+            }, roomFacts())),
+        call: (name, input)=>invokeAction(name, input),
+        durably,
+        stream: ()=>options.adapter.conversations,
+        publish: publishChangeSet,
+        closed: ()=>closed
+    });
+    const searchIndex = createSearchIndex({
+        documents: ()=>readSide.documents(),
+        document: (room, path)=>readSide.document(room, path),
+        messages: ()=>conversations.messages(),
+        message: (conversation, identity)=>conversations.message(conversation, identity)
+    });
     const journal = createLog();
     let notifyReady = ()=>{};
     const ready = new Promise((resolve)=>{
         notifyReady = resolve;
     });
-    let leader = typeof window === 'undefined';
-    let applyingRemote = false;
-    let releaseLeadership = ()=>{};
-    const channel = typeof window !== 'undefined' ? new BroadcastChannel('mdruntime') : undefined;
-    function at(locator, path) {
-        return `${locator} ${path}`;
+    function rememberRoomDraft(record) {
+        const room = roomDrafts.get(record.locator) ?? new Map();
+        room.set(record.path, record);
+        roomDrafts.set(record.locator, room);
+    }
+    function forgetRoomDraft(locator, path) {
+        const room = roomDrafts.get(locator);
+        if (room === undefined) return;
+        room.delete(path);
+        if (room.size === 0) roomDrafts.delete(locator);
+    }
+    function roomDraftOf(record) {
+        return structuredClone({
+            room: record.locator,
+            path: record.path,
+            revision: record.revision,
+            parts: record.parts,
+            changedUnderneath: underneath(record.parts, record.path, replicas.get(record.locator)?.visible),
+            returned: record.returned
+        });
+    }
+    function snapshotRoomDrafts() {
+        const records = [
+            ...roomDrafts.values()
+        ].flatMap((room)=>[
+                ...room.values()
+            ]);
+        records.sort((left, right)=>{
+            if (left.locator !== right.locator) return left.locator < right.locator ? -1 : 1;
+            if (left.path !== right.path) return left.path < right.path ? -1 : 1;
+            return 0;
+        });
+        return records.map(roomDraftOf);
+    }
+    function publishRoomDrafts(waitingOnly) {
+        if (closed) return;
+        const value = snapshotRoomDrafts();
+        for (const listener of roomDraftListeners){
+            if (waitingOnly && listener.ready) continue;
+            listener.ready = true;
+            listener.notify(value);
+        }
+    }
+    function presentationOf(app) {
+        const value = presentations.get(app);
+        return value === undefined ? null : structuredClone(value);
+    }
+    function emitPresentation(app) {
+        if (closed) return;
+        for (const listener of presentationListeners){
+            if (listener.app === app && listener.ready) listener.notify(presentationOf(app));
+        }
     }
     function pending() {
         return [
@@ -59,42 +214,73 @@ export function createMdRuntime(options) {
         ].some((replica)=>replica.queue.length > 0);
     }
     function attention() {
-        return [
-            ...replicas.values()
-        ].some((replica)=>{
-            const head = replica.queue[0];
-            return head !== undefined && refused(outcomes.get(head.id));
-        });
-    }
-    function storedOutcomes(batches) {
-        const stored = {};
-        for (const batch of batches){
-            const outcome = queuedOutcome(outcomes.get(batch.id));
-            if (outcome.kind !== 'pending') stored[batch.id] = outcome;
+        const attentionRequired = [];
+        for (const record of [
+            ...roomDrafts.values()
+        ].flatMap((room)=>[
+                ...room.values()
+            ])){
+            if (record.returned === null) continue;
+            attentionRequired.push({
+                room: record.locator,
+                path: record.path,
+                returned: structuredClone(record.returned)
+            });
         }
-        return stored;
-    }
-    async function persistQueue(local, locator, batches) {
-        await local.writeQueue({
-            locator,
-            batches,
-            outcomes: storedOutcomes(batches)
+        attentionRequired.sort((left, right)=>{
+            if (left.room !== right.room) return left.room < right.room ? -1 : 1;
+            if (left.path !== right.path) return left.path < right.path ? -1 : 1;
+            return 0;
         });
-        announce();
+        let reset = null;
+        for (const { submission } of pendings.values()){
+            if (submission.state !== 'reset') continue;
+            if (reset === null || submission.reset < reset) reset = submission.reset;
+        }
+        return {
+            attentionRequired,
+            reset
+        };
     }
     function listed() {
-        return [
+        return structuredClone([
             ...rooms.values()
-        ];
+        ]);
     }
-    function queryRooms() {
-        return [
-            ...replicas.values()
-        ].map((replica)=>({
-                room: replica.confirmed.record.locator,
-                roomVersion: replica.confirmed.record.roomVersion,
-                documents: replica.visible.collection.documents
-            }));
+    function slotted() {
+        return structuredClone(slots.map(({ slot, entries })=>({
+                slot,
+                entries: entries.flatMap(({ locator, segment })=>{
+                    const room = rooms.get(locator);
+                    return room === undefined ? [] : [
+                        {
+                            room,
+                            segment
+                        }
+                    ];
+                })
+            })));
+    }
+    function roomFacts() {
+        const held = [
+            ...rooms.values()
+        ].map((room)=>{
+            const attached = [
+                modelOf(room.locator),
+                ...room.typedSelection === null ? [] : [
+                    modelOf(room.locator, 'typed-selection')
+                ]
+            ];
+            return {
+                locator: room.locator,
+                available: attached.every((model)=>model.status !== 'unavailable'),
+                types: attached.flatMap((model)=>model.status === 'unavailable' ? [] : Object.values(model.types))
+            };
+        });
+        return {
+            listed: roomsListed,
+            rooms: held
+        };
     }
     function emitRooms() {
         const value = listed();
@@ -106,51 +292,32 @@ export function createMdRuntime(options) {
     function emitStorageLoss() {
         for (const listener of storageLossListeners)listener(storageLoss);
     }
-    function announce(type = 'changed') {
-        if (applyingRemote || channel === undefined) return;
-        if (type === 'hello') {
-            channel.postMessage({
-                type: 'hello'
-            });
-            return;
-        }
-        channel.postMessage({
-            type,
-            status
-        });
-    }
-    function adopt(next) {
-        if (closed || same(status, next)) return;
+    function moveTo(next) {
+        if (closed) return;
         status = next;
-        for (const listener of statusListeners)listener(status);
+        show();
     }
-    function moveTo(next) {
-        if (closed || same(status, next)) return;
-        adopt(next);
-        announce();
-    }
-    function visible(request) {
-        return evaluate(queryRooms(), {
-            ...request,
-            selector: {
-                $and: [
-                    PRESENTED,
-                    request.selector ?? {}
-                ]
-            }
-        });
+    function show() {
+        if (closed) return;
+        const next = status.state === 'synced' && !conversations.current() ? {
+            ...status,
+            state: 'syncing'
+        } : status;
+        if (same(shown, next)) return;
+        shown = next;
+        for (const listener of statusListeners)listener(shown);
     }
-    function emitVisible() {
-        for (const subscription of querySubscriptions){
-            subscription.notify(visible(subscription.query));
-        }
+    function submissionOf(batch) {
+        return pendings.get(batch.id)?.submission ?? {
+            state: 'waiting'
+        };
     }
     function entriesOf(locator) {
         const replica = replicas.get(locator);
         if (replica === undefined) return [];
         return replica.queue.map((batch)=>Object.freeze({
                 batch,
-                outcome: queuedOutcome(outcomes.get(batch.id))
+                ...submissionOf(batch)
             }));
     }
     function emitQueue(locator) {
@@ -159,6 +326,24 @@ export function createMdRuntime(options) {
             if (subscription.locator === locator) subscription.notify(entries);
         }
     }
+    function applyChangeSet(set) {
+        readSide.apply(set);
+        searchIndex.changed(set);
+    }
+    function publishChangeSet(set) {
+        applyChangeSet(set);
+        if (set.rooms.length > 0) emitRooms();
+        for (const locator of set.queues)emitQueue(locator);
+        if (set.drafts.length > 0 || set.documents.some((change)=>roomDrafts.get(change.locator)?.has(change.path) === true)) {
+            publishRoomDrafts(false);
+        }
+        for (const app of set.presentations)emitPresentation(app);
+        conversations.changed(set);
+        const cards = declaredCards();
+        if (cards !== undefined && set.documents.some((change)=>change.locator === cards.locator)) {
+            scheduleCurrency();
+        }
+    }
     function stopTimer() {
         if (timer === undefined) return;
         clearInterval(timer);
@@ -170,139 +355,314 @@ export function createMdRuntime(options) {
             void enqueue();
         }, period);
     }
-    function refuse(reason) {
+    async function refuse(reason, provider = null) {
         stopTimer();
         discoveryPaused = true;
-        refusal = {
-            reason,
-            reauthorizationOffered: reason === 'revoked-authorization'
-        };
-        journal.record(`connection refused ${reason}`);
-        emitRefusal();
+        try {
+            if (reason === 'revoked-authorization') {
+                await exclusive(async ()=>{
+                    const revoked = {
+                        status: 'unavailable',
+                        reason: 'revoked'
+                    };
+                    try {
+                        const local = await openLocal();
+                        await local.revokeModels([
+                            ...replicas.values()
+                        ].map((replica)=>({
+                                record: replica.confirmed.record,
+                                queue: replica.queue
+                            })));
+                    } catch  {
+                        journal.record('model revocation persistence failed');
+                    }
+                    const keys = new Set(models.keys());
+                    for (const locator of rooms.keys()){
+                        keys.add(modelKey(locator, 'collection'));
+                        keys.add(modelKey(locator, 'typed-selection'));
+                    }
+                    for (const key of keys){
+                        invalidModels.add(key);
+                        modelEpoch.set(key, (modelEpoch.get(key) ?? 0) + 1);
+                        models.set(key, revoked);
+                        liveModels.delete(key);
+                    }
+                    const changed = [];
+                    for (const [locator, room] of rooms){
+                        const before = replicas.get(locator) ?? null;
+                        if (before !== null) {
+                            const record = {
+                                ...before.confirmed.record,
+                                model: revoked,
+                                selectionModel: revoked
+                            };
+                            const read = readConfirmed(record, before.confirmed);
+                            replicas.set(locator, read.kind === 'staged' ? replicaOf(read.confirmed, before.queue, rewriting(), before) : {
+                                ...before,
+                                confirmed: {
+                                    ...before.confirmed,
+                                    record
+                                }
+                            });
+                        }
+                        rooms.set(locator, {
+                            ...room,
+                            model: modelTypes(revoked),
+                            typedSelection: room.typedSelection === null ? null : {
+                                ...room.typedSelection,
+                                model: modelTypes(revoked)
+                            }
+                        });
+                        changed.push(changeSet(locator, before, replicas.get(locator) ?? null, {
+                            room: true
+                        }));
+                    }
+                    publishChangeSet(mergeChangeSets(changed));
+                });
+            }
+        } finally{
+            refusal = {
+                reason,
+                reauthorizationOffered: reason === 'revoked-authorization',
+                refusal: provider
+            };
+            journal.record(`connection refused ${reason}`);
+            emitRefusal();
+        }
     }
     function list(room, synchronizationAvailable) {
+        const selection = room.typedSelection ?? null;
         rooms.set(room.locator, {
             name: room.name,
             locator: room.locator,
-            writeGrants: room.writeGrants,
+            operations: room.operations,
+            replica: room.replica,
+            attachedModel: room.attachedModel,
+            model: modelTypes(modelOf(room.locator)),
+            typedSelection: selection === null ? null : {
+                roots: selection.roots,
+                attachedModel: selection.attachedModel,
+                model: modelTypes(modelOf(room.locator, 'typed-selection'))
+            },
+            untypedFolders: room.untypedFolders ?? [],
             providerOwnedPaths: room.providerOwnedPaths,
             roomVersion: replicas.get(room.locator)?.confirmed.record.roomVersion ?? null,
-            synchronizationAvailable
+            attachments: replicas.get(room.locator)?.confirmed.record.attachments ?? [],
+            synchronizationAvailable,
+            refusal: scopedRefusals.get(room.locator) ?? sourceRefusals.get(room.locator) ?? null
         });
     }
-    function applyDiscovery(discovered) {
-        const listedLocators = new Set(discovered.map((room)=>room.locator));
-        for (const room of discovered){
-            list(room, !unreadable.has(room.locator));
+    async function applyDiscovery(listed, local) {
+        const listedLocators = new Set(listed.map((room)=>room.locator));
+        for (const locator of listedLocators)scopedRefusals.delete(locator);
+        discovered.clear();
+        for (const room of listed)discovered.set(room.locator, room);
+        for (const locator of wanted.keys())if (!listedLocators.has(locator)) wanted.delete(locator);
+        await dropUnlisted(listedLocators, local);
+        for (const room of listed){
+            const held = replicas.get(room.locator)?.confirmed.record;
+            if (held !== undefined && held.replica.selection !== room.replica.selection) {
+                list(held, false);
+                continue;
+            }
+            list(room, room.replica.admission === 'admitted' && !unreadable.has(room.locator));
         }
-        for (const [locator, room] of rooms){
-            if (listedLocators.has(locator)) continue;
-            rooms.set(locator, {
-                ...room,
-                synchronizationAvailable: false
+        roomsListed = true;
+        emitRooms();
+    }
+    function unlistedHeld(listed) {
+        return [
+            ...new Set([
+                ...rooms.keys(),
+                ...roomDrafts.keys()
+            ])
+        ].filter((locator)=>!listed.has(locator));
+    }
+    async function dropUnlisted(listed, local) {
+        if (unlistedHeld(listed).length === 0) return;
+        await exclusive(async ()=>{
+            const unlisted = unlistedHeld(listed);
+            await local.dropRooms(unlisted);
+            for (const [batch, locator] of outcomeRooms){
+                if (listed.has(locator)) continue;
+                outcomeRooms.delete(batch);
+                outcomes.delete(batch);
+            }
+            const removed = unlisted.map((locator)=>changeSet(locator, replicas.get(locator) ?? null, null, {
+                    room: true,
+                    queue: true,
+                    drafts: [
+                        ...roomDrafts.get(locator)?.keys() ?? []
+                    ]
+                }));
+            for (const locator of unlisted){
+                for (const batch of replicas.get(locator)?.queue ?? [])pendings.delete(batch.id);
+                replicas.delete(locator);
+                rooms.delete(locator);
+                roomDrafts.delete(locator);
+                unreadable.delete(locator);
+                scopedRefusals.delete(locator);
+                sourceRefusals.delete(locator);
+                declarationRefusals.delete(locator);
+                for (const attached of [
+                    'collection',
+                    'typed-selection'
+                ]){
+                    const key = modelKey(locator, attached);
+                    models.delete(key);
+                    liveModels.delete(key);
+                    invalidModels.delete(key);
+                    modelEpoch.delete(key);
+                }
+                journal.record(`room unlisted ${locator}`);
+            }
+            publishChangeSet(mergeChangeSets(removed));
+            moveTo({
+                ...status,
+                ...attention()
             });
+        });
+    }
+    function restored(key, persisted) {
+        const prior = models.get(key);
+        if (prior !== undefined && prior.status !== 'unavailable' && (persisted.status === 'unavailable' || !sameModel(prior.snapshot, persisted.snapshot))) {
+            modelEpoch.set(key, (modelEpoch.get(key) ?? 0) + 1);
+            invalidModels.add(key);
         }
-        emitRooms();
-        return listedLocators;
+        const model = persisted.status === 'unavailable' || liveModels.get(key) === JSON.stringify(persisted.snapshot) ? persisted : cached(persisted);
+        models.set(key, model);
+        if (model.status === 'unavailable') {
+            liveModels.delete(key);
+            invalidModels.delete(key);
+        }
+        return model;
     }
     async function hydrate(opened) {
-        const [records, queues, kept, lastCompleted, declared] = await Promise.all([
+        const [records, queues, recordedOutcomes, kept, presented, held, chatDrafts, lastCompleted, declared, named, listedSlots] = await Promise.all([
             opened.all(),
             opened.queues(),
-            opened.drafts(),
+            opened.outcomes(),
+            opened.roomDrafts(),
+            opened.presentation(),
+            opened.conversations(),
+            opened.chatDrafts(),
             opened.lastCompleted(),
-            opened.providerLimits()
+            opened.providerLimits(),
+            opened.capabilities(),
+            opened.slots()
         ]);
         limits = declared;
-        drafts.clear();
-        for (const draft of kept)drafts.set(at(draft.locator, draft.path), draft.content);
+        capabilities = named;
+        slots = listedSlots;
+        roomDrafts.clear();
+        for (const record of kept)rememberRoomDraft(record);
+        presentations.clear();
+        for (const record of presented)presentations.set(record.app, record.value);
+        conversations.hydrate(held, chatDrafts);
         const queuedBatches = new Map(queues.map((queue)=>[
                 queue.locator,
-                queue.batches
+                queue.pending.map(({ batch })=>batch)
             ]));
-        outcomes.clear();
+        pendings.clear();
         for (const queue of queues){
-            for (const [id, outcome] of Object.entries(queue.outcomes)){
-                outcomes.set(id, outcome);
-            }
+            for (const { batch, state } of queue.pending)pendings.set(batch.id, state);
+        }
+        outcomes.clear();
+        outcomeRooms.clear();
+        for (const record of recordedOutcomes){
+            outcomes.set(record.id, record.outcome);
+            outcomeRooms.set(record.id, record.locator);
         }
+        const previousReplicas = new Map(replicas);
         replicas.clear();
         for (const record of records){
-            const confirmed = readConfirmed(record);
-            if (confirmed === null) continue;
-            replicas.set(record.locator, replicaOf(confirmed, queuedBatches.get(record.locator) ?? []));
+            const model = restored(modelKey(record.locator, 'collection'), record.model);
+            const selectionModel = restored(modelKey(record.locator, 'typed-selection'), record.selectionModel);
+            const prior = previousReplicas.get(record.locator);
+            const retyped = {
+                ...record,
+                model,
+                selectionModel
+            };
+            const read = readConfirmed(retyped, prior?.confirmed);
+            const confirmed = read.kind === 'staged' ? read.confirmed : {
+                record: retyped,
+                collection: parseCollection(retyped.documents, compositionOf(retyped))
+            };
+            replicas.set(record.locator, replicaOf(confirmed, queuedBatches.get(record.locator) ?? [], rewriting(), prior));
             const existing = rooms.get(record.locator);
             if (existing === undefined) list(record, false);
             else {
                 rooms.set(record.locator, {
                     ...existing,
-                    roomVersion: record.roomVersion
+                    roomVersion: record.roomVersion,
+                    attachments: record.attachments,
+                    operations: record.operations,
+                    replica: record.replica,
+                    attachedModel: record.attachedModel,
+                    model: modelTypes(model),
+                    typedSelection: record.typedSelection === null ? null : {
+                        roots: record.typedSelection.roots,
+                        attachedModel: record.typedSelection.attachedModel,
+                        model: modelTypes(selectionModel)
+                    },
+                    untypedFolders: record.untypedFolders
                 });
             }
+            if (read.kind === 'refused') {
+                refusedSource(record, read);
+                declarationRefusals.add(record.locator);
+            }
         }
         return {
             lastCompleted,
             locators: new Set([
                 ...queuedBatches.keys(),
                 ...replicas.keys()
-            ])
+            ]),
+            read: mergeChangeSets([
+                ...new Set([
+                    ...previousReplicas.keys(),
+                    ...replicas.keys()
+                ])
+            ].map((locator)=>changeSet(locator, previousReplicas.get(locator) ?? null, replicas.get(locator) ?? null)))
         };
     }
     async function readState(opened) {
-        const { lastCompleted, locators } = await hydrate(opened);
-        if (replicas.size > 0) {
-            emitRooms();
-            emitVisible();
-        }
+        const { lastCompleted, locators, read } = await hydrate(opened);
+        applyChangeSet(read);
+        if (replicas.size > 0) emitRooms();
         for (const locator of locators)emitQueue(locator);
+        publishRoomDrafts(false);
         return lastCompleted;
     }
-    async function applyRemote(message) {
-        if (closed) return;
-        if (message.type === 'hello') {
-            if (leader) announce();
-            return;
-        }
-        applyingRemote = true;
-        try {
-            const local = await openLocal();
-            const lastCompleted = await readState(local);
-            if (message.status !== undefined) adopt(message.status);
-            else {
-                adopt({
-                    ...status,
-                    lastCompleted,
-                    attentionRequired: attention(),
-                    state: pending() ? 'pending' : status.state
-                });
-            }
-        } finally{
-            applyingRemote = false;
-        }
-        if (message.type === 'enqueue' && leader) void enqueue();
-    }
     async function open() {
-        const opened = await openReplicaStore();
+        const opened = await openRuntimeStore();
         store = opened;
-        await acrossTabs('mdruntime-generation', async ()=>{
-            const storedGeneration = await opened.generation();
-            const loss = detectStorageLoss(storedGeneration);
-            const generation = nextGeneration(storedGeneration);
-            if (generation !== storedGeneration) await opened.rememberGeneration(generation);
-            if (loss !== null) {
-                storageLoss = loss;
-                emitStorageLoss();
-            }
-        });
+        const kept = options.shell.generation;
+        const storedGeneration = await opened.generation();
+        const loss = detectStorageLoss(storedGeneration, kept);
+        const generation = nextGeneration(storedGeneration, kept);
+        if (generation !== storedGeneration) await opened.rememberGeneration(generation);
+        if (generation !== kept) await options.shell.keepGeneration(generation);
+        if (loss !== null) {
+            storageLoss = loss;
+            emitStorageLoss();
+        }
         const lastCompleted = await readState(opened);
-        adopt({
+        moveTo({
             ...status,
             lastCompleted,
-            attentionRequired: attention()
+            ...attention()
         });
-        if (!leader) announce('hello');
         return opened;
     }
+    function durably(work) {
+        return exclusive(async ()=>{
+            const local = await openLocal();
+            return work(local);
+        });
+    }
     function openLocal() {
         opening ??= open().catch((error)=>{
             opening = undefined;
@@ -315,116 +675,232 @@ export function createMdRuntime(options) {
         mutations = next.then(()=>undefined, ()=>undefined);
         return next;
     }
-    function acrossTabs(name, work) {
-        if (typeof window === 'undefined') return work();
-        return window.navigator.locks.request(name, work);
+    function withdrawable(batch) {
+        const state = pendings.get(batch.id);
+        return state !== undefined && state.submission.state !== 'submitted' && !state.lost;
+    }
+    async function settle(local, locator, before, confirmed, queue, settling = {}) {
+        const withdrawn = withdrawals(confirmed, queue, withdrawable, rewriting());
+        const kept = queue.filter((batch)=>!withdrawn.includes(batch));
+        const returning = [
+            ...withdrawn.map((batch)=>({
+                    batch,
+                    returned: {
+                        kind: 'withdrawn'
+                    }
+                })).reverse(),
+            ...settling.leaving === undefined ? [] : [
+                settling.leaving
+            ]
+        ];
+        const written = new Map();
+        for (const { batch, returned } of returning){
+            if (returned === null) continue;
+            for (const saved of pendings.get(batch.id)?.drafts ?? []){
+                const existing = written.get(saved.path) ?? roomDrafts.get(locator)?.get(saved.path);
+                written.set(saved.path, {
+                    locator,
+                    path: saved.path,
+                    revision: roomDraftRevision(),
+                    parts: returnedInto(existing?.parts, saved.parts),
+                    returned
+                });
+            }
+        }
+        const settledOutcomes = [
+            ...settling.accepted === undefined ? [] : [
+                settling.accepted
+            ],
+            ...settling.leaving === undefined ? [] : [
+                {
+                    id: settling.leaving.batch.id,
+                    outcome: settling.leaving.outcome
+                }
+            ],
+            ...withdrawn.map((batch)=>({
+                    id: batch.id,
+                    outcome: {
+                        kind: 'withdrawn'
+                    }
+                }))
+        ];
+        await local.write({
+            next: confirmed.record,
+            previous: before?.confirmed.record ?? null,
+            queue: kept,
+            previousQueue: before?.queue ?? [],
+            outcomes: settledOutcomes,
+            roomDrafts: [
+                ...written.values()
+            ]
+        });
+        for (const { id, outcome } of settledOutcomes){
+            outcomes.set(id, outcome);
+            outcomeRooms.set(id, locator);
+            pendings.delete(id);
+        }
+        for (const record of written.values())rememberRoomDraft(record);
+        for (const batch of withdrawn)journal.record(`outcome ${locator} ${batch.id} withdrawn`);
+        replicas.set(locator, replicaOf(confirmed, kept, rewriting(), before));
+        return changeSet(locator, before ?? null, replicas.get(locator) ?? null, {
+            room: settling.room,
+            queue: kept.length !== (before?.queue.length ?? 0),
+            drafts: [
+                ...written.keys()
+            ]
+        });
     }
     function publish(local, room, confirmed) {
         return exclusive(async ()=>{
-            await acrossTabs('mdruntime-replica', async ()=>{
-                await hydrate(local);
-                await local.publish(confirmed.record);
-                unreadable.delete(room.locator);
-                replicas.set(room.locator, replicaOf(confirmed, replicas.get(room.locator)?.queue ?? []));
+            if (!continuing()) return;
+            const prior = replicas.get(room.locator);
+            const retained = readConfirmed({
+                ...confirmed.record,
+                model: modelOf(room.locator),
+                selectionModel: modelOf(room.locator, 'typed-selection')
+            }, prior?.confirmed);
+            if (retained.kind !== 'staged') throw new Error(`Cannot retype staged Room ${room.locator}`);
+            const queue = prior?.queue ?? [];
+            const roomVersion = retained.confirmed.record.roomVersion;
+            const accepted = queue.filter((batch)=>{
+                const outcome = outcomes.get(batch.id);
+                return outcome?.kind === 'accepted' && options.adapter.reached(room.locator, roomVersion, outcome.roomVersion);
             });
+            const set = await settle(local, room.locator, prior, retained.confirmed, queue.filter((batch)=>!accepted.includes(batch)), {
+                room: true
+            });
+            for (const batch of accepted)pendings.delete(batch.id);
+            const target = wanted.get(room.locator);
+            if (target !== undefined && options.adapter.reached(room.locator, roomVersion, target)) {
+                wanted.delete(room.locator);
+            }
+            unreadable.delete(room.locator);
+            sourceRefusals.delete(room.locator);
+            declarationRefusals.delete(room.locator);
             list(room, true);
-            emitRooms();
-            emitVisible();
-            announce();
+            publishChangeSet(set);
+            moveTo({
+                ...status,
+                ...attention()
+            });
         });
     }
-    async function write(locator, changes, replacing) {
+    async function saveRoomDrafts(locator, named, writtenBy) {
         const local = await openLocal();
-        const result = await acrossTabs('mdruntime-replica', async ()=>{
-            await hydrate(local);
-            const replica = replicas.get(locator);
-            const room = rooms.get(locator);
-            if (replica === undefined || room === undefined) {
-                throw new Error(`No Local Replica for ${locator}`);
-            }
-            const built = buildBatch({
-                baseRoomVersion: replica.confirmed.record.roomVersion,
-                writeGrants: room.writeGrants,
-                providerOwnedPaths: room.providerOwnedPaths,
-                providerLimits: limits,
-                visible: replica.visible,
-                changes
-            });
-            if (built.kind === 'refused') return {
-                outcome: 'refused',
-                ...built.refusal
-            };
-            const head = replica.queue[0];
-            if (replacing !== undefined) {
-                if (head === undefined || head.id !== replacing || !refused(outcomes.get(head.id))) {
-                    return {
-                        outcome: 'refused',
-                        rule: 'no-refused-head'
-                    };
-                }
-            }
-            const batches = replacing === undefined ? [
-                ...replica.queue,
-                built.batch
-            ] : [
-                built.batch,
-                ...replica.queue.slice(1)
-            ];
-            const consumed = [
-                ...new Set(changes.map((change)=>change.path))
-            ];
-            try {
-                await local.append({
-                    locator,
-                    batches,
-                    outcomes: storedOutcomes(batches)
-                }, consumed);
-            } catch  {
+        const replica = replicas.get(locator);
+        const room = rooms.get(locator);
+        if (replica === undefined || room === undefined) {
+            throw new Error(`No Local Replica for ${locator}`);
+        }
+        const saved = [];
+        for (const { path, revision } of named){
+            const record = roomDrafts.get(locator)?.get(path);
+            if (record === undefined || record.revision !== revision) {
                 return {
                     outcome: 'refused',
-                    rule: 'durable-write'
+                    rule: 'stale',
+                    file: path
                 };
             }
-            if (replacing !== undefined) outcomes.delete(replacing);
-            for (const path of consumed)drafts.delete(at(locator, path));
-            replicas.set(locator, replicaOf(replica.confirmed, batches));
-            emitQueue(locator);
-            emitVisible();
-            moveTo({
-                ...saving(status),
-                attentionRequired: attention()
+            if (!saved.some((draft)=>draft.path === path)) saved.push({
+                path,
+                parts: record.parts
+            });
+        }
+        const changed = saved.flatMap(({ path, parts })=>changedParts(path, underneath(parts, path, replica.visible)));
+        if (changed.length > 0) return {
+            outcome: 'refused',
+            rule: 'changed-underneath',
+            parts: changed
+        };
+        const parts = saved.map(({ path, parts })=>changesOf(path, parts));
+        const built = buildBatch({
+            baseRoomVersion: replica.confirmed.record.roomVersion,
+            composition: compositionFor(replica.confirmed.record),
+            operations: room.operations,
+            providerOwnedPaths: room.providerOwnedPaths,
+            providerLimits: limits,
+            rewriting: rewriting(),
+            visible: replica.visible,
+            changes: parts.flatMap(({ changes })=>changes),
+            bases: parts.flatMap(({ bases })=>bases),
+            writtenBy
+        });
+        if (built.kind === 'refused') return {
+            outcome: 'refused',
+            ...built.refusal
+        };
+        const batches = [
+            ...replica.queue,
+            built.batch
+        ];
+        const consumed = saved.map(({ path })=>path);
+        try {
+            await local.write({
+                next: replica.confirmed.record,
+                previous: replica.confirmed.record,
+                queue: batches,
+                previousQueue: replica.queue,
+                saved,
+                consumedRoomDrafts: consumed
             });
+        } catch  {
             return {
-                outcome: 'saved',
-                id: built.batch.id
+                outcome: 'refused',
+                rule: 'durable-write'
             };
+        }
+        pendings.set(built.batch.id, {
+            drafts: saved,
+            submission: {
+                state: 'waiting'
+            },
+            lost: false
         });
-        if (result.outcome === 'saved') void enqueue();
-        return result;
+        for (const path of consumed)forgetRoomDraft(locator, path);
+        replicas.set(locator, replicaOf(replica.confirmed, batches, rewriting(), replica));
+        publishChangeSet(changeSet(locator, replica, replicas.get(locator) ?? null, {
+            queue: true,
+            drafts: consumed
+        }));
+        moveTo({
+            ...saving(status),
+            ...attention()
+        });
+        void enqueue();
+        return {
+            outcome: 'saved',
+            identifier: built.batch.id
+        };
     }
-    async function discardHead(locator, identifier) {
-        const local = await openLocal();
-        const changed = await acrossTabs('mdruntime-replica', async ()=>{
-            await hydrate(local);
-            const replica = replicas.get(locator);
-            const head = replica?.queue[0];
-            if (replica === undefined || head === undefined || head.id !== identifier || !refused(outcomes.get(head.id))) {
-                return false;
-            }
-            const batches = replica.queue.slice(1);
-            outcomes.delete(identifier);
-            await persistQueue(local, locator, batches);
-            replicas.set(locator, replicaOf(replica.confirmed, batches));
-            emitQueue(locator);
-            emitVisible();
-            moveTo({
-                ...status,
-                state: pending() ? 'pending' : status.state,
-                attentionRequired: attention()
-            });
-            return true;
+    async function mark(local, locator, identifier, submission, lost) {
+        const state = pendings.get(identifier);
+        if (!continuing() || state === undefined || JSON.stringify(state.submission) === JSON.stringify(submission) && state.lost === lost) {
+            return;
+        }
+        await local.submit(locator, identifier, submission, lost);
+        pendings.set(identifier, {
+            ...state,
+            submission,
+            lost
+        });
+        const replica = replicas.get(locator);
+        if (replica !== undefined) publishChangeSet(changeSet(locator, replica, replica, {
+            queue: true
+        }));
+        moveTo({
+            ...status,
+            ...attention()
         });
-        if (changed) void enqueue();
+    }
+    async function keepUpload(local, locator, identifier, upload) {
+        if (!continuing()) throw new Error('connection refused');
+        await local.keepUpload(locator, identifier, upload);
+        pendings.set(identifier, {
+            ...pendings.get(identifier),
+            upload
+        });
+        if (!continuing()) throw new Error('connection refused');
     }
     async function readHistory(locator, path, query = {}) {
         if (closed || refusal !== null) return {
@@ -463,7 +939,11 @@ export function createMdRuntime(options) {
                 }
             });
             journal.record(`outcome history ${result.kind}`);
-            if (result.kind === 'revoked-authorization') refuse('revoked-authorization');
+            if (result.kind === 'scoped-refusal') {
+                const room = replicas.get(result.locator)?.confirmed.record;
+                if (room !== undefined) await scoped(result, room, await openLocal());
+            }
+            if (result.kind === 'revoked-authorization') await refuse('revoked-authorization');
             return result;
         } catch  {
             journal.record('outcome history transport-uncertainty');
@@ -472,6 +952,12 @@ export function createMdRuntime(options) {
             };
         }
     }
+    function declaredCards() {
+        for (const capability of capabilities){
+            if (capability.conversationCards !== undefined) return capability.conversationCards;
+        }
+        return undefined;
+    }
     function declaredAction(name) {
         for (const capability of capabilities){
             for (const action of capability.actions ?? []){
@@ -506,9 +992,14 @@ export function createMdRuntime(options) {
                 name,
                 input
             });
-            if (result.kind === 'revoked-authorization') refuse('revoked-authorization');
+            if (result.kind === 'action' && result.at !== undefined) want(result.at);
+            if (result.kind === 'scoped-refusal') {
+                const room = replicas.get(result.locator)?.confirmed.record;
+                if (room !== undefined) await scoped(result, room, await openLocal());
+            }
+            if (result.kind === 'revoked-authorization') await refuse('revoked-authorization');
             journal.record(`outcome action ${result.kind}`);
-            if (result.kind === 'rejected') journal.record(`refusal rejected ${result.text}`);
+            if (result.kind === 'rejected') journal.record(`refusal rejected ${result.code}`);
             return result;
         } catch  {
             journal.record('outcome action transport-uncertainty');
@@ -517,9 +1008,43 @@ export function createMdRuntime(options) {
             };
         }
     }
-    async function pullRefresh(authorized, confirmed) {
+    function continuing() {
+        return !closed && !discoveryPaused;
+    }
+    function reachedBy(locator, roomVersion) {
+        const held = replicas.get(locator);
+        return held !== undefined && options.adapter.reached(locator, held.confirmed.record.roomVersion, roomVersion);
+    }
+    function writtenAfter(locator, roomVersion, path) {
+        const written = replicas.get(locator)?.confirmed.record.written[path];
+        return written !== undefined && options.adapter.reached(locator, written, roomVersion) && !options.adapter.reached(locator, roomVersion, written);
+    }
+    function want({ locator, roomVersion }) {
+        if (reachedBy(locator, roomVersion)) return;
+        const held = wanted.get(locator);
+        if (held === undefined || options.adapter.reached(locator, roomVersion, held)) {
+            wanted.set(locator, roomVersion);
+        }
+    }
+    function reachOf(locator) {
+        let target = wanted.get(locator);
+        const versions = (replicas.get(locator)?.queue ?? []).flatMap((batch)=>{
+            const outcome = outcomes.get(batch.id);
+            return outcome?.kind === 'accepted' ? [
+                outcome.roomVersion
+            ] : [];
+        });
+        for (const version of versions){
+            if (target === undefined || options.adapter.reached(locator, version, target)) {
+                target = version;
+            }
+        }
+        return target === undefined || reachedBy(locator, target) ? undefined : target;
+    }
+    async function pullRefresh(authorized, confirmed, minPosition) {
+        if (!continuing()) return unconfirmed;
         try {
-            const result = await refreshRoom(options.adapter, authorized, confirmed);
+            const result = await refreshRoom(options.adapter, authorized, confirmed, continuing, minPosition);
             const detail = result.kind === 'advanced' ? result.confirmed.record.roomVersion : result.kind;
             journal.record(`transfer refresh ${confirmed.record.locator} ${detail}`);
             return result;
@@ -529,8 +1054,12 @@ export function createMdRuntime(options) {
         }
     }
     async function pullBootstrap(authorized, room) {
+        if (!continuing()) return unconfirmed;
         try {
-            const result = await bootstrapRoom(options.adapter, authorized, room);
+            const result = await bootstrapRoom(options.adapter, authorized, room, {
+                collection: modelOf(room.locator),
+                selection: modelOf(room.locator, 'typed-selection')
+            }, continuing);
             const detail = result.kind === 'staged' ? result.confirmed.record.roomVersion : result.kind;
             journal.record(`transfer bootstrap ${room.locator} ${detail}`);
             return result;
@@ -542,8 +1071,10 @@ export function createMdRuntime(options) {
     async function advance(room, local, authorized) {
         const held = replicas.get(room.locator);
         if (held !== undefined) {
-            const refreshed = await pullRefresh(authorized, held.confirmed);
+            const refreshed = await pullRefresh(authorized, held.confirmed, reachOf(room.locator));
+            if (!continuing()) return unconfirmed;
             if (refreshed.kind === 'still-current') {
+                if (sourceRefusals.has(room.locator)) return unconfirmed;
                 if (unreadable.delete(room.locator)) {
                     list(room, true);
                     emitRooms();
@@ -551,157 +1082,353 @@ export function createMdRuntime(options) {
                 return null;
             }
             if (refreshed.kind === 'advanced') {
-                if (closed) return unconfirmed;
                 await publish(local, room, refreshed.confirmed);
                 return null;
             }
             if (refreshed.kind !== 'beyond-horizon') return refreshed;
         }
         const bootstrapped = await pullBootstrap(authorized, room);
+        if (!continuing()) return unconfirmed;
         if (bootstrapped.kind !== 'staged') return bootstrapped;
-        if (closed) return unconfirmed;
         await publish(local, room, bootstrapped.confirmed);
         return null;
     }
-    function recordRefusal(result) {
-        if (result.kind === 'expired') return {
-            kind: 'expired'
+    async function withhold(withheld, room, local, progress) {
+        progress.complete = false;
+        if (withheld.kind === 'scoped-refusal') {
+            await scoped(withheld, room, local);
+        } else if (withheld.kind === 'transport-uncertainty') {
+            progress.reachable = false;
+        } else if (withheld.kind === 'retryable-refusal') {
+            journal.record(`refusal ${withheld.kind} ${withheld.code}`);
+        } else if (withheld.kind === 'room-not-readable') {
+            unreadable.add(room.locator);
+            list(room, false);
+            emitRooms();
+        } else if (withheld.kind === 'refused') {
+            refusedSource(room, withheld);
+        } else if (withheld.kind === 'revoked-authorization') {
+            await refuse('revoked-authorization');
+        }
+    }
+    function refusedSource(room, { refusal }) {
+        sourceRefusals.set(room.locator, {
+            code: refusal.rule,
+            fields: {
+                file: refusal.file,
+                ...refusal.location === undefined ? {} : {
+                    location: refusal.location
+                },
+                version: refusal.version,
+                ...refusal.referrers === undefined ? {} : {
+                    referrers: refusal.referrers
+                }
+            }
+        });
+        declarationRefusals.delete(room.locator);
+        unreadable.add(room.locator);
+        list(room, false);
+        emitRooms();
+        journal.record(`source refused ${room.locator} ${refusal.rule} ${refusal.file}`);
+    }
+    function leaving(batch, result) {
+        if (result.kind === 'expired') {
+            return {
+                batch,
+                outcome: {
+                    kind: 'expired'
+                },
+                returned: {
+                    kind: 'expired'
+                }
+            };
+        }
+        const refusal = {
+            code: result.code,
+            fields: result.fields
         };
         if (result.kind === 'conflicted') {
             return {
-                kind: 'conflicted',
-                roomVersion: result.roomVersion,
-                affected: result.affected,
-                text: result.text
+                batch,
+                outcome: {
+                    kind: 'conflicted',
+                    ...result.roomVersion === undefined ? {} : {
+                        roomVersion: result.roomVersion
+                    },
+                    affected: result.affected,
+                    ...refusal
+                },
+                returned: {
+                    kind: 'conflicted',
+                    ...refusal
+                }
             };
         }
         return {
-            kind: 'rejected',
-            affected: result.affected,
-            text: result.text
+            batch,
+            outcome: {
+                kind: 'rejected',
+                affected: result.affected,
+                ...refusal
+            },
+            returned: {
+                kind: 'rejected',
+                ...refusal
+            }
         };
     }
-    async function commitAccept(room, local, submitted, accepted, base, overlay) {
-        return acrossTabs('mdruntime-replica', async ()=>{
-            await hydrate(local);
+    function acceptedOf(accepted) {
+        return {
+            kind: 'accepted',
+            roomVersion: accepted.roomVersion,
+            ...accepted.author === undefined ? {} : {
+                author: accepted.author
+            },
+            ...accepted.time === undefined ? {} : {
+                time: accepted.time
+            }
+        };
+    }
+    function logAccepted(locator, submitted, accepted) {
+        journal.record(`outcome ${locator} ${submitted.id} accepted ${accepted.roomVersion}` + (accepted.author === undefined ? '' : ` author ${accepted.author}`) + (accepted.time === undefined ? '' : ` time ${accepted.time}`));
+    }
+    async function recordAccepted(room, local, submitted, accepted) {
+        await exclusive(async ()=>{
+            if (!continuing()) return;
             const current = replicas.get(room.locator);
             if (current === undefined || !current.queue.some((batch)=>batch.id === submitted.id)) {
-                return true;
+                return;
             }
-            const remaining = current.queue.filter((batch)=>batch.id !== submitted.id);
-            const applied = overlay ? applyReturned(base, accepted.documents, accepted.revisions, accepted.removals, accepted.roomVersion) : base;
-            if (applied === null) return false;
-            await local.publish(applied.record);
-            await persistQueue(local, room.locator, remaining);
-            outcomes.set(submitted.id, {
-                kind: 'accepted',
-                roomVersion: accepted.roomVersion,
-                author: accepted.author,
-                time: accepted.time
+            const outcome = acceptedOf(accepted);
+            await local.write({
+                next: current.confirmed.record,
+                previous: current.confirmed.record,
+                queue: current.queue,
+                previousQueue: current.queue,
+                outcomes: [
+                    {
+                        id: submitted.id,
+                        outcome
+                    }
+                ]
             });
-            unreadable.delete(room.locator);
-            replicas.set(room.locator, replicaOf(applied, remaining));
-            list(room, true);
-            emitRooms();
-            emitQueue(room.locator);
-            emitVisible();
-            journal.record(`outcome ${room.locator} ${submitted.id} accepted`);
-            return true;
+            outcomes.set(submitted.id, outcome);
+            outcomeRooms.set(submitted.id, room.locator);
+            logAccepted(room.locator, submitted, accepted);
         });
     }
-    async function submitRoom(room, local, authorized, progress) {
-        while(!closed && authorization !== undefined){
-            const replica = replicas.get(room.locator);
-            const head = replica?.queue[0];
-            if (replica === undefined || head === undefined || refused(outcomes.get(head.id))) {
-                return null;
-            }
+    async function commitAccept(room, local, submitted, accepted, base, overlay) {
+        if (!continuing()) return unconfirmed;
+        const current = replicas.get(room.locator);
+        if (current === undefined || !current.queue.some((batch)=>batch.id === submitted.id)) {
+            return null;
+        }
+        const remaining = current.queue.filter((batch)=>batch.id !== submitted.id);
+        const retainedBase = readConfirmed({
+            ...base.record,
+            model: modelOf(room.locator),
+            selectionModel: modelOf(room.locator, 'typed-selection')
+        }, base);
+        const applied = overlay && retainedBase.kind === 'staged' ? applyReturned(retainedBase.confirmed, accepted.documents, accepted.revisions, accepted.removals, accepted.roomVersion) : retainedBase;
+        if (applied.kind !== 'staged') return applied;
+        const set = await settle(local, room.locator, current, applied.confirmed, remaining, {
+            accepted: {
+                id: submitted.id,
+                outcome: acceptedOf(accepted)
+            },
+            room: true
+        });
+        unreadable.delete(room.locator);
+        sourceRefusals.delete(room.locator);
+        declarationRefusals.delete(room.locator);
+        list(room, true);
+        publishChangeSet(set);
+        moveTo({
+            ...status,
+            ...attention()
+        });
+        return null;
+    }
+    async function accepting(room, local, submitted, accepted, pulled, fresh) {
+        const roomVersion = pulled.record.roomVersion;
+        if (options.adapter.reached(room.locator, roomVersion, accepted.roomVersion)) {
+            return committed(room, local, submitted, accepted, pulled, roomVersion === accepted.roomVersion);
+        }
+        if (fresh && continuing()) await publish(local, room, pulled);
+        return false;
+    }
+    async function committed(room, local, submitted, accepted, base, overlay) {
+        const failed = await exclusive(()=>commitAccept(room, local, submitted, accepted, base, overlay));
+        if (failed === null) return true;
+        if (failed.kind === 'refused' && continuing()) refusedSource(room, failed);
+        return false;
+    }
+    async function submitRoom(room, local, authorized, progress) {
+        while(continuing() && authorization !== undefined){
+            const replica = replicas.get(room.locator);
+            const head = replica?.queue[0];
+            if (replica === undefined || head === undefined) return;
+            if (outcomes.get(head.id)?.kind === 'accepted') {
+                progress.complete = false;
+                return;
+            }
+            const state = pendings.get(head.id);
+            const { submission, lost: earlier } = state ?? {
+                submission: {
+                    state: 'waiting'
+                },
+                lost: false
+            };
+            if (submission.state === 'reset' && Date.now() < Date.parse(submission.reset)) {
+                progress.complete = false;
+                return;
+            }
+            if (writesHeld()) {
+                progress.complete = false;
+                journal.record(`submission ${room.locator} ${head.id} held`);
+                return;
+            }
+            const lost = earlier || submission.state === 'submitted';
             let result;
             journal.record(`submission ${room.locator} ${head.id}`);
+            await exclusive(()=>mark(local, room.locator, head.id, {
+                    state: 'submitted'
+                }, lost));
+            if (discoveryPaused) return;
+            if (writesHeld()) {
+                await exclusive(()=>mark(local, room.locator, head.id, submission, earlier));
+                progress.complete = false;
+                journal.record(`submission ${room.locator} ${head.id} held`);
+                return;
+            }
+            const opensBefore = openSignals;
             try {
                 result = await options.adapter.mutate(authorized, {
                     locator: room.locator,
-                    changeBatch: head
-                });
+                    changeBatch: head,
+                    ...state?.upload === undefined ? {} : {
+                        upload: state.upload
+                    }
+                }, (upload)=>exclusive(()=>keepUpload(local, room.locator, head.id, upload)));
             } catch  {
                 progress.complete = false;
-                progress.reachable = false;
-                return null;
+                if (continuing()) progress.reachable = false;
+                return;
             }
-            if (closed) return null;
+            if (!continuing()) return;
             if (result.kind === 'transport-uncertainty') {
                 progress.complete = false;
                 progress.reachable = false;
-                return null;
+                return;
             }
             if (result.kind === 'room-not-readable') {
                 progress.complete = false;
                 unreadable.add(room.locator);
                 list(room, false);
                 emitRooms();
-                return null;
+                return;
             }
             if (result.kind === 'revoked-authorization') {
-                refuse('revoked-authorization');
-                return 'stop';
+                await refuse('revoked-authorization');
+                return;
+            }
+            if (result.kind === 'scoped-refusal') {
+                await scoped(result, room, local);
+                progress.complete = false;
+                return;
+            }
+            if (result.kind === 'write-halted') {
+                journal.record(`outcome ${room.locator} ${head.id} write-halted`);
+                await exclusive(()=>mark(local, room.locator, head.id, {
+                        state: 'waiting'
+                    }, lost));
+                if (serviceMode === 'open' && openSignals !== opensBefore) continue;
+                haltedRefusal = true;
+                progress.complete = false;
+                return;
+            }
+            if (result.kind === 'conflicted' || result.kind === 'rejected' || result.kind === 'expired' || result.kind === 'retryable-refusal') {
+                if (result.kind === 'expired') {
+                    const withheld = await advance(room, local, authorized);
+                    if (withheld !== null) return withhold(withheld, room, local, progress);
+                }
+                journal.record(`outcome ${room.locator} ${head.id} ${result.kind}` + (result.kind === 'conflicted' && result.roomVersion !== undefined ? ` ${result.roomVersion}` : ''));
+                if (result.kind !== 'expired') journal.record(`refusal ${result.kind} ${result.code}`);
+            }
+            if (result.kind === 'retryable-refusal') {
+                const reset = result.reset;
+                progress.complete = false;
+                await exclusive(()=>mark(local, room.locator, head.id, reset === undefined ? {
+                        state: 'waiting'
+                    } : {
+                        state: 'reset',
+                        reset
+                    }, lost));
+                return;
             }
             if (result.kind === 'conflicted' || result.kind === 'rejected' || result.kind === 'expired') {
-                journal.record(`outcome ${room.locator} ${head.id} ${result.kind}`);
-                if (result.kind !== 'expired') journal.record(`refusal ${result.kind} ${result.text}`);
+                const left = leaving(head, result);
                 await exclusive(async ()=>{
-                    await acrossTabs('mdruntime-replica', async ()=>{
-                        await hydrate(local);
-                        const current = replicas.get(room.locator);
-                        if (current === undefined || !current.queue.some((batch)=>batch.id === head.id)) {
-                            return;
-                        }
-                        outcomes.set(head.id, recordRefusal(result));
-                        await persistQueue(local, room.locator, current.queue);
-                        emitQueue(room.locator);
-                        moveTo({
-                            ...status,
-                            attentionRequired: true
-                        });
+                    if (!continuing()) return;
+                    const current = replicas.get(room.locator);
+                    if (current === undefined || !current.queue.some((batch)=>batch.id === head.id)) {
+                        return;
+                    }
+                    const set = await settle(local, room.locator, current, current.confirmed, current.queue.filter((batch)=>batch.id !== head.id), {
+                        leaving: result.kind === 'expired' && landed(head, current.confirmed) ? {
+                            ...left,
+                            returned: null
+                        } : left
+                    });
+                    publishChangeSet(set);
+                    moveTo({
+                        ...status,
+                        ...attention()
                     });
                 });
-                return null;
+                if (result.kind === 'expired') continue;
+                const withheld = await advance(room, local, authorized);
+                if (withheld !== null) return withhold(withheld, room, local, progress);
+                continue;
             }
+            await recordAccepted(room, local, head, result);
             const from = replicas.get(room.locator)?.confirmed;
-            if (from === undefined) return null;
-            const pulled = await pullRefresh(authorized, from);
+            if (from === undefined) return;
+            const pulled = await pullRefresh(authorized, from, reachOf(room.locator));
+            if (!continuing()) return;
             if (pulled.kind === 'revoked-authorization') {
-                refuse('revoked-authorization');
-                return 'stop';
+                await refuse('revoked-authorization');
+                return;
             }
-            if (pulled.kind === 'still-current') {
-                const committed = await exclusive(()=>commitAccept(room, local, head, result, from, true));
-                if (!committed) {
-                    progress.complete = false;
-                    return null;
-                }
-                continue;
+            if (pulled.kind === 'scoped-refusal') {
+                await scoped(pulled, room, local);
+                progress.complete = false;
+                return;
             }
-            if (pulled.kind === 'advanced') {
-                const overlay = pulled.confirmed.record.roomVersion === result.roomVersion;
-                const committed = await exclusive(()=>commitAccept(room, local, head, result, pulled.confirmed, overlay));
-                if (!committed) {
+            if (pulled.kind === 'still-current' || pulled.kind === 'advanced') {
+                const fresh = pulled.kind === 'advanced';
+                if (!await accepting(room, local, head, result, fresh ? pulled.confirmed : from, fresh)) {
                     progress.complete = false;
-                    return null;
+                    return;
                 }
                 continue;
             }
             if (pulled.kind === 'beyond-horizon') {
                 const bootstrapped = await pullBootstrap(authorized, room);
+                if (!continuing()) return;
                 if (bootstrapped.kind === 'revoked-authorization') {
-                    refuse('revoked-authorization');
-                    return 'stop';
+                    await refuse('revoked-authorization');
+                    return;
+                }
+                if (bootstrapped.kind === 'scoped-refusal') {
+                    await scoped(bootstrapped, room, local);
+                    progress.complete = false;
+                    return;
                 }
                 if (bootstrapped.kind === 'staged') {
-                    const overlay = bootstrapped.confirmed.record.roomVersion === result.roomVersion;
-                    const committed = await exclusive(()=>commitAccept(room, local, head, result, bootstrapped.confirmed, overlay));
-                    if (!committed) {
+                    if (!await accepting(room, local, head, result, bootstrapped.confirmed, true)) {
                         progress.complete = false;
-                        return null;
+                        return;
                     }
                     continue;
                 }
@@ -712,8 +1439,10 @@ export function createMdRuntime(options) {
                     unreadable.add(room.locator);
                     list(room, false);
                     emitRooms();
+                } else if (bootstrapped.kind === 'refused') {
+                    refusedSource(room, bootstrapped);
                 }
-                return null;
+                return;
             }
             progress.complete = false;
             if (pulled.kind === 'transport-uncertainty') {
@@ -722,38 +1451,250 @@ export function createMdRuntime(options) {
                 unreadable.add(room.locator);
                 list(room, false);
                 emitRooms();
+            } else if (pulled.kind === 'retryable-refusal') {
+                journal.record(`refusal ${pulled.kind} ${pulled.code}`);
+            } else if (pulled.kind === 'refused') {
+                refusedSource(room, pulled);
             }
-            return null;
+            return;
         }
-        return null;
+        return;
     }
-    async function synchronize(discovered, local, progress) {
-        for (const room of discovered){
-            if (closed || authorization === undefined) {
-                progress.complete = false;
-                return;
-            }
-            const withheld = await advance(room, local, authorization);
-            if (withheld !== null) {
-                progress.complete = false;
-                if (withheld.kind === 'transport-uncertainty') {
-                    progress.reachable = false;
-                    continue;
-                }
-                if (withheld.kind === 'room-not-readable') {
-                    unreadable.add(room.locator);
-                    list(room, false);
-                    emitRooms();
-                    continue;
-                }
-                if (withheld.kind === 'revoked-authorization') {
-                    refuse('revoked-authorization');
-                    return;
+    async function retainModel(local, room, attached, next) {
+        const key = modelKey(room.locator, attached);
+        if (next.status === 'unavailable') modelEpoch.set(key, (modelEpoch.get(key) ?? 0) + 1);
+        const epoch = modelEpoch.get(key) ?? 0;
+        const previous = modelOf(room.locator, attached);
+        const heldBefore = replicas.get(room.locator)?.confirmed.record;
+        if (JSON.stringify(previous) === JSON.stringify(next) && (heldBefore === undefined || JSON.stringify(heldBefore.operations) === JSON.stringify(room.operations) && JSON.stringify(heldBefore.replica) === JSON.stringify(room.replica) && JSON.stringify(heldBefore.attachedModel) === JSON.stringify(room.attachedModel) && JSON.stringify(heldBefore.typedSelection) === JSON.stringify(room.typedSelection ?? null) && JSON.stringify(heldBefore.untypedFolders) === JSON.stringify(room.untypedFolders ?? []))) return;
+        if (next.status === 'unavailable') {
+            invalidModels.add(key);
+            liveModels.delete(key);
+        }
+        await exclusive(async ()=>{
+            if (!continuing()) return;
+            if (next.status !== 'unavailable' && epoch !== (modelEpoch.get(key) ?? 0)) return;
+            const held = replicas.get(room.locator);
+            if (held !== undefined) {
+                const declared = {
+                    ...held.confirmed.record,
+                    operations: room.operations,
+                    replica: room.replica,
+                    attachedModel: room.attachedModel,
+                    typedSelection: room.typedSelection ?? null,
+                    untypedFolders: room.untypedFolders ?? [],
+                    ...attached === 'collection' ? {
+                        model: next
+                    } : {
+                        selectionModel: next
+                    }
+                };
+                const reclassified = sameMembership(declared, held.confirmed.record) ? readConfirmed(declared, held.confirmed) : readReclassified(declared, held.confirmed);
+                const record = reclassified.kind === 'staged' ? declared : {
+                    ...declared,
+                    typedSelection: held.confirmed.record.typedSelection,
+                    untypedFolders: held.confirmed.record.untypedFolders
+                };
+                const read = reclassified.kind === 'deferred' ? readConfirmed(record, held.confirmed) : reclassified;
+                await local.write({
+                    next: record,
+                    previous: held.confirmed.record,
+                    queue: held.queue
+                });
+                if (read.kind === 'staged') {
+                    replicas.set(room.locator, replicaOf(read.confirmed, held.queue, rewriting(), held));
+                    if (declarationRefusals.delete(room.locator)) {
+                        sourceRefusals.delete(room.locator);
+                        unreadable.delete(room.locator);
+                    }
+                } else if (read.kind === 'refused') {
+                    replicas.set(room.locator, {
+                        ...held,
+                        confirmed: {
+                            ...held.confirmed,
+                            record
+                        }
+                    });
+                    refusedSource(room, read);
+                    declarationRefusals.add(room.locator);
                 }
-                continue;
             }
-            if (await submitRoom(room, local, authorization, progress) === 'stop') return;
+            models.set(key, next);
+            if (next.status === 'current') {
+                liveModels.set(key, JSON.stringify(next.snapshot));
+                invalidModels.delete(key);
+            }
+            list(room, room.replica.admission === 'admitted' && !unreadable.has(room.locator));
+            if (held === undefined) emitRooms();
+            else publishChangeSet(changeSet(room.locator, held, replicas.get(room.locator) ?? null, {
+                room: true
+            }));
+        });
+    }
+    async function acquireModel(local, room, authorized, selection) {
+        const attached = selection === null ? 'collection' : 'typed-selection';
+        const key = modelKey(room.locator, attached);
+        const declared = selection === null ? room.attachedModel : selection.attachedModel;
+        let previous = modelOf(room.locator, attached);
+        if (previous.status !== 'unavailable' && (declared === null || !sameModel(previous.snapshot, declared))) {
+            previous = {
+                status: 'unavailable',
+                reason: 'version-changed'
+            };
+            await retainModel(local, room, attached, previous);
+            if (discoveryPaused) return;
+        }
+        const epoch = modelEpoch.get(key) ?? 0;
+        let answer;
+        try {
+            answer = await options.adapter.model(authorized, selection === null ? {
+                locator: room.locator,
+                attached: 'collection',
+                model: declared
+            } : {
+                locator: room.locator,
+                attached: 'typed-selection',
+                roots: selection.roots,
+                model: declared
+            });
+        } catch  {
+            answer = {
+                kind: 'transport-uncertainty'
+            };
+        }
+        if (discoveryPaused || epoch !== (modelEpoch.get(key) ?? 0)) return;
+        if (answer.kind === 'revoked-authorization') {
+            await refuse('revoked-authorization');
+            return;
+        }
+        if (answer.kind === 'transport-uncertainty') {
+            await retainModel(local, room, attached, cached(previous));
+            return;
+        }
+        if (answer.kind === 'model-unavailable') {
+            await retainModel(local, room, attached, {
+                status: 'unavailable',
+                reason: answer.reason
+            });
+            return;
         }
+        if (declared === null || !sameModel(answer.snapshot, declared)) {
+            await retainModel(local, room, attached, {
+                status: 'unavailable',
+                reason: 'version-changed'
+            });
+            return;
+        }
+        if (previous.status !== 'unavailable' && sameModel(previous.snapshot, answer.snapshot) && previous.snapshot.schema !== answer.snapshot.schema) {
+            await retainModel(local, room, attached, {
+                status: 'unavailable',
+                reason: 'invalid'
+            });
+            return;
+        }
+        const verified = answer.snapshot.schema === null ? EMPTY_SCHEMA : verify(answer.snapshot.schema);
+        if (verified.verdict === 'refuse') {
+            const where = verified.location === undefined ? '' : ` ${verified.location}`;
+            journal.record(`model invalid ${room.locator} ${attached} ${answer.snapshot.identity} ${verified.rule}${where}`);
+        }
+        await retainModel(local, room, attached, verified.verdict === 'accept' ? {
+            status: 'current',
+            snapshot: structuredClone(answer.snapshot),
+            verifiedWith: MD_MODEL,
+            types: verified.model.types
+        } : {
+            status: 'unavailable',
+            reason: 'invalid'
+        });
+    }
+    async function scoped(result, room, local) {
+        scopedRefusals.set(room.locator, {
+            code: result.code,
+            fields: result.fields
+        });
+        let scopedAway = room;
+        if (result.scope === 'model') await retainModel(local, room, 'collection', {
+            status: 'unavailable',
+            reason: 'not-readable'
+        });
+        else if (result.scope !== 'operation') {
+            unreadable.add(room.locator);
+            scopedAway = {
+                ...room,
+                replica: {
+                    ...room.replica,
+                    admission: 'unavailable'
+                },
+                operations: {
+                    ...room.operations,
+                    ...result.scope === 'content' ? {
+                        read: []
+                    } : {},
+                    ...result.scope === 'sync' ? {
+                        sync: []
+                    } : {}
+                }
+            };
+            await retainModel(local, scopedAway, 'collection', modelOf(room.locator));
+        }
+        if (!continuing()) return;
+        list(scopedAway, scopedAway.replica.admission === 'admitted' && !unreadable.has(room.locator));
+        emitRooms();
+        journal.record(`scoped refusal ${room.locator} ${result.scope} ${result.code}`);
+    }
+    async function synchronize(discovered, local, progress) {
+        const prepared = await Promise.allSettled(discovered.map((room)=>prepareRoom(room, local, progress)));
+        const ready = discovered.filter((_, index)=>{
+            const outcome = prepared[index];
+            return outcome?.status === 'fulfilled' && outcome.value;
+        });
+        const rooms = await Promise.allSettled(ready.map((room)=>synchronizeRoom(room, local, progress)));
+        const failed = [
+            ...prepared,
+            ...rooms
+        ].find((room)=>room.status === 'rejected');
+        if (failed !== undefined) throw failed.reason;
+    }
+    async function prepareRoom(room, local, progress) {
+        if (closed || authorization === undefined) {
+            progress.complete = false;
+            return false;
+        }
+        const prior = replicas.get(room.locator)?.confirmed.record;
+        if (prior !== undefined && prior.replica.selection !== room.replica.selection) {
+            list(prior, false);
+            emitRooms();
+            journal.record(`selection changed ${room.locator}`);
+            progress.complete = false;
+            return false;
+        }
+        const selection = room.typedSelection;
+        await Promise.all([
+            acquireModel(local, room, authorization, null),
+            ...selection === undefined ? [] : [
+                acquireModel(local, room, authorization, selection)
+            ]
+        ]);
+        if (discoveryPaused || authorization === undefined) return false;
+        if (room.replica.admission !== 'admitted') {
+            if (replicas.has(room.locator)) progress.complete = false;
+            return false;
+        }
+        const held = replicas.get(room.locator);
+        if (held !== undefined && held.confirmed.record.replica.selection !== room.replica.selection) {
+            progress.complete = false;
+            return false;
+        }
+        return true;
+    }
+    async function synchronizeRoom(room, local, progress) {
+        if (discoveryPaused || authorization === undefined) return;
+        const withheld = await advance(room, local, authorization);
+        if (withheld !== null) {
+            await withhold(withheld, room, local, progress);
+            return;
+        }
+        await submitRoom(room, local, authorization, progress);
     }
     async function cycle(local, progress) {
         if (closed || authorization === undefined) {
@@ -764,10 +1705,10 @@ export function createMdRuntime(options) {
         let result;
         try {
             result = await options.adapter.discover(authorization);
-        } catch (error) {
-            journal.record('connection discover transport-uncertainty');
-            notifyReady();
-            throw error;
+        } catch  {
+            result = {
+                kind: 'transport-uncertainty'
+            };
         }
         if (closed) {
             notifyReady();
@@ -775,29 +1716,72 @@ export function createMdRuntime(options) {
         }
         journal.record(`connection discover ${result.kind}`);
         if (result.kind === 'transport-uncertainty') {
+            for (const room of rooms.values()){
+                await retainModel(local, room, 'collection', cached(modelOf(room.locator)));
+                if (room.typedSelection !== null) {
+                    await retainModel(local, room, 'typed-selection', cached(modelOf(room.locator, 'typed-selection')));
+                }
+            }
             progress.reachable = false;
             notifyReady();
             return;
         }
+        if (result.kind === 'contract-unavailable') {
+            journal.record(`connection contract unavailable ${result.code}`);
+            await refuse('missing-required-guarantee', {
+                code: result.code,
+                fields: result.fields
+            });
+            notifyReady();
+            return;
+        }
         if (result.kind === 'revoked-authorization') {
-            refuse('revoked-authorization');
+            await refuse('revoked-authorization');
             notifyReady();
             return;
         }
         if (!result.supportedVersions.includes(ROOM_CONTRACT_VERSION)) {
-            refuse('no-matching-version');
+            await refuse('no-matching-version');
             notifyReady();
             return;
         }
         if (result.mdModel.identity !== MD_MODEL.identity || result.mdModel.version !== MD_MODEL.version) {
-            refuse('md-model-version-mismatch');
+            await refuse('md-model-version-mismatch');
             notifyReady();
             return;
         }
+        for (const room of result.rooms){
+            if (room.operations === undefined || ![
+                'read',
+                'sync',
+                'write',
+                'delete'
+            ].every((operation)=>Array.isArray(room.operations[operation]) && room.operations[operation].every((scope)=>typeof scope === 'string')) || room.replica === undefined || typeof room.replica.selection !== 'string' || room.replica.selection.length === 0 || ![
+                'admitted',
+                'unavailable'
+            ].includes(room.replica.admission) || !declaredIdentity(room.attachedModel)) {
+                journal.record(`invalid model or replica declaration ${room.locator}`);
+                await refuse('missing-required-guarantee');
+                notifyReady();
+                return;
+            }
+            if (!declaredSelection(room)) {
+                journal.record(`invalid typed selection declaration ${room.locator}`);
+                await refuse('missing-required-guarantee');
+                notifyReady();
+                return;
+            }
+            if (!declaredUntypedFolders(room)) {
+                journal.record(`invalid untyped folder declaration ${room.locator}`);
+                await refuse('missing-required-guarantee');
+                notifyReady();
+                return;
+            }
+        }
         const declared = new Set(result.capabilities.map((capability)=>capability.name));
         for (const required of options.requiredGuarantees){
             if (!knownCapabilities.has(required) || !declared.has(required)) {
-                refuse('missing-required-guarantee');
+                await refuse('missing-required-guarantee');
                 notifyReady();
                 return;
             }
@@ -806,17 +1790,24 @@ export function createMdRuntime(options) {
             refusal = null;
             emitRefusal();
         }
+        const previousCapabilities = capabilities;
         capabilities = result.capabilities;
         notifyReady();
-        if (JSON.stringify(result.providerLimits) !== JSON.stringify(limits)) {
+        if (declared.has('room-version-notifications')) observeRoomVersions();
+        const discoveredSlots = result.slots ?? [];
+        if (JSON.stringify(result.providerLimits) !== JSON.stringify(limits) || JSON.stringify(result.capabilities) !== JSON.stringify(previousCapabilities) || JSON.stringify(discoveredSlots) !== JSON.stringify(slots)) {
             limits = result.providerLimits;
-            await local.declare(limits);
+            slots = discoveredSlots;
+            await local.declare(limits, capabilities, slots);
         }
-        const listedLocators = applyDiscovery(result.rooms);
-        progress.complete = [
-            ...replicas.keys()
-        ].every((locator)=>listedLocators.has(locator));
+        await applyDiscovery(result.rooms, local);
+        handSelected(result.rooms.filter((room)=>room.replica.admission === 'admitted').map((room)=>room.locator).sort());
+        progress.complete = true;
         await synchronize(result.rooms, local, progress);
+        if (closed || discoveryPaused) return;
+        await conversations.reconcile();
+        if (status.providerUnreachable) conversations.reconnected();
+        await conversations.catchUp(progress);
     }
     async function ensureAuthorization() {
         if (authorization !== undefined) return;
@@ -829,7 +1820,7 @@ export function createMdRuntime(options) {
         }
     }
     async function connect() {
-        if (closed || discoveryPaused) {
+        if (closed || stopping || discoveryPaused) {
             notifyReady();
             return;
         }
@@ -870,11 +1861,141 @@ export function createMdRuntime(options) {
             }
         }
     }
-    function enqueue() {
-        if (!leader) {
-            announce('enqueue');
-            return chain;
+    function observeRoomVersions() {
+        const path = options.adapter.roomVersions;
+        if (path === undefined || withdrawNotifications !== undefined) return;
+        withdrawNotifications = path.observe((notification)=>{
+            if (closed || stopping || discoveryPaused) return;
+            if (notification.modelChanged === true && handed?.includes(notification.locator) === true) {
+                void enqueue();
+                return;
+            }
+            notices.set(notification.locator, notification.roomVersion);
+            chain = chain.then(runNotified, runNotified);
+        });
+    }
+    function writesHeld() {
+        return serviceMode === 'write-halted' || haltedRefusal;
+    }
+    function signalled(mode) {
+        if (closed) return;
+        if (mode === 'open') openSignals += 1;
+        const releasing = mode === 'open' && (haltedRefusal || serviceMode === 'write-halted');
+        if (mode === 'open') haltedRefusal = false;
+        if (mode !== serviceMode) {
+            serviceMode = mode;
+            journal.record(`service mode ${mode}`);
+            for (const listener of serviceModeListeners)listener(mode);
+        }
+        if (releasing) void enqueue();
+    }
+    function observeConversations() {
+        const stream = options.adapter.conversations;
+        if (stream === undefined || withdrawConversations !== undefined) return;
+        withdrawConversations = stream.observe((event)=>{
+            conversations.receive(event);
+            if (event.kind !== 'gap' || conversations.current()) return;
+            show();
+            scheduleCurrency();
+        });
+    }
+    function scheduleCurrency() {
+        if (currencyQueued || closed || stopping) return;
+        currencyQueued = true;
+        chain = chain.then(runCurrency, runCurrency);
+    }
+    async function runCurrency() {
+        currencyQueued = false;
+        if (closed || stopping || discoveryPaused) return;
+        await conversations.reconcile();
+        if (conversations.current()) {
+            show();
+            return;
+        }
+        const resting = status;
+        const progress = {
+            complete: false,
+            reachable: !resting.providerUnreachable
+        };
+        moveTo(transferring(resting));
+        try {
+            await conversations.catchUp(progress);
+        } catch  {
+            progress.reachable = false;
+        } finally{
+            if (!closed) {
+                moveTo(settled(resting, progress, resting.lastCompleted, pending(), attention()));
+            }
+        }
+    }
+    function handSelected(locators) {
+        const path = options.adapter.roomVersions;
+        if (path === undefined || withdrawNotifications === undefined) return;
+        if (handed !== undefined && JSON.stringify(locators) === JSON.stringify(handed)) return;
+        handed = locators;
+        path.select(locators);
+    }
+    async function runNotified() {
+        const announced = [
+            ...notices
+        ];
+        notices.clear();
+        if (announced.length === 0 || closed || stopping || discoveryPaused) return;
+        const resting = status;
+        const progress = {
+            complete: false,
+            reachable: !resting.providerUnreachable
+        };
+        moveTo(transferring(resting));
+        try {
+            const local = await openLocal();
+            for (const [locator, roomVersion] of announced){
+                if (closed || discoveryPaused || authorization === undefined) return;
+                if (handed?.includes(locator) !== true) continue;
+                const room = discovered.get(locator);
+                const held = replicas.get(locator);
+                if (room === undefined) continue;
+                if (sourceRefusals.has(locator)) {
+                    void enqueue();
+                    continue;
+                }
+                if (held === undefined) continue;
+                if (held.confirmed.record.roomVersion === roomVersion) continue;
+                const withheld = await advance(room, local, authorization);
+                if (withheld === null) continue;
+                if (withheld.kind === 'refused') {
+                    void enqueue();
+                    continue;
+                }
+                if (withheld.kind === 'scoped-refusal') {
+                    await scoped(withheld, room, local);
+                    continue;
+                }
+                if (withheld.kind === 'transport-uncertainty') {
+                    progress.reachable = false;
+                    continue;
+                }
+                if (withheld.kind === 'room-not-readable') {
+                    unreadable.add(locator);
+                    list(room, false);
+                    emitRooms();
+                    continue;
+                }
+                if (withheld.kind === 'revoked-authorization') {
+                    await refuse('revoked-authorization');
+                    return;
+                }
+            }
+        } catch  {
+            progress.reachable = false;
+        } finally{
+            if (!closed) {
+                moveTo(settled(resting, progress, resting.lastCompleted, pending(), attention()));
+            }
         }
+    }
+    function enqueue() {
+        if (stopping) return chain;
         if (inflight) {
             queued = true;
             return chain;
@@ -883,103 +2004,267 @@ export function createMdRuntime(options) {
         chain = chain.then(run, run);
         return chain;
     }
-    function startProcessing() {
-        if (leader) {
-            void enqueue();
-            return;
-        }
-        void window.navigator.locks.request('mdruntime-sync', {
-            signal: options.signal
-        }, async ()=>{
-            if (closed) return;
-            leader = true;
-            announce();
-            void enqueue();
-            await new Promise((resolve)=>{
-                releaseLeadership = ()=>{
-                    leader = false;
-                    resolve();
-                };
-            });
-        }).catch(()=>{});
-    }
     function close() {
+        if (closed) return;
         closed = true;
+        withdrawNotifications?.();
+        withdrawNotifications = undefined;
+        withdrawConversations?.();
+        withdrawConversations = undefined;
+        withdrawServiceMode?.();
+        conversations.close();
         stopTimer();
-        releaseLeadership();
-        channel?.close();
         store?.close();
+        void opening?.then((opened)=>{
+            opened.close();
+        }, ()=>{});
         roomListeners.clear();
         refusalListeners.clear();
         storageLossListeners.clear();
         statusListeners.clear();
-        querySubscriptions.clear();
+        serviceModeListeners.clear();
+        readSide.close();
         queueSubscriptions.clear();
+        roomDraftListeners.clear();
+        presentationListeners.clear();
     }
-    channel?.addEventListener('message', (event)=>{
-        const data = event.data;
-        if (data === null || typeof data !== 'object') return;
-        void exclusive(()=>applyRemote(data));
-    });
+    async function stop() {
+        stopping = true;
+        stopTimer();
+        await chain.catch(()=>undefined);
+        await mutations;
+        close();
+    }
+    const withdrawServiceMode = options.adapter.serviceMode?.observe(signalled);
+    observeConversations();
     options.signal?.addEventListener('abort', close, {
         once: true
     });
     if (options.signal?.aborted) close();
-    void openLocal().then(()=>{
-        if (!leader) notifyReady();
-    }, ()=>{
+    void openLocal().catch(()=>{
         notifyReady();
     });
-    startProcessing();
-    return {
+    void enqueue();
+    function watch(topic, input, deliver) {
+        if (topic === 'room-drafts') {
+            const listener = {
+                notify: deliver,
+                ready: false
+            };
+            roomDraftListeners.add(listener);
+            void exclusive(async ()=>{
+                await openLocal();
+                if (closed || !roomDraftListeners.has(listener)) return;
+                listener.ready = true;
+            }).then(()=>{
+                if (closed || !listener.ready || !roomDraftListeners.has(listener)) return;
+                listener.notify(snapshotRoomDrafts());
+            }, ()=>{});
+            return ()=>{
+                roomDraftListeners.delete(listener);
+            };
+        }
+        if (topic === 'conversation') {
+            return conversations.watch(input[0], input[1], deliver);
+        }
+        if (topic === 'presentation') {
+            const listener = {
+                app: input[0],
+                notify: deliver,
+                ready: false
+            };
+            presentationListeners.add(listener);
+            void exclusive(async ()=>{
+                await openLocal();
+            }).then(()=>{
+                if (closed || !presentationListeners.has(listener)) return;
+                listener.ready = true;
+                listener.notify(presentationOf(listener.app));
+            }, ()=>{});
+            return ()=>{
+                presentationListeners.delete(listener);
+            };
+        }
+        if (topic === 'rooms') {
+            roomListeners.add(deliver);
+            deliver(listed());
+            return ()=>{
+                roomListeners.delete(deliver);
+            };
+        }
+        if (topic === 'connection-refusal') {
+            refusalListeners.add(deliver);
+            deliver(refusal);
+            return ()=>{
+                refusalListeners.delete(deliver);
+            };
+        }
+        if (topic === 'storage-loss') {
+            storageLossListeners.add(deliver);
+            deliver(storageLoss);
+            return ()=>{
+                storageLossListeners.delete(deliver);
+            };
+        }
+        if (topic === 'sync-status') {
+            statusListeners.add(deliver);
+            deliver(shown);
+            return ()=>{
+                statusListeners.delete(deliver);
+            };
+        }
+        if (topic === 'service-mode') {
+            serviceModeListeners.add(deliver);
+            deliver(serviceMode);
+            return ()=>{
+                serviceModeListeners.delete(deliver);
+            };
+        }
+        if (topic === 'queue') {
+            const queue = {
+                locator: input[0],
+                notify: deliver
+            };
+            queueSubscriptions.add(queue);
+            queue.notify(entriesOf(queue.locator));
+            return ()=>{
+                queueSubscriptions.delete(queue);
+            };
+        }
+        const plan = planOf(input[0], roomFacts());
+        return readSide.watch(plan, identityOf(plan), deliver);
+    }
+    const md = {
+        loaded () {
+            return openLocal().then(()=>undefined);
+        },
         rooms () {
             return listed();
         },
-        query (request = {}) {
-            return visible(request);
+        slots () {
+            return slotted();
+        },
+        query: (input)=>readSide.query(planOf(input, roomFacts())),
+        async search (input) {
+            const plan = searchPlanOf(input);
+            const selected = plan.documents === undefined ? null : (await readSide.query(filterOf(plan.documents, roomFacts()))).documents;
+            return searchIndex.search(plan, selected);
         },
         types (locator) {
-            return replicas.get(locator)?.visible.collection.types ?? [];
+            return {
+                collection: modelTypes(modelOf(locator)),
+                typedSelection: rooms.get(locator)?.typedSelection === undefined || rooms.get(locator)?.typedSelection === null ? null : modelTypes(modelOf(locator, 'typed-selection'))
+            };
         },
         syncStatus () {
-            return status;
+            return shown;
         },
-        draft: {
-            read (locator, path) {
-                return drafts.get(at(locator, path)) ?? null;
+        serviceMode () {
+            return serviceMode;
+        },
+        roomDraft: {
+            list () {
+                return exclusive(async ()=>{
+                    await openLocal();
+                    return snapshotRoomDrafts();
+                }).then((listed)=>{
+                    publishRoomDrafts(true);
+                    return listed;
+                });
             },
-            async replace (locator, path, content) {
-                const local = await openLocal();
-                await local.keep({
-                    locator,
-                    path,
-                    content
+            read (room, path) {
+                const record = roomDrafts.get(room)?.get(path);
+                return record === undefined ? null : roomDraftOf(record);
+            },
+            write (room, path, revision, input) {
+                return exclusive(async ()=>{
+                    const parts = readParts(input);
+                    if (path === '' || normalize(path) !== path) throw new Error('room-draft-malformed');
+                    const local = await openLocal();
+                    const current = roomDrafts.get(room)?.get(path);
+                    if ((current?.revision ?? null) !== revision) {
+                        return {
+                            outcome: 'stale',
+                            current: current === undefined ? null : roomDraftOf(current)
+                        };
+                    }
+                    const record = {
+                        locator: room,
+                        path,
+                        revision: roomDraftRevision(),
+                        parts: held(current?.parts, parts),
+                        returned: current?.returned ?? null
+                    };
+                    await local.keepRoomDraft(record);
+                    rememberRoomDraft(record);
+                    publishChangeSet(changeSet(room, null, null, {
+                        drafts: [
+                            path
+                        ]
+                    }));
+                    return {
+                        outcome: 'written',
+                        roomDraft: roomDraftOf(record)
+                    };
                 });
-                drafts.set(at(locator, path), content);
             },
-            async discard (locator, path) {
-                const local = await openLocal();
-                await local.discard(locator, path);
-                drafts.delete(at(locator, path));
+            discard (room, path, revision) {
+                return exclusive(async ()=>{
+                    const local = await openLocal();
+                    const current = roomDrafts.get(room)?.get(path);
+                    if (current === undefined || current.revision !== revision) {
+                        return {
+                            outcome: 'stale',
+                            current: current === undefined ? null : roomDraftOf(current)
+                        };
+                    }
+                    await local.discardRoomDraft(room, path);
+                    forgetRoomDraft(room, path);
+                    publishChangeSet(changeSet(room, null, null, {
+                        drafts: [
+                            path
+                        ]
+                    }));
+                    moveTo({
+                        ...status,
+                        ...attention()
+                    });
+                    return {
+                        outcome: 'written',
+                        roomDraft: null
+                    };
+                });
             }
         },
-        save (locator, changes, replacing) {
-            return exclusive(()=>write(locator, changes, replacing));
-        },
-        outcome (identifier) {
-            const recorded = outcomes.get(identifier);
-            if (recorded !== undefined) return recorded;
-            for (const replica of replicas.values()){
-                if (replica.queue.some((batch)=>batch.id === identifier)) return {
-                    kind: 'pending'
-                };
+        conversation: conversations.surface,
+        chatDraft: conversations.chatDraft,
+        presentation: {
+            read (app) {
+                return exclusive(async ()=>{
+                    await openLocal();
+                    return presentationOf(app);
+                });
+            },
+            write (app, value) {
+                return exclusive(async ()=>{
+                    const local = await openLocal();
+                    const stored = structuredClone(value);
+                    await local.present({
+                        app,
+                        value: stored
+                    });
+                    presentations.set(app, stored);
+                    publishChangeSet(changeSet('', null, null, {
+                        presentation: app
+                    }));
+                });
             }
-            return null;
         },
-        queue: {
-            discard (locator, identifier) {
-                return exclusive(()=>discardHead(locator, identifier));
-            }
+        save (room, named, writtenBy) {
+            return exclusive(()=>saveRoomDrafts(room, named, writtenBy));
+        },
+        outcome (identifier) {
+            return outcomes.get(identifier) ?? null;
         },
         history (locator, path, query) {
             return readHistory(locator, path, query);
@@ -987,75 +2272,36 @@ export function createMdRuntime(options) {
         call (name, input) {
             return invokeAction(name, input);
         },
+        reached (locator, roomVersion, path) {
+            return path === undefined ? reachedBy(locator, roomVersion) : writtenAfter(locator, roomVersion, path);
+        },
         log () {
             return journal.export();
         },
         storageLoss () {
             return storageLoss;
         },
-        observe (topic, second, third) {
-            if (topic === 'rooms') {
-                const notify = second;
-                roomListeners.add(notify);
-                notify(listed());
-                return ()=>{
-                    roomListeners.delete(notify);
-                };
-            }
-            if (topic === 'connection-refusal') {
-                const notify = second;
-                refusalListeners.add(notify);
-                notify(refusal);
-                return ()=>{
-                    refusalListeners.delete(notify);
-                };
-            }
-            if (topic === 'storage-loss') {
-                const notify = second;
-                storageLossListeners.add(notify);
-                notify(storageLoss);
-                return ()=>{
-                    storageLossListeners.delete(notify);
-                };
-            }
-            if (topic === 'sync-status') {
-                const notify = second;
-                statusListeners.add(notify);
-                notify(status);
-                return ()=>{
-                    statusListeners.delete(notify);
-                };
-            }
-            if (topic === 'queue') {
-                const queue = {
-                    locator: second,
-                    notify: third
-                };
-                queueSubscriptions.add(queue);
-                queue.notify(entriesOf(queue.locator));
-                return ()=>{
-                    queueSubscriptions.delete(queue);
-                };
-            }
-            const subscription = {
-                query: second,
-                notify: third
-            };
-            const first = visible(subscription.query);
-            querySubscriptions.add(subscription);
-            subscription.notify(first);
-            return ()=>{
-                querySubscriptions.delete(subscription);
-            };
+        persistence () {
+            return options.shell.persistentStorage;
         },
+        observe: (topic, ...input)=>opened((deliver)=>watch(topic, input, (message)=>{
+                    deliver(structuredClone(message));
+                }), topic === 'query'),
         async reauthorize () {
             if (refusal === null || !refusal.reauthorizationOffered) return;
             journal.record('connection reauthorize');
+            await chain.catch(()=>undefined);
+            await mutations;
             authorization = undefined;
             discoveryPaused = false;
             await enqueue();
         }
     };
+    return {
+        md,
+        stop,
+        watch
+    };
 }
 
 //# sourceMappingURL=connection.js.map