@agentshouse/mdruntime 0.1.0-c2aaa9c0e3ca4 → 0.1.0-c2c52158b7381

package/dist/connection.js

@@ -1,30 +1,49 @@
-import { attachedModel } from './attached-model.js';
+import { roomTarget, target } from '@agentshouse/mdmodel';
+import { attachedModel, NO_ROOM_TYPES, roomTypesOf } from './attached-model.js';
 import { cached, modelTypes, NO_MODEL, sameModel, } from './model.js';
-import { observing } from './observation.js';
-import { filterOf, identityOf, planOf, } from './query.js';
+import { observing, whole } from './observation.js';
+import { filterOf, identityOf, planOf, plain, queryKey, } from './query.js';
 import { createReadSide } from './read-side.js';
-import { markdownPath, roomOfKey } from './rows.js';
+import { seededResult } from './seed.js';
+import { documentKey, markdownPath, roomOfKey } from './rows.js';
 import { createSearchIndex, searchPlanOf, } from './search.js';
+import { capped, MAXIMUM_WINDOW } from './windows.js';
 import { bootstrapRoom } from './bootstrap.js';
-import { changeSet, mergeChangeSets } from './change-set.js';
+import { changeSet, changing, entering, mergeChangeSets } from './change-set.js';
 import { createConversationStore, } from './conversation.js';
-import { queuedFile } from './change.js';
-import { validRoot } from './collection.js';
+import { leaving as leavingIn, partnerOf, queuedFile, } from './change.js';
+import { indexReferrers, referencesIndexed, validRoot, } from './collection.js';
 import { runtimeError } from './failure.js';
 import { createLog } from './log.js';
 import { binaryRecord } from './binary.js';
-import { absentBinary, binaryAnswer, calledResult, historyAnswer, undeclared, UNCERTAIN, } from './outcome.js';
+import { openedFiles } from './opened.js';
+import { ABSENT_TARGET, absentBinary, absentReference, binaryAnswer, binaryLinkAnswer, calledResult, failure, historyAnswer, LOCKED_UNREADABLE, lockedRoom, undeclared, UNCERTAIN, UNREADABLE, } from './outcome.js';
+import { createRecovery } from './recovery.js';
+import { doorReads } from './reads.js';
 import { refreshRoom } from './refresh.js';
-import { buildBatch, joined, limitedIn, requeued } from './save.js';
-import { applyReturned, compositionOf, confirmedOf, landed, readReclassified, replicaOf, sameMembership, withdrawals, } from './replica.js';
-import { binaryBase, changedParts, changesOf, held, heldFile, joinedDraft, readParts, returnedBy, returnedInto, staleWrite, underneath, withdrawnDrafts, } from './room-draft.js';
+import { buildBatch, buildMove, joined, limiting, queuedDocuments, requeuing, } from './save.js';
+import { applyReturned, compositionOf, confirmedOf, landed, readReclassified, replicating, sameMembership, standing, } from './replica.js';
+import { binaryBase, changedParts, changesOf, held, heldFile, joinedDraft, moveTarget, readParts, returnedBy, returnedInto, staleWrite, underneath, withdrawnDrafts, } from './room-draft.js';
 import { same, saving, STARTING, transferring, } from './status.js';
 import { detectStorageLoss, nextGeneration } from './durability.js';
-import { roomDraftRevision } from './identity.js';
+import { readinessOf, SETTLED_ROOMS, } from './readiness.js';
+import { FencedMap } from './fence.js';
+import { keysIn, tallying } from './shared.js';
+import { finished, inChunks, ROW_WEIGHT, stepped, yielded } from './turn.js';
+import { identityTime, roomDraftRevision } from './identity.js';
 import { beneath, normalize } from './paths.js';
 import { openRuntimeStore, } from './store.js';
 import { unconfirmed } from './transfer.js';
 import { governs, holds, narrowed, planReach, } from './reach.js';
+function roomsAlone(plan) {
+    return (plan.reach === null &&
+        plan.root.types === null &&
+        plan.root.where === null &&
+        plan.root.pathPrefix === null &&
+        plan.paths === null &&
+        plan.hop === null &&
+        plan.backlinks === null);
+}
 function within(root, path) {
     return root === '' || beneath(root, path);
 }
@@ -38,25 +57,74 @@ function declaredSelection(room) {
         root !== '' &&
         selection.roots.every((other, at) => at === index || !within(other, root)));
 }
+const OPENING_LANE = 'opening';
+const CONVERSATION_LANE = 'conversations';
+const ROOM_READS = 256;
+const ROOM_ATTEMPTS = 16;
+// A Room that locks offline stays readable this long after the connection drops, so a laptop waking or changing network keeps working while a disconnected device locks soon after.
+const LOCK_GRACE_MS = 120_000;
+function operationOf(input) {
+    const operation = input?.operation_id;
+    return typeof operation === 'string' ? operation : null;
+}
+const outside = new Map();
+function outsideOf(roots) {
+    const key = JSON.stringify(roots);
+    const held = outside.get(key);
+    if (held !== undefined)
+        return held;
+    const counted = (path) => (roots.some((root) => beneath(root, path)) ? 0 : 1);
+    const made = {
+        documents: (path) => (markdownPath(path) ? counted(path) : 0),
+        binaries: counted,
+    };
+    outside.set(key, made);
+    return made;
+}
+function abandonedOn(signal) {
+    return new Promise((resolve) => {
+        if (signal.aborted)
+            resolve(null);
+        else
+            signal.addEventListener('abort', () => resolve(null), { once: true });
+    });
+}
+function roomLane(locator) {
+    return `room ${locator}`;
+}
+function pendingKey(locator, id) {
+    return `${locator}\u0000${id}`;
+}
 export function composeRuntime(options) {
     const localSaves = options.adapter.localSaves === true;
+    const roomTypes = roomTypesOf(options.adapter.roomTypes);
     let authorization = options.authorization;
     let opening;
     let store;
-    const replicas = new Map();
-    const queuesWithoutReplica = new Map();
+    const fences = new Map();
+    const isFenced = (locator) => fences.has(locator);
+    let fencings = 0;
+    const lastFenced = new Map();
+    const fencedSince = (locator, since) => fences.has(locator) || (lastFenced.get(locator) ?? 0) > since;
+    let discoveries = 0;
+    const replicas = new FencedMap(isFenced);
+    const queuesWithoutReplica = new FencedMap(isFenced);
     const pendings = new Map();
-    const roomDrafts = new Map();
+    const seeds = new Map();
+    const seedWatchers = new Map();
+    const roomDrafts = new FencedMap(isFenced);
     const presentations = new Map();
     let limits = [];
     let capabilities = [];
-    const rooms = new Map();
+    const rooms = new FencedMap(isFenced);
     const counted = new Map();
     const unreadable = new Set();
-    const models = new Map();
-    const liveModels = new Map();
+    const isModelFenced = (key) => isFenced(key.slice(key.indexOf(' ') + 1));
+    const models = new FencedMap(isModelFenced);
+    const liveModels = new FencedMap(isModelFenced);
     const invalidModels = new Set();
     const discovered = new Map();
+    const reads = doorReads(options.adapter, (locator) => discovered.get(locator), () => generation);
     let roomsListed = false;
     const scopedRefusals = new Map();
     const sourceRefusals = new Map();
@@ -84,7 +152,6 @@ export function composeRuntime(options) {
     let status = STARTING;
     let shown = STARTING;
     let discoveryPaused = false;
-    let resetTimer;
     let closed = false;
     let stopping = false;
     let withdrawStream;
@@ -92,12 +159,23 @@ export function composeRuntime(options) {
     let underway = null;
     let streamed = null;
     let handed = false;
-    const submitting = new Map();
+    const recovery = (options.recovery ?? createRecovery()).scope(ROOM_ATTEMPTS);
+    const repairing = new Set();
+    const calling = new Set();
+    const repairable = new Map();
+    let outcomeRetention = null;
     const answering = new Map();
     let complete = false;
     let recorded = false;
     const stale = new Set();
-    let chain = Promise.resolve();
+    let generation = 0;
+    let discovering = null;
+    let opened = null;
+    const owed = new Set();
+    const reloadsDue = new Map();
+    const lanes = new Map();
+    let roomReads = { generation, free: ROOM_READS, waiting: [] };
+    const working = new Set();
     let mutations = Promise.resolve();
     const roomListeners = new Set();
     const refusalListeners = new Set();
@@ -108,33 +186,52 @@ export function composeRuntime(options) {
     const presentationListeners = new Set();
     const readSide = createReadSide();
     let withdrawConversations;
-    let currencyQueued = false;
+    let currencyQueued = null;
     let socketOpen = false;
+    const confirmed = new Set();
+    let lockGrace = null;
+    const lockListeners = new Set();
     let serviceMode = 'open';
     let haltedRefusal = false;
     let openSignals = 0;
     const serviceModeListeners = new Set();
     let member = null;
     const memberListeners = new Set();
-    const materialized = new Set();
-    let everyRoom = false;
-    const transfers = new Map();
+    const prepared = new Set();
+    const projecting = new Set();
+    const unpreparedDemand = new Set();
+    const unindexable = new Set();
+    let preparing = false;
+    let targets = {};
+    let persistence = options.shell.persistence;
+    let capacity = null;
+    const paused = new Set();
+    let rechecking = null;
+    const readinessWatches = new Set();
+    let readinessQueued = false;
+    const catching = new Set();
+    const transfers = new FencedMap(isFenced);
     const conversations = createConversationStore({
         agents: declaredAgents,
-        documents: (locator) => rowsQuery(planOf({ rooms: [locator], select: 'all' }, roomFacts())),
+        documents: ({ locator }) => rowsQuery(planOf({ rooms: [locator], select: { fields: 'all' } }, roomFacts())),
         call: (name, input) => invokeAction(name, input),
         durably,
         stream: () => options.adapter.conversations,
         publish: publishChangeSet,
+        online: () => connectionOf() !== 'unreachable' && refusal === null,
         closed: () => closed,
+        unanswered: resendLater,
+        expired: (operation) => pastHorizon(operation),
     });
     const searchIndex = createSearchIndex({
-        documents: () => readSide.documents(),
+        room: (room) => readSide.room(room),
         document: (room, path) => readSide.document(room, path),
-        messages: () => conversations.messages(),
-        message: (conversation, identity) => conversations.message(conversation, identity),
     });
+    const roomsToIndex = new Set();
+    const conversationsToIndex = new Set();
+    let indexing = false;
     const journal = createLog();
+    const keptFiles = openedFiles(options.database, isFenced);
     let notifyReady = () => { };
     const ready = new Promise((resolve) => {
         notifyReady = resolve;
@@ -188,6 +285,15 @@ export function composeRuntime(options) {
         const value = presentations.get(app);
         return value === undefined ? null : structuredClone(value);
     }
+    function keepPresentation(app, next) {
+        return exclusive(async () => {
+            const local = await openLocal();
+            const stored = next(presentations.get(app));
+            await local.present({ app, value: stored });
+            presentations.set(app, stored);
+            publishChangeSet(changeSet('', null, null, { presentation: app }));
+        });
+    }
     function emitPresentation(app) {
         if (closed)
             return;
@@ -212,9 +318,16 @@ export function composeRuntime(options) {
                 returned: structuredClone(record.returned),
             });
         }
+        for (const [room, refusal] of sourceRefusals)
+            attentionRequired.push({ room, refusal: structuredClone(refusal) });
         attentionRequired.sort((left, right) => {
             if (left.room !== right.room)
                 return left.room < right.room ? -1 : 1;
+            if ('refusal' in left || 'refusal' in right) {
+                if ('refusal' in left && 'refusal' in right)
+                    return 0;
+                return 'refusal' in left ? -1 : 1;
+            }
             if (left.path !== right.path)
                 return left.path < right.path ? -1 : 1;
             return 0;
@@ -230,23 +343,74 @@ export function composeRuntime(options) {
     }
     function documentsIn(locator) {
         const replica = replicas.get(locator);
-        if (replica === undefined)
-            return 0;
-        const roots = replica.confirmed.record.typedSelection?.roots ?? [];
-        let count = 0;
-        for (const path of Object.keys(replica.visible.documents)) {
-            if (markdownPath(path) && !roots.some((root) => beneath(root, path)))
-                count += 1;
-        }
-        return count;
+        return replica === undefined ? 0 : finished(counting(replica));
+    }
+    function* counting(replica) {
+        const weighed = outsideOf(replica.confirmed.record.typedSelection?.roots ?? []);
+        return ((yield* tallying(replica.visible.documents, weighed.documents)) +
+            (yield* tallying(replica.visible.binaries, weighed.binaries)));
     }
     function listed() {
         return structuredClone([...rooms.values()].map((room) => {
             const documents = documentsIn(room.locator);
             counted.set(room.locator, documents);
-            return { ...room, documents };
+            return locked(room.locator)
+                ? {
+                    ...room,
+                    model: modelTypes(NO_MODEL),
+                    typedSelection: null,
+                    documents: 0,
+                    locked: true,
+                }
+                : { ...room, documents, locked: false };
         }));
     }
+    function locked(locator) {
+        return rooms.get(locator)?.replica.offline === 'locked' && !confirmed.has(locator);
+    }
+    function lockedRooms() {
+        return [...rooms.keys()].filter(locked).sort();
+    }
+    function relocked(before) {
+        const after = lockedRooms();
+        if (JSON.stringify(after) === JSON.stringify(before))
+            return;
+        journal.record(`locked ${after.length}`);
+        emitRooms();
+        for (const notify of [...lockListeners])
+            notify();
+    }
+    function confirmLocks(listed) {
+        if (!socketOpen)
+            return;
+        for (const room of listed) {
+            if (room.replica.admission === 'admitted')
+                confirmed.add(room.locator);
+        }
+    }
+    function connectionLost() {
+        if (lockGrace !== null || closed)
+            return;
+        lockGrace = setTimeout(() => {
+            lockGrace = null;
+            if (socketOpen || closed)
+                return;
+            const before = lockedRooms();
+            confirmed.clear();
+            relocked(before);
+        }, LOCK_GRACE_MS);
+    }
+    function connectionLive() {
+        if (lockGrace !== null)
+            clearTimeout(lockGrace);
+        lockGrace = null;
+    }
+    function watchLocks(notify) {
+        lockListeners.add(notify);
+        return () => {
+            lockListeners.delete(notify);
+        };
+    }
     function roomFacts(reach = null) {
         const held = [...rooms.values()]
             .filter((room) => holds(reach, room.locator))
@@ -265,15 +429,19 @@ export function composeRuntime(options) {
         return { listed: roomsListed, rooms: held };
     }
     function emitRooms() {
+        readSide.recover();
+        queueReadiness();
         const value = listed();
         for (const listener of roomListeners)
             listener(value);
     }
     function emitRefusal() {
+        queueReadiness();
         for (const listener of refusalListeners)
             listener(refusal);
     }
     function emitStorageLoss() {
+        queueReadiness();
         for (const listener of storageLossListeners)
             listener(storageLoss);
     }
@@ -290,6 +458,7 @@ export function composeRuntime(options) {
     function show() {
         if (closed)
             return;
+        queueReadiness();
         const next = status.state === 'synced' && !conversations.current()
             ? { ...status, state: 'syncing' }
             : status;
@@ -299,17 +468,17 @@ export function composeRuntime(options) {
         for (const listener of statusListeners)
             listener(shown);
     }
-    function entryOf(batch) {
+    function entryOf(locator, batch) {
         if (localSaves)
             return Object.freeze({ batch, state: 'local' });
-        const state = pendings.get(batch.id);
+        const state = pendings.get(pendingKey(locator, batch.id));
         if (state?.accepted !== undefined) {
             return Object.freeze({ batch, state: 'accepted', roomVersion: state.accepted });
         }
         return Object.freeze({ batch, ...(state?.submission ?? { state: 'waiting' }) });
     }
     function entriesOf(locator) {
-        return (replicas.get(locator)?.queue ?? queuesWithoutReplica.get(locator) ?? []).map(entryOf);
+        return (replicas.get(locator)?.queue ?? queuesWithoutReplica.get(locator) ?? []).map((batch) => entryOf(locator, batch));
     }
     function emitQueue(locator) {
         const entries = entriesOf(locator);
@@ -319,42 +488,462 @@ export function composeRuntime(options) {
         }
     }
     function applyChangeSet(set) {
-        const held = everyRoom
-            ? set
-            : { ...set, documents: set.documents.filter(({ locator }) => materialized.has(locator)) };
-        readSide.apply(held);
-        searchIndex.changed(held);
-    }
-    function materialize(locators) {
-        if (everyRoom)
+        const held = {
+            ...set,
+            documents: set.documents.filter(({ locator }) => prepared.has(locator) || projecting.has(locator)),
+        };
+        const applied = readSide.apply(held, () => searchIndex.changed(held));
+        if (applied instanceof Promise)
+            void applied.catch(unpublished);
+    }
+    function unpublished(error) {
+        journal.record(`publication failed ${error instanceof Error ? error.name : 'unknown'}`);
+    }
+    async function referenced(locator) {
+        for (;;) {
+            const record = replicas.get(locator)?.confirmed.record;
+            if (record === undefined || closed)
+                return;
+            const held = { text: record.documents, binaries: record.binaries };
+            const composition = compositionOf(record);
+            if (referencesIndexed(held, composition))
+                return;
+            await indexReferrers(held, composition);
+        }
+    }
+    async function prepareReplica(locator) {
+        await referenced(locator);
+        const replica = replicas.get(locator);
+        if (replica === undefined || closed || prepared.has(locator))
             return;
-        if (locators === null)
-            everyRoom = true;
-        const sets = [];
-        for (const locator of locators ?? [...replicas.keys()]) {
-            if (materialized.has(locator))
-                continue;
-            materialized.add(locator);
-            const replica = replicas.get(locator);
-            if (replica !== undefined)
-                sets.push(changeSet(locator, null, replica));
+        const visible = replica.visible;
+        const entered = [];
+        projecting.add(locator);
+        try {
+            await inChunks(await stepped(keysIn(visible.documents, visible.binaries)), (path) => ROW_WEIGHT + (visible.documents[path]?.length ?? 0), (chunk) => {
+                const current = replicas.get(locator);
+                if (current === undefined || closed)
+                    return;
+                const set = entering(locator, current, chunk);
+                entered.push(set);
+                return readSide.apply(set);
+            });
+            if (!replicas.has(locator) || closed)
+                return;
+            prepared.add(locator);
         }
-        if (sets.length === 0)
+        finally {
+            projecting.delete(locator);
+        }
+        conversations.changed(mergeChangeSets(entered));
+        readSide.recover();
+        queueReadiness();
+    }
+    function unprepared() {
+        return [...unpreparedDemand, ...replicas.keys()].find((locator) => !prepared.has(locator) && !unindexable.has(locator));
+    }
+    function unbuilt(locator, error) {
+        unindexable.add(locator);
+        journal.record(`index failed ${locator} ${error instanceof Error ? error.name : 'unknown'}`);
+        queueReadiness();
+    }
+    function prepare(locators = []) {
+        for (const locator of locators)
+            unpreparedDemand.add(locator);
+        if (preparing)
             return;
-        const set = mergeChangeSets(sets);
-        readSide.apply(set);
-        searchIndex.changed(set);
+        preparing = true;
+        void (async () => {
+            try {
+                for (let waiting = unprepared(); waiting !== undefined; waiting = unprepared()) {
+                    await yielded();
+                    if (closed)
+                        return;
+                    unpreparedDemand.delete(waiting);
+                    await prepareReplica(waiting).catch((error) => unbuilt(waiting, error));
+                }
+            }
+            finally {
+                preparing = false;
+            }
+        })();
+    }
+    function roomsOfReach(reach) {
+        return new Set([...reach.rooms, ...reach.documents.map(roomOfKey)]);
     }
     function reachedRooms(plan) {
-        if (plan.rooms !== null)
-            return plan.rooms;
-        if (plan.reach === null)
+        const reached = plan.reach === null ? null : roomsOfReach(plan.reach);
+        const named = plan.rooms ??
+            (reached === null
+                ? [...new Set([...rooms.keys(), ...replicas.keys(), ...queuesWithoutReplica.keys()])]
+                : [...reached]);
+        return [...new Set(named)]
+            .filter((locator) => (reached === null || reached.has(locator)) && !plan.locked.includes(locator))
+            .sort();
+    }
+    function awaited(locator) {
+        return (!roomsListed ||
+            (rooms.has(locator) && discovered.get(locator)?.replica.admission === 'admitted'));
+    }
+    function covered(plan) {
+        const locators = reachedRooms(plan);
+        if (locators.length === 0 && plan.rooms === null && plan.reach === null && !roomsListed) {
+            return { pending: [] };
+        }
+        const pending = [];
+        const coverage = [];
+        const overlay = [];
+        for (const locator of locators) {
+            const replica = replicas.get(locator);
+            if (replica === undefined) {
+                if (awaited(locator))
+                    pending.push({ room: locator, awaits: 'acquisition' });
+                continue;
+            }
+            if (!prepared.has(locator)) {
+                pending.push({ room: locator, awaits: 'preparation' });
+                continue;
+            }
+            coverage.push({
+                room: locator,
+                generation: replica.confirmed.record.transfer,
+                current: !(catching.has(locator) || owed.has(locator) || transfers.has(locator)),
+            });
+            for (const batch of replica.queue)
+                overlay.push(batch.id);
+        }
+        if (pending.length > 0)
+            return { pending };
+        return { coverage: { rooms: coverage, indexes: [], overlay } };
+    }
+    function awaitPreparation(cover) {
+        if (!('pending' in cover))
+            return;
+        const waiting = cover.pending.filter(({ awaits }) => awaits === 'preparation');
+        if (waiting.length > 0)
+            prepare(waiting.map(({ room }) => room));
+    }
+    function requiredRooms(given) {
+        const reach = planReach(given);
+        if (reach === null)
+            return { listed: roomsListed, rooms: [...rooms.keys()].sort() };
+        const named = [...roomsOfReach(reach)].sort();
+        if (roomsListed)
+            return { listed: true, rooms: named.filter((room) => rooms.has(room)) };
+        return { listed: named.every((room) => replicas.has(room)), rooms: named };
+    }
+    function roomState(locator, search) {
+        if (sourceRefusals.has(locator))
+            return 'refused';
+        const listedRoom = discovered.get(locator);
+        if (roomsListed &&
+            (listedRoom === undefined ||
+                listedRoom.replica.admission !== 'admitted' ||
+                unreadable.has(locator)))
+            return 'unadmitted';
+        if (!replicas.has(locator))
+            return 'acquiring';
+        if (!prepared.has(locator))
+            return 'preparing';
+        if (search && !searchIndex.rooms().has(locator))
+            return 'indexing';
+        return 'complete';
+    }
+    function conversationCoverage(reach, search) {
+        const declared = reach === null || reach.conversations;
+        if (!declared || options.adapter.conversations === undefined || declaredAgents() === undefined)
+            return 'undeclared';
+        if (!conversations.known() || !conversations.current())
+            return 'acquiring';
+        if (!search)
+            return 'complete';
+        const unindexed = conversations
+            .searchable()
+            .filter((one) => conversations.acquired(one) && !searchIndex.conversations().has(one));
+        if (unindexed.length === 0)
+            return 'complete';
+        index([], unindexed);
+        return 'indexing';
+    }
+    function connectionOf() {
+        if (socketOpen)
+            return 'connected';
+        if (status.providerUnreachable)
+            return 'unreachable';
+        return options.adapter.roomStream === undefined && status.lastCompleted !== null
+            ? 'connected'
+            : 'connecting';
+    }
+    function refusedIn(locators) {
+        return locators.flatMap((room) => {
+            const held = sourceRefusals.get(room);
+            if (held === undefined)
+                return [];
+            const { file, location } = held.fields;
+            return [
+                {
+                    room,
+                    file: typeof file === 'string' ? file : '',
+                    rule: held.code,
+                    location: typeof location === 'string' ? location : null,
+                },
+            ];
+        });
+    }
+    function readinessFor(port, reach) {
+        const required = requiredRooms(reach);
+        const search = port.search === 'required';
+        const coverage = required.rooms.map((room) => ({ room, state: roomState(room, search) }));
+        const building = (state) => coverage
+            .filter((room) => room.state === state && !unindexable.has(room.room))
+            .map(({ room }) => room);
+        const preparing = building('preparing');
+        if (preparing.length > 0)
+            prepare(preparing);
+        const indexing = building('indexing');
+        if (indexing.length > 0)
+            index(indexing, []);
+        return readinessOf({
+            code: port.code,
+            coverage: {
+                listed: required.listed,
+                rooms: coverage,
+                conversations: conversationCoverage(reach, search),
+                search: search ? 'required' : 'unused',
+            },
+            persistence,
+            connection: connectionOf(),
+            house: refusal !== null ? 'refused' : writesHeld() ? 'write-halted' : 'open',
+            capacity: capacity !== null &&
+                coverage.some(({ room, state }) => paused.has(room) || !SETTLED_ROOMS.has(state))
+                ? capacity
+                : port.capacity,
+            refused: refusedIn(required.rooms),
+            lost: storageLoss !== null,
+            established: targets[port.target]?.established === true,
+        });
+    }
+    function establish(name) {
+        targets = { ...targets, [name]: { established: true } };
+        queueReadiness();
+        void durably((local) => local.keepTargets(targets)).catch(() => {
+            journal.record(`target record failed ${name}`);
+        });
+    }
+    function deliverReadiness(watch) {
+        if (!readinessWatches.has(watch))
+            return;
+        const readiness = readinessFor(watch.port, watch.reach);
+        if (readiness.ready && targets[watch.port.target]?.established !== true) {
+            establish(watch.port.target);
+        }
+        const shown = JSON.stringify(readiness);
+        if (shown === watch.last)
+            return;
+        watch.last = shown;
+        watch.deliver(structuredClone(readiness));
+    }
+    function queueReadiness() {
+        if (readinessQueued || closed || readinessWatches.size === 0)
+            return;
+        readinessQueued = true;
+        queueMicrotask(() => {
+            readinessQueued = false;
+            if (closed)
+                return;
+            for (const watch of [...readinessWatches])
+                deliverReadiness(watch);
+        });
+    }
+    function watchReadiness(port, reach, deliver) {
+        const watch = { port, reach, deliver, last: null };
+        readinessWatches.add(watch);
+        void openLocal().then(() => deliverReadiness(watch), () => deliverReadiness(watch));
+        return () => {
+            readinessWatches.delete(watch);
+        };
+    }
+    function layerBytes(layer) {
+        let bytes = 0;
+        for (const [path, text] of Object.entries(layer.documents))
+            bytes += (path.length + text.length) * 2;
+        return bytes;
+    }
+    function grownBy(next, previous) {
+        if (previous === undefined)
+            return layerBytes(next);
+        const documents = Object.fromEntries(Object.entries(next.documents).filter(([path, text]) => previous.documents[path] !== text));
+        return layerBytes({ ...next, documents });
+    }
+    function exceeded(error) {
+        return (typeof error === 'object' &&
+            error !== null &&
+            error.name === 'QuotaExceededError');
+    }
+    async function estimated() {
+        const estimate = options.shell.estimate === undefined ? null : await options.shell.estimate();
+        return estimate === null ? null : Math.max(0, estimate.total - estimate.usage);
+    }
+    function pause(locator, cause) {
+        paused.add(locator);
+        capacity = cause;
+        journal.record(`capacity ${cause.cause} ${locator} ${cause.needed} ${cause.available ?? '-'}`);
+        queueReadiness();
+        if (rechecking !== null)
+            return;
+        // A paused preparation measures the browser's space again each minute, so space freed elsewhere resumes it without a retry.
+        rechecking = setInterval(() => {
+            void recheck();
+        }, 60_000);
+    }
+    async function recheck() {
+        const held = capacity;
+        if (held === null || closed)
+            return;
+        const available = await estimated().catch(() => null);
+        if (available === null || available < (held.needed ?? 0))
+            return;
+        if (held.cause === 'storage-exceeded' &&
+            (held.available === null || available <= held.available))
+            return;
+        resume();
+    }
+    function resume() {
+        if (rechecking !== null)
+            clearInterval(rechecking);
+        rechecking = null;
+        if (paused.size === 0 && capacity === null)
+            return;
+        paused.clear();
+        capacity = null;
+        journal.record('capacity resumed');
+        queueReadiness();
+        if (!closed && authorization !== undefined)
+            void sync('unstreamed');
+    }
+    async function reclaimed(local) {
+        const unreferenced = [...transfers.keys()].filter((locator) => !discovered.has(locator));
+        for (const locator of unreferenced) {
+            await local.abandon(locator);
+            transfers.delete(locator);
+        }
+        if (unreferenced.length > 0)
+            journal.record(`capacity reclaimed ${unreferenced.length}`);
+        return unreferenced.length > 0;
+    }
+    async function admitted(local, locator, needed) {
+        if (paused.has(locator))
+            return false;
+        let available = await estimated().catch(() => null);
+        if (available === null || available >= needed)
+            return true;
+        if (await reclaimed(local))
+            available = await estimated().catch(() => null);
+        if (available === null || available >= needed)
+            return true;
+        pause(locator, { cause: 'insufficient-space', needed, available });
+        return false;
+    }
+    async function exceededOn(locator, bytes) {
+        const available = await estimated().catch(() => null);
+        pause(locator, { cause: 'storage-exceeded', needed: bytes, available });
+    }
+    function seedRoomHeld(room, version) {
+        return prepared.has(room) && reachedBy(room, version);
+    }
+    function seedHeld(at) {
+        return Object.entries(at).every(([room, version]) => (roomsListed && !rooms.has(room)) || seedRoomHeld(room, version));
+    }
+    function seedApplies(plan) {
+        const seed = seeds.get(plan.key);
+        if (seed === undefined)
+            return null;
+        if (!seedHeld(seed.at))
+            return seed;
+        seeds.delete(plan.key);
+        return null;
+    }
+    function seedBehind(plan, cover) {
+        const seed = seedApplies(plan);
+        if (seed === null || 'pending' in cover)
+            return cover;
+        return {
+            pending: Object.entries(seed.at)
+                .filter(([room, version]) => !seedRoomHeld(room, version))
+                .map(([room]) => ({ room, awaits: 'acquisition' })),
+        };
+    }
+    function seed(entry) {
+        if (seedHeld(entry.at))
+            return;
+        for (const { query, rows } of entry.queries) {
+            const key = queryKey(query);
+            seeds.set(key, { rows, at: entry.at });
+            for (const shown of seedWatchers.get(key) ?? [])
+                shown();
+        }
+    }
+    async function rowsQuery(plan) {
+        const before = covered(plan);
+        awaitPreparation(before);
+        const seeded = seedApplies(plan);
+        if (seeded !== null)
+            return seededResult(seeded).result;
+        if ('pending' in before)
+            return before;
+        const { rows, at: cover } = await readSide.query(plan, () => covered(plan));
+        awaitPreparation(cover);
+        if ('pending' in cover)
+            return cover;
+        return { ...rows, coverage: cover.coverage };
+    }
+    async function indexConversation(conversation) {
+        searchIndex.indexMessages(conversation, [], false);
+        let after = null;
+        for (;;) {
+            const batch = await durably((local) => local.messagesAfter(conversation, after));
+            if (closed)
+                return;
+            searchIndex.indexMessages(conversation, batch.map(({ identity, text }) => ({ conversation, identity, text })), batch.length === 0);
+            if (batch.length === 0)
+                return;
+            after = batch[batch.length - 1].identity;
+        }
+    }
+    function indexNext() {
+        const room = [...roomsToIndex].find((locator) => !searchIndex.rooms().has(locator) && !unindexable.has(locator));
+        if (room !== undefined) {
+            roomsToIndex.delete(room);
+            return () => prepared.has(room)
+                ? searchIndex.indexRoom(room).catch((error) => unbuilt(room, error))
+                : undefined;
+        }
+        const conversation = [...conversationsToIndex].find((one) => !searchIndex.conversations().has(one));
+        if (conversation === undefined)
             return null;
-        return [...plan.reach.rooms, ...plan.reach.documents.map(roomOfKey)];
+        conversationsToIndex.delete(conversation);
+        return () => indexConversation(conversation);
     }
-    function rowsQuery(plan) {
-        materialize(reachedRooms(plan));
-        return readSide.query(plan);
+    function index(rooms, named) {
+        for (const room of rooms)
+            roomsToIndex.add(room);
+        for (const conversation of named)
+            conversationsToIndex.add(conversation);
+        if (indexing)
+            return;
+        indexing = true;
+        void (async () => {
+            try {
+                for (let unit = indexNext(); unit !== null && !closed; unit = indexNext()) {
+                    await yielded();
+                    await unit();
+                    queueReadiness();
+                }
+            }
+            finally {
+                indexing = false;
+            }
+        })().catch(() => { });
     }
     function publishChangeSet(set) {
         applyChangeSet(set);
@@ -371,34 +960,7 @@ export function composeRuntime(options) {
             emitPresentation(app);
         conversations.changed(set);
     }
-    function stopTimer() {
-        if (resetTimer === undefined)
-            return;
-        clearTimeout(resetTimer);
-        resetTimer = undefined;
-    }
-    function armTimer() {
-        stopTimer();
-        if (closed || stopping)
-            return;
-        let earliest = null;
-        for (const { submission } of pendings.values()) {
-            if (submission.state !== 'reset')
-                continue;
-            const at = Date.parse(submission.reset);
-            if (earliest === null || at < earliest)
-                earliest = at;
-        }
-        if (earliest === null)
-            return;
-        // A Save House held back goes again only once the reset its answer named has passed.
-        resetTimer = setTimeout(() => {
-            resetTimer = undefined;
-            submitAll();
-        }, Math.max(0, earliest - Date.now()));
-    }
     async function refuse(reason, provider = null) {
-        stopTimer();
         discoveryPaused = true;
         try {
             if (reason === 'revoked-authorization') {
@@ -421,17 +983,22 @@ export function composeRuntime(options) {
                         models.set(key, revoked);
                         liveModels.delete(key);
                     }
-                    const changed = [];
-                    for (const [locator, room] of rooms) {
+                    const revocations = [];
+                    for (const locator of [...rooms.keys()]) {
                         const before = replicas.get(locator) ?? null;
-                        if (before !== null) {
-                            const record = {
-                                ...before.confirmed.record,
-                                model: revoked,
-                                selectionModel: revoked,
-                            };
-                            replicas.set(locator, replicaOf(confirmedOf(record, before.confirmed), before.queue, before));
-                        }
+                        const after = before === null
+                            ? null
+                            : await stepped(replicating(await confirmedOf({ ...before.confirmed.record, model: revoked, selectionModel: revoked }, before.confirmed), before.queue, before));
+                        const set = await stepped(changing(locator, before, after, { room: true }));
+                        revocations.push([locator, before, after, set]);
+                    }
+                    const changed = [];
+                    for (const [locator, before, after, set] of revocations) {
+                        const room = rooms.get(locator);
+                        if (room === undefined || (replicas.get(locator) ?? null) !== before)
+                            continue;
+                        if (after !== null)
+                            replicas.set(locator, after);
                         rooms.set(locator, {
                             ...room,
                             model: modelTypes(revoked),
@@ -439,7 +1006,7 @@ export function composeRuntime(options) {
                                 ? null
                                 : { ...room.typedSelection, model: modelTypes(revoked) },
                         });
-                        changed.push(changeSet(locator, before, replicas.get(locator) ?? null, { room: true }));
+                        changed.push(set);
                     }
                     publishChangeSet(mergeChangeSets(changed));
                 });
@@ -477,14 +1044,32 @@ export function composeRuntime(options) {
             refusal: scopedRefusals.get(room.locator) ?? sourceRefusals.get(room.locator) ?? null,
         });
     }
-    async function applyDiscovery(listed, local) {
+    async function applyDiscovery(found, started, covered) {
+        const lockedBefore = lockedRooms();
+        for (const room of found) {
+            const fence = fences.get(room.locator);
+            if (fence !== undefined && fence.erased && fence.at < started)
+                fences.delete(room.locator);
+        }
+        await loseRooms(found
+            .filter((room) => room.replica.admission !== 'admitted' && heldLocally(room.locator))
+            .map((room) => room.locator));
+        const listed = found.filter((room) => !fences.has(room.locator));
         const listedLocators = new Set(listed.map((room) => room.locator));
         for (const locator of listedLocators)
             scopedRefusals.delete(locator);
-        discovered.clear();
+        if (covered === undefined)
+            discovered.clear();
+        else
+            for (const locator of covered)
+                discovered.delete(locator);
         for (const room of listed)
             discovered.set(room.locator, room);
-        await dropUnlisted(listedLocators, local);
+        const unlisted = unlistedHeld(new Set(found.map((room) => room.locator))).filter((locator) => covered === undefined || covered.includes(locator));
+        if (options.adapter.exhaustiveDiscovery === true)
+            await loseRooms(unlisted);
+        else
+            unlistedKept(unlisted);
         for (const room of listed) {
             const held = replicas.get(room.locator)?.confirmed.record;
             if (held !== undefined && held.replica.selection !== room.replica.selection) {
@@ -493,8 +1078,17 @@ export function composeRuntime(options) {
             }
             list(room, room.replica.admission === 'admitted' && !unreadable.has(room.locator));
         }
+        confirmLocks(listed);
         roomsListed = true;
         emitRooms();
+        relocked(lockedBefore);
+        return listed;
+    }
+    function heldLocally(locator) {
+        return (replicas.has(locator) ||
+            roomDrafts.has(locator) ||
+            transfers.has(locator) ||
+            queuesWithoutReplica.has(locator));
     }
     function unlistedHeld(listed) {
         return [
@@ -506,40 +1100,85 @@ export function composeRuntime(options) {
             ]),
         ].filter((locator) => !listed.has(locator));
     }
-    async function dropUnlisted(listed, local) {
-        if (unlistedHeld(listed).length === 0)
-            return;
-        await exclusive(async () => {
-            const unlisted = unlistedHeld(listed);
-            await local.dropRooms(unlisted);
-            const removed = unlisted.map((locator) => changeSet(locator, replicas.get(locator) ?? null, null, {
-                room: true,
-                queue: true,
-                drafts: [...(roomDrafts.get(locator)?.keys() ?? [])],
-            }));
-            for (const locator of unlisted) {
-                for (const batch of replicas.get(locator)?.queue ?? queuesWithoutReplica.get(locator) ?? [])
-                    pendings.delete(batch.id);
-                replicas.delete(locator);
-                queuesWithoutReplica.delete(locator);
+    function unlistedKept(unlisted) {
+        for (const locator of unlisted) {
+            const held = replicas.get(locator)?.confirmed.record;
+            if (held !== undefined)
+                list(held, false);
+            else
                 rooms.delete(locator);
-                roomDrafts.delete(locator);
-                transfers.delete(locator);
-                unreadable.delete(locator);
-                stale.delete(locator);
-                scopedRefusals.delete(locator);
-                sourceRefusals.delete(locator);
-                declarationRefusals.delete(locator);
-                for (const attached of ['collection', 'typed-selection']) {
-                    const key = modelKey(locator, attached);
-                    models.delete(key);
-                    liveModels.delete(key);
-                    invalidModels.delete(key);
-                }
-                journal.record(`room unlisted ${locator}`);
+        }
+    }
+    function fence(locators) {
+        const fresh = [...new Set(locators)].filter((locator) => !fences.has(locator));
+        const removed = fresh.map((locator) => ({
+            locator,
+            shown: prepared.has(locator) || projecting.has(locator) ? (replicas.get(locator) ?? null) : null,
+            drafts: [...(roomDrafts.get(locator)?.keys() ?? [])],
+        }));
+        for (const locator of fresh) {
+            fences.set(locator, { at: discoveries, erased: false });
+            lastFenced.set(locator, ++fencings);
+            confirmed.delete(locator);
+            for (const batch of replicas.get(locator)?.queue ?? queuesWithoutReplica.get(locator) ?? [])
+                pendings.delete(pendingKey(locator, batch.id));
+            replicas.delete(locator);
+            queuesWithoutReplica.delete(locator);
+            rooms.delete(locator);
+            roomDrafts.delete(locator);
+            transfers.delete(locator);
+            catching.delete(locator);
+            discovered.delete(locator);
+            announced.delete(locator);
+            unreadable.delete(locator);
+            stale.delete(locator);
+            repairable.delete(locator);
+            unindexable.delete(locator);
+            paused.delete(locator);
+            prepared.delete(locator);
+            scopedRefusals.delete(locator);
+            sourceRefusals.delete(locator);
+            declarationRefusals.delete(locator);
+            for (const attached of ['collection', 'typed-selection']) {
+                const key = modelKey(locator, attached);
+                models.delete(key);
+                liveModels.delete(key);
+                invalidModels.delete(key);
             }
-            publishChangeSet(mergeChangeSets(removed));
-            moveTo({ ...status, ...attention() });
+            journal.record(`room lost ${locator}`);
+        }
+        if (fresh.length === 0)
+            return fresh;
+        searchIndex.forget(fresh);
+        const withdrawn = readSide.apply(stepped(withdrawing(removed)), (set) => conversations.changed(set));
+        if (withdrawn instanceof Promise)
+            void withdrawn.catch(unpublished);
+        publishChangeSet(mergeChangeSets(removed.map(({ locator, drafts }) => changeSet(locator, null, null, { room: true, queue: true, drafts }))));
+        readSide.recover();
+        moveTo({ ...status, ...attention() });
+        return fresh;
+    }
+    function* withdrawing(removed) {
+        const sets = [];
+        for (const { locator, shown } of removed)
+            sets.push(yield* changing(locator, shown, null));
+        return mergeChangeSets(sets);
+    }
+    async function erased(local, locators) {
+        await local.erase(locators);
+        for (const locator of locators) {
+            const held = fences.get(locator);
+            if (held !== undefined)
+                held.erased = true;
+        }
+    }
+    async function loseRooms(locators) {
+        const fresh = fence(locators);
+        if (fresh.length === 0)
+            return;
+        await durably(async (local) => {
+            await erased(local, fresh);
+            await unpair(local);
         });
     }
     function restored(key, persisted) {
@@ -561,7 +1200,7 @@ export function composeRuntime(options) {
         return model;
     }
     async function hydrate(opened) {
-        const [records, queues, kept, presented, held, chatDrafts, lastCompleted, declared, named, known, staged,] = await Promise.all([
+        const [records, queues, kept, presented, held, chatDrafts, lastCompleted, declared, named, known, staged, heldTargets,] = await Promise.all([
             opened.all(),
             opened.queues(),
             opened.roomDrafts(),
@@ -573,7 +1212,25 @@ export function composeRuntime(options) {
             opened.capabilities(),
             opened.member(),
             opened.transfers(),
+            opened.targets(),
         ]);
+        const queuedBatches = new Map(queues.map((queue) => [queue.locator, queue.pending.map(({ batch }) => batch)]));
+        const previousReplicas = new Map(replicas);
+        const read = new Map();
+        for (const record of records) {
+            const model = restored(modelKey(record.locator, 'collection'), record.model);
+            const selectionModel = restored(modelKey(record.locator, 'typed-selection'), record.selectionModel);
+            const prior = previousReplicas.get(record.locator);
+            const confirmed = await confirmedOf({ ...record, model, selectionModel }, prior?.confirmed);
+            const replica = await stepped(replicating(confirmed, queuedBatches.get(record.locator) ?? [], prior));
+            await stepped(counting(replica));
+            read.set(record.locator, replica);
+        }
+        const sets = new Map();
+        for (const locator of new Set([...previousReplicas.keys(), ...read.keys()])) {
+            sets.set(locator, await stepped(changing(locator, previousReplicas.get(locator) ?? null, read.get(locator) ?? null)));
+        }
+        targets = heldTargets;
         transfers.clear();
         for (const record of staged)
             transfers.set(record.locator, record);
@@ -587,26 +1244,24 @@ export function composeRuntime(options) {
         for (const record of presented)
             presentations.set(record.app, record.value);
         conversations.hydrate(held, chatDrafts);
-        const queuedBatches = new Map(queues.map((queue) => [queue.locator, queue.pending.map(({ batch }) => batch)]));
         pendings.clear();
         for (const queue of queues) {
-            for (const { batch, state } of queue.pending)
-                pendings.set(batch.id, state);
+            for (const { batch, state } of queue.pending) {
+                pendings.set(pendingKey(queue.locator, batch.id), state);
+            }
         }
-        const previousReplicas = new Map(replicas);
         replicas.clear();
         queuesWithoutReplica.clear();
-        const replicated = new Set(records.map((record) => record.locator));
         for (const [locator, queue] of queuedBatches) {
-            if (!replicated.has(locator))
+            if (!read.has(locator))
                 queuesWithoutReplica.set(locator, queue);
         }
         for (const record of records) {
-            const model = restored(modelKey(record.locator, 'collection'), record.model);
-            const selectionModel = restored(modelKey(record.locator, 'typed-selection'), record.selectionModel);
-            const prior = previousReplicas.get(record.locator);
-            const confirmed = confirmedOf({ ...record, model, selectionModel }, prior?.confirmed);
-            replicas.set(record.locator, replicaOf(confirmed, queuedBatches.get(record.locator) ?? [], prior));
+            if (fences.has(record.locator))
+                continue;
+            const replica = read.get(record.locator);
+            const { model, selectionModel } = replica.confirmed.record;
+            replicas.set(record.locator, replica);
             const existing = rooms.get(record.locator);
             if (existing === undefined)
                 list(record, false);
@@ -629,12 +1284,13 @@ export function composeRuntime(options) {
         return {
             lastCompleted,
             locators: new Set([...queuedBatches.keys(), ...replicas.keys()]),
-            read: mergeChangeSets([...new Set([...previousReplicas.keys(), ...replicas.keys()])].map((locator) => changeSet(locator, previousReplicas.get(locator) ?? null, replicas.get(locator) ?? null))),
+            read: mergeChangeSets([...sets].flatMap(([locator, set]) => (fences.has(locator) ? [] : [set]))),
         };
     }
     async function readState(opened) {
         const { lastCompleted, locators, read } = await hydrate(opened);
         applyChangeSet(read);
+        prepare();
         if (replicas.size > 0)
             emitRooms();
         if (member !== null)
@@ -645,8 +1301,15 @@ export function composeRuntime(options) {
         return lastCompleted;
     }
     async function open() {
-        const opened = await openRuntimeStore();
+        if (closed)
+            throw new Error('runtime closed');
+        const opened = await openRuntimeStore(isFenced, options.database);
         store = opened;
+        const interrupted = await opened.fences();
+        for (const locator of interrupted) {
+            fences.set(locator, { at: discoveries, erased: false });
+            lastFenced.set(locator, ++fencings);
+        }
         const kept = options.shell.generation;
         const storedGeneration = await opened.generation();
         const loss = detectStorageLoss(storedGeneration, kept);
@@ -660,7 +1323,12 @@ export function composeRuntime(options) {
             emitStorageLoss();
         }
         const lastCompleted = await readState(opened);
+        if (interrupted.length > 0)
+            await erased(opened, interrupted);
         moveTo({ ...status, lastCompleted, ...attention() });
+        void exclusive(() => unpair(opened)).catch(() => {
+            journal.record('unpair failed');
+        });
         return opened;
     }
     function durably(work) {
@@ -681,27 +1349,92 @@ export function composeRuntime(options) {
         mutations = next.then(() => undefined, () => undefined);
         return next;
     }
-    function withdrawable(batch) {
-        const state = pendings.get(batch.id);
-        return state !== undefined && state.submission.state !== 'submitted' && !state.lost;
+    function withdrawable(locator) {
+        return (batch) => {
+            const state = pendings.get(pendingKey(locator, batch.id));
+            return state !== undefined && state.submission.state !== 'submitted' && !state.lost;
+        };
+    }
+    function landedWhole(locator, batch, confirmed, current) {
+        if (!landed(batch, confirmed, current))
+            return false;
+        const partner = partnerOf(batch, locator);
+        if (partner === null)
+            return true;
+        const other = replicas.get(partner);
+        const half = other?.queue.find((one) => one.id === batch.id);
+        return other !== undefined && half !== undefined && landed(half, other.confirmed);
+    }
+    function carriedBack(locator, unlanded, written) {
+        const back = new Map();
+        const taken = [];
+        for (const batch of unlanded) {
+            const between = batch.between;
+            if (between === undefined)
+                continue;
+            const source = between.source.room;
+            const destination = between.destination.room;
+            for (const { path: to } of pendings.get(pendingKey(destination, batch.id))?.drafts ?? []) {
+                const record = roomDrafts.get(destination)?.get(to);
+                const path = between.moves.find((move) => move.to === to)?.path;
+                if (record === undefined || path === undefined)
+                    continue;
+                const [into, key] = source === locator ? [written, path] : [back, documentKey(source, path)];
+                const existing = into.get(key) ?? roomDrafts.get(source)?.get(path);
+                taken.push({ locator: destination, path: to });
+                into.set(key, {
+                    locator: source,
+                    path,
+                    revision: roomDraftRevision(),
+                    parts: returnedInto(existing?.parts, record.parts),
+                    returned: existing?.returned ?? null,
+                });
+            }
+        }
+        const records = [...back.values()];
+        const elsewhere = taken.filter((one) => one.locator !== locator);
+        const rooms = new Set([...records, ...elsewhere].map((one) => one.locator));
+        return {
+            taken: taken.filter((one) => one.locator === locator).map(({ path }) => path),
+            writes: [...rooms].map((room) => ({
+                locator: room,
+                roomDrafts: records.filter((record) => record.locator === room),
+                consumedRoomDrafts: elsewhere.filter((one) => one.locator === room).map(({ path }) => path),
+            })),
+            changes: [...rooms].map((room) => changeSet(room, null, null, {
+                drafts: [...records, ...elsewhere]
+                    .filter((one) => one.locator === room)
+                    .map(({ path }) => path),
+            })),
+            remember() {
+                for (const one of taken)
+                    forgetRoomDraft(one.locator, one.path);
+                for (const record of records)
+                    rememberRoomDraft(record);
+            },
+        };
     }
     async function settle(local, locator, before, confirmed, queue, settling = {}) {
         const previousQueue = before?.queue ?? queuesWithoutReplica.get(locator) ?? [];
-        const withdrawn = withdrawals(confirmed, queue, withdrawable, localSaves);
-        const kept = queue.filter((batch) => !withdrawn.includes(batch));
+        const { withdrawn, kept } = await stepped(standing(confirmed, queue, withdrawable(locator), localSaves));
+        const founded = kept.filter((batch) => !queue.includes(batch));
+        const queueChanged = kept.length !== previousQueue.length || founded.length > 0;
         const unqueued = withdrawn.map((batch) => ({
             batch,
-            returned: localSaves || landed(batch, confirmed) ? null : returnedBy('withdrawn'),
+            landed: landedWhole(locator, batch, confirmed),
         }));
         const returning = [
-            ...[...unqueued].reverse(),
+            ...[...unqueued].reverse().map(({ batch, landed }) => ({
+                batch,
+                returned: localSaves || landed ? null : returnedBy('withdrawn'),
+            })),
             ...(settling.leaving === undefined ? [] : [settling.leaving]),
         ];
         const written = new Map();
         for (const { batch, returned } of returning) {
-            if (returned === null)
+            if (returned === null || batch.between?.destination.room === locator)
                 continue;
-            for (const saved of pendings.get(batch.id)?.drafts ?? []) {
+            for (const saved of pendings.get(pendingKey(locator, batch.id))?.drafts ?? []) {
                 const existing = written.get(saved.path) ?? roomDrafts.get(locator)?.get(saved.path);
                 written.set(saved.path, {
                     locator,
@@ -712,13 +1445,28 @@ export function composeRuntime(options) {
                 });
             }
         }
-        await local.keepAuthored({ locator, queue: kept, roomDrafts: [...written.values()] });
+        const carried = carriedBack(locator, [
+            ...[...unqueued].reverse().flatMap(({ batch, landed }) => (landed ? [] : [batch])),
+            ...(settling.leaving === undefined || settling.leaving.returned === null
+                ? []
+                : [settling.leaving.batch]),
+        ], written);
+        await local.keepAuthored({
+            locator,
+            queue: kept,
+            founded,
+            roomDrafts: [...written.values()],
+            consumedRoomDrafts: carried.taken,
+        }, ...carried.writes);
+        const staying = new Set(kept.map((batch) => batch.id));
         for (const batch of previousQueue) {
-            if (!kept.includes(batch))
-                pendings.delete(batch.id);
+            if (!staying.has(batch.id))
+                pendings.delete(pendingKey(locator, batch.id));
         }
         for (const record of written.values())
             rememberRoomDraft(record);
+        carried.remember();
+        const drafts = [...written.keys(), ...carried.taken];
         try {
             await local.write({
                 next: confirmed.record,
@@ -727,31 +1475,38 @@ export function composeRuntime(options) {
             });
         }
         catch (error) {
-            const held = before === undefined ? null : replicaOf(before.confirmed, kept, before);
+            const held = before === undefined ? null : await stepped(replicating(before.confirmed, kept, before));
+            const set = await stepped(changing(locator, before ?? null, held, { queue: queueChanged, drafts }));
             if (held !== null)
                 replicas.set(locator, held);
             else if (kept.length > 0)
                 queuesWithoutReplica.set(locator, kept);
             else
                 queuesWithoutReplica.delete(locator);
-            publishChangeSet(changeSet(locator, before ?? null, held, {
-                queue: kept.length !== previousQueue.length,
-                drafts: [...written.keys()],
-            }));
+            publishChangeSet(mergeChangeSets([set, ...carried.changes]));
             moveTo({ ...status, ...attention() });
             throw error;
         }
-        queuesWithoutReplica.delete(locator);
-        for (const { batch, returned } of unqueued) {
-            const outcome = localSaves ? 'dropped' : returned === null ? 'landed' : 'withdrawn';
-            journal.record(`outcome ${locator} ${batch.id} ${outcome}`);
-        }
-        replicas.set(locator, replicaOf(confirmed, kept, before));
-        return changeSet(locator, before ?? null, replicas.get(locator) ?? null, {
-            room: settling.room,
-            queue: kept.length !== previousQueue.length,
-            drafts: [...written.keys()],
-        });
+        const changed = { room: settling.room, queue: queueChanged, drafts };
+        const next = await stepped(replicating(confirmed, kept, before));
+        await stepped(counting(next));
+        const set = await stepped(changing(locator, before ?? null, next, changed));
+        return () => {
+            queuesWithoutReplica.delete(locator);
+            for (const { batch, landed } of unqueued) {
+                const outcome = localSaves ? 'dropped' : landed ? 'landed' : 'withdrawn';
+                journal.record(`outcome ${locator} ${batch.id} ${outcome}`);
+            }
+            replicas.set(locator, next);
+            return mergeChangeSets([
+                heldChange(locator, before ?? null, next, set, changed),
+                ...carried.changes,
+            ]);
+        };
+    }
+    function heldChange(locator, before, next, set, changed) {
+        const held = replicas.get(locator) ?? null;
+        return held === next ? set : changeSet(locator, before, held, changed);
     }
     function adoptModels(locator, record) {
         for (const [attached, model] of [
@@ -771,7 +1526,7 @@ export function composeRuntime(options) {
         const taken = (answer, previous, attached) => {
             if (answer === undefined)
                 return previous;
-            const { state, refused } = attachedModel(answer, previous);
+            const { state, refused } = attachedModel(answer, previous, attached === 'collection' ? roomTypes : NO_ROOM_TYPES);
             if (refused !== null) {
                 const where = refused.location === undefined ? '' : ` ${refused.location}`;
                 journal.record(`model invalid ${locator} ${attached} ${refused.identity} ${refused.rule}${where}`);
@@ -784,11 +1539,16 @@ export function composeRuntime(options) {
             selection: taken(answers?.selection, held.selection, 'typed-selection'),
         };
     }
-    function publish(local, room, confirmed, landing = {}) {
+    function publish(local, room, confirmed, landing, live) {
         const { base, stored } = landing;
         return exclusive(async () => {
-            if (!continuing())
+            if (stored !== undefined) {
+                await indexReferrers({ text: confirmed.record.documents, binaries: confirmed.record.binaries }, compositionOf(confirmed.record));
+            }
+            if (!live()) {
+                caughtUpTo(room.locator);
                 return true;
+            }
             const prior = replicas.get(room.locator);
             if (base !== undefined &&
                 (prior?.confirmed.record.roomVersion !== base.record.roomVersion ||
@@ -799,32 +1559,58 @@ export function composeRuntime(options) {
             const queue = prior?.queue ?? queuesWithoutReplica.get(room.locator) ?? [];
             const roomVersion = confirmed.record.roomVersion;
             const accepted = queue.filter((batch) => {
-                const accepted = pendings.get(batch.id)?.accepted;
+                const accepted = pendings.get(pendingKey(room.locator, batch.id))?.accepted;
                 return (accepted !== undefined && options.adapter.reached(room.locator, roomVersion, accepted));
             });
-            const set = await settle(local, room.locator, prior, confirmed, queue.filter((batch) => !accepted.includes(batch)), { room: true, ...(stored === undefined ? {} : { stored }) });
-            if (stored !== undefined)
+            let settled;
+            try {
+                settled = await settle(local, room.locator, prior, confirmed, queue.filter((batch) => !accepted.includes(batch)), { room: true, ...(stored === undefined ? {} : { stored }) });
+            }
+            catch (error) {
+                if (!exceeded(error))
+                    throw error;
+                await exceededOn(room.locator, grownBy(confirmed.record, prior?.confirmed.record));
+                caughtUpTo(room.locator);
+                return true;
+            }
+            const set = settled();
+            if (stored !== undefined) {
                 transfers.delete(room.locator);
+                catching.delete(room.locator);
+            }
             for (const batch of accepted)
-                pendings.delete(batch.id);
+                pendings.delete(pendingKey(room.locator, batch.id));
             stale.delete(room.locator);
+            unindexable.delete(room.locator);
             if (unreadable.delete(room.locator))
                 scopedRefusals.delete(room.locator);
             sourceRefusals.delete(room.locator);
             declarationRefusals.delete(room.locator);
             list(room, true);
+            if (prior === undefined)
+                prepared.add(room.locator);
             publishChangeSet(set);
+            await unpair(local);
             moveTo({ ...status, ...attention() });
+            options.adapter.roomStream?.published(room.locator, roomVersion);
+            if (accepted.length > 0 && (replicas.get(room.locator)?.queue.length ?? 0) > 0) {
+                submitLater(room.locator);
+            }
             return true;
         });
     }
-    async function saveRoomDrafts(locator, named, writtenBy) {
+    async function savedRoom(locator) {
         const local = await openLocal();
+        await referenced(locator);
         const replica = replicas.get(locator);
         const room = rooms.get(locator);
         if (replica === undefined || room === undefined) {
             throw runtimeError('room-not-held', `No Local Replica for ${locator}`);
         }
+        return { local, replica, room };
+    }
+    async function saveRoomDrafts(locator, named, writtenBy) {
+        const target = await savedRoom(locator);
         const saved = [];
         for (const { path, revision } of named) {
             const record = roomDrafts.get(locator)?.get(path);
@@ -834,12 +1620,180 @@ export function composeRuntime(options) {
             if (!saved.some((draft) => draft.path === path))
                 saved.push({ path, parts: record.parts });
         }
+        return committed(locator, target, saved, new Set(saved.map(({ path }) => path)), writtenBy);
+    }
+    async function saveParts(locator, named, writtenBy) {
+        const read = named.map(({ path, parts }) => ({ path, parts: readParts(parts) }));
+        if (read.some(({ path }, at) => path === '' ||
+            normalize(path) !== path ||
+            read.findIndex((one) => one.path === path) !== at)) {
+            throw runtimeError('room-draft-malformed');
+        }
+        const target = await savedRoom(locator);
+        const saved = [];
+        const files = [];
+        for (const { path, parts } of read) {
+            const file = parts.file === undefined
+                ? undefined
+                : await heldFile(parts.file.blob, binaryBase(target.replica.visible, path));
+            if (parts.file !== undefined && file !== undefined) {
+                files.push({ key: file.localId, blob: parts.file.blob });
+            }
+            saved.push({ path, parts: held(undefined, parts, file) });
+        }
+        return committed(locator, target, saved, new Set(), writtenBy, files);
+    }
+    function carriedDrafts(locator, saved, consumed) {
+        const holding = roomDrafts.get(locator);
+        return new Map(saved.flatMap(({ path, parts }) => {
+            const record = holding?.get(path);
+            if (parts.move === undefined || record === undefined || consumed.has(path))
+                return [];
+            const to = moveTarget(parts.move);
+            if (to === path || holding?.has(to) === true)
+                return [];
+            return [[path, { ...record, path: to, revision: roomDraftRevision() }]];
+        }));
+    }
+    function sideOf(locator, replica, room) {
+        const record = replica.confirmed.record;
+        return {
+            room: locator,
+            handle: room.handle,
+            baseRoomVersion: record.roomVersion,
+            composition: compositionFor(record),
+            operations: room.operations,
+            providerOwnedPaths: room.providerOwnedPaths,
+            visible: replica.visible,
+            queued: queuedDocuments(replica.queue),
+            clean: {
+                text: record.documents,
+                binaries: record.binaries,
+                composition: compositionOf(record),
+            },
+        };
+    }
+    function movedInto(locator, saved) {
+        const into = saved.find(({ parts }) => parts.move?.room !== undefined && parts.move.room !== locator);
+        return into?.parts.move?.room ?? null;
+    }
+    async function committedMove(locator, destination, { local, replica, room }, saved, consumed, writtenBy, files) {
+        const mixed = saved.find(({ parts }) => Object.keys(parts).length !== 1 || parts.move?.room !== destination);
+        if (mixed !== undefined) {
+            return { outcome: 'refused', code: 'mixed-room-move', retryable: false, file: mixed.path };
+        }
+        const changed = saved.flatMap(({ path, parts }) => changedParts(path, underneath(parts, path, replica.visible)));
+        if (changed.length > 0)
+            return { outcome: 'refused', code: 'changed-underneath', retryable: false, parts: changed };
+        await referenced(destination);
+        const target = replicas.get(destination);
+        const listedRoom = rooms.get(destination);
+        if (target === undefined || listedRoom === undefined) {
+            throw runtimeError('room-not-held', `No Local Replica for ${destination}`);
+        }
+        const built = await buildMove({
+            source: sideOf(locator, replica, room),
+            destination: sideOf(destination, target, listedRoom),
+            moves: saved.map(({ path, parts }) => ({ path, to: moveTarget(parts.move) })),
+            providerLimits: limits,
+            local: localSaves,
+            ...(writtenBy === undefined ? {} : { writtenBy }),
+        });
+        if (built.kind === 'refused')
+            return { outcome: 'refused', ...built.refusal };
+        const id = built.leaving.id;
+        const carrying = saved.flatMap(({ path, parts }) => {
+            const record = roomDrafts.get(locator)?.get(path);
+            const to = moveTarget(parts.move);
+            if (record === undefined || consumed.has(path) || roomDrafts.get(destination)?.has(to)) {
+                return [];
+            }
+            const moved = {
+                ...record,
+                locator: destination,
+                path: to,
+                revision: roomDraftRevision(),
+            };
+            return [{ from: path, record: moved }];
+        });
+        const carried = carrying.map(({ record }) => record);
+        const marked = carried.map(({ path }) => ({ path, parts: {} }));
+        const left = [...consumed, ...carrying.map(({ from }) => from)];
+        const leavingQueue = [...replica.queue, built.leaving];
+        const arrivingQueue = [...target.queue, built.arriving];
+        let fencedRoom;
+        try {
+            fencedRoom = await local.saveAuthored(files, {
+                locator,
+                queue: leavingQueue,
+                saved: new Map([[id, saved]]),
+                consumedRoomDrafts: left,
+            }, {
+                locator: destination,
+                queue: arrivingQueue,
+                saved: new Map([[id, marked]]),
+                roomDrafts: carried,
+            });
+        }
+        catch {
+            return { outcome: 'refused', code: 'durable-write', retryable: true };
+        }
+        if (fencedRoom !== null) {
+            throw runtimeError('room-not-held', `No Local Replica for ${fencedRoom}`);
+        }
+        const nextSource = await stepped(replicating(replica.confirmed, leavingQueue, replica));
+        const nextDestination = await stepped(replicating(target.confirmed, arrivingQueue, target));
+        const sets = [
+            await stepped(changing(locator, replica, nextSource, { queue: true, drafts: left })),
+            await stepped(changing(destination, target, nextDestination, {
+                queue: true,
+                drafts: carried.map(({ path }) => path),
+            })),
+        ];
+        if (fences.has(locator) || fences.has(destination)) {
+            throw runtimeError('room-not-held', `No Local Replica for ${locator}`);
+        }
+        pendings.set(pendingKey(locator, id), {
+            drafts: saved,
+            submission: { state: 'waiting' },
+            lost: false,
+        });
+        pendings.set(pendingKey(destination, id), {
+            drafts: marked,
+            submission: { state: 'waiting' },
+            lost: false,
+        });
+        for (const path of left)
+            forgetRoomDraft(locator, path);
+        for (const record of carried)
+            rememberRoomDraft(record);
+        replicas.set(locator, nextSource);
+        replicas.set(destination, nextDestination);
+        publishChangeSet(mergeChangeSets(sets));
+        queuedSave(locator);
+        return { outcome: 'saved', identifier: id };
+    }
+    function queuedSave(locator) {
+        if (!localSaves)
+            recorded = false;
+        moveTo({ ...(localSaves ? status : saving(status)), ...attention() });
+        submitLater(locator);
+    }
+    async function committed(locator, target, saved, consumed, writtenBy, files = []) {
+        const into = movedInto(locator, saved);
+        if (into !== null) {
+            return committedMove(locator, into, target, saved, consumed, writtenBy, files);
+        }
+        const { local, replica, room } = target;
         const changed = saved.flatMap(({ path, parts }) => changedParts(path, underneath(parts, path, replica.visible)));
         if (changed.length > 0)
             return { outcome: 'refused', code: 'changed-underneath', retryable: false, parts: changed };
         const parts = saved.map(({ path, parts }) => changesOf(path, parts));
         const changes = parts.flatMap(({ changes }) => changes);
-        const requeue = requeued(replica.queue, changes, replica.visible, withdrawable, (queue) => replicaOf(replica.confirmed, queue, replica).visible);
+        const visibleOver = function* (queue) {
+            return (yield* replicating(replica.confirmed, queue, replica)).visible;
+        };
+        const requeue = await stepped(requeuing(replica.queue, changes, replica.visible, withdrawable(locator), visibleOver));
         if (requeue.kind === 'refused')
             return { outcome: 'refused', ...requeue.refusal };
         const foreign = [...requeue.withdrawn.keys()].some((origin) => {
@@ -866,9 +1820,17 @@ export function composeRuntime(options) {
             visible: replica.visible,
             changes,
             bases: parts.flatMap(({ bases }) => bases),
+            queued: queuedDocuments(replica.queue),
             writtenBy,
+            clean: {
+                text: replica.confirmed.record.documents,
+                binaries: replica.confirmed.record.binaries,
+                composition: compositionOf(replica.confirmed.record),
+            },
         };
-        const checked = withdrawing ? buildBatch({ ...input, queued: requeue.queued }) : null;
+        const checked = withdrawing
+            ? await buildBatch({ ...input, queued: new Set([...input.queued, ...requeue.queued]) })
+            : null;
         if (checked?.kind === 'refused')
             return { outcome: 'refused', ...checked.refusal };
         const owners = [...requeue.owners].flatMap((origin) => {
@@ -884,13 +1846,15 @@ export function composeRuntime(options) {
             };
         }
         const built = !withdrawing
-            ? buildBatch(input)
+            ? await buildBatch(input)
             : requeue.changes.length === 0
                 ? null
-                : buildBatch({
+                : await buildBatch({
                     ...input,
-                    visible: replicaOf(replica.confirmed, requeue.queue, replica).visible,
+                    visible: (await stepped(replicating(replica.confirmed, requeue.queue, replica)))
+                        .visible,
                     changes: requeue.changes,
+                    queued: queuedDocuments(requeue.queue),
                 });
         if (built?.kind === 'refused')
             return { outcome: 'refused', ...built.refusal };
@@ -907,7 +1871,7 @@ export function composeRuntime(options) {
         for (const [origin, replaced] of withdrawn) {
             if (replaced === null)
                 continue;
-            const carried = withdrawnDrafts(pendings.get(origin)?.drafts ?? [], changes);
+            const carried = withdrawnDrafts(pendings.get(pendingKey(locator, origin))?.drafts ?? [], changes);
             drafted.set(replaced.id, replaced === join?.batch
                 ? [
                     ...carried.map((held) => joinedDraft(held, saved)),
@@ -921,62 +1885,84 @@ export function composeRuntime(options) {
         for (const replaced of withdrawn.values()) {
             if (replaced === null || !batches.includes(replaced))
                 continue;
-            const limited = limitedIn(batches, replaced, limits, (queue) => replicaOf(replica.confirmed, queue, replica).visible);
+            const limited = await stepped(limiting(batches, replaced, limits, visibleOver));
             if (limited !== null)
                 return { outcome: 'refused', ...limited };
         }
-        const consumed = saved.map(({ path }) => path);
+        const carried = carriedDrafts(locator, saved, consumed);
+        const left = [...consumed, ...carried.keys()];
+        const arrived = [...carried.values()];
+        let fencedRoom;
         try {
-            await local.keepAuthored({
+            fencedRoom = await local.saveAuthored(files, {
                 locator,
                 queue: batches,
                 saved: drafted,
-                consumedRoomDrafts: consumed,
+                consumedRoomDrafts: left,
+                roomDrafts: arrived,
             });
         }
         catch {
             return { outcome: 'refused', code: 'durable-write', retryable: true };
         }
+        if (fencedRoom !== null) {
+            throw runtimeError('room-not-held', `No Local Replica for ${fencedRoom}`);
+        }
+        const next = await stepped(replicating(replica.confirmed, batches, replica));
+        const set = await stepped(changing(locator, replica, next, {
+            queue: true,
+            drafts: [...left, ...arrived.map(({ path }) => path)],
+        }));
+        if (fences.has(locator))
+            throw runtimeError('room-not-held', `No Local Replica for ${locator}`);
         for (const origin of withdrawn.keys())
-            pendings.delete(origin);
+            pendings.delete(pendingKey(locator, origin));
         for (const [id, drafts] of drafted) {
-            pendings.set(id, { drafts, submission: { state: 'waiting' }, lost: false });
+            pendings.set(pendingKey(locator, id), {
+                drafts,
+                submission: { state: 'waiting' },
+                lost: false,
+            });
         }
-        if (!localSaves)
-            recorded = false;
-        for (const path of consumed)
+        for (const path of left)
             forgetRoomDraft(locator, path);
-        replicas.set(locator, replicaOf(replica.confirmed, batches, replica));
-        publishChangeSet(changeSet(locator, replica, replicas.get(locator) ?? null, {
-            queue: true,
-            drafts: consumed,
-        }));
-        moveTo({ ...(localSaves ? status : saving(status)), ...attention() });
-        submitLater(locator);
+        for (const record of arrived)
+            rememberRoomDraft(record);
+        replicas.set(locator, next);
+        publishChangeSet(set);
+        queuedSave(locator);
         const identifier = join?.batch.id ??
             built?.batch.id ??
             [...requeue.withdrawn].map(([origin, replaced]) => replaced?.id ?? origin).at(-1);
         return { outcome: 'saved', identifier };
     }
-    async function mark(local, locator, identifier, submission, lost) {
-        const state = pendings.get(identifier);
-        if (!continuing() ||
-            state === undefined ||
-            (JSON.stringify(state.submission) === JSON.stringify(submission) && state.lost === lost)) {
-            return;
+    async function mark(local, locator, batch, submission, lost) {
+        const partner = partnerOf(batch, locator);
+        for (const held of partner === null ? [locator] : [locator, partner]) {
+            const state = pendings.get(pendingKey(held, batch.id));
+            if (!continuing() ||
+                state === undefined ||
+                (JSON.stringify(state.submission) === JSON.stringify(submission) && state.lost === lost)) {
+                continue;
+            }
+            await local.submit(held, batch.id, submission, lost);
+            if (fences.has(held))
+                continue;
+            pendings.set(pendingKey(held, batch.id), { ...state, submission, lost });
+            const replica = replicas.get(held);
+            if (replica !== undefined)
+                publishChangeSet(changeSet(held, replica, replica, { queue: true }));
         }
-        await local.submit(locator, identifier, submission, lost);
-        pendings.set(identifier, { ...state, submission, lost });
-        const replica = replicas.get(locator);
-        if (replica !== undefined)
-            publishChangeSet(changeSet(locator, replica, replica, { queue: true }));
         moveTo({ ...status, ...attention() });
     }
     async function keepUpload(local, locator, identifier, upload) {
         if (!continuing())
             throw new Error('connection refused');
         await local.keepUpload(locator, identifier, upload);
-        pendings.set(identifier, { ...pendings.get(identifier), upload });
+        if (fences.has(locator))
+            throw runtimeError('room-not-held', `No Local Replica for ${locator}`);
+        const key = pendingKey(locator, identifier);
+        pendings.set(key, { ...pendings.get(key), upload });
         if (!continuing())
             throw new Error('connection refused');
     }
@@ -991,6 +1977,7 @@ export function composeRuntime(options) {
         }
         if (closed || authorization === undefined || refusal !== null)
             return UNCERTAIN;
+        const since = fencings;
         const transfer = ['transfer', 'history', locator, path];
         if (query.revision !== undefined)
             transfer.push(query.revision);
@@ -1005,6 +1992,8 @@ export function composeRuntime(options) {
                 ...(query.pageToken === undefined ? {} : { pageToken: query.pageToken }),
             });
             journal.record(`outcome history ${result.kind}`);
+            if (fencedSince(locator, since))
+                return failure({ kind: 'room-not-readable', locator });
             if (result.kind === 'scoped-refusal') {
                 const room = replicas.get(result.locator)?.confirmed.record;
                 if (room !== undefined)
@@ -1019,15 +2008,61 @@ export function composeRuntime(options) {
             return UNCERTAIN;
         }
     }
-    function queuedBlob(locator, path, localId) {
+    function located(room, path, destination) {
+        const crossing = roomTarget(destination);
+        if (crossing === null) {
+            const named = target(path, destination);
+            return named === null || !rooms.has(room) ? null : { room, path: named };
+        }
+        const held = [...rooms.values()].find((listed) => listed.handle === crossing.handle);
+        return held === undefined ? null : { room: held.locator, path: crossing.path };
+    }
+    async function resolveReference(room, path, destination) {
+        if (roomTarget(destination) === null && target(path, destination) === null) {
+            return ABSENT_TARGET;
+        }
+        const at = located(room, path, destination);
+        if (at === null)
+            return UNREADABLE;
+        if (locked(at.room))
+            return LOCKED_UNREADABLE;
+        const visible = replicas.get(at.room)?.visible;
+        if (visible?.documents[at.path] !== undefined || visible?.binaries[at.path] !== undefined) {
+            return { kind: 'document', ...at };
+        }
+        const history = await readHistory(at.room, at.path);
+        if (history.kind === 'no-history' || history.kind === 'revision')
+            return ABSENT_TARGET;
+        if (history.kind !== 'history')
+            return history;
+        const [last] = history.revisions;
+        if (last === undefined)
+            return ABSENT_TARGET;
+        return history.deleted === true
+            ? { kind: 'deleted', ...at, revision: last }
+            : { kind: 'document', ...at };
+    }
+    function queuedFacts(locator, path, localId) {
         for (const batch of replicas.get(locator)?.queue ?? []) {
             const change = batch.changes[queuedFile(batch, path, localId)];
             if (change?.kind === 'binary')
-                return change.blob;
+                return change;
         }
-        return null;
+        const drafted = roomDrafts.get(locator)?.get(path)?.parts.file;
+        return drafted?.localId === localId ? drafted : null;
+    }
+    function batchFile(batch) {
+        return async (localId) => {
+            const change = batch.changes.find((held) => held.kind === 'binary' && held.localId === localId);
+            return (await openLocal()).file(localId, change?.kind === 'binary' ? change.mediaType : '');
+        };
     }
-    async function readBinary(request) {
+    function binaryRoom(request) {
+        if (request.kind === 'path')
+            return request.locator;
+        return options.adapter.referrerScope(request.referrer)?.locator ?? null;
+    }
+    async function transferBinary(request, transfer, answer) {
         if (closed || refusal !== null)
             return UNCERTAIN;
         try {
@@ -1038,41 +2073,51 @@ export function composeRuntime(options) {
         }
         if (closed || authorization === undefined || refusal !== null)
             return UNCERTAIN;
+        const since = fencings;
         journal.record(request.kind === 'path'
             ? `transfer binary ${request.locator} ${request.path}`
             : `transfer binary ${request.fileRef}`);
         try {
-            const result = await options.adapter.binary(authorization, request);
-            journal.record(`outcome binary ${result.kind}`);
-            if (result.kind === 'scoped-refusal') {
-                const room = replicas.get(result.locator)?.confirmed.record;
+            const result = await transfer(authorization);
+            const settled = result;
+            journal.record(`outcome binary ${settled.kind}`);
+            const locator = binaryRoom(request);
+            if (locator !== null && fencedSince(locator, since))
+                return failure({ kind: 'room-not-readable', locator });
+            if (settled.kind === 'scoped-refusal') {
+                const room = replicas.get(settled.locator)?.confirmed.record;
                 if (room !== undefined)
-                    await scoped(result, room, await openLocal());
+                    await scoped(settled, room, await openLocal());
             }
-            if (result.kind === 'revoked-authorization')
+            if (settled.kind === 'revoked-authorization')
                 await refuse('revoked-authorization');
-            return binaryAnswer(result);
+            return answer(result);
         }
         catch {
             journal.record('outcome binary transport-uncertainty');
             return UNCERTAIN;
         }
     }
-    async function readBinaryPath(locator, path, revision) {
-        await ready;
+    async function readBinary(request, name) {
+        if (closed)
+            return UNCERTAIN;
+        const held = await keptFiles.find(name);
+        if (held !== null)
+            return held;
+        return transferBinary(request, (authorization) => keptFiles.fetch(name, () => options.adapter.binary(authorization, request)), binaryAnswer);
+    }
+    function binaryPath(locator, path, revision) {
         if (revision !== undefined)
-            return readBinary({ kind: 'path', locator, path, revision });
+            return { kind: 'path', locator, path, revision };
         const visible = replicas.get(locator)?.visible;
         const held = visible?.binaries[path];
         if (visible === undefined || held === undefined)
-            return absentBinary(path);
-        if (held.state === 'pending') {
-            const blob = queuedBlob(locator, path, held.localId);
-            return blob === null ? absentBinary(path) : { kind: 'binary', blob };
-        }
+            return null;
+        if (held.state === 'pending')
+            return { kind: 'pending', localId: held.localId };
         const record = binaryRecord(path, held, visible.revisions[path]);
         if (record.state !== 'accepted')
-            return absentBinary(path);
+            return null;
         const replica = replicas.get(locator);
         const queued = (replica?.queue ?? []).flatMap((batch) => batch.changes);
         const holds = (at) => {
@@ -1087,21 +2132,55 @@ export function composeRuntime(options) {
             if (change.kind === 'move' && change.to === confirmed)
                 confirmed = change.path;
         }
-        return readBinary({
+        return {
             kind: 'path',
             locator,
             path: confirmed,
             revision: record.revision,
             fileRef: record.fileRef,
-        });
+        };
+    }
+    async function readBinaryPath(locator, path, revision) {
+        await ready;
+        const drafted = roomDrafts.get(locator)?.get(path)?.parts.file;
+        const asked = drafted !== undefined && drafted.localId === revision
+            ? { kind: 'pending', localId: revision }
+            : binaryPath(locator, path, revision);
+        if (asked === null)
+            return absentBinary(path);
+        if (asked.kind === 'pending') {
+            const facts = queuedFacts(locator, path, asked.localId);
+            return facts === null
+                ? absentBinary(path)
+                : {
+                    kind: 'binary',
+                    file: asked.localId,
+                    byteLength: facts.byteLength,
+                    mediaType: facts.mediaType,
+                };
+        }
+        return readBinary(asked, { locator, path: asked.path, revision: asked.revision });
+    }
+    async function linkBinaryPath(locator, path, revision) {
+        await ready;
+        const asked = binaryPath(locator, path, revision);
+        if (asked === null || asked.kind === 'pending')
+            return absentBinary(path);
+        return transferBinary(asked, (held) => options.adapter.link(held, asked), binaryLinkAnswer);
     }
     async function readBinaryReference(reference) {
         await ready;
-        return readBinary({
-            kind: 'reference',
-            fileRef: reference.fileRef,
-            referrer: reference.referrer,
-        });
+        const scope = options.adapter.referrerScope(reference.referrer);
+        if (scope === null)
+            return absentReference(reference.fileRef);
+        return readBinary({ kind: 'reference', fileRef: reference.fileRef, referrer: reference.referrer }, { locator: scope.locator, path: scope.path ?? '', revision: reference.fileRef });
+    }
+    function readPart(file, part) {
+        return options.database.ask({ kind: 'file.part', key: file, part });
+    }
+    async function cleanUp() {
+        const freed = await options.database.ask({ kind: 'opened.clean' });
+        return freed + ((await options.shell.cleanUp?.()) ?? 0);
     }
     function declaredAgents() {
         for (const capability of capabilities) {
@@ -1119,7 +2198,14 @@ export function composeRuntime(options) {
         }
         return undefined;
     }
-    async function invokeAction(name, input) {
+    function calledRooms(name, input) {
+        const member = declaredAction(name)?.room;
+        if (member === undefined || input === null || typeof input !== 'object')
+            return [];
+        const named = input[member];
+        return (Array.isArray(named) ? named : [named]).filter((room) => typeof room === 'string');
+    }
+    async function invokeAction(name, input, dispatching) {
         await ready;
         if (closed || refusal !== null)
             return UNCERTAIN;
@@ -1133,6 +2219,7 @@ export function composeRuntime(options) {
         }
         if (closed || authorization === undefined || refusal !== null)
             return UNCERTAIN;
+        await dispatching?.();
         journal.record(`transfer action ${name}`);
         try {
             const result = await options.adapter.action(authorization, { name, input });
@@ -1153,6 +2240,60 @@ export function composeRuntime(options) {
             return UNCERTAIN;
         }
     }
+    function unsettled(result) {
+        return result.kind !== 'action' && result.retryable;
+    }
+    async function recoveredAction(name, input) {
+        const operation = operationOf(input);
+        if (operation === null)
+            return invokeAction(name, input);
+        const kept = async () => (await openLocal()).keepCall({ operation, name, input });
+        calling.add(operation);
+        try {
+            let result = await invokeAction(name, input, kept);
+            if (unsettled(result)) {
+                await recovery.attempt(`action ${operation}`, async () => {
+                    if (closed || refusal !== null)
+                        return 'done';
+                    if (!socketOpen)
+                        return 'again';
+                    result = await invokeAction(name, input, kept);
+                    return unsettled(result) ? 'again' : 'done';
+                }, { again: true });
+            }
+            if (!unsettled(result))
+                await (await openLocal()).dropCall(operation);
+            return result;
+        }
+        finally {
+            calling.delete(operation);
+        }
+    }
+    async function resendCalls(signal) {
+        if (!socketOpen || closed || stopping)
+            return 'done';
+        const local = await openLocal();
+        for (const held of await local.calls()) {
+            if (calling.has(held.operation))
+                continue;
+            if (closed || signal.aborted)
+                return 'done';
+            if (pastHorizon(held.operation)) {
+                await local.dropCall(held.operation);
+                continue;
+            }
+            calling.add(held.operation);
+            try {
+                if (unsettled(await invokeAction(held.name, held.input)))
+                    return 'again';
+                await local.dropCall(held.operation);
+            }
+            finally {
+                calling.delete(held.operation);
+            }
+        }
+        return 'done';
+    }
     function continuing() {
         return !closed && !discoveryPaused;
     }
@@ -1167,11 +2308,12 @@ export function composeRuntime(options) {
             options.adapter.reached(locator, written, roomVersion) &&
             !options.adapter.reached(locator, roomVersion, written));
     }
-    async function pullRefresh(authorized, confirmed) {
-        if (!continuing())
+    async function pullRefresh(authorized, confirmed, live) {
+        if (!live())
             return unconfirmed;
+        const turn = generation;
         try {
-            const result = await refreshRoom(options.adapter, authorized, confirmed, (models, held) => remodel(confirmed.record.locator, models, held), continuing);
+            const result = await refreshRoom(reads, authorized, confirmed, (models, held) => (live() ? remodel(confirmed.record.locator, models, held) : held), live);
             const detail = result.kind === 'advanced' ? result.confirmed.record.roomVersion : result.kind;
             journal.record(`transfer refresh ${confirmed.record.locator} ${detail}`);
             return result;
@@ -1180,48 +2322,101 @@ export function composeRuntime(options) {
             journal.record(`transfer refresh ${confirmed.record.locator} transport-uncertainty`);
             throw error;
         }
+        finally {
+            reads.finished(confirmed.record.locator, turn);
+        }
     }
-    function staging(local) {
+    function staging(local, live) {
         return {
             held: (locator) => transfers.get(locator) ?? null,
             staged: (record) => local.staged(record),
             stage: (record, page) => exclusive(async () => {
-                if (!continuing())
+                if (!live())
+                    return false;
+                const bytes = layerBytes(page);
+                if (!(await admitted(local, record.locator, bytes)))
                     return false;
-                await local.stage(record, page);
+                try {
+                    await local.stage(record, page);
+                }
+                catch (error) {
+                    if (!exceeded(error))
+                        throw error;
+                    await exceededOn(record.locator, bytes);
+                    return false;
+                }
                 transfers.set(record.locator, record);
+                readSide.recover();
                 return true;
             }),
             abandon: (locator) => exclusive(async () => {
-                if (!continuing())
+                if (!live())
                     return;
                 await local.abandon(locator);
                 transfers.delete(locator);
+                readSide.recover();
             }),
         };
     }
-    async function pullBootstrap(authorized, room, local) {
-        if (!continuing())
+    function reusable(room) {
+        const record = replicas.get(room.locator)?.confirmed.record;
+        if (record === undefined || record.replica.selection !== room.replica.selection)
+            return null;
+        return { documents: record.documents, revisions: record.revisions };
+    }
+    async function pullBootstrap(authorized, room, local, live) {
+        if (!live())
             return unconfirmed;
+        const turn = generation;
+        if (replicas.has(room.locator)) {
+            catching.add(room.locator);
+            readSide.recover();
+        }
         try {
-            const result = await bootstrapRoom(options.adapter, authorized, room, {
+            const result = await bootstrapRoom(reads, authorized, room, {
                 collection: modelOf(room.locator),
                 selection: modelOf(room.locator, 'typed-selection'),
-            }, (models, held) => remodel(room.locator, models, held), continuing, staging(local));
+            }, (models, held) => (live() ? remodel(room.locator, models, held) : held), live, staging(local, live), reusable(room));
             const detail = result.kind === 'staged' ? result.confirmed.record.roomVersion : result.kind;
             journal.record(`transfer bootstrap ${room.locator} ${detail}`);
+            if (result.kind !== 'staged')
+                caughtUpTo(room.locator);
             return result;
         }
         catch (error) {
             journal.record(`transfer bootstrap ${room.locator} transport-uncertainty`);
+            caughtUpTo(room.locator);
             throw error;
         }
+        finally {
+            reads.finished(room.locator, turn);
+        }
+    }
+    function caughtUpTo(locator) {
+        if (catching.delete(locator))
+            readSide.recover();
+    }
+    function behind(room) {
+        const held = replicas.get(room.locator)?.confirmed.record.roomVersion;
+        return (held !== undefined &&
+            [announced.get(room.locator), room.roomVersion].some((later) => later !== undefined && !options.adapter.reached(room.locator, held, later)));
+    }
+    async function advance(room, local, authorized, live) {
+        const carried = reads.carried(room.locator);
+        const withheld = await advanceOnce(room, local, authorized, live);
+        if (withheld !== null || reads.carried(room.locator) === carried || !behind(room)) {
+            return withheld;
+        }
+        return advanceOnce(room, local, authorized, live);
     }
-    async function advance(room, local, authorized) {
+    async function advanceOnce(room, local, authorized, live) {
+        await referenced(room.locator);
+        if (!live() || paused.has(room.locator))
+            return unconfirmed;
         const held = replicas.get(room.locator);
         if (held !== undefined) {
-            const refreshed = await pullRefresh(authorized, held.confirmed);
-            if (!continuing())
+            const refreshed = await pullRefresh(authorized, held.confirmed, live);
+            if (!live())
                 return unconfirmed;
             if (refreshed.kind === 'still-current') {
                 stale.delete(room.locator);
@@ -1235,31 +2430,47 @@ export function composeRuntime(options) {
                 return null;
             }
             if (refreshed.kind === 'advanced') {
-                if (!(await publish(local, room, refreshed.confirmed, { base: held.confirmed }))) {
+                if (!(await publish(local, room, refreshed.confirmed, { base: held.confirmed }, live))) {
                     const now = replicas.get(room.locator)?.confirmed.record.roomVersion;
                     const reached = now !== undefined &&
                         options.adapter.reached(room.locator, now, refreshed.confirmed.record.roomVersion);
-                    return reached ? null : advance(room, local, authorized);
+                    return reached ? null : advance(room, local, authorized, live);
                 }
                 await retainModel(local, room, 'collection', modelOf(room.locator));
                 return null;
             }
             if (refreshed.kind !== 'beyond-horizon')
                 return refreshed;
+            if (opened !== null) {
+                owed.add(room.locator);
+                readSide.recover();
+                return unconfirmed;
+            }
+            if (reloadsDue.get(room.locator) === generation)
+                return unconfirmed;
         }
-        const bootstrapped = await pullBootstrap(authorized, room, local);
-        if (!continuing())
+        const bootstrapped = await pullBootstrap(authorized, room, local, live);
+        if (!live())
             return unconfirmed;
         if (bootstrapped.kind !== 'staged')
             return bootstrapped;
-        await publish(local, room, bootstrapped.confirmed, { stored: bootstrapped.stored });
+        await publish(local, room, bootstrapped.confirmed, { stored: bootstrapped.stored }, live);
         return null;
     }
     async function withhold(withheld, room, local, progress) {
+        if (withheld.kind === 'unconfirmed')
+            return;
         if (withheld.kind === 'refused')
             stale.delete(room.locator);
         else
             stale.add(room.locator);
+        if (withheld.kind === 'transport-uncertainty' || withheld.kind === 'retryable-refusal') {
+            const reset = withheld.kind === 'retryable-refusal' ? withheld.reset : undefined;
+            repairable.set(room.locator, reset);
+            repairLater(room.locator, reset === undefined ? { again: true } : { at: Date.parse(reset) });
+        }
+        else
+            repairable.delete(room.locator);
         if (withheld.kind === 'scoped-refusal') {
             await scoped(withheld, room, local);
         }
@@ -1295,6 +2506,7 @@ export function composeRuntime(options) {
         unreadable.add(room.locator);
         list(room, false);
         emitRooms();
+        moveTo({ ...status, ...attention() });
         journal.record(`source refused ${room.locator} ${refusal.rule} ${refusal.file}`);
     }
     function leaving(batch, result) {
@@ -1316,6 +2528,7 @@ export function composeRuntime(options) {
             (accepted.time === undefined ? '' : ` time ${accepted.time}`));
     }
     async function adoptAccepted(room, local, submitted, accepted) {
+        await referenced(room.locator);
         if (!continuing())
             return unconfirmed;
         const current = replicas.get(room.locator);
@@ -1326,75 +2539,217 @@ export function composeRuntime(options) {
         logAccepted(room.locator, submitted, accepted);
         const applied = options.adapter.reached(room.locator, held, accepted.roomVersion)
             ? { kind: 'staged', confirmed: current.confirmed }
-            : applyReturned(current.confirmed, submitted, accepted, options.adapter.follows(room.locator, held, accepted.roomVersion)
+            : await applyReturned(current.confirmed, submitted, accepted, options.adapter.follows(room.locator, held, accepted.roomVersion)
                 ? accepted.roomVersion
                 : held, accepted.roomVersion);
         if (applied.kind !== 'staged') {
-            const state = pendings.get(submitted.id);
+            const key = pendingKey(room.locator, submitted.id);
+            const state = pendings.get(key);
             await local.accept(room.locator, submitted.id, accepted.roomVersion);
-            if (state !== undefined)
-                pendings.set(submitted.id, { ...state, accepted: accepted.roomVersion });
+            if (state !== undefined && !fences.has(room.locator))
+                pendings.set(key, { ...state, accepted: accepted.roomVersion });
             emitQueue(room.locator);
             return applied;
         }
-        const set = await settle(local, room.locator, current, applied.confirmed, current.queue.filter((batch) => batch.id !== submitted.id), { room: true });
-        pendings.delete(submitted.id);
+        const settled = await settle(local, room.locator, current, applied.confirmed, current.queue.filter((batch) => batch.id !== submitted.id), { room: true });
+        pendings.delete(pendingKey(room.locator, submitted.id));
         unreadable.delete(room.locator);
         sourceRefusals.delete(room.locator);
         declarationRefusals.delete(room.locator);
+        const set = settled();
         list(room, true);
         publishChangeSet(set);
         moveTo({ ...status, ...attention() });
         return null;
     }
     async function adopted(room, local, submitted, accepted) {
-        const failed = await exclusive(() => adoptAccepted(room, local, submitted, accepted));
+        const failed = await exclusive(async () => {
+            const adopting = await adoptAccepted(room, local, submitted, accepted);
+            await unpair(local);
+            return adopting;
+        });
+        if (failed === null)
+            return true;
+        if (failed.kind === 'refused' && continuing())
+            refusedSource(room, failed);
+        return false;
+    }
+    async function adoptedMove(room, partner, local, submitted, accepted) {
+        const other = discovered.get(partner);
+        const failed = await exclusive(async () => {
+            const left = await adoptAccepted(room, local, submitted, accepted);
+            const arriving = replicas.get(partner)?.queue.find((batch) => batch.id === submitted.id);
+            const arrived = other === undefined || arriving === undefined || accepted.destination === undefined
+                ? null
+                : await adoptAccepted(other, local, arriving, {
+                    kind: 'accepted',
+                    ...accepted.destination,
+                });
+            if (other !== undefined && arrived?.kind === 'refused' && continuing()) {
+                refusedSource(other, arrived);
+            }
+            await unpair(local);
+            return left;
+        });
+        submitLater(partner);
         if (failed === null)
             return true;
         if (failed.kind === 'refused' && continuing())
             refusedSource(room, failed);
         return false;
     }
-    async function submitRoom(room, local, authorized, progress) {
-        while (continuing() && authorization !== undefined) {
+    function queueIn(locator) {
+        return replicas.get(locator)?.queue ?? queuesWithoutReplica.get(locator) ?? [];
+    }
+    function behindIn(locator, batch) {
+        const held = replicas.get(locator)?.queue;
+        if (held === undefined)
+            return queuesWithoutReplica.get(locator) !== undefined;
+        return held.findIndex((one) => one.id === batch.id) > 0;
+    }
+    function unpaired(skipped) {
+        for (const locator of [...replicas.keys(), ...queuesWithoutReplica.keys()]) {
+            for (const batch of queueIn(locator)) {
+                const partner = partnerOf(batch, locator);
+                if (partner === null || skipped.has(pendingKey(locator, batch.id)))
+                    continue;
+                if (queueIn(partner).some((held) => held.id === batch.id))
+                    continue;
+                if (pendings.get(pendingKey(locator, batch.id))?.accepted !== undefined)
+                    continue;
+                if (leavingIn(batch, locator) && !withdrawable(locator)(batch))
+                    continue;
+                return { locator, batch };
+            }
+        }
+        return null;
+    }
+    async function unpair(local) {
+        const handled = new Set();
+        for (let held = unpaired(handled); held !== null && continuing(); held = unpaired(handled)) {
+            const { locator, batch } = held;
+            handled.add(pendingKey(locator, batch.id));
+            journal.record(`outcome ${locator} ${batch.id} ${localSaves ? 'dropped' : 'unpaired'}`);
+            const leaving = {
+                batch,
+                returned: !localSaves && leavingIn(batch, locator) ? returnedBy('withdrawn') : null,
+            };
+            const current = replicas.get(locator);
+            if (current !== undefined) {
+                const settled = await settle(local, locator, current, current.confirmed, current.queue.filter((one) => one.id !== batch.id), { leaving });
+                publishChangeSet(settled());
+                continue;
+            }
+            const queue = queueIn(locator).filter((one) => one.id !== batch.id);
+            const written = new Map((leaving.returned === null
+                ? []
+                : (pendings.get(pendingKey(locator, batch.id))?.drafts ?? [])).map((saved) => [
+                saved.path,
+                {
+                    locator,
+                    path: saved.path,
+                    revision: roomDraftRevision(),
+                    parts: returnedInto(roomDrafts.get(locator)?.get(saved.path)?.parts, saved.parts),
+                    returned: leaving.returned,
+                },
+            ]));
+            const carried = carriedBack(locator, leaving.returned === null ? [] : [batch], written);
+            await local.keepAuthored({
+                locator,
+                queue,
+                roomDrafts: [...written.values()],
+                consumedRoomDrafts: carried.taken,
+            }, ...carried.writes);
+            pendings.delete(pendingKey(locator, batch.id));
+            if (queue.length > 0)
+                queuesWithoutReplica.set(locator, queue);
+            else
+                queuesWithoutReplica.delete(locator);
+            for (const record of written.values())
+                rememberRoomDraft(record);
+            carried.remember();
+            publishChangeSet(mergeChangeSets([
+                changeSet(locator, null, null, {
+                    queue: true,
+                    drafts: [...written.keys(), ...carried.taken],
+                }),
+                ...carried.changes,
+            ]));
+        }
+        if (handled.size === 0)
+            return;
+        moveTo({ ...status, ...attention() });
+        for (const key of handled)
+            submitLater(key.slice(0, key.indexOf('\u0000')));
+    }
+    async function discardHeld(head, room, local, signal) {
+        const partner = partnerOf(head, room.locator);
+        const other = partner === null ? undefined : discovered.get(partner);
+        await discardPending(room, local, signal);
+        if (other !== undefined && !signal.aborted)
+            await discardPending(other, local, signal);
+    }
+    async function submitRoom(room, local, authorized, progress, signal) {
+        while (continuing() && authorization !== undefined && !signal.aborted) {
             const replica = replicas.get(room.locator);
             const head = replica?.queue[0];
             if (replica === undefined || head === undefined)
-                return;
-            if (pendings.get(head.id)?.accepted !== undefined)
-                return;
-            const state = pendings.get(head.id);
+                return 'done';
+            const state = pendings.get(pendingKey(room.locator, head.id));
+            if (state?.accepted !== undefined)
+                return 'done';
+            const partner = partnerOf(head, room.locator);
+            if (partner !== null && !leavingIn(head, room.locator)) {
+                submitLater(partner);
+                return 'done';
+            }
+            if (partner !== null && behindIn(partner, head)) {
+                progress.complete = false;
+                return 'done';
+            }
             const { submission, lost: earlier } = state ?? {
                 submission: { state: 'waiting' },
                 lost: false,
             };
             if (submission.state === 'reset' && Date.now() < Date.parse(submission.reset)) {
                 progress.complete = false;
-                return;
+                return { at: Date.parse(submission.reset) };
             }
             if (writesHeld()) {
                 progress.complete = false;
                 journal.record(`submission ${room.locator} ${head.id} held`);
-                return;
+                return 'done';
             }
             const lost = earlier || submission.state === 'submitted';
+            if (lost && pastHorizon(head.id)) {
+                await discardHeld(head, room, local, signal);
+                return 'done';
+            }
             let result;
             journal.record(`submission ${room.locator} ${head.id}`);
-            await exclusive(() => mark(local, room.locator, head.id, { state: 'submitted' }, lost));
-            if (discoveryPaused)
-                return;
-            if (writesHeld()) {
-                await exclusive(() => mark(local, room.locator, head.id, submission, earlier));
+            await exclusive(() => mark(local, room.locator, head, { state: 'submitted' }, lost));
+            if (discoveryPaused || fences.has(room.locator))
+                return 'done';
+            if (signal.aborted || writesHeld()) {
+                await exclusive(() => mark(local, room.locator, head, submission, earlier));
+                if (signal.aborted)
+                    return 'done';
                 progress.complete = false;
                 journal.record(`submission ${room.locator} ${head.id} held`);
-                return;
+                return 'done';
             }
             const opensBefore = openSignals;
-            const answered = awaitingAnswer(room.locator);
+            const answeredHere = awaitingAnswer(room.locator);
+            const answeredThere = partner === null ? () => { } : awaitingAnswer(partner);
+            const answered = () => {
+                answeredHere();
+                answeredThere();
+            };
             try {
                 result = await options.adapter.mutate(authorized, {
                     locator: room.locator,
                     changeBatch: head,
+                    file: batchFile(head),
                     ...(state?.upload === undefined ? {} : { upload: state.upload }),
                 }, (upload) => exclusive(() => keepUpload(local, room.locator, head.id, upload)));
             }
@@ -1403,50 +2758,69 @@ export function composeRuntime(options) {
                 progress.complete = false;
                 if (continuing())
                     progress.reachable = false;
-                return;
+                return 'again';
+            }
+            if (signal.aborted) {
+                answered();
+                return 'done';
             }
             if (result.kind !== 'accepted' || !continuing())
                 answered();
             if (!continuing())
-                return;
+                return 'done';
             if (result.kind === 'transport-uncertainty') {
                 progress.complete = false;
                 progress.reachable = false;
-                return;
+                return 'again';
             }
             if (result.kind === 'room-not-readable') {
+                const unread = discovered.get(result.locator) ?? room;
                 progress.complete = false;
-                unreadable.add(room.locator);
-                list(room, false);
+                unreadable.add(unread.locator);
+                list(unread, false);
                 emitRooms();
-                return;
+                return 'done';
             }
             if (result.kind === 'revoked-authorization') {
                 await refuse('revoked-authorization');
-                return;
+                return 'done';
             }
             if (result.kind === 'scoped-refusal') {
                 await scoped(result, room, local);
                 progress.complete = false;
-                return;
+                return 'done';
             }
             if (result.kind === 'write-halted') {
                 journal.record(`outcome ${room.locator} ${head.id} write-halted`);
-                await exclusive(() => mark(local, room.locator, head.id, { state: 'waiting' }, lost));
+                await exclusive(() => mark(local, room.locator, head, { state: 'waiting' }, lost));
                 if (serviceMode === 'open' && openSignals !== opensBefore)
                     continue;
                 haltedRefusal = true;
                 progress.complete = false;
-                return;
+                return 'done';
             }
+            const other = partner === null ? undefined : discovered.get(partner);
             if (result.kind === 'conflicted' ||
                 result.kind === 'rejected' ||
                 result.kind === 'expired' ||
                 result.kind === 'retryable-refusal') {
+                if (result.kind === 'expired' && lost && result.restored !== true) {
+                    journal.record(`outcome ${room.locator} ${head.id} expired`);
+                    await discardHeld(head, room, local, signal);
+                    return 'done';
+                }
                 if (result.kind === 'expired') {
-                    const withheld = await advance(room, local, authorized);
-                    if (withheld !== null)
-                        return withhold(withheld, room, local, progress);
+                    await exclusive(() => mark(local, room.locator, head, { state: 'waiting' }, partner !== null && lost));
+                    const there = other === undefined ? null : await advance(other, local, authorized, continuing);
+                    if (other !== undefined && there !== null) {
+                        await withhold(there, other, local, progress);
+                        return 'done';
+                    }
+                    const withheld = await advance(room, local, authorized, continuing);
+                    if (withheld !== null) {
+                        await withhold(withheld, room, local, progress);
+                        return 'done';
+                    }
                 }
                 journal.record(`outcome ${room.locator} ${head.id} ${result.kind}` +
                     (result.kind === 'conflicted' && result.roomVersion !== undefined
@@ -1458,12 +2832,25 @@ export function composeRuntime(options) {
             if (result.kind === 'retryable-refusal') {
                 const reset = result.reset;
                 progress.complete = false;
-                await exclusive(() => mark(local, room.locator, head.id, reset === undefined ? { state: 'waiting' } : { state: 'reset', reset }, lost));
-                armTimer();
-                return;
+                await exclusive(() => mark(local, room.locator, head, reset === undefined ? { state: 'waiting' } : { state: 'reset', reset }, lost));
+                return reset === undefined ? 'again' : { at: Date.parse(reset) };
             }
             if (result.kind === 'conflicted' || result.kind === 'rejected' || result.kind === 'expired') {
                 const left = leaving(head, result);
+                const refreshed = async () => ({
+                    there: other === undefined ? null : await advance(other, local, authorized, continuing),
+                    here: await advance(room, local, authorized, continuing),
+                });
+                const judged = result.kind === 'conflicted' && other !== undefined ? await refreshed() : null;
+                if (judged !== null && (judged.there !== null || judged.here !== null)) {
+                    await exclusive(() => mark(local, room.locator, head, { state: 'waiting' }, lost));
+                    if (other !== undefined && judged.there !== null) {
+                        await withhold(judged.there, other, local, progress);
+                    }
+                    if (judged.here !== null)
+                        await withhold(judged.here, room, local, progress);
+                    return 'done';
+                }
                 await exclusive(async () => {
                     if (!continuing())
                         return;
@@ -1471,37 +2858,88 @@ export function composeRuntime(options) {
                     if (current === undefined || !current.queue.some((batch) => batch.id === head.id)) {
                         return;
                     }
-                    const set = await settle(local, room.locator, current, current.confirmed, current.queue.filter((batch) => batch.id !== head.id), {
-                        leaving: (result.kind === 'expired' && landed(head, current.confirmed)) ||
-                            (result.kind === 'conflicted' && landed(head, current.confirmed, result.affected))
+                    const settled = await settle(local, room.locator, current, current.confirmed, current.queue.filter((batch) => batch.id !== head.id), {
+                        leaving: (result.kind === 'expired' && landedWhole(room.locator, head, current.confirmed)) ||
+                            (result.kind === 'conflicted' &&
+                                landedWhole(room.locator, head, current.confirmed, result.affected))
                             ? { ...left, returned: null }
                             : left,
                     });
-                    publishChangeSet(set);
+                    publishChangeSet(settled());
+                    await unpair(local);
                     moveTo({ ...status, ...attention() });
                 });
                 if (result.kind === 'expired')
                     continue;
-                const withheld = await advance(room, local, authorized);
-                if (withheld !== null)
-                    return withhold(withheld, room, local, progress);
+                const { there, here } = judged ?? (await refreshed());
+                if (other !== undefined && there !== null)
+                    await withhold(there, other, local, progress);
+                if (here !== null) {
+                    await withhold(here, room, local, progress);
+                    return 'done';
+                }
                 continue;
             }
-            const kept = await adopted(room, local, head, result).finally(answered);
+            const kept = await (partner === null
+                ? adopted(room, local, head, result)
+                : adoptedMove(room, partner, local, head, result)).finally(answered);
             if (!kept) {
                 progress.complete = false;
-                return;
+                return 'done';
             }
         }
+        return 'done';
+    }
+    function pastHorizon(identity) {
+        return (outcomeRetention !== null && identityTime(identity) + outcomeRetention * 1000 <= Date.now());
+    }
+    async function discardPending(room, local, signal) {
+        const { locator } = room;
+        const discarded = await exclusive(async () => {
+            if (fences.has(locator))
+                return false;
+            const before = replicas.get(locator);
+            const queue = before?.queue ?? queuesWithoutReplica.get(locator) ?? [];
+            fences.set(locator, { at: discoveries, erased: false });
+            lastFenced.set(locator, ++fencings);
+            try {
+                await local.discard(locator);
+            }
+            finally {
+                fences.delete(locator);
+            }
+            for (const batch of queue)
+                pendings.delete(pendingKey(locator, batch.id));
+            queuesWithoutReplica.delete(locator);
+            const after = before === undefined ? null : await stepped(replicating(before.confirmed, [], before));
+            if (after !== null)
+                replicas.set(locator, after);
+            journal.record(`room discarded ${locator}`);
+            publishChangeSet(changeSet(locator, before ?? null, after, { queue: true }));
+            moveTo({ ...status, ...attention() });
+            return true;
+        });
+        if (!discarded)
+            return;
+        const progress = { complete: true, reachable: true };
+        await roomTask(locator, async (live) => {
+            await Promise.race([
+                reload(room, local, progress, () => live() && !signal.aborted),
+                abandonedOn(signal),
+            ]);
+        });
+        if (signal.aborted)
+            return;
+        await rest(progress);
     }
     function awaitingAnswer(locator) {
         let release = () => { };
         const awaited = new Promise((resolve) => {
             release = resolve;
         });
-        answering.set(locator, awaited);
+        answering.set(locator, { generation, answered: awaited });
         return () => {
-            if (answering.get(locator) === awaited)
+            if (answering.get(locator)?.answered === awaited)
                 answering.delete(locator);
             release();
         };
@@ -1525,6 +2963,7 @@ export function composeRuntime(options) {
             if (!continuing())
                 return;
             const held = replicas.get(room.locator);
+            let changed = null;
             if (held !== undefined) {
                 const declared = {
                     ...held.confirmed.record,
@@ -1534,8 +2973,8 @@ export function composeRuntime(options) {
                     ...(attached === 'collection' ? { model: next } : { selectionModel: next }),
                 };
                 const reclassified = sameMembership(declared, held.confirmed.record)
-                    ? { kind: 'staged', confirmed: confirmedOf(declared, held.confirmed) }
-                    : readReclassified(declared, held.confirmed);
+                    ? { kind: 'staged', confirmed: await confirmedOf(declared, held.confirmed) }
+                    : await readReclassified(declared, held.confirmed);
                 const record = reclassified.kind === 'staged'
                     ? declared
                     : {
@@ -1543,18 +2982,23 @@ export function composeRuntime(options) {
                         typedSelection: held.confirmed.record.typedSelection,
                     };
                 const read = reclassified.kind === 'deferred'
-                    ? { kind: 'staged', confirmed: confirmedOf(record, held.confirmed) }
+                    ? { kind: 'staged', confirmed: await confirmedOf(record, held.confirmed) }
                     : reclassified;
                 await local.write({ next: record, previous: held.confirmed.record });
+                const replica = read.kind === 'staged'
+                    ? await stepped(replicating(read.confirmed, held.queue, held))
+                    : { ...held, confirmed: { ...held.confirmed, record } };
+                await stepped(counting(replica));
+                const set = await stepped(changing(room.locator, held, replica, { room: true }));
+                replicas.set(room.locator, replica);
+                changed = heldChange(room.locator, held, replica, set, { room: true });
                 if (read.kind === 'staged') {
-                    replicas.set(room.locator, replicaOf(read.confirmed, held.queue, held));
                     if (declarationRefusals.delete(room.locator)) {
                         sourceRefusals.delete(room.locator);
                         unreadable.delete(room.locator);
                     }
                 }
-                else if (read.kind === 'refused') {
-                    replicas.set(room.locator, { ...held, confirmed: { ...held.confirmed, record } });
+                else {
                     refusedSource(room, read);
                     declarationRefusals.add(room.locator);
                 }
@@ -1565,13 +3009,18 @@ export function composeRuntime(options) {
                 invalidModels.delete(key);
             }
             list(room, room.replica.admission === 'admitted' && !unreadable.has(room.locator));
-            if (held === undefined)
+            if (changed === null)
                 emitRooms();
             else
-                publishChangeSet(changeSet(room.locator, held, replicas.get(room.locator) ?? null, { room: true }));
+                publishChangeSet(changed);
         });
     }
     async function scoped(result, room, local) {
+        if (result.scope === 'content' && !result.retryable) {
+            journal.record(`scoped refusal ${room.locator} ${result.scope} ${result.code}`);
+            await loseRooms([room.locator]);
+            return;
+        }
         scopedRefusals.set(room.locator, {
             code: result.code,
             fields: result.fields,
@@ -1585,15 +3034,7 @@ export function composeRuntime(options) {
             });
         else if (result.scope !== 'operation') {
             unreadable.add(room.locator);
-            scopedAway = {
-                ...room,
-                replica: { ...room.replica, admission: 'unavailable' },
-                operations: {
-                    ...room.operations,
-                    ...(result.scope === 'content' ? { read: [] } : {}),
-                    ...(result.scope === 'sync' ? { sync: [] } : {}),
-                },
-            };
+            scopedAway = { ...room, replica: { ...room.replica, admission: 'unavailable' } };
             await retainModel(local, scopedAway, 'collection', modelOf(room.locator));
         }
         if (!continuing())
@@ -1617,8 +3058,10 @@ export function composeRuntime(options) {
             ];
         });
     }
-    async function synchronize(listed, local, progress, attempt) {
+    async function synchronize(listed, local, progress, attempt, live) {
         const prepared = await Promise.allSettled(listed.map((room) => prepareRoom(room, local, progress)));
+        if (!live())
+            return;
         const ready = listed.filter((_, index) => {
             const outcome = prepared[index];
             return outcome?.status === 'fulfilled' && outcome.value;
@@ -1627,9 +3070,10 @@ export function composeRuntime(options) {
             options.adapter.roomStream?.hold(heldRooms(ready));
             handed = true;
         }
+        discovering?.release();
         const loaded = await Promise.allSettled(ready
             .filter((room) => attempt === 'unstreamed' || !replicas.has(room.locator))
-            .map((room) => loadRoom(room, local, progress)));
+            .map((room) => roomTask(room.locator, (held) => loadRoom(room, local, progress, held))));
         const failed = [...prepared, ...loaded].find((room) => room.status === 'rejected');
         if (failed !== undefined)
             throw failed.reason;
@@ -1651,21 +3095,12 @@ export function composeRuntime(options) {
             await retainModel(local, room, 'collection', modelOf(room.locator));
         if (discoveryPaused || authorization === undefined)
             return false;
-        if (room.replica.admission !== 'admitted') {
-            if (replicas.has(room.locator))
-                progress.complete = false;
-            return false;
-        }
-        return true;
+        return room.replica.admission === 'admitted';
     }
-    async function caughtUp(room, local, progress) {
-        const held = replicas.get(room.locator)?.confirmed.record.roomVersion;
-        if (held === undefined || authorization === undefined)
-            return;
-        const behind = [announced.get(room.locator), room.roomVersion].some((later) => later !== undefined && !options.adapter.reached(room.locator, held, later));
-        if (!behind)
+    async function caughtUp(room, local, progress, live) {
+        if (authorization === undefined || !live() || !behind(room))
             return;
-        const withheld = await advance(room, local, authorization);
+        const withheld = await advance(room, local, authorization, live);
         if (withheld !== null)
             await withhold(withheld, room, local, progress);
     }
@@ -1675,47 +3110,57 @@ export function composeRuntime(options) {
             return model.status === 'unavailable' && model.reason === 'revoked';
         });
     }
-    async function loadRoom(room, local, progress) {
-        if (discoveryPaused || authorization === undefined)
+    async function loadRoom(room, local, progress, live) {
+        if (!live() || authorization === undefined)
             return;
         if (replicas.has(room.locator) && revoked(room.locator)) {
-            await reload(room, local, progress);
+            await reload(room, local, progress, live);
             return;
         }
-        const withheld = await advance(room, local, authorization);
+        const withheld = await advance(room, local, authorization, live);
         if (withheld !== null) {
             await withhold(withheld, room, local, progress);
             return;
         }
-        await caughtUp(room, local, progress);
+        await caughtUp(room, local, progress, live);
     }
-    async function reload(room, local, progress) {
-        if (discoveryPaused || authorization === undefined)
-            return;
-        const bootstrapped = await pullBootstrap(authorization, room, local);
-        if (!continuing())
-            return;
-        if (bootstrapped.kind !== 'staged') {
-            await withhold(bootstrapped, room, local, progress);
-            return;
+    async function reload(room, local, progress, live) {
+        try {
+            if (live())
+                reloadsDue.delete(room.locator);
+            if (!live() || authorization === undefined)
+                return;
+            const bootstrapped = await pullBootstrap(authorization, room, local, live);
+            if (!live())
+                return;
+            if (bootstrapped.kind !== 'staged') {
+                await withhold(bootstrapped, room, local, progress);
+                return;
+            }
+            await publish(local, room, bootstrapped.confirmed, { stored: bootstrapped.stored }, live);
+            await caughtUp(room, local, progress, live);
+        }
+        finally {
+            caughtUpTo(room.locator);
         }
-        await publish(local, room, bootstrapped.confirmed, { stored: bootstrapped.stored });
-        await caughtUp(room, local, progress);
     }
-    async function discoverRooms(local, progress, attempt) {
+    async function discoverRooms(local, progress, attempt, live, scope) {
         if (closed || authorization === undefined) {
             notifyReady();
             return;
         }
         moveTo(transferring(status));
+        discoveries += 1;
+        const started = discoveries;
         let result;
         try {
-            result = await options.adapter.discover(authorization);
+            result = await options.adapter.discover(authorization, scope);
         }
         catch {
             result = { kind: 'transport-uncertainty' };
         }
-        if (closed) {
+        if (!live()) {
+            progress.complete = false;
             notifyReady();
             return;
         }
@@ -1749,12 +3194,13 @@ export function composeRuntime(options) {
         }
         for (const room of result.rooms) {
             if (room.operations === undefined ||
-                !['read', 'sync', 'write', 'delete'].every((operation) => Array.isArray(room.operations[operation]) &&
+                !['write', 'delete'].every((operation) => Array.isArray(room.operations[operation]) &&
                     room.operations[operation].every((scope) => typeof scope === 'string')) ||
                 room.replica === undefined ||
                 typeof room.replica.selection !== 'string' ||
                 room.replica.selection.length === 0 ||
-                !['admitted', 'unavailable'].includes(room.replica.admission)) {
+                !['admitted', 'unavailable'].includes(room.replica.admission) ||
+                !['locked', 'open'].includes(room.replica.offline)) {
                 journal.record(`invalid model or replica declaration ${room.locator}`);
                 await refuse('missing-required-guarantee');
                 notifyReady();
@@ -1773,6 +3219,7 @@ export function composeRuntime(options) {
         }
         const previousCapabilities = capabilities;
         capabilities = result.capabilities;
+        outcomeRetention = result.retention.outcome;
         notifyReady();
         if (JSON.stringify(result.providerLimits) !== JSON.stringify(limits) ||
             JSON.stringify(result.capabilities) !== JSON.stringify(previousCapabilities)) {
@@ -1785,8 +3232,7 @@ export function composeRuntime(options) {
             member = signedIn;
             emitMember();
         }
-        await applyDiscovery(result.rooms, local);
-        await synchronize(result.rooms, local, progress, attempt);
+        await synchronize(await applyDiscovery(result.rooms, started, result.covered), local, progress, attempt, live);
     }
     async function ensureAuthorization() {
         if (authorization !== undefined)
@@ -1800,20 +3246,50 @@ export function composeRuntime(options) {
             throw error;
         }
     }
-    function task(work) {
+    async function admittedRead(work) {
+        if (roomReads.generation !== generation) {
+            roomReads = { generation, free: ROOM_READS, waiting: [] };
+        }
+        const reads = roomReads;
+        while (reads.free === 0)
+            await new Promise((admit) => reads.waiting.push(admit));
+        reads.free -= 1;
+        try {
+            await work();
+        }
+        finally {
+            reads.free += 1;
+            reads.waiting.shift()?.();
+        }
+    }
+    function roomTask(locator, work) {
+        return task(roomLane(locator), (live) => admittedRead(() => work(live)));
+    }
+    function task(lane, work) {
         if (stopping)
-            return chain;
-        chain = chain.then(work, work).catch(() => undefined);
-        return chain;
+            return Promise.resolve();
+        const held = lanes.get(lane);
+        const current = held?.generation === generation ? held : { generation, chain: Promise.resolve() };
+        const turn = current.generation;
+        const live = () => turn === generation && continuing();
+        const run = current.chain.then(() => work(live)).catch(() => undefined);
+        current.chain = run;
+        lanes.set(lane, current);
+        working.add(run);
+        void run.finally(() => working.delete(run));
+        return run;
     }
     function sync(attempt) {
-        return task(async () => {
-            if (closed || stopping || discoveryPaused) {
+        return task(OPENING_LANE, async (live) => {
+            if (!live()) {
                 notifyReady();
                 return;
             }
             const progress = { complete: true, reachable: true };
-            underway = attempt === 'opened' ? progress : null;
+            const gate = discover();
+            if (attempt === 'opened')
+                opened = generation;
+            underway = attempt === 'opened' ? { generation, progress } : null;
             if (attempt === 'opened')
                 streamed = progress;
             complete = false;
@@ -1822,12 +3298,12 @@ export function composeRuntime(options) {
             handed = false;
             try {
                 const local = await openLocal();
-                if (closed)
+                if (!live())
                     return;
                 await ensureAuthorization();
-                if (closed)
+                if (!live())
                     return;
-                await discoverRooms(local, progress, attempt);
+                await discoverRooms(local, progress, attempt, live);
             }
             catch {
                 progress.complete = false;
@@ -1835,23 +3311,62 @@ export function composeRuntime(options) {
                     progress.reachable = false;
             }
             finally {
+                gate.release();
                 notifyReady();
             }
+            if (!live())
+                return;
             if (attempt !== 'opened') {
-                await finishOpening(progress);
+                await finishOpening(progress, live);
                 return;
             }
             if (handed || closed || progress.reachable)
                 return;
             underway = null;
+            opened = null;
             journal.record('connection reopen');
-            await rest(progress);
+            await rest(progress, live);
             options.adapter.roomStream?.reopen();
         });
     }
-    function closedSocket(revoked) {
+    function rediscover(scope) {
+        return task(OPENING_LANE, async (live) => {
+            if (!live() || !socketOpen)
+                return;
+            const progress = { complete: true, reachable: true };
+            const gate = discover();
+            moveTo(transferring(status));
+            try {
+                const local = await openLocal();
+                if (!live())
+                    return;
+                await ensureAuthorization();
+                if (!live())
+                    return;
+                await discoverRooms(local, progress, 'authorized', live, scope);
+            }
+            catch {
+                progress.complete = false;
+            }
+            finally {
+                gate.release();
+                notifyReady();
+            }
+            if (!live())
+                return;
+            if (!progress.complete)
+                complete = false;
+            await rest(progress, live);
+        });
+    }
+    function closedSocket(revoked, lost) {
         const opened = socketOpen;
         socketOpen = false;
+        connectionLost();
+        if (lost) {
+            reads.lost();
+            conversations.lost();
+        }
         if (revoked) {
             void refuse('revoked-authorization');
             return;
@@ -1866,24 +3381,35 @@ export function composeRuntime(options) {
         });
     }
     function applyOpening(expired) {
-        return task(async () => {
-            const progress = underway;
+        const progress = underway?.generation === generation ? underway.progress : null;
+        const cycle = progress ?? { complete: true, reachable: true };
+        if (opened === generation)
+            opened = null;
+        const reloading = progress === null ? [] : owedReloads(expired);
+        const replacing = reloadNow((room) => expired.includes(room.locator) || reloading.includes(room.locator), cycle);
+        return task(OPENING_LANE, async (live) => {
             underway = null;
-            if (closed || stopping)
+            if (!live())
                 return;
             if (progress === null) {
-                await reloadExpired(expired);
+                await replacing;
+                await rest(cycle, live);
                 return;
             }
+            await roomsCarried([...expired, ...reloading]);
+            if (!live())
+                return;
             try {
                 const local = await openLocal();
-                const held = [...discovered.values()].filter((room) => replicas.has(room.locator));
-                const reloading = held.filter((room) => expired.includes(room.locator) || revoked(room.locator));
-                const reloaded = await Promise.allSettled(reloading.map((room) => reload(room, local, progress)));
+                const reloaded = await replacing;
                 if (progress.reachable) {
-                    for (const room of held)
-                        if (!reloading.includes(room))
+                    for (const room of discovered.values()) {
+                        if (replicas.has(room.locator) &&
+                            !expired.includes(room.locator) &&
+                            !reloading.includes(room.locator)) {
                             await confirmModels(room, local);
+                        }
+                    }
                 }
                 const failed = reloaded.find((outcome) => outcome.status === 'rejected');
                 if (failed !== undefined)
@@ -1893,21 +3419,36 @@ export function composeRuntime(options) {
                 progress.complete = false;
                 progress.reachable = false;
             }
-            await finishOpening(progress);
+            if (live())
+                await finishOpening(progress, live);
         });
     }
-    async function reloadExpired(expired) {
-        const progress = { complete: true, reachable: true };
+    function owedReloads(expired) {
+        const reloading = [...discovered.values()]
+            .filter((room) => replicas.has(room.locator) &&
+            !expired.includes(room.locator) &&
+            (owed.has(room.locator) || revoked(room.locator)))
+            .map((room) => room.locator);
+        owed.clear();
+        for (const locator of reloading)
+            catching.add(locator);
+        readSide.recover();
+        return reloading;
+    }
+    async function reloadNow(replaced, progress) {
+        const reloaded = [...discovered.values()].filter((room) => replicas.has(room.locator) && replaced(room));
+        for (const room of reloaded)
+            reloadsDue.set(room.locator, generation);
         try {
             const local = await openLocal();
-            await Promise.allSettled([...discovered.values()]
-                .filter((room) => replicas.has(room.locator) && expired.includes(room.locator))
-                .map((room) => reload(room, local, progress)));
+            return await Promise.allSettled(reloaded.map((room) => roomTask(room.locator, (live) => reload(room, local, progress, live))));
         }
         catch {
+            for (const room of reloaded)
+                reloadsDue.delete(room.locator);
             progress.reachable = false;
+            return [];
         }
-        await rest(progress);
     }
     async function confirmModels(room, local) {
         for (const attached of ['collection', 'typed-selection']) {
@@ -1920,38 +3461,94 @@ export function composeRuntime(options) {
     function submitLater(locator) {
         if (localSaves)
             return;
-        const running = submitting.get(locator);
-        if (running !== undefined) {
-            running.again = true;
+        void recovery.attempt(`submit ${locator}`, (signal) => submitPass(locator, signal));
+    }
+    async function submitPass(locator, signal) {
+        const room = discovered.get(locator);
+        if (closed || stopping || discoveryPaused || room === undefined)
+            return 'done';
+        const progress = { complete: true, reachable: true };
+        let next;
+        try {
+            await ensureAuthorization();
+            if (authorization === undefined)
+                return 'done';
+            next = await submitRoom(room, await openLocal(), authorization, progress, signal);
+        }
+        catch {
+            progress.reachable = false;
+            next = 'again';
+        }
+        if (signal.aborted)
+            return 'done';
+        await rest(progress);
+        return next === 'again' && !socketOpen ? 'done' : next;
+    }
+    function repairLater(locator, when) {
+        if (!socketOpen || repairing.has(locator))
             return;
+        void recovery.attempt(`repair ${locator}`, (signal) => repairPass(locator, signal), when);
+    }
+    async function repairPass(locator, signal) {
+        const room = discovered.get(locator);
+        if (!socketOpen || closed || stopping || discoveryPaused || !stale.has(locator))
+            return 'done';
+        if (room === undefined || room.replica.admission !== 'admitted')
+            return 'done';
+        const progress = { complete: true, reachable: true };
+        repairing.add(locator);
+        try {
+            const local = await openLocal();
+            await roomTask(locator, async (live) => {
+                const current = () => live() && !signal.aborted;
+                if (!current() || authorization === undefined)
+                    return;
+                const withheld = await Promise.race([
+                    advance(room, local, authorization, current),
+                    abandonedOn(signal),
+                ]);
+                if (withheld !== null && current())
+                    await withhold(withheld, room, local, progress);
+            });
         }
-        const run = { again: false, done: Promise.resolve() };
-        submitting.set(locator, run);
-        run.done = (async () => {
-            try {
-                do {
-                    run.again = false;
-                    const room = discovered.get(locator);
-                    if (closed || stopping || discoveryPaused || room === undefined)
-                        return;
-                    const progress = { complete: true, reachable: true };
-                    try {
-                        await ensureAuthorization();
-                        if (authorization === undefined)
-                            return;
-                        await submitRoom(room, await openLocal(), authorization, progress);
-                    }
-                    catch {
-                        progress.reachable = false;
-                    }
-                    armTimer();
-                    await rest(progress);
-                } while (run.again);
-            }
-            finally {
-                submitting.delete(locator);
-            }
-        })();
+        catch {
+            stale.add(locator);
+            progress.reachable = false;
+        }
+        finally {
+            repairing.delete(locator);
+        }
+        if (signal.aborted)
+            return 'done';
+        await rest(progress);
+        if (!stale.has(locator)) {
+            if ((replicas.get(locator)?.queue.length ?? 0) > 0)
+                submitLater(locator);
+            return 'done';
+        }
+        if (!repairable.has(locator))
+            return 'done';
+        const reset = repairable.get(locator);
+        return reset === undefined ? 'again' : { at: Date.parse(reset) };
+    }
+    function resendLater() {
+        if (!socketOpen)
+            return;
+        void recovery.attempt('resend', resendPass, { again: true });
+    }
+    async function resendPass(signal) {
+        if (!socketOpen || closed || stopping || discoveryPaused)
+            return 'done';
+        const reading = { complete: true, reachable: true };
+        try {
+            await conversations.resend(reading);
+        }
+        catch {
+            reading.reachable = false;
+        }
+        if (signal.aborted)
+            return 'done';
+        return reading.reachable && reading.complete ? 'done' : 'again';
     }
     function submitAll() {
         for (const [locator, replica] of replicas) {
@@ -1959,31 +3556,43 @@ export function composeRuntime(options) {
                 submitLater(locator);
         }
     }
-    async function finishOpening(progress) {
+    async function finishOpening(progress, live) {
         try {
-            if (closed || discoveryPaused) {
+            if (!live()) {
                 progress.complete = false;
                 return;
             }
+            reads.applied();
             submitAll();
+            for (const locator of stale)
+                if (repairable.has(locator))
+                    repairLater(locator, {});
             await conversations.reconcile();
             if (status.providerUnreachable)
                 conversations.reconnected();
             const reading = { complete: true, reachable: true };
             await conversations.catchUp(reading);
-            if (!reading.reachable)
+            if (progress.reachable && reading.reachable)
+                await conversations.resend(reading);
+            if (progress.reachable)
+                void recovery.attempt('calls', resendCalls);
+            if (!reading.reachable) {
                 progress.reachable = false;
+                resendLater();
+            }
         }
         catch {
             progress.complete = false;
         }
         finally {
-            complete = progress.complete;
-            await rest(progress);
+            if (live()) {
+                complete = progress.complete;
+                await rest(progress, live);
+            }
         }
     }
-    async function rest(progress) {
-        if (closed)
+    async function rest(progress, live = () => !closed) {
+        if (!live())
             return;
         let lastCompleted = status.lastCompleted;
         let synced = complete && stale.size === 0 && !pending();
@@ -1991,6 +3600,8 @@ export function composeRuntime(options) {
             const completedAt = new Date().toISOString();
             try {
                 await (await openLocal()).complete(completedAt);
+                if (!live())
+                    return;
                 recorded = true;
                 lastCompleted = completedAt;
             }
@@ -2005,11 +3616,23 @@ export function composeRuntime(options) {
             ...attention(),
         });
     }
+    function discover() {
+        let release = () => { };
+        const done = new Promise((resolve) => {
+            release = resolve;
+        });
+        discovering = { generation, done, release };
+        return discovering;
+    }
     function applyRoom(locator, roomVersion) {
         announced.set(locator, roomVersion);
-        return task(async () => {
-            await answering.get(locator);
-            if (closed || stopping || discoveryPaused || authorization === undefined)
+        return task(roomLane(locator), async (live) => {
+            if (discovering?.generation === generation)
+                await discovering.done;
+            const saving = answering.get(locator);
+            if (saving?.generation === generation)
+                await saving.answered;
+            if (!live() || authorization === undefined)
                 return;
             const room = discovered.get(locator);
             const held = replicas.get(locator);
@@ -2020,25 +3643,41 @@ export function composeRuntime(options) {
                     options.adapter.reached(locator, held.confirmed.record.roomVersion, roomVersion))) {
                 return;
             }
-            const during = underway;
+            const during = underway?.generation === generation ? underway.progress : null;
             const progress = during ?? { complete: true, reachable: true };
             if (during === null)
                 moveTo(transferring(status));
             try {
                 const local = await openLocal();
-                const withheld = await advance(room, local, authorization);
-                if (withheld !== null)
-                    await withhold(withheld, room, local, progress);
+                await admittedRead(async () => {
+                    if (!live() || authorization === undefined)
+                        return;
+                    const withheld = await advance(room, local, authorization, live);
+                    if (withheld !== null)
+                        await withhold(withheld, room, local, progress);
+                });
             }
             catch {
                 stale.add(locator);
             }
             finally {
                 if (during === null)
-                    await rest(progress);
+                    await rest(progress, live);
             }
         });
     }
+    function roomsCarried(replacing) {
+        const replaced = new Set(replacing.map(roomLane));
+        return Promise.all([...lanes]
+            .filter(([lane, held]) => lane !== OPENING_LANE && !replaced.has(lane) && held.generation === generation)
+            .map(([, held]) => held.chain));
+    }
+    const receipts = {
+        heads: async () => (await openLocal()).receivedHeads(),
+        parts: async (key, count) => (await openLocal()).receivedParts(key, count),
+        keep: async (key, head, part) => (await openLocal()).keepReceived(key, head, part),
+        drop: async (keys) => (await openLocal()).dropReceived(keys),
+    };
     function observeStream() {
         const stream = options.adapter.roomStream;
         if (stream === undefined || withdrawStream !== undefined)
@@ -2048,15 +3687,22 @@ export function composeRuntime(options) {
                 return;
             if (event.kind === 'opened') {
                 socketOpen = true;
+                connectionLive();
+                generation += 1;
+                reads.opened();
+                conversations.reopened();
+                recovery.resume();
                 void sync('opened');
             }
             else if (event.kind === 'closed')
-                closedSocket(event.revoked);
+                closedSocket(event.revoked, event.lost);
             else if (event.kind === 'opening')
                 void applyOpening(event.expired);
+            else if (event.kind === 'authority-changed')
+                void rediscover(event.scope);
             else
                 void applyRoom(event.locator, event.roomVersion);
-        });
+        }, receipts);
     }
     function writesHeld() {
         return serviceMode === 'write-halted' || haltedRefusal;
@@ -2071,6 +3717,7 @@ export function composeRuntime(options) {
             haltedRefusal = false;
         if (mode !== serviceMode) {
             serviceMode = mode;
+            queueReadiness();
             journal.record(`service mode ${mode}`);
             for (const listener of serviceModeListeners)
                 listener(mode);
@@ -2083,6 +3730,8 @@ export function composeRuntime(options) {
         if (stream === undefined || withdrawConversations !== undefined)
             return;
         withdrawConversations = stream.observe((event) => {
+            if (event.kind === 'list' || event.kind === 'listed' || event.kind === 'unlisted')
+                queueReadiness();
             if (conversations.receive(event)) {
                 void ready.then(scheduleCurrency);
                 return;
@@ -2094,14 +3743,15 @@ export function composeRuntime(options) {
         });
     }
     function scheduleCurrency() {
-        if (currencyQueued || closed || stopping)
+        if (currencyQueued === generation || closed || stopping)
             return;
-        currencyQueued = true;
-        void task(runCurrency);
+        currencyQueued = generation;
+        void task(CONVERSATION_LANE, runCurrency);
     }
-    async function runCurrency() {
-        currencyQueued = false;
-        if (closed || stopping || discoveryPaused)
+    async function runCurrency(live) {
+        if (currencyQueued === generation)
+            currencyQueued = null;
+        if (!live())
             return;
         await conversations.reconcile();
         if (conversations.current()) {
@@ -2116,19 +3766,24 @@ export function composeRuntime(options) {
         catch {
             progress.reachable = false;
         }
-        await rest(progress);
+        await rest(progress, live);
     }
     function close() {
         if (closed)
             return;
         closed = true;
+        if (rechecking !== null)
+            clearInterval(rechecking);
+        connectionLive();
+        lockListeners.clear();
+        readinessWatches.clear();
         withdrawStream?.();
         withdrawStream = undefined;
         withdrawConversations?.();
         withdrawConversations = undefined;
         withdrawServiceMode?.();
         conversations.close();
-        stopTimer();
+        void recovery.retire();
         store?.close();
         void opening?.then((opened) => {
             opened.close();
@@ -2146,9 +3801,8 @@ export function composeRuntime(options) {
     }
     async function stop() {
         stopping = true;
-        stopTimer();
-        await chain.catch(() => undefined);
-        await Promise.all([...submitting.values()].map((run) => run.done));
+        await recovery.retire();
+        await Promise.all(working);
         await mutations;
         close();
     }
@@ -2167,20 +3821,125 @@ export function composeRuntime(options) {
     if (options.adapter.roomStream === undefined)
         void sync('unstreamed');
     function planned(input, reach) {
-        return planOf(input, roomFacts(reach), planReach(reach));
+        const plan = planOf(input, roomFacts(reach), planReach(reach));
+        const named = plan.paths !== null &&
+            plan.rooms !== null &&
+            plan.paths.length * plan.rooms.length <= MAXIMUM_WINDOW;
+        return plan.limit === null && named ? plan : { ...plan, limit: capped(plan.limit) };
     }
     function watchPlan(plan, deliver) {
-        materialize(reachedRooms(plan));
-        return readSide.watch(plan, identityOf(plan), deliver);
+        let seeded = false;
+        let pending = true;
+        const shown = () => {
+            const seed = seeds.get(plan.key);
+            if (seed === undefined || seeded || !pending)
+                return;
+            seeded = true;
+            deliver(seededResult(seed));
+        };
+        const watchers = seedWatchers.get(plan.key) ?? new Set();
+        seedWatchers.set(plan.key, watchers);
+        watchers.add(shown);
+        const stop = readSide.watch(plan, identityOf(plan), () => {
+            const cover = covered(plan);
+            awaitPreparation(cover);
+            return seedBehind(plan, cover);
+        }, (message) => {
+            const answered = message;
+            pending = whole(answered) && 'pending' in answered.result;
+            if (pending && seeds.has(plan.key)) {
+                shown();
+                return;
+            }
+            seeded = false;
+            deliver(message);
+        });
+        return () => {
+            watchers.delete(shown);
+            if (watchers.size === 0)
+                seedWatchers.delete(plan.key);
+            stop();
+        };
     }
-    async function searched(input, reach) {
-        const plan = searchPlanOf(input);
-        const selected = plan.documents === undefined && reach === null
-            ? null
-            : (await rowsQuery(filterOf(plan.documents ?? {}, roomFacts(reach), planReach(reach)))).documents;
-        if (selected === null)
-            materialize(null);
-        return searchIndex.search(reach === null || reach.conversations ? plan : { ...plan, conversations: [] }, selected);
+    async function searched(input, reach, locked) {
+        const asked = searchPlanOf(input);
+        const plan = { ...asked, limit: capped(asked.limit) };
+        const filter = {
+            ...filterOf(plan.documents ?? {}, roomFacts(reach), planReach(reach)),
+            locked,
+        };
+        const unlocking = (filter.rooms ?? [])
+            .filter((room) => locked.includes(room))
+            .map((room) => ({ room, awaits: 'unlock' }));
+        for (;;) {
+            const cover = covered(filter);
+            awaitPreparation(cover);
+            const pending = [
+                ...unlocking,
+                ...('pending' in cover ? cover.pending : []),
+            ];
+            const awaited = new Set('pending' in cover ? cover.pending.map(({ room }) => room) : []);
+            const held = covered({
+                ...filter,
+                rooms: reachedRooms(filter).filter((room) => !awaited.has(room)),
+            });
+            const covering = 'pending' in held ? [] : held.coverage.rooms;
+            const unindexed = covering
+                .filter(({ room }) => !searchIndex.rooms().has(room))
+                .map(({ room }) => room);
+            for (const room of unindexed)
+                pending.push({ room, awaits: 'index' });
+            const listed = conversations.searchable();
+            const named = reach !== null && !reach.conversations
+                ? []
+                : (plan.conversations ?? listed).filter((one) => listed.includes(one) && conversations.acquired(one));
+            const waiting = named.filter((one) => !searchIndex.conversations().has(one));
+            for (const conversation of waiting)
+                pending.push({ conversation, awaits: 'index' });
+            if (unindexed.length > 0 || waiting.length > 0)
+                index(unindexed, waiting);
+            const complete = pending.length === 0 && !('pending' in cover);
+            const answering = complete
+                ? filter
+                : {
+                    ...filter,
+                    rooms: covering
+                        .filter(({ room }) => searchIndex.rooms().has(room))
+                        .map(({ room }) => room),
+                };
+            const answered = covered(answering);
+            if ('pending' in answered)
+                continue;
+            const searchedConversations = named.filter((one) => searchIndex.conversations().has(one));
+            await readSide.settled();
+            const seen = searchIndex.changes();
+            await searchIndex.caughtUp();
+            const selected = roomsAlone(answering) ? null : await rowsQuery(answering);
+            if (selected !== null && 'pending' in selected)
+                continue;
+            if (searchIndex.changes() !== seen ||
+                JSON.stringify(covered(answering)) !== JSON.stringify(answered))
+                continue;
+            const hits = searchIndex.search(plan, selected === null ? null : selected.documents, searchedConversations, answering.rooms !== null
+                ? new Set(answering.rooms)
+                : locked.length === 0
+                    ? null
+                    : new Set(reachedRooms(answering)), plan.collection
+                ? new Map(answered.coverage.rooms.map(({ room }) => [
+                    room,
+                    replicas.get(room)?.confirmed.record.typedSelection?.roots ?? [],
+                ]))
+                : null);
+            const coverage = {
+                rooms: answered.coverage.rooms,
+                conversations: searchedConversations,
+                index: searchIndex.generation(),
+                overlay: answered.coverage.overlay,
+            };
+            return complete
+                ? { ...hits, coverage }
+                : { pending, documents: hits.documents, messages: hits.messages, coverage };
+        }
     }
     const watch = (topic, input, deliver) => {
         if (topic === 'room-drafts') {
@@ -2226,6 +3985,9 @@ export function composeRuntime(options) {
                 presentationListeners.delete(listener);
             };
         }
+        if (topic === 'readiness') {
+            return watchReadiness({ target: '', code: 'stored', capacity: null, search: 'unused' }, null, deliver);
+        }
         if (topic === 'rooms') {
             roomListeners.add(deliver);
             deliver(listed());
@@ -2286,7 +4048,7 @@ export function composeRuntime(options) {
             return listed();
         },
         query: ((input) => rowsQuery(planned(input, null))),
-        search: (input) => searched(input, null),
+        search: (input) => searched(input, null, []),
         types(locator) {
             return {
                 collection: modelTypes(modelOf(locator)),
@@ -2330,7 +4092,9 @@ export function composeRuntime(options) {
                         parts: held(current?.parts, parts, file),
                         returned: current?.returned ?? null,
                     };
-                    await local.keepRoomDraft(record);
+                    await local.keepRoomDraft(record, parts.file === undefined || file === undefined
+                        ? []
+                        : [{ key: file.localId, blob: parts.file.blob }]);
                     rememberRoomDraft(record);
                     publishChangeSet(changeSet(room, null, null, { drafts: [path] }));
                     return { outcome: 'written', roomDraft: roomDraftOf(record) };
@@ -2361,27 +4125,37 @@ export function composeRuntime(options) {
                 });
             },
             write(app, value) {
-                return exclusive(async () => {
-                    const local = await openLocal();
-                    const stored = structuredClone(value);
-                    await local.present({ app, value: stored });
-                    presentations.set(app, stored);
-                    publishChangeSet(changeSet('', null, null, { presentation: app }));
-                });
+                return keepPresentation(app, () => structuredClone(value));
+            },
+            edit(app, members) {
+                return keepPresentation(app, (held) => Object.fromEntries([
+                    ...Object.entries(plain(held) ? held : {}).filter(([member]) => !Object.hasOwn(members, member)),
+                    ...Object.entries(structuredClone(members)).filter(([, value]) => value !== null),
+                ]));
             },
         },
         save(room, named, writtenBy) {
             return exclusive(() => saveRoomDrafts(room, named, writtenBy));
         },
+        saveParts(room, parts, writtenBy) {
+            return exclusive(() => saveParts(room, parts, writtenBy));
+        },
         history(locator, path, query) {
             return readHistory(locator, path, query);
         },
+        resolve(room, path, destination) {
+            return resolveReference(room, path, destination);
+        },
         binaryFile: {
+            part: readPart,
             read: readBinaryPath,
+            link: linkBinaryPath,
             readReference: readBinaryReference,
         },
-        call(name, input) {
-            return invokeAction(name, input);
+        async call(name, input) {
+            await ready;
+            const room = calledRooms(name, input).find((one) => locked(one));
+            return room === undefined ? recoveredAction(name, input) : lockedRoom(room);
         },
         reached(locator, roomVersion, path) {
             return path === undefined
@@ -2391,22 +4165,31 @@ export function composeRuntime(options) {
         log() {
             return journal.export();
         },
+        cleanUp,
         persistence() {
-            return options.shell.persistentStorage;
+            return persistence === 'granted';
+        },
+        async retry() {
+            journal.record('retry');
+            unindexable.clear();
+            queueReadiness();
+            resume();
         },
         observe: observing(watch),
         async reauthorize() {
             if (refusal === null || !refusal.reauthorizationOffered)
                 return;
             journal.record('connection reauthorize');
-            await chain.catch(() => undefined);
+            await Promise.all([...lanes.values()]
+                .filter((held) => held.generation === generation)
+                .map((held) => held.chain));
             await mutations;
             authorization = undefined;
             discoveryPaused = false;
             if (options.adapter.roomStream === undefined)
                 await sync('unstreamed');
             else
-                await task(ensureAuthorization);
+                await task(OPENING_LANE, ensureAuthorization);
         },
     };
     const reachable = {
@@ -2417,6 +4200,25 @@ export function composeRuntime(options) {
         query: (plan) => rowsQuery(plan),
         watchPlan,
         search: searched,
+        watchReadiness,
+        locked,
+        lockedRooms,
+        watchLocks,
+        located,
+    };
+    return {
+        md,
+        seed,
+        stop,
+        lose: loseRooms,
+        watch,
+        persisted(answer) {
+            if (answer === persistence)
+                return;
+            persistence = answer;
+            journal.record(`persistence ${answer}`);
+            queueReadiness();
+        },
+        within: (reach, port) => narrowed(reachable, reach, port),
     };
-    return { md, stop, watch, within: (reach) => narrowed(reachable, reach) };
 }